projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: timeout handling in new connect procedure
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
e58627d1 41#define MGMT_REVISION 10
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
04124681
GP		 271static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
272 u16 data_len)
a38528f1
JH		 273{
274 struct mgmt_rp_read_version rp;
275
276 BT_DBG("sock %p", sk);
277
278 rp.version = MGMT_VERSION;
dcf4adbf 279 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 280
2a1afb5a
JH		 281 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
282 &rp, sizeof(rp));
a38528f1
JH		 283}
284
04124681
GP		 285static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
286 u16 data_len)
e70bb2e8
JH		 287{
288 struct mgmt_rp_read_commands *rp;
99c679ac 289 u16 num_commands, num_events;
e70bb2e8
JH		 290 size_t rp_size;
291 int i, err;
292
293 BT_DBG("sock %p", sk);
294
99c679ac
MH		 295 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
296 num_commands = ARRAY_SIZE(mgmt_commands);
297 num_events = ARRAY_SIZE(mgmt_events);
298 } else {
299 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
300 num_events = ARRAY_SIZE(mgmt_untrusted_events);
301 }
302
e70bb2e8
JH		 303 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
304
305 rp = kmalloc(rp_size, GFP_KERNEL);
306 if (!rp)
307 return -ENOMEM;
308
dcf4adbf
JP		 309 rp->num_commands = cpu_to_le16(num_commands);
310 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 311
99c679ac
MH		 312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 __le16 *opcode = rp->opcodes;
314
315 for (i = 0; i < num_commands; i++, opcode++)
316 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 317
99c679ac
MH		 318 for (i = 0; i < num_events; i++, opcode++)
319 put_unaligned_le16(mgmt_events[i], opcode);
320 } else {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
325
326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
328 }
e70bb2e8 329
2a1afb5a
JH		 330 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
331 rp, rp_size);
e70bb2e8
JH		 332 kfree(rp);
333
334 return err;
335}
336
04124681
GP		 337static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
338 u16 data_len)
faba42eb 339{
faba42eb 340 struct mgmt_rp_read_index_list *rp;
8035ded4 341 struct hci_dev *d;
a38528f1 342 size_t rp_len;
faba42eb 343 u16 count;
476e44cb 344 int err;
faba42eb
JH		 345
346 BT_DBG("sock %p", sk);
347
348 read_lock(&hci_dev_list_lock);
349
350 count = 0;
bb4b2a9a 351 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 352 if (d->dev_type == HCI_BREDR &&
d7a5a11d 353 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 354 count++;
faba42eb
JH		 355 }
356
a38528f1
JH		 357 rp_len = sizeof(*rp) + (2 * count);
358 rp = kmalloc(rp_len, GFP_ATOMIC);
359 if (!rp) {
b2c60d42 360 read_unlock(&hci_dev_list_lock);
faba42eb 361 return -ENOMEM;
b2c60d42 362 }
faba42eb 363
476e44cb 364 count = 0;
8035ded4 365 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 366 if (hci_dev_test_flag(d, HCI_SETUP) ||
367 hci_dev_test_flag(d, HCI_CONFIG) ||
368 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 369 continue;
370
73d1df2a
MH		 371 /* Devices marked as raw-only are neither configured
372 * nor unconfigured controllers.
373 */
374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 375 continue;
376
73d1df2a 377 if (d->dev_type == HCI_BREDR &&
d7a5a11d 378 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 379 rp->index[count++] = cpu_to_le16(d->id);
380 BT_DBG("Added hci%u", d->id);
381 }
faba42eb
JH		 382 }
383
476e44cb
JH		 384 rp->num_controllers = cpu_to_le16(count);
385 rp_len = sizeof(*rp) + (2 * count);
386
faba42eb
JH		 387 read_unlock(&hci_dev_list_lock);
388
2a1afb5a
JH		 389 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
390 0, rp, rp_len);
faba42eb 391
a38528f1
JH		 392 kfree(rp);
393
394 return err;
faba42eb
JH		 395}
396
73d1df2a
MH		 397static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
398 void *data, u16 data_len)
399{
400 struct mgmt_rp_read_unconf_index_list *rp;
401 struct hci_dev *d;
402 size_t rp_len;
403 u16 count;
404 int err;
405
406 BT_DBG("sock %p", sk);
407
408 read_lock(&hci_dev_list_lock);
409
410 count = 0;
411 list_for_each_entry(d, &hci_dev_list, list) {
412 if (d->dev_type == HCI_BREDR &&
d7a5a11d 413 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 414 count++;
415 }
416
417 rp_len = sizeof(*rp) + (2 * count);
418 rp = kmalloc(rp_len, GFP_ATOMIC);
419 if (!rp) {
420 read_unlock(&hci_dev_list_lock);
421 return -ENOMEM;
422 }
423
424 count = 0;
425 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 426 if (hci_dev_test_flag(d, HCI_SETUP) ||
427 hci_dev_test_flag(d, HCI_CONFIG) ||
428 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 429 continue;
430
431 /* Devices marked as raw-only are neither configured
432 * nor unconfigured controllers.
433 */
434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
435 continue;
436
437 if (d->dev_type == HCI_BREDR &&
d7a5a11d 438 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 439 rp->index[count++] = cpu_to_le16(d->id);
440 BT_DBG("Added hci%u", d->id);
441 }
442 }
443
444 rp->num_controllers = cpu_to_le16(count);
445 rp_len = sizeof(*rp) + (2 * count);
446
447 read_unlock(&hci_dev_list_lock);
448
2a1afb5a
JH		 449 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
450 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 451
452 kfree(rp);
453
454 return err;
455}
456
96f1474a
MH		 457static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
458 void *data, u16 data_len)
459{
460 struct mgmt_rp_read_ext_index_list *rp;
461 struct hci_dev *d;
462 size_t rp_len;
463 u16 count;
464 int err;
465
466 BT_DBG("sock %p", sk);
467
468 read_lock(&hci_dev_list_lock);
469
470 count = 0;
471 list_for_each_entry(d, &hci_dev_list, list) {
472 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
473 count++;
474 }
475
476 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
477 rp = kmalloc(rp_len, GFP_ATOMIC);
478 if (!rp) {
479 read_unlock(&hci_dev_list_lock);
480 return -ENOMEM;
481 }
482
483 count = 0;
484 list_for_each_entry(d, &hci_dev_list, list) {
485 if (hci_dev_test_flag(d, HCI_SETUP) ||
486 hci_dev_test_flag(d, HCI_CONFIG) ||
487 hci_dev_test_flag(d, HCI_USER_CHANNEL))
488 continue;
489
490 /* Devices marked as raw-only are neither configured
491 * nor unconfigured controllers.
492 */
493 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
494 continue;
495
496 if (d->dev_type == HCI_BREDR) {
497 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
498 rp->entry[count].type = 0x01;
499 else
500 rp->entry[count].type = 0x00;
501 } else if (d->dev_type == HCI_AMP) {
502 rp->entry[count].type = 0x02;
503 } else {
504 continue;
505 }
506
507 rp->entry[count].bus = d->bus;
508 rp->entry[count++].index = cpu_to_le16(d->id);
509 BT_DBG("Added hci%u", d->id);
510 }
511
512 rp->num_controllers = cpu_to_le16(count);
513 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
514
515 read_unlock(&hci_dev_list_lock);
516
517 /* If this command is called at least once, then all the
518 * default index and unconfigured index events are disabled
519 * and from now on only extended index events are used.
520 */
521 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
522 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
523 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
524
525 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
526 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
527
528 kfree(rp);
529
530 return err;
531}
532
dbece37a
MH		 533static bool is_configured(struct hci_dev *hdev)
534{
535 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 536 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 537 return false;
538
539 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
540 !bacmp(&hdev->public_addr, BDADDR_ANY))
541 return false;
542
543 return true;
544}
545
89bc22d2
MH		 546static __le32 get_missing_options(struct hci_dev *hdev)
547{
548 u32 options = 0;
549
dbece37a 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 552 options |= MGMT_OPTION_EXTERNAL_CONFIG;
553
89bc22d2
MH		 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 options |= MGMT_OPTION_PUBLIC_ADDRESS;
557
558 return cpu_to_le32(options);
559}
560
f4537c04
MH		 561static int new_options(struct hci_dev *hdev, struct sock *skip)
562{
563 __le32 options = get_missing_options(hdev);
564
f6b7712e
MH		 565 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
566 sizeof(options), skip);
f4537c04
MH		 567}
568
dbece37a
MH		 569static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
570{
571 __le32 options = get_missing_options(hdev);
572
2a1afb5a
JH		 573 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
574 sizeof(options));
dbece37a
MH		 575}
576
9fc3bfb6
MH		 577static int read_config_info(struct sock *sk, struct hci_dev *hdev,
578 void *data, u16 data_len)
579{
580 struct mgmt_rp_read_config_info rp;
89bc22d2 581 u32 options = 0;
9fc3bfb6
MH		 582
583 BT_DBG("sock %p %s", sk, hdev->name);
584
585 hci_dev_lock(hdev);
586
587 memset(&rp, 0, sizeof(rp));
588 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 589
eb1904f4
MH		 590 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
591 options |= MGMT_OPTION_EXTERNAL_CONFIG;
592
9fc3bfb6 593 if (hdev->set_bdaddr)
89bc22d2
MH		 594 options |= MGMT_OPTION_PUBLIC_ADDRESS;
595
596 rp.supported_options = cpu_to_le32(options);
597 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 598
599 hci_dev_unlock(hdev);
600
2a1afb5a
JH		 601 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
602 &rp, sizeof(rp));
9fc3bfb6
MH		 603}
604
69ab39ea
JH		 605static u32 get_supported_settings(struct hci_dev *hdev)
606{
607 u32 settings = 0;
608
609 settings |= MGMT_SETTING_POWERED;
b2939475 610 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 611 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 612 settings |= MGMT_SETTING_CONNECTABLE;
613 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 614
ed3fa31f 615 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 616 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
617 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 618 settings |= MGMT_SETTING_BREDR;
619 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 620
621 if (lmp_ssp_capable(hdev)) {
622 settings |= MGMT_SETTING_SSP;
623 settings |= MGMT_SETTING_HS;
624 }
e98d2ce2 625
05b3c3e7 626 if (lmp_sc_capable(hdev))
e98d2ce2 627 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 628 }
d7b7e796 629
eeca6f89 630 if (lmp_le_capable(hdev)) {
9d42820f 631 settings |= MGMT_SETTING_LE;
eeca6f89 632 settings |= MGMT_SETTING_ADVERTISING;
a3209694 633 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 634 settings |= MGMT_SETTING_PRIVACY;
93690c22 635 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 636 }
69ab39ea 637
eb1904f4
MH		 638 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
639 hdev->set_bdaddr)
9fc3bfb6
MH		 640 settings |= MGMT_SETTING_CONFIGURATION;
641
69ab39ea
JH		 642 return settings;
643}
644
645static u32 get_current_settings(struct hci_dev *hdev)
646{
647 u32 settings = 0;
648
f1f0eb02 649 if (hdev_is_powered(hdev))
f0d4b78a
MH		 650 settings |= MGMT_SETTING_POWERED;
651
d7a5a11d 652 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 653 settings |= MGMT_SETTING_CONNECTABLE;
654
d7a5a11d 655 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 656 settings |= MGMT_SETTING_FAST_CONNECTABLE;
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 659 settings |= MGMT_SETTING_DISCOVERABLE;
660
d7a5a11d 661 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 662 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 665 settings |= MGMT_SETTING_BREDR;
666
d7a5a11d 667 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 668 settings |= MGMT_SETTING_LE;
669
d7a5a11d 670 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 671 settings |= MGMT_SETTING_LINK_SECURITY;
672
d7a5a11d 673 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 674 settings |= MGMT_SETTING_SSP;
675
d7a5a11d 676 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 677 settings |= MGMT_SETTING_HS;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 680 settings |= MGMT_SETTING_ADVERTISING;
681
d7a5a11d 682 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 683 settings |= MGMT_SETTING_SECURE_CONN;
684
d7a5a11d 685 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 686 settings |= MGMT_SETTING_DEBUG_KEYS;
687
d7a5a11d 688 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 689 settings |= MGMT_SETTING_PRIVACY;
690
93690c22
MH		 691 /* The current setting for static address has two purposes. The
692 * first is to indicate if the static address will be used and
693 * the second is to indicate if it is actually set.
694 *
695 * This means if the static address is not configured, this flag
08dc0e98 696 * will never be set. If the address is configured, then if the
93690c22
MH		 697 * address is actually used decides if the flag is set or not.
698 *
699 * For single mode LE only controllers and dual-mode controllers
700 * with BR/EDR disabled, the existence of the static address will
701 * be evaluated.
702 */
b7cb93e5 703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 704 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 705 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
706 if (bacmp(&hdev->static_addr, BDADDR_ANY))
707 settings |= MGMT_SETTING_STATIC_ADDRESS;
708 }
709
69ab39ea
JH		 710 return settings;
711}
712
ef580372
JH		 713#define PNP_INFO_SVCLASS_ID 0x1200
714
213202ed
JH		 715static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
716{
717 u8 *ptr = data, *uuids_start = NULL;
718 struct bt_uuid *uuid;
719
720 if (len < 4)
721 return ptr;
722
723 list_for_each_entry(uuid, &hdev->uuids, list) {
724 u16 uuid16;
725
726 if (uuid->size != 16)
727 continue;
728
729 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
730 if (uuid16 < 0x1100)
731 continue;
732
733 if (uuid16 == PNP_INFO_SVCLASS_ID)
734 continue;
735
736 if (!uuids_start) {
737 uuids_start = ptr;
738 uuids_start[0] = 1;
739 uuids_start[1] = EIR_UUID16_ALL;
740 ptr += 2;
741 }
742
743 /* Stop if not enough space to put next UUID */
744 if ((ptr - data) + sizeof(u16) > len) {
745 uuids_start[1] = EIR_UUID16_SOME;
746 break;
747 }
748
749 *ptr++ = (uuid16 & 0x00ff);
750 *ptr++ = (uuid16 & 0xff00) >> 8;
751 uuids_start[0] += sizeof(uuid16);
752 }
753
754 return ptr;
755}
756
cdf1963f
JH		 757static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
758{
759 u8 *ptr = data, *uuids_start = NULL;
760 struct bt_uuid *uuid;
761
762 if (len < 6)
763 return ptr;
764
765 list_for_each_entry(uuid, &hdev->uuids, list) {
766 if (uuid->size != 32)
767 continue;
768
769 if (!uuids_start) {
770 uuids_start = ptr;
771 uuids_start[0] = 1;
772 uuids_start[1] = EIR_UUID32_ALL;
773 ptr += 2;
774 }
775
776 /* Stop if not enough space to put next UUID */
777 if ((ptr - data) + sizeof(u32) > len) {
778 uuids_start[1] = EIR_UUID32_SOME;
779 break;
780 }
781
782 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
783 ptr += sizeof(u32);
784 uuids_start[0] += sizeof(u32);
785 }
786
787 return ptr;
788}
789
c00d575b
JH		 790static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
791{
792 u8 *ptr = data, *uuids_start = NULL;
793 struct bt_uuid *uuid;
794
795 if (len < 18)
796 return ptr;
797
798 list_for_each_entry(uuid, &hdev->uuids, list) {
799 if (uuid->size != 128)
800 continue;
801
802 if (!uuids_start) {
803 uuids_start = ptr;
804 uuids_start[0] = 1;
805 uuids_start[1] = EIR_UUID128_ALL;
806 ptr += 2;
807 }
808
809 /* Stop if not enough space to put next UUID */
810 if ((ptr - data) + 16 > len) {
811 uuids_start[1] = EIR_UUID128_SOME;
812 break;
813 }
814
815 memcpy(ptr, uuid->uuid, 16);
816 ptr += 16;
817 uuids_start[0] += 16;
818 }
819
820 return ptr;
821}
822
333ae95d
JH		 823static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
824{
825 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
826}
827
333ae95d
JH		 828static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
829 struct hci_dev *hdev,
830 const void *data)
831{
832 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
833}
834
91aa9bb2
FG		 835static u8 get_current_adv_instance(struct hci_dev *hdev)
836{
837 /* The "Set Advertising" setting supersedes the "Add Advertising"
838 * setting. Here we set the advertising data based on which
839 * setting was set. When neither apply, default to the global settings,
840 * represented by instance "0".
841 */
842 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
843 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
3ff37e6b 844 return hdev->cur_adv_instance;
91aa9bb2
FG		 845
846 return 0x00;
847}
848
4117ed70 849static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 850{
7a5f4990
MH		 851 u8 ad_len = 0;
852 size_t name_len;
853
854 name_len = strlen(hdev->dev_name);
855 if (name_len > 0) {
856 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
857
858 if (name_len > max_len) {
859 name_len = max_len;
860 ptr[1] = EIR_NAME_SHORT;
861 } else
862 ptr[1] = EIR_NAME_COMPLETE;
863
864 ptr[0] = name_len + 1;
865
866 memcpy(ptr + 2, hdev->dev_name, name_len);
867
868 ad_len += (name_len + 2);
869 ptr += (name_len + 2);
870 }
871
872 return ad_len;
f14d8f64
MH		 873}
874
ca21fbe9
FG		 875static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
876 u8 *ptr)
4117ed70 877{
ca21fbe9
FG		 878 struct adv_info *adv_instance;
879
880 adv_instance = hci_find_adv_instance(hdev, instance);
881 if (!adv_instance)
882 return 0;
883
4117ed70
AU		 884 /* TODO: Set the appropriate entries based on advertising instance flags
885 * here once flags other than 0 are supported.
886 */
ca21fbe9
FG		 887 memcpy(ptr, adv_instance->scan_rsp_data,
888 adv_instance->scan_rsp_len);
4117ed70 889
ca21fbe9 890 return adv_instance->scan_rsp_len;
4117ed70
AU		 891}
892
efae002c 893static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
f14d8f64
MH		 894{
895 struct hci_dev *hdev = req->hdev;
896 struct hci_cp_le_set_scan_rsp_data cp;
897 u8 len;
898
d7a5a11d 899 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 900 return;
901
902 memset(&cp, 0, sizeof(cp));
903
4117ed70 904 if (instance)
ca21fbe9 905 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
4117ed70
AU		 906 else
907 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 908
eb438b5f 909 if (hdev->scan_rsp_data_len == len &&
4117ed70 910 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 911 return;
912
eb438b5f
JH		 913 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
914 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 915
916 cp.length = len;
917
918 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
919}
920
4117ed70
AU		 921static void update_scan_rsp_data(struct hci_request *req)
922{
efae002c 923 update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
4117ed70
AU		 924}
925
9a43e25f
JH		 926static u8 get_adv_discov_flags(struct hci_dev *hdev)
927{
3b0602cd 928 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 929
930 /* If there's a pending mgmt command the flags will not yet have
931 * their final values, so check for this first.
932 */
333ae95d 933 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 934 if (cmd) {
935 struct mgmt_mode *cp = cmd->param;
936 if (cp->val == 0x01)
937 return LE_AD_GENERAL;
938 else if (cp->val == 0x02)
939 return LE_AD_LIMITED;
940 } else {
d7a5a11d 941 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 942 return LE_AD_LIMITED;
d7a5a11d 943 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 944 return LE_AD_GENERAL;
945 }
946
947 return 0;
948}
949
fdf51784
AU		 950static bool get_connectable(struct hci_dev *hdev)
951{
952 struct mgmt_pending_cmd *cmd;
441ad2d0 953
fdf51784
AU		 954 /* If there's a pending mgmt command the flag will not yet have
955 * it's final value, so check for this first.
956 */
957 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
958 if (cmd) {
959 struct mgmt_mode *cp = cmd->param;
441ad2d0 960
fdf51784 961 return cp->val;
441ad2d0
MH		 962 }
963
fdf51784
AU		 964 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
965}
441ad2d0 966
fdf51784
AU		 967static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
968{
969 u32 flags;
411b4121 970 struct adv_info *adv_instance;
441ad2d0 971
bea28e65
FG		 972 if (instance == 0x00) {
973 /* Instance 0 always manages the "Tx Power" and "Flags"
974 * fields
975 */
976 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
411b4121 977
bea28e65
FG		 978 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
979 * corresponds to the "connectable" instance flag.
980 */
981 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
982 flags |= MGMT_ADV_FLAG_CONNECTABLE;
fdf51784 983
bea28e65 984 return flags;
411b4121 985 }
fdf51784 986
bea28e65 987 adv_instance = hci_find_adv_instance(hdev, instance);
fdf51784 988
bea28e65
FG		 989 /* Return 0 when we got an invalid instance identifier. */
990 if (!adv_instance)
991 return 0;
fdf51784 992
bea28e65 993 return adv_instance->flags;
441ad2d0
MH		 994}
995
7b683b74 996static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
c7d4883b 997{
7b683b74
FG		 998 u8 instance = get_current_adv_instance(hdev);
999 struct adv_info *adv_instance;
1000
1001 /* Ignore instance 0 */
1002 if (instance == 0x00)
1003 return 0;
1004
1005 adv_instance = hci_find_adv_instance(hdev, instance);
1006 if (!adv_instance)
c7d4883b
AU		 1007 return 0;
1008
1009 /* TODO: Take into account the "appearance" and "local-name" flags here.
1010 * These are currently being ignored as they are not supported.
1011 */
7b683b74 1012 return adv_instance->scan_rsp_len;
c7d4883b
AU		 1013}
1014
fdf51784 1015static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1016{
f63ba24b 1017 struct adv_info *adv_instance = NULL;
b44133ff 1018 u8 ad_len = 0, flags = 0;
f63ba24b
FG		 1019 u32 instance_flags;
1020
1021 /* Return 0 when the current instance identifier is invalid. */
1022 if (instance) {
1023 adv_instance = hci_find_adv_instance(hdev, instance);
1024 if (!adv_instance)
1025 return 0;
1026 }
1027
1028 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1029
807ec772
AU		 1030 /* The Add Advertising command allows userspace to set both the general
1031 * and limited discoverable flags.
1032 */
fdf51784 1033 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1034 flags |= LE_AD_GENERAL;
1035
fdf51784 1036 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1037 flags |= LE_AD_LIMITED;
1038
fdf51784 1039 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1040 /* If a discovery flag wasn't provided, simply use the global
1041 * settings.
1042 */
1043 if (!flags)
1044 flags |= get_adv_discov_flags(hdev);
1045
b44133ff
AU		 1046 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1047 flags |= LE_AD_NO_BREDR;
1048
fdf51784
AU		 1049 /* If flags would still be empty, then there is no need to
1050 * include the "Flags" AD field".
1051 */
1052 if (flags) {
1053 ptr[0] = 0x02;
1054 ptr[1] = EIR_FLAGS;
1055 ptr[2] = flags;
b44133ff 1056
fdf51784
AU		 1057 ad_len += 3;
1058 ptr += 3;
1059 }
b44133ff
AU		 1060 }
1061
f63ba24b
FG		 1062 if (adv_instance) {
1063 memcpy(ptr, adv_instance->adv_data,
1064 adv_instance->adv_data_len);
1065 ad_len += adv_instance->adv_data_len;
1066 ptr += adv_instance->adv_data_len;
38c8af60
MH		 1067 }
1068
fdf51784 1069 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1070 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1071 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1072 ptr[0] = 0x02;
1073 ptr[1] = EIR_TX_POWER;
1074 ptr[2] = (u8)hdev->adv_tx_power;
1075
1076 ad_len += 3;
1077 ptr += 3;
1078 }
1079
b44133ff 1080 return ad_len;
24b4f38f
AU		 1081}
1082
efae002c 1083static void update_inst_adv_data(struct hci_request *req, u8 instance)
441ad2d0
MH		 1084{
1085 struct hci_dev *hdev = req->hdev;
1086 struct hci_cp_le_set_adv_data cp;
1087 u8 len;
1088
d7a5a11d 1089 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1090 return;
1091
1092 memset(&cp, 0, sizeof(cp));
1093
fdf51784 1094 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1095
24b4f38f 1096 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1097 if (hdev->adv_data_len == len &&
1098 memcmp(cp.data, hdev->adv_data, len) == 0)
1099 return;
1100
1101 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1102 hdev->adv_data_len = len;
1103
1104 cp.length = len;
1105
1106 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1107}
1108
e7a685d3
AU		 1109static void update_adv_data(struct hci_request *req)
1110{
efae002c 1111 update_inst_adv_data(req, get_current_adv_instance(req->hdev));
24b4f38f
AU		 1112}
1113
bc6d2d04
JH		 1114int mgmt_update_adv_data(struct hci_dev *hdev)
1115{
1116 struct hci_request req;
1117
1118 hci_req_init(&req, hdev);
1119 update_adv_data(&req);
1120
1121 return hci_req_run(&req, NULL);
1122}
1123
ef580372
JH		 1124static void create_eir(struct hci_dev *hdev, u8 *data)
1125{
1126 u8 *ptr = data;
ef580372
JH		 1127 size_t name_len;
1128
1129 name_len = strlen(hdev->dev_name);
1130
1131 if (name_len > 0) {
1132 /* EIR Data type */
1133 if (name_len > 48) {
1134 name_len = 48;
1135 ptr[1] = EIR_NAME_SHORT;
1136 } else
1137 ptr[1] = EIR_NAME_COMPLETE;
1138
1139 /* EIR Data length */
1140 ptr[0] = name_len + 1;
1141
1142 memcpy(ptr + 2, hdev->dev_name, name_len);
1143
ef580372
JH		 1144 ptr += (name_len + 2);
1145 }
1146
bbaf444a 1147 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1148 ptr[0] = 2;
1149 ptr[1] = EIR_TX_POWER;
1150 ptr[2] = (u8) hdev->inq_tx_power;
1151
91c4e9b1
MH		 1152 ptr += 3;
1153 }
1154
2b9be137
MH		 1155 if (hdev->devid_source > 0) {
1156 ptr[0] = 9;
1157 ptr[1] = EIR_DEVICE_ID;
1158
1159 put_unaligned_le16(hdev->devid_source, ptr + 2);
1160 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1161 put_unaligned_le16(hdev->devid_product, ptr + 6);
1162 put_unaligned_le16(hdev->devid_version, ptr + 8);
1163
2b9be137
MH		 1164 ptr += 10;
1165 }
1166
213202ed 1167 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1168 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1169 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1170}
1171
890ea898 1172static void update_eir(struct hci_request *req)
ef580372 1173{
890ea898 1174 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1175 struct hci_cp_write_eir cp;
1176
504c8dcd 1177 if (!hdev_is_powered(hdev))
890ea898 1178 return;
7770c4aa 1179
976eb20e 1180 if (!lmp_ext_inq_capable(hdev))
890ea898 1181 return;
ef580372 1182
d7a5a11d 1183 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1184 return;
ef580372 1185
d7a5a11d 1186 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1187 return;
ef580372
JH		 1188
1189 memset(&cp, 0, sizeof(cp));
1190
1191 create_eir(hdev, cp.data);
1192
1193 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1194 return;
ef580372
JH		 1195
1196 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1197
890ea898 1198 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1199}
1200
1201static u8 get_service_classes(struct hci_dev *hdev)
1202{
1203 struct bt_uuid *uuid;
1204 u8 val = 0;
1205
1206 list_for_each_entry(uuid, &hdev->uuids, list)
1207 val |= uuid->svc_hint;
1208
1209 return val;
1210}
1211
890ea898 1212static void update_class(struct hci_request *req)
ef580372 1213{
890ea898 1214 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1215 u8 cod[3];
1216
1217 BT_DBG("%s", hdev->name);
1218
504c8dcd 1219 if (!hdev_is_powered(hdev))
890ea898 1220 return;
7770c4aa 1221
d7a5a11d 1222 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1223 return;
1224
d7a5a11d 1225 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1226 return;
ef580372
JH		 1227
1228 cod[0] = hdev->minor_class;
1229 cod[1] = hdev->major_class;
1230 cod[2] = get_service_classes(hdev);
1231
d7a5a11d 1232 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1233 cod[1] |= 0x20;
1234
ef580372 1235 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1236 return;
ef580372 1237
890ea898 1238 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1239}
1240
0ec5ae84
JH		 1241static void disable_advertising(struct hci_request *req)
1242{
1243 u8 enable = 0x00;
1244
1245 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1246}
1247
199a2fb1
JH		 1248static void enable_advertising(struct hci_request *req)
1249{
1250 struct hci_dev *hdev = req->hdev;
1251 struct hci_cp_le_set_adv_param cp;
8f2a0601 1252 u8 own_addr_type, enable = 0x01;
a4858cb9 1253 bool connectable;
e7a685d3
AU		 1254 u8 instance;
1255 u32 flags;
199a2fb1 1256
0ec5ae84
JH		 1257 if (hci_conn_num(hdev, LE_LINK) > 0)
1258 return;
1259
d7a5a11d 1260 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1261 disable_advertising(req);
1262
5ce194c4 1263 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1264 * hci_update_random_address knows that it's safe to go ahead
1265 * and write a new random address. The flag will be set back on
1266 * as soon as the SET_ADV_ENABLE HCI command completes.
1267 */
a358dc11 1268 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1269
e7a685d3
AU		 1270 instance = get_current_adv_instance(hdev);
1271 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1272
1273 /* If the "connectable" instance flag was not set, then choose between
1274 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1275 */
1276 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1277 get_connectable(hdev);
8f2a0601 1278
a4858cb9
JH		 1279 /* Set require_privacy to true only when non-connectable
1280 * advertising is used. In that case it is fine to use a
1281 * non-resolvable private address.
1282 */
1283 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1284 return;
1285
41c90c18 1286 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1287 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1288 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1289
1290 if (connectable)
1291 cp.type = LE_ADV_IND;
7b683b74 1292 else if (get_cur_adv_instance_scan_rsp_len(hdev))
c7d4883b
AU		 1293 cp.type = LE_ADV_SCAN_IND;
1294 else
1295 cp.type = LE_ADV_NONCONN_IND;
1296
8f2a0601 1297 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1298 cp.channel_map = hdev->le_adv_channel_map;
1299
1300 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1301
1302 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1303}
1304
7d78525d
JH		 1305static void service_cache_off(struct work_struct *work)
1306{
1307 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1308 service_cache.work);
890ea898 1309 struct hci_request req;
7d78525d 1310
a69d8927 1311 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1312 return;
1313
890ea898
JH		 1314 hci_req_init(&req, hdev);
1315
7d78525d
JH		 1316 hci_dev_lock(hdev);
1317
890ea898
JH		 1318 update_eir(&req);
1319 update_class(&req);
7d78525d
JH		 1320
1321 hci_dev_unlock(hdev);
890ea898
JH		 1322
1323 hci_req_run(&req, NULL);
7d78525d
JH		 1324}
1325
d6bfd59c
JH		 1326static void rpa_expired(struct work_struct *work)
1327{
1328 struct hci_dev *hdev = container_of(work, struct hci_dev,
1329 rpa_expired.work);
1330 struct hci_request req;
1331
1332 BT_DBG("");
1333
a1536da2 1334 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1335
d7a5a11d 1336 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1337 return;
1338
1339 /* The generation of a new RPA and programming it into the
1340 * controller happens in the enable_advertising() function.
1341 */
d6bfd59c 1342 hci_req_init(&req, hdev);
d6bfd59c 1343 enable_advertising(&req);
d6bfd59c
JH		 1344 hci_req_run(&req, NULL);
1345}
1346
6a919082 1347static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1348{
238be788 1349 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1350 return;
1351
4f87da80 1352 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1353 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1354
4f87da80
JH		 1355 /* Non-mgmt controlled devices get this bit set
1356 * implicitly so that pairing works for them, however
1357 * for mgmt we require user-space to explicitly enable
1358 * it
1359 */
a358dc11 1360 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1361}
1362
0f4e68cf 1363static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1364 void *data, u16 data_len)
0381101f 1365{
a38528f1 1366 struct mgmt_rp_read_info rp;
f7b64e69 1367
bdb6d971 1368 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1369
09fd0de5 1370 hci_dev_lock(hdev);
f7b64e69 1371
dc4fe30b
JH		 1372 memset(&rp, 0, sizeof(rp));
1373
69ab39ea 1374 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1375
69ab39ea 1376 rp.version = hdev->hci_ver;
eb55ef07 1377 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1378
1379 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1380 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1381
a38528f1 1382 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1383
dc4fe30b 1384 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1385 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1386
09fd0de5 1387 hci_dev_unlock(hdev);
0381101f 1388
2a1afb5a
JH		 1389 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1390 sizeof(rp));
0381101f
JH		 1391}
1392
69ab39ea 1393static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1394{
69ab39ea 1395 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1396
2a1afb5a
JH		 1397 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1398 sizeof(settings));
8680570b
JH		 1399}
1400
1904a853 1401static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1402{
1403 BT_DBG("%s status 0x%02x", hdev->name, status);
1404
a3172b7e
JH		 1405 if (hci_conn_count(hdev) == 0) {
1406 cancel_delayed_work(&hdev->power_off);
8b064a3a 1407 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1408 }
8b064a3a
JH		 1409}
1410
23a48093 1411static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1412{
1413 struct hci_dev *hdev = req->hdev;
1414 struct hci_cp_remote_name_req_cancel cp;
1415 struct inquiry_entry *e;
1416
1417 switch (hdev->discovery.state) {
1418 case DISCOVERY_FINDING:
07d2334a 1419 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1420 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1421
1422 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1423 cancel_delayed_work(&hdev->le_scan_disable);
1424 hci_req_add_le_scan_disable(req);
1425 }
1426
23a48093 1427 return true;
21a60d30
JH		 1428
1429 case DISCOVERY_RESOLVING:
1430 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1431 NAME_PENDING);
1432 if (!e)
23a48093 1433 break;
21a60d30
JH		 1434
1435 bacpy(&cp.bdaddr, &e->data.bdaddr);
1436 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1437 &cp);
1438
23a48093 1439 return true;
21a60d30
JH		 1440
1441 default:
1442 /* Passive scanning */
d7a5a11d 1443 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1444 hci_req_add_le_scan_disable(req);
23a48093
JH		 1445 return true;
1446 }
1447
21a60d30
JH		 1448 break;
1449 }
23a48093
JH		 1450
1451 return false;
21a60d30
JH		 1452}
1453
912098a6
AU		 1454static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1455 u8 instance)
1456{
1457 struct mgmt_ev_advertising_added ev;
1458
1459 ev.instance = instance;
1460
1461 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1462}
1463
1464static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1465 u8 instance)
1466{
1467 struct mgmt_ev_advertising_removed ev;
1468
1469 ev.instance = instance;
1470
1471 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1472}
1473
7816b820
FG		 1474static int schedule_adv_instance(struct hci_request *req, u8 instance,
1475 bool force) {
1476 struct hci_dev *hdev = req->hdev;
1477 struct adv_info *adv_instance = NULL;
1478 u16 timeout;
1479
1480 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1481 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1482 return -EPERM;
1483
1484 if (hdev->adv_instance_timeout)
1485 return -EBUSY;
1486
1487 adv_instance = hci_find_adv_instance(hdev, instance);
1488 if (!adv_instance)
1489 return -ENOENT;
1490
1491 /* A zero timeout means unlimited advertising. As long as there is
1492 * only one instance, duration should be ignored. We still set a timeout
1493 * in case further instances are being added later on.
1494 *
1495 * If the remaining lifetime of the instance is more than the duration
1496 * then the timeout corresponds to the duration, otherwise it will be
1497 * reduced to the remaining instance lifetime.
1498 */
1499 if (adv_instance->timeout == 0 ||
1500 adv_instance->duration <= adv_instance->remaining_time)
1501 timeout = adv_instance->duration;
1502 else
1503 timeout = adv_instance->remaining_time;
1504
1505 /* The remaining time is being reduced unless the instance is being
1506 * advertised without time limit.
1507 */
1508 if (adv_instance->timeout)
1509 adv_instance->remaining_time =
1510 adv_instance->remaining_time - timeout;
1511
1512 hdev->adv_instance_timeout = timeout;
1513 queue_delayed_work(hdev->workqueue,
1514 &hdev->adv_instance_expire,
1515 msecs_to_jiffies(timeout * 1000));
1516
1517 /* If we're just re-scheduling the same instance again then do not
1518 * execute any HCI commands. This happens when a single instance is
1519 * being advertised.
1520 */
1521 if (!force && hdev->cur_adv_instance == instance &&
1522 hci_dev_test_flag(hdev, HCI_LE_ADV))
1523 return 0;
1524
1525 hdev->cur_adv_instance = instance;
1526 update_adv_data(req);
1527 update_scan_rsp_data(req);
1528 enable_advertising(req);
1529
1530 return 0;
1531}
1532
1533static void cancel_adv_timeout(struct hci_dev *hdev)
1534{
1535 if (hdev->adv_instance_timeout) {
1536 hdev->adv_instance_timeout = 0;
1537 cancel_delayed_work(&hdev->adv_instance_expire);
1538 }
1539}
1540
847818d9
FG		 1541/* For a single instance:
1542 * - force == true: The instance will be removed even when its remaining
1543 * lifetime is not zero.
1544 * - force == false: the instance will be deactivated but kept stored unless
1545 * the remaining lifetime is zero.
1546 *
1547 * For instance == 0x00:
1548 * - force == true: All instances will be removed regardless of their timeout
1549 * setting.
1550 * - force == false: Only instances that have a timeout will be removed.
1551 */
1552static void clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1553 u8 instance, bool force)
912098a6 1554{
847818d9
FG		 1555 struct adv_info *adv_instance, *n, *next_instance = NULL;
1556 int err;
1557 u8 rem_inst;
912098a6 1558
847818d9
FG		 1559 /* Cancel any timeout concerning the removed instance(s). */
1560 if (!instance || hdev->cur_adv_instance == instance)
1561 cancel_adv_timeout(hdev);
912098a6 1562
847818d9
FG		 1563 /* Get the next instance to advertise BEFORE we remove
1564 * the current one. This can be the same instance again
1565 * if there is only one instance.
1566 */
1567 if (instance && hdev->cur_adv_instance == instance)
1568 next_instance = hci_get_next_instance(hdev, instance);
912098a6 1569
847818d9
FG		 1570 if (instance == 0x00) {
1571 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1572 list) {
1573 if (!(force || adv_instance->timeout))
1574 continue;
912098a6 1575
847818d9
FG		 1576 rem_inst = adv_instance->instance;
1577 err = hci_remove_adv_instance(hdev, rem_inst);
1578 if (!err)
1579 advertising_removed(NULL, hdev, rem_inst);
1580 }
1581 hdev->cur_adv_instance = 0x00;
1582 } else {
1583 adv_instance = hci_find_adv_instance(hdev, instance);
1584
1585 if (force || (adv_instance && adv_instance->timeout &&
1586 !adv_instance->remaining_time)) {
1587 /* Don't advertise a removed instance. */
1588 if (next_instance &&
1589 next_instance->instance == instance)
1590 next_instance = NULL;
1591
1592 err = hci_remove_adv_instance(hdev, instance);
1593 if (!err)
1594 advertising_removed(NULL, hdev, instance);
1595 }
1596 }
1597
1598 if (list_empty(&hdev->adv_instances)) {
1599 hdev->cur_adv_instance = 0x00;
1600 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1601 }
1602
1603 if (!req || !hdev_is_powered(hdev) ||
912098a6
AU		 1604 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1605 return;
1606
847818d9
FG		 1607 if (next_instance)
1608 schedule_adv_instance(req, next_instance->instance, false);
912098a6
AU		 1609}
1610
8b064a3a
JH		 1611static int clean_up_hci_state(struct hci_dev *hdev)
1612{
1613 struct hci_request req;
1614 struct hci_conn *conn;
23a48093
JH		 1615 bool discov_stopped;
1616 int err;
8b064a3a
JH		 1617
1618 hci_req_init(&req, hdev);
1619
1620 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1621 test_bit(HCI_PSCAN, &hdev->flags)) {
1622 u8 scan = 0x00;
1623 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1624 }
1625
847818d9 1626 clear_adv_instance(hdev, NULL, 0x00, false);
912098a6 1627
d7a5a11d 1628 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1629 disable_advertising(&req);
1630
23a48093 1631 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1632
1633 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1634 struct hci_cp_disconnect dc;
c9910d0f
JH		 1635 struct hci_cp_reject_conn_req rej;
1636
1637 switch (conn->state) {
1638 case BT_CONNECTED:
1639 case BT_CONFIG:
1640 dc.handle = cpu_to_le16(conn->handle);
1641 dc.reason = 0x15; /* Terminated due to Power Off */
1642 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1643 break;
1644 case BT_CONNECT:
1645 if (conn->type == LE_LINK)
1646 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1647 0, NULL);
1648 else if (conn->type == ACL_LINK)
1649 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1650 6, &conn->dst);
1651 break;
1652 case BT_CONNECT2:
1653 bacpy(&rej.bdaddr, &conn->dst);
1654 rej.reason = 0x15; /* Terminated due to Power Off */
1655 if (conn->type == ACL_LINK)
1656 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1657 sizeof(rej), &rej);
1658 else if (conn->type == SCO_LINK)
1659 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1660 sizeof(rej), &rej);
1661 break;
1662 }
8b064a3a
JH		 1663 }
1664
23a48093
JH		 1665 err = hci_req_run(&req, clean_up_hci_complete);
1666 if (!err && discov_stopped)
1667 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1668
1669 return err;
8b064a3a
JH		 1670}
1671
bdb6d971 1672static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1673 u16 len)
eec8d2bc 1674{
650f726d 1675 struct mgmt_mode *cp = data;
3b0602cd 1676 struct mgmt_pending_cmd *cmd;
4b34ee78 1677 int err;
eec8d2bc 1678
bdb6d971 1679 BT_DBG("request for %s", hdev->name);
eec8d2bc 1680
a7e80f25 1681 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1682 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1683 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1684
09fd0de5 1685 hci_dev_lock(hdev);
eec8d2bc 1686
333ae95d 1687 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1688 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1689 MGMT_STATUS_BUSY);
87b95ba6
JH		 1690 goto failed;
1691 }
1692
a69d8927 1693 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1694 cancel_delayed_work(&hdev->power_off);
1695
1696 if (cp->val) {
a1d70450
JH		 1697 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1698 data, len);
1699 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1700 goto failed;
1701 }
1702 }
1703
4b34ee78 1704 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1705 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1706 goto failed;
1707 }
1708
2e58ef3e 1709 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1710 if (!cmd) {
1711 err = -ENOMEM;
eec8d2bc 1712 goto failed;
366a0336 1713 }
eec8d2bc 1714
8b064a3a 1715 if (cp->val) {
19202573 1716 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1717 err = 0;
1718 } else {
1719 /* Disconnect connections, stop scans, etc */
1720 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1721 if (!err)
1722 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1723 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1724
8b064a3a
JH		 1725 /* ENODATA means there were no HCI commands queued */
1726 if (err == -ENODATA) {
a3172b7e 1727 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1728 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1729 err = 0;
1730 }
1731 }
eec8d2bc
JH		 1732
1733failed:
09fd0de5 1734 hci_dev_unlock(hdev);
366a0336 1735 return err;
eec8d2bc
JH		 1736}
1737
beadb2bd
JH		 1738static int new_settings(struct hci_dev *hdev, struct sock *skip)
1739{
f6b7712e 1740 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1741
f6b7712e
MH		 1742 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1743 sizeof(ev), skip);
beadb2bd
JH		 1744}
1745
91a668b0
JH		 1746int mgmt_new_settings(struct hci_dev *hdev)
1747{
1748 return new_settings(hdev, NULL);
1749}
1750
bd99abdd
JH		 1751struct cmd_lookup {
1752 struct sock *sk;
1753 struct hci_dev *hdev;
1754 u8 mgmt_status;
1755};
1756
3b0602cd 1757static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1758{
1759 struct cmd_lookup *match = data;
1760
1761 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1762
1763 list_del(&cmd->list);
1764
1765 if (match->sk == NULL) {
1766 match->sk = cmd->sk;
1767 sock_hold(match->sk);
1768 }
1769
1770 mgmt_pending_free(cmd);
1771}
1772
3b0602cd 1773static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1774{
1775 u8 *status = data;
1776
a69e8375 1777 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1778 mgmt_pending_remove(cmd);
1779}
1780
3b0602cd 1781static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1782{
1783 if (cmd->cmd_complete) {
1784 u8 *status = data;
1785
1786 cmd->cmd_complete(cmd, *status);
1787 mgmt_pending_remove(cmd);
1788
1789 return;
1790 }
1791
1792 cmd_status_rsp(cmd, data);
1793}
1794
3b0602cd 1795static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1796{
2a1afb5a
JH		 1797 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1798 cmd->param, cmd->param_len);
f5818c22
JH		 1799}
1800
3b0602cd 1801static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1802{
2a1afb5a
JH		 1803 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1804 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1805}
1806
e6fe7986
JH		 1807static u8 mgmt_bredr_support(struct hci_dev *hdev)
1808{
1809 if (!lmp_bredr_capable(hdev))
1810 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1811 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1812 return MGMT_STATUS_REJECTED;
1813 else
1814 return MGMT_STATUS_SUCCESS;
1815}
1816
1817static u8 mgmt_le_support(struct hci_dev *hdev)
1818{
1819 if (!lmp_le_capable(hdev))
1820 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1821 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1822 return MGMT_STATUS_REJECTED;
1823 else
1824 return MGMT_STATUS_SUCCESS;
1825}
1826
1904a853
MH		 1827static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1828 u16 opcode)
bfaf8c9f 1829{
3b0602cd 1830 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1831 struct mgmt_mode *cp;
970ba524 1832 struct hci_request req;
bfaf8c9f
JH		 1833 bool changed;
1834
1835 BT_DBG("status 0x%02x", status);
1836
1837 hci_dev_lock(hdev);
1838
333ae95d 1839 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1840 if (!cmd)
1841 goto unlock;
1842
1843 if (status) {
1844 u8 mgmt_err = mgmt_status(status);
a69e8375 1845 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1846 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1847 goto remove_cmd;
1848 }
1849
1850 cp = cmd->param;
d4462a07 1851 if (cp->val) {
238be788 1852 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1853
1854 if (hdev->discov_timeout > 0) {
1855 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1856 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1857 to);
1858 }
1859 } else {
a69d8927 1860 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1861 }
bfaf8c9f
JH		 1862
1863 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1864
1865 if (changed)
1866 new_settings(hdev, cmd->sk);
1867
970ba524
MH		 1868 /* When the discoverable mode gets changed, make sure
1869 * that class of device has the limited discoverable
432df05e
JH		 1870 * bit correctly set. Also update page scan based on whitelist
1871 * entries.
970ba524
MH		 1872 */
1873 hci_req_init(&req, hdev);
1d2dc5b7 1874 __hci_update_page_scan(&req);
970ba524
MH		 1875 update_class(&req);
1876 hci_req_run(&req, NULL);
1877
bfaf8c9f
JH		 1878remove_cmd:
1879 mgmt_pending_remove(cmd);
1880
1881unlock:
1882 hci_dev_unlock(hdev);
1883}
1884
bdb6d971 1885static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1886 u16 len)
73f22f62 1887{
650f726d 1888 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1889 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1890 struct hci_request req;
5e5282bb 1891 u16 timeout;
9a43e25f 1892 u8 scan;
73f22f62
JH		 1893 int err;
1894
bdb6d971 1895 BT_DBG("request for %s", hdev->name);
73f22f62 1896
d7a5a11d
MH		 1897 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1898 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1899 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1900 MGMT_STATUS_REJECTED);
33c525c0 1901
310a3d48 1902 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1903 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1904 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1905
1f350c87 1906 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1907
1908 /* Disabling discoverable requires that no timeout is set,
1909 * and enabling limited discoverable requires a timeout.
1910 */
1911 if ((cp->val == 0x00 && timeout > 0) ||
1912 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1913 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1914 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1915
09fd0de5 1916 hci_dev_lock(hdev);
73f22f62 1917
5e5282bb 1918 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1920 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1921 goto failed;
1922 }
1923
333ae95d
JH		 1924 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1925 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1926 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1927 MGMT_STATUS_BUSY);
73f22f62
JH		 1928 goto failed;
1929 }
1930
d7a5a11d 1931 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1933 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1934 goto failed;
1935 }
1936
1937 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1938 bool changed = false;
1939
310a3d48
MH		 1940 /* Setting limited discoverable when powered off is
1941 * not a valid operation since it requires a timeout
1942 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1943 */
d7a5a11d 1944 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1945 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1946 changed = true;
1947 }
1948
5e5282bb 1949 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1950 if (err < 0)
1951 goto failed;
1952
1953 if (changed)
1954 err = new_settings(hdev, sk);
1955
5e5282bb
JH		 1956 goto failed;
1957 }
1958
310a3d48
MH		 1959 /* If the current mode is the same, then just update the timeout
1960 * value with the new value. And if only the timeout gets updated,
1961 * then no need for any HCI transactions.
1962 */
d7a5a11d
MH		 1963 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1964 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1965 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1966 cancel_delayed_work(&hdev->discov_off);
1967 hdev->discov_timeout = timeout;
955638ec 1968
36261547
MH		 1969 if (cp->val && hdev->discov_timeout > 0) {
1970 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1971 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1972 to);
955638ec
MH		 1973 }
1974
69ab39ea 1975 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1976 goto failed;
1977 }
1978
2e58ef3e 1979 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1980 if (!cmd) {
1981 err = -ENOMEM;
73f22f62 1982 goto failed;
366a0336 1983 }
73f22f62 1984
310a3d48
MH		 1985 /* Cancel any potential discoverable timeout that might be
1986 * still active and store new timeout value. The arming of
1987 * the timeout happens in the complete handler.
1988 */
1989 cancel_delayed_work(&hdev->discov_off);
1990 hdev->discov_timeout = timeout;
1991
b456f87c
JH		 1992 /* Limited discoverable mode */
1993 if (cp->val == 0x02)
a1536da2 1994 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1995 else
a358dc11 1996 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1997
bfaf8c9f
JH		 1998 hci_req_init(&req, hdev);
1999
9a43e25f
JH		 2000 /* The procedure for LE-only controllers is much simpler - just
2001 * update the advertising data.
2002 */
d7a5a11d 2003 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 2004 goto update_ad;
2005
73f22f62
JH		 2006 scan = SCAN_PAGE;
2007
310a3d48
MH		 2008 if (cp->val) {
2009 struct hci_cp_write_current_iac_lap hci_cp;
2010
2011 if (cp->val == 0x02) {
2012 /* Limited discoverable mode */
33337dcb 2013 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 2014 hci_cp.iac_lap[0] = 0x00; /* LIAC */
2015 hci_cp.iac_lap[1] = 0x8b;
2016 hci_cp.iac_lap[2] = 0x9e;
2017 hci_cp.iac_lap[3] = 0x33; /* GIAC */
2018 hci_cp.iac_lap[4] = 0x8b;
2019 hci_cp.iac_lap[5] = 0x9e;
2020 } else {
2021 /* General discoverable mode */
310a3d48
MH		 2022 hci_cp.num_iac = 1;
2023 hci_cp.iac_lap[0] = 0x33; /* GIAC */
2024 hci_cp.iac_lap[1] = 0x8b;
2025 hci_cp.iac_lap[2] = 0x9e;
2026 }
2027
2028 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2029 (hci_cp.num_iac * 3) + 1, &hci_cp);
2030
73f22f62 2031 scan |= SCAN_INQUIRY;
310a3d48 2032 } else {
a358dc11 2033 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 2034 }
73f22f62 2035
310a3d48 2036 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 2037
9a43e25f
JH		 2038update_ad:
2039 update_adv_data(&req);
2040
bfaf8c9f 2041 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 2042 if (err < 0)
a664b5bc 2043 mgmt_pending_remove(cmd);
73f22f62
JH		 2044
2045failed:
09fd0de5 2046 hci_dev_unlock(hdev);
73f22f62
JH		 2047 return err;
2048}
2049
406d7804
JH		 2050static void write_fast_connectable(struct hci_request *req, bool enable)
2051{
bd98b996 2052 struct hci_dev *hdev = req->hdev;
406d7804
JH		 2053 struct hci_cp_write_page_scan_activity acp;
2054 u8 type;
2055
d7a5a11d 2056 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 2057 return;
2058
4c01f8b8
JH		 2059 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2060 return;
2061
406d7804
JH		 2062 if (enable) {
2063 type = PAGE_SCAN_TYPE_INTERLACED;
2064
2065 /* 160 msec page scan interval */
dcf4adbf 2066 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 2067 } else {
2068 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2069
2070 /* default 1.28 sec page scan */
dcf4adbf 2071 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 2072 }
2073
dcf4adbf 2074 acp.window = cpu_to_le16(0x0012);
406d7804 2075
bd98b996
JH		 2076 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2077 __cpu_to_le16(hdev->page_scan_window) != acp.window)
2078 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2079 sizeof(acp), &acp);
2080
2081 if (hdev->page_scan_type != type)
2082 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 2083}
2084
1904a853
MH		 2085static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2086 u16 opcode)
2b76f453 2087{
3b0602cd 2088 struct mgmt_pending_cmd *cmd;
d7b856f9 2089 struct mgmt_mode *cp;
bc6d2d04 2090 bool conn_changed, discov_changed;
2b76f453
JH		 2091
2092 BT_DBG("status 0x%02x", status);
2093
2094 hci_dev_lock(hdev);
2095
333ae95d 2096 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 2097 if (!cmd)
2098 goto unlock;
2099
37438c1f
JH		 2100 if (status) {
2101 u8 mgmt_err = mgmt_status(status);
a69e8375 2102 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 2103 goto remove_cmd;
2104 }
2105
d7b856f9 2106 cp = cmd->param;
bc6d2d04 2107 if (cp->val) {
238be788
MH		 2108 conn_changed = !hci_dev_test_and_set_flag(hdev,
2109 HCI_CONNECTABLE);
bc6d2d04
JH		 2110 discov_changed = false;
2111 } else {
a69d8927
MH		 2112 conn_changed = hci_dev_test_and_clear_flag(hdev,
2113 HCI_CONNECTABLE);
2114 discov_changed = hci_dev_test_and_clear_flag(hdev,
2115 HCI_DISCOVERABLE);
bc6d2d04 2116 }
d7b856f9 2117
2b76f453
JH		 2118 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2119
bc6d2d04 2120 if (conn_changed || discov_changed) {
d7b856f9 2121 new_settings(hdev, cmd->sk);
1d2dc5b7 2122 hci_update_page_scan(hdev);
bc6d2d04
JH		 2123 if (discov_changed)
2124 mgmt_update_adv_data(hdev);
2b7be33e
JH		 2125 hci_update_background_scan(hdev);
2126 }
d7b856f9 2127
37438c1f 2128remove_cmd:
2b76f453
JH		 2129 mgmt_pending_remove(cmd);
2130
2131unlock:
2132 hci_dev_unlock(hdev);
2133}
2134
e8ba3a1f
JH		 2135static int set_connectable_update_settings(struct hci_dev *hdev,
2136 struct sock *sk, u8 val)
2137{
2138 bool changed = false;
2139 int err;
2140
d7a5a11d 2141 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2142 changed = true;
2143
2144 if (val) {
a1536da2 2145 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2146 } else {
a358dc11
MH		 2147 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2148 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2149 }
2150
2151 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2152 if (err < 0)
2153 return err;
2154
562064e6 2155 if (changed) {
1d2dc5b7 2156 hci_update_page_scan(hdev);
562064e6 2157 hci_update_background_scan(hdev);
e8ba3a1f 2158 return new_settings(hdev, sk);
562064e6 2159 }
e8ba3a1f
JH		 2160
2161 return 0;
2162}
2163
bdb6d971 2164static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2165 u16 len)
9fbcbb45 2166{
650f726d 2167 struct mgmt_mode *cp = data;
3b0602cd 2168 struct mgmt_pending_cmd *cmd;
2b76f453 2169 struct hci_request req;
1987fdc7 2170 u8 scan;
9fbcbb45
JH		 2171 int err;
2172
bdb6d971 2173 BT_DBG("request for %s", hdev->name);
9fbcbb45 2174
d7a5a11d
MH		 2175 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2176 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2177 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2178 MGMT_STATUS_REJECTED);
33c525c0 2179
a7e80f25 2180 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2181 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2182 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2183
09fd0de5 2184 hci_dev_lock(hdev);
9fbcbb45 2185
4b34ee78 2186 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2187 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2188 goto failed;
2189 }
2190
333ae95d
JH		 2191 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2192 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2193 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2194 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2195 goto failed;
2196 }
2197
2e58ef3e 2198 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2199 if (!cmd) {
2200 err = -ENOMEM;
9fbcbb45 2201 goto failed;
366a0336 2202 }
9fbcbb45 2203
9b74246f 2204 hci_req_init(&req, hdev);
9fbcbb45 2205
9a43e25f
JH		 2206 /* If BR/EDR is not enabled and we disable advertising as a
2207 * by-product of disabling connectable, we need to update the
2208 * advertising flags.
2209 */
d7a5a11d 2210 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2211 if (!cp->val) {
a358dc11
MH		 2212 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2213 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2214 }
2215 update_adv_data(&req);
2216 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2217 if (cp->val) {
2218 scan = SCAN_PAGE;
2219 } else {
3bd27240
JH		 2220 /* If we don't have any whitelist entries just
2221 * disable all scanning. If there are entries
2222 * and we had both page and inquiry scanning
2223 * enabled then fall back to only page scanning.
2224 * Otherwise no changes are needed.
2225 */
2226 if (list_empty(&hdev->whitelist))
2227 scan = SCAN_DISABLED;
2228 else if (test_bit(HCI_ISCAN, &hdev->flags))
2229 scan = SCAN_PAGE;
2230 else
2231 goto no_scan_update;
9b74246f
JH		 2232
2233 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2234 hdev->discov_timeout > 0)
9b74246f
JH		 2235 cancel_delayed_work(&hdev->discov_off);
2236 }
2b76f453 2237
9b74246f
JH		 2238 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2239 }
2b76f453 2240
3bd27240 2241no_scan_update:
e8b1202c 2242 /* Update the advertising parameters if necessary */
880897d4
AU		 2243 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2244 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2245 enable_advertising(&req);
1987fdc7 2246
2b76f453 2247 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2248 if (err < 0) {
a664b5bc 2249 mgmt_pending_remove(cmd);
9b74246f 2250 if (err == -ENODATA)
a81070ba
JH		 2251 err = set_connectable_update_settings(hdev, sk,
2252 cp->val);
9b74246f
JH		 2253 goto failed;
2254 }
9fbcbb45
JH		 2255
2256failed:
09fd0de5 2257 hci_dev_unlock(hdev);
9fbcbb45
JH		 2258 return err;
2259}
2260
b2939475 2261static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2262 u16 len)
c542a06c 2263{
650f726d 2264 struct mgmt_mode *cp = data;
55594356 2265 bool changed;
c542a06c
JH		 2266 int err;
2267
bdb6d971 2268 BT_DBG("request for %s", hdev->name);
c542a06c 2269
a7e80f25 2270 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2271 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2272 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2273
09fd0de5 2274 hci_dev_lock(hdev);
c542a06c
JH		 2275
2276 if (cp->val)
238be788 2277 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2278 else
a69d8927 2279 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2280
b2939475 2281 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2282 if (err < 0)
55594356 2283 goto unlock;
c542a06c 2284
55594356
MH		 2285 if (changed)
2286 err = new_settings(hdev, sk);
c542a06c 2287
55594356 2288unlock:
09fd0de5 2289 hci_dev_unlock(hdev);
c542a06c
JH		 2290 return err;
2291}
2292
04124681
GP		 2293static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2294 u16 len)
33ef95ed
JH		 2295{
2296 struct mgmt_mode *cp = data;
3b0602cd 2297 struct mgmt_pending_cmd *cmd;
e6fe7986 2298 u8 val, status;
33ef95ed
JH		 2299 int err;
2300
bdb6d971 2301 BT_DBG("request for %s", hdev->name);
33ef95ed 2302
e6fe7986
JH		 2303 status = mgmt_bredr_support(hdev);
2304 if (status)
a69e8375
JH		 2305 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2306 status);
33c525c0 2307
a7e80f25 2308 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2309 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2310 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2311
33ef95ed
JH		 2312 hci_dev_lock(hdev);
2313
4b34ee78 2314 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2315 bool changed = false;
2316
d7a5a11d 2317 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2318 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2319 changed = true;
2320 }
2321
2322 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2323 if (err < 0)
2324 goto failed;
2325
2326 if (changed)
2327 err = new_settings(hdev, sk);
2328
33ef95ed
JH		 2329 goto failed;
2330 }
2331
333ae95d 2332 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2333 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2334 MGMT_STATUS_BUSY);
33ef95ed
JH		 2335 goto failed;
2336 }
2337
2338 val = !!cp->val;
2339
2340 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2341 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2342 goto failed;
2343 }
2344
2345 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2346 if (!cmd) {
2347 err = -ENOMEM;
2348 goto failed;
2349 }
2350
2351 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2352 if (err < 0) {
2353 mgmt_pending_remove(cmd);
2354 goto failed;
2355 }
2356
2357failed:
2358 hci_dev_unlock(hdev);
33ef95ed
JH		 2359 return err;
2360}
2361
bdb6d971 2362static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2363{
2364 struct mgmt_mode *cp = data;
3b0602cd 2365 struct mgmt_pending_cmd *cmd;
72ef0c1a 2366 u8 status;
ed2c4ee3
JH		 2367 int err;
2368
bdb6d971 2369 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2370
cdba5281
MH		 2371 status = mgmt_bredr_support(hdev);
2372 if (status)
a69e8375 2373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2374
13ecd8b6 2375 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2376 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2377 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2378
a7e80f25 2379 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2380 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2381 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2382
13ecd8b6 2383 hci_dev_lock(hdev);
6c8f12c1 2384
4b34ee78 2385 if (!hdev_is_powered(hdev)) {
9ecb3e24 2386 bool changed;
c0ecddc2 2387
9ecb3e24 2388 if (cp->val) {
238be788
MH		 2389 changed = !hci_dev_test_and_set_flag(hdev,
2390 HCI_SSP_ENABLED);
9ecb3e24 2391 } else {
a69d8927
MH		 2392 changed = hci_dev_test_and_clear_flag(hdev,
2393 HCI_SSP_ENABLED);
9ecb3e24 2394 if (!changed)
a69d8927
MH		 2395 changed = hci_dev_test_and_clear_flag(hdev,
2396 HCI_HS_ENABLED);
9ecb3e24 2397 else
a358dc11 2398 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2399 }
2400
2401 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2402 if (err < 0)
2403 goto failed;
2404
2405 if (changed)
2406 err = new_settings(hdev, sk);
2407
ed2c4ee3
JH		 2408 goto failed;
2409 }
2410
333ae95d 2411 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2413 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2414 goto failed;
2415 }
2416
d7a5a11d 2417 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2418 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2419 goto failed;
2420 }
2421
2422 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2423 if (!cmd) {
2424 err = -ENOMEM;
2425 goto failed;
2426 }
2427
d7a5a11d 2428 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2429 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2430 sizeof(cp->val), &cp->val);
2431
72ef0c1a 2432 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2433 if (err < 0) {
2434 mgmt_pending_remove(cmd);
2435 goto failed;
2436 }
2437
2438failed:
2439 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2440 return err;
2441}
2442
bdb6d971 2443static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2444{
2445 struct mgmt_mode *cp = data;
ee392693 2446 bool changed;
e6fe7986 2447 u8 status;
ee392693 2448 int err;
6d80dfd0 2449
bdb6d971 2450 BT_DBG("request for %s", hdev->name);
6d80dfd0 2451
e6fe7986
JH		 2452 status = mgmt_bredr_support(hdev);
2453 if (status)
a69e8375 2454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2455
9ecb3e24 2456 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2458 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2459
d7a5a11d 2460 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2462 MGMT_STATUS_REJECTED);
9ecb3e24 2463
a7e80f25 2464 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2465 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2466 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2467
ee392693
MH		 2468 hci_dev_lock(hdev);
2469
333ae95d 2470 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2471 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2472 MGMT_STATUS_BUSY);
a2cb01de
JH		 2473 goto unlock;
2474 }
2475
a0cdf960 2476 if (cp->val) {
238be788 2477 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2478 } else {
2479 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2480 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2481 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2482 goto unlock;
2483 }
2484
a69d8927 2485 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2486 }
ee392693
MH		 2487
2488 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2489 if (err < 0)
2490 goto unlock;
2491
2492 if (changed)
2493 err = new_settings(hdev, sk);
6d80dfd0 2494
ee392693
MH		 2495unlock:
2496 hci_dev_unlock(hdev);
2497 return err;
6d80dfd0
JH		 2498}
2499
1904a853 2500static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2501{
2502 struct cmd_lookup match = { NULL, hdev };
2503
3ad67582
JK		 2504 hci_dev_lock(hdev);
2505
416a4ae5
JH		 2506 if (status) {
2507 u8 mgmt_err = mgmt_status(status);
2508
2509 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2510 &mgmt_err);
3ad67582 2511 goto unlock;
416a4ae5
JH		 2512 }
2513
2514 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2515
2516 new_settings(hdev, match.sk);
2517
2518 if (match.sk)
2519 sock_put(match.sk);
441ad2d0
MH		 2520
2521 /* Make sure the controller has a good default for
2522 * advertising data. Restrict the update to when LE
2523 * has actually been enabled. During power on, the
2524 * update in powered_update_hci will take care of it.
2525 */
d7a5a11d 2526 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2527 struct hci_request req;
2528
441ad2d0 2529 hci_req_init(&req, hdev);
5947f4bc 2530 update_adv_data(&req);
f14d8f64 2531 update_scan_rsp_data(&req);
2cf22218 2532 __hci_update_background_scan(&req);
441ad2d0 2533 hci_req_run(&req, NULL);
441ad2d0 2534 }
3ad67582
JK		 2535
2536unlock:
2537 hci_dev_unlock(hdev);
416a4ae5
JH		 2538}
2539
bdb6d971 2540static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2541{
2542 struct mgmt_mode *cp = data;
2543 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2544 struct mgmt_pending_cmd *cmd;
416a4ae5 2545 struct hci_request req;
06199cf8 2546 int err;
0b60eba1 2547 u8 val, enabled;
06199cf8 2548
bdb6d971 2549 BT_DBG("request for %s", hdev->name);
06199cf8 2550
13ecd8b6 2551 if (!lmp_le_capable(hdev))
a69e8375
JH		 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2553 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2554
a7e80f25 2555 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2557 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2558
e7844ee5
MH		 2559 /* Bluetooth single mode LE only controllers or dual-mode
2560 * controllers configured as LE only devices, do not allow
2561 * switching LE off. These have either LE enabled explicitly
2562 * or BR/EDR has been previously switched off.
2563 *
2564 * When trying to enable an already enabled LE, then gracefully
2565 * send a positive response. Trying to disable it however will
2566 * result into rejection.
2567 */
2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2569 if (cp->val == 0x01)
2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2571
a69e8375
JH		 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2573 MGMT_STATUS_REJECTED);
e7844ee5 2574 }
c73eee91 2575
13ecd8b6 2576 hci_dev_lock(hdev);
06199cf8
JH		 2577
2578 val = !!cp->val;
ffa88e02 2579 enabled = lmp_host_le_capable(hdev);
06199cf8 2580
847818d9
FG		 2581 if (!val)
2582 clear_adv_instance(hdev, NULL, 0x00, true);
2583
0b60eba1 2584 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2585 bool changed = false;
2586
d7a5a11d 2587 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2588 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2589 changed = true;
2590 }
2591
d7a5a11d 2592 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2593 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2594 changed = true;
2595 }
2596
06199cf8
JH		 2597 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2598 if (err < 0)
1de028ce 2599 goto unlock;
06199cf8
JH		 2600
2601 if (changed)
2602 err = new_settings(hdev, sk);
2603
1de028ce 2604 goto unlock;
06199cf8
JH		 2605 }
2606
333ae95d
JH		 2607 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2608 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2610 MGMT_STATUS_BUSY);
1de028ce 2611 goto unlock;
06199cf8
JH		 2612 }
2613
2614 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2615 if (!cmd) {
2616 err = -ENOMEM;
1de028ce 2617 goto unlock;
06199cf8
JH		 2618 }
2619
441ad2d0
MH		 2620 hci_req_init(&req, hdev);
2621
06199cf8
JH		 2622 memset(&hci_cp, 0, sizeof(hci_cp));
2623
2624 if (val) {
2625 hci_cp.le = val;
32226e4f 2626 hci_cp.simul = 0x00;
441ad2d0 2627 } else {
d7a5a11d 2628 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2629 disable_advertising(&req);
06199cf8
JH		 2630 }
2631
416a4ae5
JH		 2632 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2633 &hci_cp);
2634
2635 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2636 if (err < 0)
06199cf8 2637 mgmt_pending_remove(cmd);
06199cf8 2638
1de028ce
JH		 2639unlock:
2640 hci_dev_unlock(hdev);
06199cf8
JH		 2641 return err;
2642}
2643
0cab9c80
JH		 2644/* This is a helper function to test for pending mgmt commands that can
2645 * cause CoD or EIR HCI commands. We can only allow one such pending
2646 * mgmt command at a time since otherwise we cannot easily track what
2647 * the current values are, will be, and based on that calculate if a new
2648 * HCI command needs to be sent and if yes with what value.
2649 */
2650static bool pending_eir_or_class(struct hci_dev *hdev)
2651{
3b0602cd 2652 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2653
2654 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2655 switch (cmd->opcode) {
2656 case MGMT_OP_ADD_UUID:
2657 case MGMT_OP_REMOVE_UUID:
2658 case MGMT_OP_SET_DEV_CLASS:
2659 case MGMT_OP_SET_POWERED:
2660 return true;
2661 }
2662 }
2663
2664 return false;
2665}
2666
83be8eca
JH		 2667static const u8 bluetooth_base_uuid[] = {
2668 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2669 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2670};
2671
2672static u8 get_uuid_size(const u8 *uuid)
2673{
2674 u32 val;
2675
2676 if (memcmp(uuid, bluetooth_base_uuid, 12))
2677 return 128;
2678
2679 val = get_unaligned_le32(&uuid[12]);
2680 if (val > 0xffff)
2681 return 32;
2682
2683 return 16;
2684}
2685
92da6097
JH		 2686static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2687{
3b0602cd 2688 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2689
2690 hci_dev_lock(hdev);
2691
333ae95d 2692 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2693 if (!cmd)
2694 goto unlock;
2695
2a1afb5a
JH		 2696 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2697 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2698
2699 mgmt_pending_remove(cmd);
2700
2701unlock:
2702 hci_dev_unlock(hdev);
2703}
2704
1904a853 2705static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2706{
2707 BT_DBG("status 0x%02x", status);
2708
2709 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2710}
2711
bdb6d971 2712static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2713{
650f726d 2714 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2715 struct mgmt_pending_cmd *cmd;
890ea898 2716 struct hci_request req;
2aeb9a1a 2717 struct bt_uuid *uuid;
2aeb9a1a
JH		 2718 int err;
2719
bdb6d971 2720 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2721
09fd0de5 2722 hci_dev_lock(hdev);
2aeb9a1a 2723
0cab9c80 2724 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2725 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2726 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2727 goto failed;
2728 }
2729
92c4c204 2730 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2731 if (!uuid) {
2732 err = -ENOMEM;
2733 goto failed;
2734 }
2735
2736 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2737 uuid->svc_hint = cp->svc_hint;
83be8eca 2738 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2739
de66aa63 2740 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2741
890ea898 2742 hci_req_init(&req, hdev);
1aff6f09 2743
890ea898
JH		 2744 update_class(&req);
2745 update_eir(&req);
2746
92da6097
JH		 2747 err = hci_req_run(&req, add_uuid_complete);
2748 if (err < 0) {
2749 if (err != -ENODATA)
2750 goto failed;
80a1e1db 2751
2a1afb5a
JH		 2752 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2753 hdev->dev_class, 3);
90e70454
JH		 2754 goto failed;
2755 }
2756
2757 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2758 if (!cmd) {
90e70454 2759 err = -ENOMEM;
890ea898
JH		 2760 goto failed;
2761 }
2762
2763 err = 0;
2aeb9a1a
JH		 2764
2765failed:
09fd0de5 2766 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2767 return err;
2768}
2769
24b78d0f
JH		 2770static bool enable_service_cache(struct hci_dev *hdev)
2771{
2772 if (!hdev_is_powered(hdev))
2773 return false;
2774
238be788 2775 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2776 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2777 CACHE_TIMEOUT);
24b78d0f
JH		 2778 return true;
2779 }
2780
2781 return false;
2782}
2783
1904a853 2784static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2785{
2786 BT_DBG("status 0x%02x", status);
2787
2788 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2789}
2790
bdb6d971 2791static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2792 u16 len)
2aeb9a1a 2793{
650f726d 2794 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2795 struct mgmt_pending_cmd *cmd;
056341c8 2796 struct bt_uuid *match, *tmp;
2aeb9a1a 2797 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2798 struct hci_request req;
2aeb9a1a
JH		 2799 int err, found;
2800
bdb6d971 2801 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2802
09fd0de5 2803 hci_dev_lock(hdev);
2aeb9a1a 2804
0cab9c80 2805 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2806 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2807 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2808 goto unlock;
2809 }
2810
2aeb9a1a 2811 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2812 hci_uuids_clear(hdev);
4004b6d9 2813
24b78d0f 2814 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2815 err = mgmt_cmd_complete(sk, hdev->id,
2816 MGMT_OP_REMOVE_UUID,
2817 0, hdev->dev_class, 3);
24b78d0f
JH		 2818 goto unlock;
2819 }
4004b6d9 2820
9246a869 2821 goto update_class;
2aeb9a1a
JH		 2822 }
2823
2824 found = 0;
2825
056341c8 2826 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2827 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2828 continue;
2829
2830 list_del(&match->list);
482049f7 2831 kfree(match);
2aeb9a1a
JH		 2832 found++;
2833 }
2834
2835 if (found == 0) {
a69e8375
JH		 2836 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2837 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2838 goto unlock;
2839 }
2840
9246a869 2841update_class:
890ea898 2842 hci_req_init(&req, hdev);
1aff6f09 2843
890ea898
JH		 2844 update_class(&req);
2845 update_eir(&req);
2846
92da6097
JH		 2847 err = hci_req_run(&req, remove_uuid_complete);
2848 if (err < 0) {
2849 if (err != -ENODATA)
2850 goto unlock;
80a1e1db 2851
2a1afb5a
JH		 2852 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2853 hdev->dev_class, 3);
90e70454
JH		 2854 goto unlock;
2855 }
2856
2857 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2858 if (!cmd) {
90e70454 2859 err = -ENOMEM;
890ea898
JH		 2860 goto unlock;
2861 }
2862
2863 err = 0;
2aeb9a1a
JH		 2864
2865unlock:
09fd0de5 2866 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2867 return err;
2868}
2869
1904a853 2870static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2871{
2872 BT_DBG("status 0x%02x", status);
2873
2874 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2875}
2876
bdb6d971 2877static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2878 u16 len)
1aff6f09 2879{
650f726d 2880 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2881 struct mgmt_pending_cmd *cmd;
890ea898 2882 struct hci_request req;
1aff6f09
JH		 2883 int err;
2884
bdb6d971 2885 BT_DBG("request for %s", hdev->name);
1aff6f09 2886
6203fc98 2887 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2888 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2889 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2890
0cab9c80 2891 hci_dev_lock(hdev);
ee98f473 2892
0cab9c80 2893 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2894 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2895 MGMT_STATUS_BUSY);
0cab9c80
JH		 2896 goto unlock;
2897 }
c95f0ba7 2898
0cab9c80 2899 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2900 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2901 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2902 goto unlock;
2903 }
575b3a02 2904
932f5ff5
JH		 2905 hdev->major_class = cp->major;
2906 hdev->minor_class = cp->minor;
2907
b5235a65 2908 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2909 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2910 hdev->dev_class, 3);
b5235a65
JH		 2911 goto unlock;
2912 }
2913
890ea898
JH		 2914 hci_req_init(&req, hdev);
2915
a69d8927 2916 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2917 hci_dev_unlock(hdev);
2918 cancel_delayed_work_sync(&hdev->service_cache);
2919 hci_dev_lock(hdev);
890ea898 2920 update_eir(&req);
7d78525d 2921 }
14c0b608 2922
890ea898
JH		 2923 update_class(&req);
2924
92da6097
JH		 2925 err = hci_req_run(&req, set_class_complete);
2926 if (err < 0) {
2927 if (err != -ENODATA)
2928 goto unlock;
1aff6f09 2929
2a1afb5a
JH		 2930 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2931 hdev->dev_class, 3);
90e70454
JH		 2932 goto unlock;
2933 }
2934
2935 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2936 if (!cmd) {
90e70454 2937 err = -ENOMEM;
890ea898
JH		 2938 goto unlock;
2939 }
2940
2941 err = 0;
1aff6f09 2942
b5235a65 2943unlock:
09fd0de5 2944 hci_dev_unlock(hdev);
1aff6f09
JH		 2945 return err;
2946}
2947
bdb6d971 2948static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2949 u16 len)
55ed8ca1 2950{
650f726d 2951 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2952 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2953 sizeof(struct mgmt_link_key_info));
4e51eae9 2954 u16 key_count, expected_len;
b1de97d8 2955 bool changed;
a492cd52 2956 int i;
55ed8ca1 2957
9060d5cf
MH		 2958 BT_DBG("request for %s", hdev->name);
2959
2960 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2962 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2963
1f350c87 2964 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2965 if (key_count > max_key_count) {
2966 BT_ERR("load_link_keys: too big key_count value %u",
2967 key_count);
a69e8375
JH		 2968 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2969 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2970 }
55ed8ca1 2971
86742e1e
JH		 2972 expected_len = sizeof(*cp) + key_count *
2973 sizeof(struct mgmt_link_key_info);
a492cd52 2974 if (expected_len != len) {
86742e1e 2975 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2976 expected_len, len);
a69e8375
JH		 2977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2978 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2979 }
2980
4ae14301 2981 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2983 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2984
bdb6d971 2985 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2986 key_count);
55ed8ca1 2987
4ee71b20
JH		 2988 for (i = 0; i < key_count; i++) {
2989 struct mgmt_link_key_info *key = &cp->keys[i];
2990
8e991132 2991 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2992 return mgmt_cmd_status(sk, hdev->id,
2993 MGMT_OP_LOAD_LINK_KEYS,
2994 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2995 }
2996
09fd0de5 2997 hci_dev_lock(hdev);
55ed8ca1
JH		 2998
2999 hci_link_keys_clear(hdev);
3000
55ed8ca1 3001 if (cp->debug_keys)
238be788 3002 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 3003 else
a69d8927
MH		 3004 changed = hci_dev_test_and_clear_flag(hdev,
3005 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 3006
3007 if (changed)
3008 new_settings(hdev, NULL);
55ed8ca1 3009
a492cd52 3010 for (i = 0; i < key_count; i++) {
86742e1e 3011 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 3012
58e9293c
JH		 3013 /* Always ignore debug keys and require a new pairing if
3014 * the user wants to use them.
3015 */
3016 if (key->type == HCI_LK_DEBUG_COMBINATION)
3017 continue;
3018
7652ff6a
JH		 3019 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3020 key->type, key->pin_len, NULL);
55ed8ca1
JH		 3021 }
3022
2a1afb5a 3023 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 3024
09fd0de5 3025 hci_dev_unlock(hdev);
55ed8ca1 3026
a492cd52 3027 return 0;
55ed8ca1
JH		 3028}
3029
b1078ad0 3030static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 3031 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 3032{
3033 struct mgmt_ev_device_unpaired ev;
3034
3035 bacpy(&ev.addr.bdaddr, bdaddr);
3036 ev.addr.type = addr_type;
3037
3038 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 3039 skip_sk);
b1078ad0
JH		 3040}
3041
bdb6d971 3042static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3043 u16 len)
55ed8ca1 3044{
124f6e35
JH		 3045 struct mgmt_cp_unpair_device *cp = data;
3046 struct mgmt_rp_unpair_device rp;
a8a1d19e 3047 struct hci_cp_disconnect dc;
3b0602cd 3048 struct mgmt_pending_cmd *cmd;
55ed8ca1 3049 struct hci_conn *conn;
55ed8ca1
JH		 3050 int err;
3051
a8a1d19e 3052 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 3053 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3054 rp.addr.type = cp->addr.type;
a8a1d19e 3055
4ee71b20 3056 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3057 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3058 MGMT_STATUS_INVALID_PARAMS,
3059 &rp, sizeof(rp));
4ee71b20 3060
118da70b 3061 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 3062 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3063 MGMT_STATUS_INVALID_PARAMS,
3064 &rp, sizeof(rp));
118da70b 3065
4ee71b20
JH		 3066 hci_dev_lock(hdev);
3067
86a8cfc6 3068 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3070 MGMT_STATUS_NOT_POWERED, &rp,
3071 sizeof(rp));
86a8cfc6
JH		 3072 goto unlock;
3073 }
3074
e0b2b27e 3075 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 3076 /* If disconnection is requested, then look up the
3077 * connection. If the remote device is connected, it
3078 * will be later used to terminate the link.
3079 *
3080 * Setting it to NULL explicitly will cause no
3081 * termination of the link.
3082 */
3083 if (cp->disconnect)
3084 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3085 &cp->addr.bdaddr);
3086 else
3087 conn = NULL;
3088
124f6e35 3089 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 3090 } else {
3091 u8 addr_type;
3092
89cbb063
AA		 3093 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
3094 &cp->addr.bdaddr);
3095 if (conn) {
3096 /* Defer clearing up the connection parameters
3097 * until closing to give a chance of keeping
3098 * them if a repairing happens.
3099 */
3100 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3101
3102 /* If disconnection is not requested, then
3103 * clear the connection variable so that the
3104 * link is not terminated.
3105 */
3106 if (!cp->disconnect)
3107 conn = NULL;
3108 }
3109
e0b2b27e
JH		 3110 if (cp->addr.type == BDADDR_LE_PUBLIC)
3111 addr_type = ADDR_LE_DEV_PUBLIC;
3112 else
3113 addr_type = ADDR_LE_DEV_RANDOM;
3114
a7ec7338
JH		 3115 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
3116
e0b2b27e
JH		 3117 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
3118 }
b0dbfb46 3119
55ed8ca1 3120 if (err < 0) {
2a1afb5a
JH		 3121 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3122 MGMT_STATUS_NOT_PAIRED, &rp,
3123 sizeof(rp));
55ed8ca1
JH		 3124 goto unlock;
3125 }
3126
89cbb063
AA		 3127 /* If the connection variable is set, then termination of the
3128 * link is requested.
3129 */
a8a1d19e 3130 if (!conn) {
2a1afb5a
JH		 3131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3132 &rp, sizeof(rp));
b1078ad0 3133 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3134 goto unlock;
3135 }
55ed8ca1 3136
124f6e35 3137 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3138 sizeof(*cp));
a8a1d19e
JH		 3139 if (!cmd) {
3140 err = -ENOMEM;
3141 goto unlock;
55ed8ca1
JH		 3142 }
3143
d8b7b1e4
JH		 3144 cmd->cmd_complete = addr_cmd_complete;
3145
eb55ef07 3146 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3147 dc.reason = 0x13; /* Remote User Terminated Connection */
3148 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3149 if (err < 0)
3150 mgmt_pending_remove(cmd);
3151
55ed8ca1 3152unlock:
09fd0de5 3153 hci_dev_unlock(hdev);
55ed8ca1
JH		 3154 return err;
3155}
3156
bdb6d971 3157static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3158 u16 len)
8962ee74 3159{
650f726d 3160 struct mgmt_cp_disconnect *cp = data;
06a63b19 3161 struct mgmt_rp_disconnect rp;
3b0602cd 3162 struct mgmt_pending_cmd *cmd;
8962ee74 3163 struct hci_conn *conn;
8962ee74
JH		 3164 int err;
3165
3166 BT_DBG("");
3167
06a63b19
JH		 3168 memset(&rp, 0, sizeof(rp));
3169 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3170 rp.addr.type = cp->addr.type;
3171
4ee71b20 3172 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3174 MGMT_STATUS_INVALID_PARAMS,
3175 &rp, sizeof(rp));
4ee71b20 3176
09fd0de5 3177 hci_dev_lock(hdev);
8962ee74
JH		 3178
3179 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3181 MGMT_STATUS_NOT_POWERED, &rp,
3182 sizeof(rp));
8962ee74
JH		 3183 goto failed;
3184 }
3185
333ae95d 3186 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3188 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3189 goto failed;
3190 }
3191
591f47f3 3192 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3193 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3194 &cp->addr.bdaddr);
88c3df13
JH		 3195 else
3196 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 3197
f960727e 3198 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3199 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3200 MGMT_STATUS_NOT_CONNECTED, &rp,
3201 sizeof(rp));
8962ee74
JH		 3202 goto failed;
3203 }
3204
2e58ef3e 3205 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3206 if (!cmd) {
3207 err = -ENOMEM;
8962ee74 3208 goto failed;
366a0336 3209 }
8962ee74 3210
f5818c22
JH		 3211 cmd->cmd_complete = generic_cmd_complete;
3212
e3f2f92a 3213 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3214 if (err < 0)
a664b5bc 3215 mgmt_pending_remove(cmd);
8962ee74
JH		 3216
3217failed:
09fd0de5 3218 hci_dev_unlock(hdev);
8962ee74
JH		 3219 return err;
3220}
3221
57c1477c 3222static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3223{
3224 switch (link_type) {
3225 case LE_LINK:
48264f06
JH		 3226 switch (addr_type) {
3227 case ADDR_LE_DEV_PUBLIC:
591f47f3 3228 return BDADDR_LE_PUBLIC;
0ed09148 3229
48264f06 3230 default:
0ed09148 3231 /* Fallback to LE Random address type */
591f47f3 3232 return BDADDR_LE_RANDOM;
48264f06 3233 }
0ed09148 3234
4c659c39 3235 default:
0ed09148 3236 /* Fallback to BR/EDR type */
591f47f3 3237 return BDADDR_BREDR;
4c659c39
JH		 3238 }
3239}
3240
04124681
GP		 3241static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3242 u16 data_len)
2784eb41 3243{
2784eb41 3244 struct mgmt_rp_get_connections *rp;
8035ded4 3245 struct hci_conn *c;
a38528f1 3246 size_t rp_len;
60fc5fb6
JH		 3247 int err;
3248 u16 i;
2784eb41
JH		 3249
3250 BT_DBG("");
3251
09fd0de5 3252 hci_dev_lock(hdev);
2784eb41 3253
5f97c1df 3254 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3255 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3256 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3257 goto unlock;
3258 }
3259
60fc5fb6 3260 i = 0;
b644ba33
JH		 3261 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3262 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3263 i++;
2784eb41
JH		 3264 }
3265
60fc5fb6 3266 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3267 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3268 if (!rp) {
2784eb41
JH		 3269 err = -ENOMEM;
3270 goto unlock;
3271 }
3272
2784eb41 3273 i = 0;
4c659c39 3274 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3275 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3276 continue;
4c659c39 3277 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3278 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3279 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3280 continue;
3281 i++;
3282 }
3283
eb55ef07 3284 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3285
4c659c39
JH		 3286 /* Recalculate length in case of filtered SCO connections, etc */
3287 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3288
2a1afb5a
JH		 3289 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3290 rp_len);
2784eb41 3291
a38528f1 3292 kfree(rp);
5f97c1df
JH		 3293
3294unlock:
09fd0de5 3295 hci_dev_unlock(hdev);
2784eb41
JH		 3296 return err;
3297}
3298
bdb6d971 3299static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3300 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3301{
3b0602cd 3302 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3303 int err;
3304
2e58ef3e 3305 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3306 sizeof(*cp));
96d97a67
WR		 3307 if (!cmd)
3308 return -ENOMEM;
3309
d8457698 3310 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3311 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3312 if (err < 0)
3313 mgmt_pending_remove(cmd);
3314
3315 return err;
3316}
3317
bdb6d971 3318static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3319 u16 len)
980e1a53 3320{
96d97a67 3321 struct hci_conn *conn;
650f726d 3322 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3323 struct hci_cp_pin_code_reply reply;
3b0602cd 3324 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3325 int err;
3326
3327 BT_DBG("");
3328
09fd0de5 3329 hci_dev_lock(hdev);
980e1a53 3330
4b34ee78 3331 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3332 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3333 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3334 goto failed;
3335 }
3336
d8457698 3337 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3338 if (!conn) {
a69e8375
JH		 3339 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3340 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3341 goto failed;
3342 }
3343
3344 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3345 struct mgmt_cp_pin_code_neg_reply ncp;
3346
3347 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3348
3349 BT_ERR("PIN code is not 16 bytes long");
3350
bdb6d971 3351 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3352 if (err >= 0)
a69e8375
JH		 3353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3354 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3355
3356 goto failed;
3357 }
3358
00abfe44 3359 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3360 if (!cmd) {
3361 err = -ENOMEM;
980e1a53 3362 goto failed;
366a0336 3363 }
980e1a53 3364
7776d1d8
JH		 3365 cmd->cmd_complete = addr_cmd_complete;
3366
d8457698 3367 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3368 reply.pin_len = cp->pin_len;
24718ca5 3369 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3370
3371 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3372 if (err < 0)
a664b5bc 3373 mgmt_pending_remove(cmd);
980e1a53
JH		 3374
3375failed:
09fd0de5 3376 hci_dev_unlock(hdev);
980e1a53
JH		 3377 return err;
3378}
3379
04124681
GP		 3380static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3381 u16 len)
17fa4b9d 3382{
650f726d 3383 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3384
3385 BT_DBG("");
3386
4ec86d4c 3387 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3388 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3389 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3390
09fd0de5 3391 hci_dev_lock(hdev);
17fa4b9d
JH		 3392
3393 hdev->io_capability = cp->io_capability;
3394
3395 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3396 hdev->io_capability);
17fa4b9d 3397
09fd0de5 3398 hci_dev_unlock(hdev);
17fa4b9d 3399
2a1afb5a
JH		 3400 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3401 NULL, 0);
17fa4b9d
JH		 3402}
3403
3b0602cd 3404static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3405{
3406 struct hci_dev *hdev = conn->hdev;
3b0602cd 3407 struct mgmt_pending_cmd *cmd;
e9a416b5 3408
2e58ef3e 3409 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3410 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3411 continue;
3412
e9a416b5
JH		 3413 if (cmd->user_data != conn)
3414 continue;
3415
3416 return cmd;
3417 }
3418
3419 return NULL;
3420}
3421
3b0602cd 3422static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3423{
3424 struct mgmt_rp_pair_device rp;
3425 struct hci_conn *conn = cmd->user_data;
9df74653 3426 int err;
e9a416b5 3427
61b1a7fb
JH		 3428 bacpy(&rp.addr.bdaddr, &conn->dst);
3429 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3430
2a1afb5a
JH		 3431 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3432 status, &rp, sizeof(rp));
e9a416b5
JH		 3433
3434 /* So we don't get further callbacks for this connection */
3435 conn->connect_cfm_cb = NULL;
3436 conn->security_cfm_cb = NULL;
3437 conn->disconn_cfm_cb = NULL;
3438
76a68ba0 3439 hci_conn_drop(conn);
89cbb063
AA		 3440
3441 /* The device is paired so there is no need to remove
3442 * its connection parameters anymore.
3443 */
3444 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3445
3446 hci_conn_put(conn);
9df74653
JH		 3447
3448 return err;
e9a416b5
JH		 3449}
3450
f4a407be
JH		 3451void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3452{
3453 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3454 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3455
3456 cmd = find_pairing(conn);
a511b35b 3457 if (cmd) {
04ab2749 3458 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3459 mgmt_pending_remove(cmd);
3460 }
f4a407be
JH		 3461}
3462
e9a416b5
JH		 3463static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3464{
3b0602cd 3465 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3466
3467 BT_DBG("status %u", status);
3468
3469 cmd = find_pairing(conn);
a511b35b 3470 if (!cmd) {
e9a416b5 3471 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3472 return;
3473 }
3474
3475 cmd->cmd_complete(cmd, mgmt_status(status));
3476 mgmt_pending_remove(cmd);
e9a416b5
JH		 3477}
3478
f4a407be 3479static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3480{
3b0602cd 3481 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3482
3483 BT_DBG("status %u", status);
3484
3485 if (!status)
3486 return;
3487
3488 cmd = find_pairing(conn);
a511b35b 3489 if (!cmd) {
4c47d739 3490 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3491 return;
3492 }
3493
3494 cmd->cmd_complete(cmd, mgmt_status(status));
3495 mgmt_pending_remove(cmd);
4c47d739
VA		 3496}
3497
bdb6d971 3498static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3499 u16 len)
e9a416b5 3500{
650f726d 3501 struct mgmt_cp_pair_device *cp = data;
1425acb7 3502 struct mgmt_rp_pair_device rp;
3b0602cd 3503 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3504 u8 sec_level, auth_type;
3505 struct hci_conn *conn;
e9a416b5
JH		 3506 int err;
3507
3508 BT_DBG("");
3509
f950a30e
SJ		 3510 memset(&rp, 0, sizeof(rp));
3511 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3512 rp.addr.type = cp->addr.type;
3513
4ee71b20 3514 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3515 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3516 MGMT_STATUS_INVALID_PARAMS,
3517 &rp, sizeof(rp));
4ee71b20 3518
4ec86d4c 3519 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3520 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3521 MGMT_STATUS_INVALID_PARAMS,
3522 &rp, sizeof(rp));
4ec86d4c 3523
09fd0de5 3524 hci_dev_lock(hdev);
e9a416b5 3525
5f97c1df 3526 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3527 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3528 MGMT_STATUS_NOT_POWERED, &rp,
3529 sizeof(rp));
5f97c1df
JH		 3530 goto unlock;
3531 }
3532
55e76b38
JH		 3533 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3534 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3535 MGMT_STATUS_ALREADY_PAIRED, &rp,
3536 sizeof(rp));
3537 goto unlock;
3538 }
3539
c908df36 3540 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3541 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3542
6f77d8c7 3543 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3544 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3545 auth_type);
6f77d8c7
AG		 3546 } else {
3547 u8 addr_type;
3548
3549 /* Convert from L2CAP channel address type to HCI address type
3550 */
3551 if (cp->addr.type == BDADDR_LE_PUBLIC)
3552 addr_type = ADDR_LE_DEV_PUBLIC;
3553 else
3554 addr_type = ADDR_LE_DEV_RANDOM;
3555
7c264b10
MH		 3556 /* When pairing a new device, it is expected to remember
3557 * this device for future connections. Adding the connection
3558 * parameter information ahead of time allows tracking
3559 * of the slave preferred values and will speed up any
3560 * further connection establishment.
3561 *
3562 * If connection parameters already exist, then they
3563 * will be kept and this function does nothing.
3564 */
3565 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3566
6f77d8c7 3567 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3568 sec_level, HCI_LE_CONN_TIMEOUT,
3569 HCI_ROLE_MASTER);
6f77d8c7 3570 }
7a512d01 3571
30e76272 3572 if (IS_ERR(conn)) {
489dc48e
AK		 3573 int status;
3574
3575 if (PTR_ERR(conn) == -EBUSY)
3576 status = MGMT_STATUS_BUSY;
faa81030
LR		 3577 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3578 status = MGMT_STATUS_NOT_SUPPORTED;
3579 else if (PTR_ERR(conn) == -ECONNREFUSED)
3580 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3581 else
3582 status = MGMT_STATUS_CONNECT_FAILED;
3583
2a1afb5a
JH		 3584 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3585 status, &rp, sizeof(rp));
e9a416b5
JH		 3586 goto unlock;
3587 }
3588
3589 if (conn->connect_cfm_cb) {
76a68ba0 3590 hci_conn_drop(conn);
2a1afb5a
JH		 3591 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3592 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3593 goto unlock;
3594 }
3595
2e58ef3e 3596 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3597 if (!cmd) {
3598 err = -ENOMEM;
76a68ba0 3599 hci_conn_drop(conn);
e9a416b5
JH		 3600 goto unlock;
3601 }
3602
04ab2749
JH		 3603 cmd->cmd_complete = pairing_complete;
3604
7a512d01 3605 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3606 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3607 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3608 conn->security_cfm_cb = pairing_complete_cb;
3609 conn->disconn_cfm_cb = pairing_complete_cb;
3610 } else {
3611 conn->connect_cfm_cb = le_pairing_complete_cb;
3612 conn->security_cfm_cb = le_pairing_complete_cb;
3613 conn->disconn_cfm_cb = le_pairing_complete_cb;
3614 }
7a512d01 3615
e9a416b5 3616 conn->io_capability = cp->io_cap;
f8aaf9b6 3617 cmd->user_data = hci_conn_get(conn);
e9a416b5 3618
6f78fd4b 3619 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3620 hci_conn_security(conn, sec_level, auth_type, true)) {
3621 cmd->cmd_complete(cmd, 0);
3622 mgmt_pending_remove(cmd);
3623 }
e9a416b5
JH		 3624
3625 err = 0;
3626
3627unlock:
09fd0de5 3628 hci_dev_unlock(hdev);
e9a416b5
JH		 3629 return err;
3630}
3631
04124681
GP		 3632static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3633 u16 len)
28424707 3634{
0f4e68cf 3635 struct mgmt_addr_info *addr = data;
3b0602cd 3636 struct mgmt_pending_cmd *cmd;
28424707
JH		 3637 struct hci_conn *conn;
3638 int err;
3639
3640 BT_DBG("");
3641
28424707
JH		 3642 hci_dev_lock(hdev);
3643
5f97c1df 3644 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3645 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3646 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3647 goto unlock;
3648 }
3649
333ae95d 3650 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3651 if (!cmd) {
a69e8375
JH		 3652 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3653 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3654 goto unlock;
3655 }
3656
3657 conn = cmd->user_data;
3658
3659 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3660 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3661 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3662 goto unlock;
3663 }
3664
a511b35b
JH		 3665 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3666 mgmt_pending_remove(cmd);
28424707 3667
2a1afb5a
JH		 3668 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3669 addr, sizeof(*addr));
28424707
JH		 3670unlock:
3671 hci_dev_unlock(hdev);
28424707
JH		 3672 return err;
3673}
3674
bdb6d971 3675static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3676 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3677 u16 hci_op, __le32 passkey)
a5c29683 3678{
3b0602cd 3679 struct mgmt_pending_cmd *cmd;
0df4c185 3680 struct hci_conn *conn;
a5c29683
JH		 3681 int err;
3682
09fd0de5 3683 hci_dev_lock(hdev);
08ba5382 3684
4b34ee78 3685 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3686 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3687 MGMT_STATUS_NOT_POWERED, addr,
3688 sizeof(*addr));
0df4c185 3689 goto done;
a5c29683
JH		 3690 }
3691
1707c60e
JH		 3692 if (addr->type == BDADDR_BREDR)
3693 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3694 else
1707c60e 3695 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3696
3697 if (!conn) {
2a1afb5a
JH		 3698 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3699 MGMT_STATUS_NOT_CONNECTED, addr,
3700 sizeof(*addr));
272d90df
JH		 3701 goto done;
3702 }
47c15e2b 3703
1707c60e 3704 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3705 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3706 if (!err)
2a1afb5a
JH		 3707 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3708 MGMT_STATUS_SUCCESS, addr,
3709 sizeof(*addr));
5fe57d9e 3710 else
2a1afb5a
JH		 3711 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3712 MGMT_STATUS_FAILED, addr,
3713 sizeof(*addr));
47c15e2b 3714
47c15e2b
BG		 3715 goto done;
3716 }
3717
1707c60e 3718 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3719 if (!cmd) {
3720 err = -ENOMEM;
0df4c185 3721 goto done;
a5c29683
JH		 3722 }
3723
7776d1d8
JH		 3724 cmd->cmd_complete = addr_cmd_complete;
3725
0df4c185 3726 /* Continue with pairing via HCI */
604086b7
BG		 3727 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3728 struct hci_cp_user_passkey_reply cp;
3729
1707c60e 3730 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3731 cp.passkey = passkey;
3732 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3733 } else
1707c60e
JH		 3734 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3735 &addr->bdaddr);
604086b7 3736
a664b5bc
JH		 3737 if (err < 0)
3738 mgmt_pending_remove(cmd);
a5c29683 3739
0df4c185 3740done:
09fd0de5 3741 hci_dev_unlock(hdev);
a5c29683
JH		 3742 return err;
3743}
3744
afeb019d
JK		 3745static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3746 void *data, u16 len)
3747{
3748 struct mgmt_cp_pin_code_neg_reply *cp = data;
3749
3750 BT_DBG("");
3751
1707c60e 3752 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3753 MGMT_OP_PIN_CODE_NEG_REPLY,
3754 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3755}
3756
04124681
GP		 3757static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3758 u16 len)
0df4c185 3759{
650f726d 3760 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3761
3762 BT_DBG("");
3763
3764 if (len != sizeof(*cp))
a69e8375
JH		 3765 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3766 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3767
1707c60e 3768 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3769 MGMT_OP_USER_CONFIRM_REPLY,
3770 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3771}
3772
bdb6d971 3773static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3774 void *data, u16 len)
0df4c185 3775{
c9c2659f 3776 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3777
3778 BT_DBG("");
3779
1707c60e 3780 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3781 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3782 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3783}
3784
04124681
GP		 3785static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3786 u16 len)
604086b7 3787{
650f726d 3788 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3789
3790 BT_DBG("");
3791
1707c60e 3792 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3793 MGMT_OP_USER_PASSKEY_REPLY,
3794 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3795}
3796
bdb6d971 3797static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3798 void *data, u16 len)
604086b7 3799{
650f726d 3800 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3801
3802 BT_DBG("");
3803
1707c60e 3804 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3805 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3806 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3807}
3808
13928971 3809static void update_name(struct hci_request *req)
2b4bf397 3810{
13928971 3811 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3812 struct hci_cp_write_local_name cp;
3813
13928971 3814 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3815
890ea898 3816 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3817}
3818
1904a853 3819static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3820{
3821 struct mgmt_cp_set_local_name *cp;
3b0602cd 3822 struct mgmt_pending_cmd *cmd;
13928971
JH		 3823
3824 BT_DBG("status 0x%02x", status);
3825
3826 hci_dev_lock(hdev);
3827
333ae95d 3828 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3829 if (!cmd)
3830 goto unlock;
3831
3832 cp = cmd->param;
3833
3834 if (status)
a69e8375
JH		 3835 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3836 mgmt_status(status));
13928971 3837 else
2a1afb5a
JH		 3838 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3839 cp, sizeof(*cp));
13928971
JH		 3840
3841 mgmt_pending_remove(cmd);
3842
3843unlock:
3844 hci_dev_unlock(hdev);
3845}
3846
bdb6d971 3847static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3848 u16 len)
b312b161 3849{
2b4bf397 3850 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3851 struct mgmt_pending_cmd *cmd;
890ea898 3852 struct hci_request req;
b312b161
JH		 3853 int err;
3854
3855 BT_DBG("");
3856
09fd0de5 3857 hci_dev_lock(hdev);
b312b161 3858
b3f2ca94
JH		 3859 /* If the old values are the same as the new ones just return a
3860 * direct command complete event.
3861 */
3862 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3863 !memcmp(hdev->short_name, cp->short_name,
3864 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3865 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3866 data, len);
b3f2ca94
JH		 3867 goto failed;
3868 }
3869
2b4bf397 3870 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3871
b5235a65 3872 if (!hdev_is_powered(hdev)) {
2b4bf397 3873 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3874
2a1afb5a
JH		 3875 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3876 data, len);
28cc7bde
JH		 3877 if (err < 0)
3878 goto failed;
3879
f6b7712e
MH		 3880 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3881 data, len, sk);
28cc7bde 3882
b5235a65
JH		 3883 goto failed;
3884 }
3885
28cc7bde 3886 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3887 if (!cmd) {
3888 err = -ENOMEM;
3889 goto failed;
3890 }
3891
13928971
JH		 3892 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3893
890ea898 3894 hci_req_init(&req, hdev);
3f985050
JH		 3895
3896 if (lmp_bredr_capable(hdev)) {
3897 update_name(&req);
3898 update_eir(&req);
3899 }
3900
7a5f4990
MH		 3901 /* The name is stored in the scan response data and so
3902 * no need to udpate the advertising data here.
3903 */
3f985050 3904 if (lmp_le_capable(hdev))
7a5f4990 3905 update_scan_rsp_data(&req);
3f985050 3906
13928971 3907 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3908 if (err < 0)
3909 mgmt_pending_remove(cmd);
3910
3911failed:
09fd0de5 3912 hci_dev_unlock(hdev);
b312b161
JH		 3913 return err;
3914}
3915
1b9441f8
JH		 3916static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3917 u16 opcode, struct sk_buff *skb)
3918{
3919 struct mgmt_rp_read_local_oob_data mgmt_rp;
3920 size_t rp_size = sizeof(mgmt_rp);
3921 struct mgmt_pending_cmd *cmd;
3922
3923 BT_DBG("%s status %u", hdev->name, status);
3924
3925 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3926 if (!cmd)
3927 return;
3928
3929 if (status || !skb) {
3930 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3931 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3932 goto remove;
3933 }
3934
3935 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3936
3937 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3938 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3939
3940 if (skb->len < sizeof(*rp)) {
3941 mgmt_cmd_status(cmd->sk, hdev->id,
3942 MGMT_OP_READ_LOCAL_OOB_DATA,
3943 MGMT_STATUS_FAILED);
3944 goto remove;
3945 }
3946
3947 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3948 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3949
3950 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3951 } else {
3952 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3953
3954 if (skb->len < sizeof(*rp)) {
3955 mgmt_cmd_status(cmd->sk, hdev->id,
3956 MGMT_OP_READ_LOCAL_OOB_DATA,
3957 MGMT_STATUS_FAILED);
3958 goto remove;
3959 }
3960
3961 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3962 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3963
3964 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3965 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3966 }
3967
3968 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3969 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3970
3971remove:
3972 mgmt_pending_remove(cmd);
3973}
3974
0f4e68cf 3975static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3976 void *data, u16 data_len)
c35938b2 3977{
3b0602cd 3978 struct mgmt_pending_cmd *cmd;
1b9441f8 3979 struct hci_request req;
c35938b2
SJ		 3980 int err;
3981
bdb6d971 3982 BT_DBG("%s", hdev->name);
c35938b2 3983
09fd0de5 3984 hci_dev_lock(hdev);
c35938b2 3985
4b34ee78 3986 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3987 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3988 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3989 goto unlock;
3990 }
3991
9a1a1996 3992 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3993 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3994 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3995 goto unlock;
3996 }
3997
333ae95d 3998 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3999 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4000 MGMT_STATUS_BUSY);
c35938b2
SJ		 4001 goto unlock;
4002 }
4003
2e58ef3e 4004 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 4005 if (!cmd) {
4006 err = -ENOMEM;
4007 goto unlock;
4008 }
4009
1b9441f8
JH		 4010 hci_req_init(&req, hdev);
4011
710f11c0 4012 if (bredr_sc_enabled(hdev))
1b9441f8 4013 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4d2d2796 4014 else
1b9441f8 4015 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4d2d2796 4016
1b9441f8 4017 err = hci_req_run_skb(&req, read_local_oob_data_complete);
c35938b2
SJ		 4018 if (err < 0)
4019 mgmt_pending_remove(cmd);
4020
4021unlock:
09fd0de5 4022 hci_dev_unlock(hdev);
c35938b2
SJ		 4023 return err;
4024}
4025
bdb6d971 4026static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 4027 void *data, u16 len)
2763eda6 4028{
5d57e796 4029 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 4030 int err;
4031
bdb6d971 4032 BT_DBG("%s ", hdev->name);
2763eda6 4033
5d57e796 4034 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 4035 return mgmt_cmd_complete(sk, hdev->id,
4036 MGMT_OP_ADD_REMOTE_OOB_DATA,
4037 MGMT_STATUS_INVALID_PARAMS,
4038 addr, sizeof(*addr));
5d57e796 4039
09fd0de5 4040 hci_dev_lock(hdev);
2763eda6 4041
ec109113
MH		 4042 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4043 struct mgmt_cp_add_remote_oob_data *cp = data;
4044 u8 status;
bf1e3541 4045
c19a495c 4046 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 4047 err = mgmt_cmd_complete(sk, hdev->id,
4048 MGMT_OP_ADD_REMOTE_OOB_DATA,
4049 MGMT_STATUS_INVALID_PARAMS,
4050 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 4051 goto unlock;
4052 }
4053
ec109113 4054 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 4055 cp->addr.type, cp->hash,
4056 cp->rand, NULL, NULL);
ec109113
MH		 4057 if (err < 0)
4058 status = MGMT_STATUS_FAILED;
4059 else
4060 status = MGMT_STATUS_SUCCESS;
4061
2a1afb5a
JH		 4062 err = mgmt_cmd_complete(sk, hdev->id,
4063 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4064 &cp->addr, sizeof(cp->addr));
ec109113
MH		 4065 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4066 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 4067 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 4068 u8 status;
4069
86df9200 4070 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 4071 /* Enforce zero-valued 192-bit parameters as
4072 * long as legacy SMP OOB isn't implemented.
4073 */
4074 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4075 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 4076 err = mgmt_cmd_complete(sk, hdev->id,
4077 MGMT_OP_ADD_REMOTE_OOB_DATA,
4078 MGMT_STATUS_INVALID_PARAMS,
4079 addr, sizeof(*addr));
d25b78e2
JH		 4080 goto unlock;
4081 }
4082
86df9200
JH		 4083 rand192 = NULL;
4084 hash192 = NULL;
4085 } else {
41bcfd50
MH		 4086 /* In case one of the P-192 values is set to zero,
4087 * then just disable OOB data for P-192.
4088 */
4089 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4090 !memcmp(cp->hash192, ZERO_KEY, 16)) {
4091 rand192 = NULL;
4092 hash192 = NULL;
4093 } else {
4094 rand192 = cp->rand192;
4095 hash192 = cp->hash192;
4096 }
4097 }
4098
4099 /* In case one of the P-256 values is set to zero, then just
4100 * disable OOB data for P-256.
4101 */
4102 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4103 !memcmp(cp->hash256, ZERO_KEY, 16)) {
4104 rand256 = NULL;
4105 hash256 = NULL;
4106 } else {
4107 rand256 = cp->rand256;
4108 hash256 = cp->hash256;
86df9200
JH		 4109 }
4110
81328d5c 4111 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 4112 cp->addr.type, hash192, rand192,
41bcfd50 4113 hash256, rand256);
ec109113
MH		 4114 if (err < 0)
4115 status = MGMT_STATUS_FAILED;
4116 else
4117 status = MGMT_STATUS_SUCCESS;
4118
2a1afb5a
JH		 4119 err = mgmt_cmd_complete(sk, hdev->id,
4120 MGMT_OP_ADD_REMOTE_OOB_DATA,
4121 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 4122 } else {
4123 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 4124 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4125 MGMT_STATUS_INVALID_PARAMS);
ec109113 4126 }
2763eda6 4127
c19a495c 4128unlock:
09fd0de5 4129 hci_dev_unlock(hdev);
2763eda6
SJ		 4130 return err;
4131}
4132
bdb6d971 4133static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 4134 void *data, u16 len)
2763eda6 4135{
650f726d 4136 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 4137 u8 status;
2763eda6
SJ		 4138 int err;
4139
bdb6d971 4140 BT_DBG("%s", hdev->name);
2763eda6 4141
c19a495c 4142 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 4143 return mgmt_cmd_complete(sk, hdev->id,
4144 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4145 MGMT_STATUS_INVALID_PARAMS,
4146 &cp->addr, sizeof(cp->addr));
c19a495c 4147
09fd0de5 4148 hci_dev_lock(hdev);
2763eda6 4149
eedbd581
JH		 4150 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4151 hci_remote_oob_data_clear(hdev);
4152 status = MGMT_STATUS_SUCCESS;
4153 goto done;
4154 }
4155
6928a924 4156 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 4157 if (err < 0)
bf1e3541 4158 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 4159 else
a6785be2 4160 status = MGMT_STATUS_SUCCESS;
bf1e3541 4161
eedbd581 4162done:
2a1afb5a
JH		 4163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4164 status, &cp->addr, sizeof(cp->addr));
2763eda6 4165
09fd0de5 4166 hci_dev_unlock(hdev);
2763eda6
SJ		 4167 return err;
4168}
4169
812abb13 4170static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 4171{
8019044d 4172 struct hci_dev *hdev = req->hdev;
812abb13 4173 struct hci_cp_inquiry cp;
8019044d
MH		 4174 /* General inquiry access code (GIAC) */
4175 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 4176
4177 *status = mgmt_bredr_support(hdev);
4178 if (*status)
4179 return false;
4180
4181 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4182 *status = MGMT_STATUS_BUSY;
4183 return false;
4184 }
4185
4186 hci_inquiry_cache_flush(hdev);
4187
4188 memset(&cp, 0, sizeof(cp));
4189 memcpy(&cp.lap, lap, sizeof(cp.lap));
4190 cp.length = DISCOV_BREDR_INQUIRY_LEN;
4191
4192 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4193
4194 return true;
4195}
4196
4197static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4198{
4199 struct hci_dev *hdev = req->hdev;
4200 struct hci_cp_le_set_scan_param param_cp;
4201 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4202 u8 own_addr_type;
41dc2bd6
AG		 4203 int err;
4204
812abb13
JP		 4205 *status = mgmt_le_support(hdev);
4206 if (*status)
4207 return false;
41dc2bd6 4208
812abb13
JP		 4209 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4210 /* Don't let discovery abort an outgoing connection attempt
4211 * that's using directed advertising.
4212 */
e7d9ab73 4213 if (hci_lookup_le_connect(hdev)) {
812abb13 4214 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4215 return false;
4216 }
41dc2bd6 4217
9d5fc2f2 4218 cancel_adv_timeout(hdev);
812abb13
JP		 4219 disable_advertising(req);
4220 }
41dc2bd6 4221
812abb13
JP		 4222 /* If controller is scanning, it means the background scanning is
4223 * running. Thus, we should temporarily stop it in order to set the
4224 * discovery scanning parameters.
4225 */
4226 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4227 hci_req_add_le_scan_disable(req);
41dc2bd6 4228
812abb13
JP		 4229 /* All active scans will be done with either a resolvable private
4230 * address (when privacy feature has been enabled) or non-resolvable
4231 * private address.
4232 */
4233 err = hci_update_random_address(req, true, &own_addr_type);
4234 if (err < 0) {
4235 *status = MGMT_STATUS_FAILED;
4236 return false;
4237 }
8019044d 4238
812abb13
JP		 4239 memset(&param_cp, 0, sizeof(param_cp));
4240 param_cp.type = LE_SCAN_ACTIVE;
4241 param_cp.interval = cpu_to_le16(interval);
4242 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4243 param_cp.own_address_type = own_addr_type;
8019044d 4244
812abb13
JP		 4245 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4246 &param_cp);
8019044d 4247
812abb13
JP		 4248 memset(&enable_cp, 0, sizeof(enable_cp));
4249 enable_cp.enable = LE_SCAN_ENABLE;
4250 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4251
812abb13
JP		 4252 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4253 &enable_cp);
4254
4255 return true;
4256}
8019044d 4257
812abb13
JP		 4258static bool trigger_discovery(struct hci_request *req, u8 *status)
4259{
4260 struct hci_dev *hdev = req->hdev;
8019044d 4261
812abb13
JP		 4262 switch (hdev->discovery.type) {
4263 case DISCOV_TYPE_BREDR:
4264 if (!trigger_bredr_inquiry(req, status))
4265 return false;
4266 break;
4267
4268 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4269 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4270 &hdev->quirks)) {
4271 /* During simultaneous discovery, we double LE scan
4272 * interval. We must leave some time for the controller
4273 * to do BR/EDR inquiry.
4274 */
4275 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4276 status))
4277 return false;
4278
4279 if (!trigger_bredr_inquiry(req, status))
4280 return false;
4281
4282 return true;
4283 }
4284
812abb13
JP		 4285 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4286 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4287 return false;
4288 }
812abb13 4289 /* fall through */
8019044d 4290
812abb13
JP		 4291 case DISCOV_TYPE_LE:
4292 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4293 return false;
8019044d
MH		 4294 break;
4295
4296 default:
4297 *status = MGMT_STATUS_INVALID_PARAMS;
4298 return false;
4299 }
4300
4301 return true;
41dc2bd6
AG		 4302}
4303
1904a853
MH		 4304static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4305 u16 opcode)
7c307720 4306{
3b0602cd 4307 struct mgmt_pending_cmd *cmd;
11e6e25d 4308 unsigned long timeout;
ae55f598 4309
7c307720
AG		 4310 BT_DBG("status %d", status);
4311
11e6e25d 4312 hci_dev_lock(hdev);
41dc2bd6 4313
333ae95d 4314 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4315 if (!cmd)
333ae95d 4316 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4317
11e6e25d 4318 if (cmd) {
2922a94f 4319 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4320 mgmt_pending_remove(cmd);
4321 }
7c307720
AG		 4322
4323 if (status) {
11e6e25d
MH		 4324 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4325 goto unlock;
7c307720
AG		 4326 }
4327
7c307720 4328 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4329
2d28cfe7
JP		 4330 /* If the scan involves LE scan, pick proper timeout to schedule
4331 * hdev->le_scan_disable that will stop it.
4332 */
7c307720
AG		 4333 switch (hdev->discovery.type) {
4334 case DISCOV_TYPE_LE:
3d5a76f0 4335 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4336 break;
7c307720 4337 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4338 /* When running simultaneous discovery, the LE scanning time
4339 * should occupy the whole discovery time sine BR/EDR inquiry
4340 * and LE scanning are scheduled by the controller.
4341 *
4342 * For interleaving discovery in comparison, BR/EDR inquiry
4343 * and LE scanning are done sequentially with separate
4344 * timeouts.
4345 */
4346 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4347 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4348 else
4349 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4350 break;
7c307720 4351 case DISCOV_TYPE_BREDR:
11e6e25d 4352 timeout = 0;
7c307720 4353 break;
7c307720
AG		 4354 default:
4355 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4356 timeout = 0;
4357 break;
7c307720 4358 }
ae55f598 4359
2d28cfe7
JP		 4360 if (timeout) {
4361 /* When service discovery is used and the controller has
4362 * a strict duplicate filter, it is important to remember
4363 * the start and duration of the scan. This is required
4364 * for restarting scanning during the discovery phase.
4365 */
4366 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4367 &hdev->quirks) &&
82f8b651 4368 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4369 hdev->discovery.scan_start = jiffies;
4370 hdev->discovery.scan_duration = timeout;
4371 }
4372
11e6e25d
MH		 4373 queue_delayed_work(hdev->workqueue,
4374 &hdev->le_scan_disable, timeout);
2d28cfe7 4375 }
ae55f598 4376
11e6e25d
MH		 4377unlock:
4378 hci_dev_unlock(hdev);
7c307720
AG		 4379}
4380
bdb6d971 4381static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4382 void *data, u16 len)
14a53664 4383{
650f726d 4384 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4385 struct mgmt_pending_cmd *cmd;
7c307720 4386 struct hci_request req;
8019044d 4387 u8 status;
14a53664
JH		 4388 int err;
4389
bdb6d971 4390 BT_DBG("%s", hdev->name);
14a53664 4391
09fd0de5 4392 hci_dev_lock(hdev);
14a53664 4393
4b34ee78 4394 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4395 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4396 MGMT_STATUS_NOT_POWERED,
4397 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4398 goto failed;
4399 }
4400
f5a969f2 4401 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4402 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4404 MGMT_STATUS_BUSY, &cp->type,
4405 sizeof(cp->type));
642be6c7
AG		 4406 goto failed;
4407 }
4408
2922a94f 4409 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4410 if (!cmd) {
4411 err = -ENOMEM;
4412 goto failed;
4413 }
4414
2922a94f
JH		 4415 cmd->cmd_complete = generic_cmd_complete;
4416
22078800
MH		 4417 /* Clear the discovery filter first to free any previously
4418 * allocated memory for the UUID list.
4419 */
4420 hci_discovery_filter_clear(hdev);
4421
4aab14e5 4422 hdev->discovery.type = cp->type;
da25cf6a 4423 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4424
7c307720
AG		 4425 hci_req_init(&req, hdev);
4426
8019044d 4427 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4428 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4429 status, &cp->type, sizeof(cp->type));
04106755
JH		 4430 mgmt_pending_remove(cmd);
4431 goto failed;
f39799f5 4432 }
04106755 4433
7c307720 4434 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4435 if (err < 0) {
14a53664 4436 mgmt_pending_remove(cmd);
f5a969f2
MH		 4437 goto failed;
4438 }
7c307720 4439
f5a969f2 4440 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4441
14a53664 4442failed:
09fd0de5 4443 hci_dev_unlock(hdev);
14a53664
JH		 4444 return err;
4445}
f39799f5 4446
3b0602cd
JH		 4447static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4448 u8 status)
2922a94f 4449{
2a1afb5a
JH		 4450 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4451 cmd->param, 1);
2922a94f 4452}
04106755 4453
66ea9427
JP		 4454static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4455 void *data, u16 len)
4456{
4457 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4458 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4459 struct hci_request req;
4460 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4461 u16 uuid_count, expected_len;
4462 u8 status;
4463 int err;
04106755 4464
66ea9427 4465 BT_DBG("%s", hdev->name);
e8bb6b97 4466
66ea9427 4467 hci_dev_lock(hdev);
7c307720 4468
66ea9427 4469 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4470 err = mgmt_cmd_complete(sk, hdev->id,
4471 MGMT_OP_START_SERVICE_DISCOVERY,
4472 MGMT_STATUS_NOT_POWERED,
4473 &cp->type, sizeof(cp->type));
66ea9427
JP		 4474 goto failed;
4475 }
7c307720 4476
66ea9427 4477 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4478 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4479 err = mgmt_cmd_complete(sk, hdev->id,
4480 MGMT_OP_START_SERVICE_DISCOVERY,
4481 MGMT_STATUS_BUSY, &cp->type,
4482 sizeof(cp->type));
66ea9427
JP		 4483 goto failed;
4484 }
d9483943 4485
66ea9427
JP		 4486 uuid_count = __le16_to_cpu(cp->uuid_count);
4487 if (uuid_count > max_uuid_count) {
4488 BT_ERR("service_discovery: too big uuid_count value %u",
4489 uuid_count);
2a1afb5a
JH		 4490 err = mgmt_cmd_complete(sk, hdev->id,
4491 MGMT_OP_START_SERVICE_DISCOVERY,
4492 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4493 sizeof(cp->type));
66ea9427
JP		 4494 goto failed;
4495 }
4496
4497 expected_len = sizeof(*cp) + uuid_count * 16;
4498 if (expected_len != len) {
4499 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4500 expected_len, len);
2a1afb5a
JH		 4501 err = mgmt_cmd_complete(sk, hdev->id,
4502 MGMT_OP_START_SERVICE_DISCOVERY,
4503 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4504 sizeof(cp->type));
66ea9427
JP		 4505 goto failed;
4506 }
4507
4508 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4509 hdev, data, len);
66ea9427
JP		 4510 if (!cmd) {
4511 err = -ENOMEM;
4512 goto failed;
4513 }
4514
2922a94f
JH		 4515 cmd->cmd_complete = service_discovery_cmd_complete;
4516
22078800
MH		 4517 /* Clear the discovery filter first to free any previously
4518 * allocated memory for the UUID list.
4519 */
4520 hci_discovery_filter_clear(hdev);
4521
82f8b651 4522 hdev->discovery.result_filtering = true;
66ea9427
JP		 4523 hdev->discovery.type = cp->type;
4524 hdev->discovery.rssi = cp->rssi;
4525 hdev->discovery.uuid_count = uuid_count;
4526
4527 if (uuid_count > 0) {
4528 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4529 GFP_KERNEL);
4530 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4531 err = mgmt_cmd_complete(sk, hdev->id,
4532 MGMT_OP_START_SERVICE_DISCOVERY,
4533 MGMT_STATUS_FAILED,
4534 &cp->type, sizeof(cp->type));
d9483943
JH		 4535 mgmt_pending_remove(cmd);
4536 goto failed;
4537 }
66ea9427 4538 }
d9483943 4539
66ea9427 4540 hci_req_init(&req, hdev);
5e0452c0 4541
66ea9427 4542 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4543 err = mgmt_cmd_complete(sk, hdev->id,
4544 MGMT_OP_START_SERVICE_DISCOVERY,
4545 status, &cp->type, sizeof(cp->type));
04106755
JH		 4546 mgmt_pending_remove(cmd);
4547 goto failed;
f39799f5 4548 }
3fd24153 4549
7c307720 4550 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4551 if (err < 0) {
14a53664 4552 mgmt_pending_remove(cmd);
66ea9427
JP		 4553 goto failed;
4554 }
4555
4556 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4557
4558failed:
09fd0de5 4559 hci_dev_unlock(hdev);
14a53664
JH		 4560 return err;
4561}
4562
1904a853 4563static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4564{
3b0602cd 4565 struct mgmt_pending_cmd *cmd;
1183fdca 4566
0e05bba6
AG		 4567 BT_DBG("status %d", status);
4568
4569 hci_dev_lock(hdev);
4570
333ae95d 4571 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4572 if (cmd) {
2922a94f 4573 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4574 mgmt_pending_remove(cmd);
0e05bba6
AG		 4575 }
4576
11e6e25d
MH		 4577 if (!status)
4578 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4579
0e05bba6
AG		 4580 hci_dev_unlock(hdev);
4581}
4582
bdb6d971 4583static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4584 u16 len)
14a53664 4585{
d930650b 4586 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4587 struct mgmt_pending_cmd *cmd;
0e05bba6 4588 struct hci_request req;
14a53664
JH		 4589 int err;
4590
bdb6d971 4591 BT_DBG("%s", hdev->name);
14a53664 4592
09fd0de5 4593 hci_dev_lock(hdev);
14a53664 4594
30dc78e1 4595 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4596 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4597 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4598 sizeof(mgmt_cp->type));
d930650b
JH		 4599 goto unlock;
4600 }
4601
4602 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4603 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4604 MGMT_STATUS_INVALID_PARAMS,
4605 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4606 goto unlock;
ff9ef578
JH		 4607 }
4608
2922a94f 4609 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4610 if (!cmd) {
4611 err = -ENOMEM;
30dc78e1
JH		 4612 goto unlock;
4613 }
4614
2922a94f
JH		 4615 cmd->cmd_complete = generic_cmd_complete;
4616
0e05bba6
AG		 4617 hci_req_init(&req, hdev);
4618
21a60d30 4619 hci_stop_discovery(&req);
e0d9727e 4620
21a60d30
JH		 4621 err = hci_req_run(&req, stop_discovery_complete);
4622 if (!err) {
4623 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4624 goto unlock;
14a53664
JH		 4625 }
4626
21a60d30
JH		 4627 mgmt_pending_remove(cmd);
4628
4629 /* If no HCI commands were sent we're done */
4630 if (err == -ENODATA) {
2a1afb5a
JH		 4631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4632 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4633 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4634 }
14a53664 4635
30dc78e1 4636unlock:
09fd0de5 4637 hci_dev_unlock(hdev);
14a53664
JH		 4638 return err;
4639}
4640
bdb6d971 4641static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4642 u16 len)
561aafbc 4643{
650f726d 4644 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4645 struct inquiry_entry *e;
561aafbc
JH		 4646 int err;
4647
bdb6d971 4648 BT_DBG("%s", hdev->name);
561aafbc 4649
561aafbc
JH		 4650 hci_dev_lock(hdev);
4651
30dc78e1 4652 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4653 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4654 MGMT_STATUS_FAILED, &cp->addr,
4655 sizeof(cp->addr));
30dc78e1
JH		 4656 goto failed;
4657 }
4658
a198e7b1 4659 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4660 if (!e) {
2a1afb5a
JH		 4661 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4662 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4663 sizeof(cp->addr));
561aafbc
JH		 4664 goto failed;
4665 }
4666
4667 if (cp->name_known) {
4668 e->name_state = NAME_KNOWN;
4669 list_del(&e->list);
4670 } else {
4671 e->name_state = NAME_NEEDED;
a3d4e20a 4672 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4673 }
4674
2a1afb5a
JH		 4675 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4676 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4677
4678failed:
4679 hci_dev_unlock(hdev);
561aafbc
JH		 4680 return err;
4681}
4682
bdb6d971 4683static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4684 u16 len)
7fbec224 4685{
650f726d 4686 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4687 u8 status;
7fbec224
AJ		 4688 int err;
4689
bdb6d971 4690 BT_DBG("%s", hdev->name);
7fbec224 4691
4ee71b20 4692 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4693 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4694 MGMT_STATUS_INVALID_PARAMS,
4695 &cp->addr, sizeof(cp->addr));
4ee71b20 4696
09fd0de5 4697 hci_dev_lock(hdev);
5e762444 4698
dcc36c16
JH		 4699 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4700 cp->addr.type);
2a8357f2 4701 if (err < 0) {
f0eeea8b 4702 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4703 goto done;
4704 }
4705
4706 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4707 sk);
4708 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4709
2a8357f2 4710done:
2a1afb5a
JH		 4711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4712 &cp->addr, sizeof(cp->addr));
5e762444 4713
09fd0de5 4714 hci_dev_unlock(hdev);
7fbec224
AJ		 4715
4716 return err;
4717}
4718
bdb6d971 4719static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4720 u16 len)
7fbec224 4721{
650f726d 4722 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4723 u8 status;
7fbec224
AJ		 4724 int err;
4725
bdb6d971 4726 BT_DBG("%s", hdev->name);
7fbec224 4727
4ee71b20 4728 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4729 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4730 MGMT_STATUS_INVALID_PARAMS,
4731 &cp->addr, sizeof(cp->addr));
4ee71b20 4732
09fd0de5 4733 hci_dev_lock(hdev);
5e762444 4734
dcc36c16
JH		 4735 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4736 cp->addr.type);
2a8357f2 4737 if (err < 0) {
f0eeea8b 4738 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4739 goto done;
4740 }
4741
4742 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4743 sk);
4744 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4745
2a8357f2 4746done:
2a1afb5a
JH		 4747 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4748 &cp->addr, sizeof(cp->addr));
5e762444 4749
09fd0de5 4750 hci_dev_unlock(hdev);
7fbec224
AJ		 4751
4752 return err;
4753}
4754
cdbaccca
MH		 4755static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4756 u16 len)
4757{
4758 struct mgmt_cp_set_device_id *cp = data;
890ea898 4759 struct hci_request req;
cdbaccca 4760 int err;
c72d4b8a 4761 __u16 source;
cdbaccca
MH		 4762
4763 BT_DBG("%s", hdev->name);
4764
c72d4b8a
SJ		 4765 source = __le16_to_cpu(cp->source);
4766
4767 if (source > 0x0002)
a69e8375
JH		 4768 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4769 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4770
cdbaccca
MH		 4771 hci_dev_lock(hdev);
4772
c72d4b8a 4773 hdev->devid_source = source;
cdbaccca
MH		 4774 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4775 hdev->devid_product = __le16_to_cpu(cp->product);
4776 hdev->devid_version = __le16_to_cpu(cp->version);
4777
2a1afb5a
JH		 4778 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4779 NULL, 0);
cdbaccca 4780
890ea898
JH		 4781 hci_req_init(&req, hdev);
4782 update_eir(&req);
4783 hci_req_run(&req, NULL);
cdbaccca
MH		 4784
4785 hci_dev_unlock(hdev);
4786
4787 return err;
4788}
4789
24b4f38f
AU		 4790static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4791 u16 opcode)
4792{
4793 BT_DBG("status %d", status);
4794}
4795
1904a853
MH		 4796static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4797 u16 opcode)
4375f103
JH		 4798{
4799 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4800 struct hci_request req;
7816b820
FG		 4801 u8 instance;
4802 struct adv_info *adv_instance;
4803 int err;
4375f103 4804
3ad67582
JK		 4805 hci_dev_lock(hdev);
4806
4375f103
JH		 4807 if (status) {
4808 u8 mgmt_err = mgmt_status(status);
4809
4810 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4811 cmd_status_rsp, &mgmt_err);
3ad67582 4812 goto unlock;
4375f103
JH		 4813 }
4814
d7a5a11d 4815 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4816 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4817 else
a358dc11 4818 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4819
4375f103
JH		 4820 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4821 &match);
4822
4823 new_settings(hdev, match.sk);
4824
4825 if (match.sk)
4826 sock_put(match.sk);
3ad67582 4827
24b4f38f 4828 /* If "Set Advertising" was just disabled and instance advertising was
7816b820 4829 * set up earlier, then re-enable multi-instance advertising.
24b4f38f
AU		 4830 */
4831 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7816b820
FG		 4832 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4833 list_empty(&hdev->adv_instances))
24b4f38f
AU		 4834 goto unlock;
4835
7816b820
FG		 4836 instance = hdev->cur_adv_instance;
4837 if (!instance) {
4838 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4839 struct adv_info, list);
4840 if (!adv_instance)
4841 goto unlock;
4842
4843 instance = adv_instance->instance;
4844 }
4845
24b4f38f
AU		 4846 hci_req_init(&req, hdev);
4847
7816b820
FG		 4848 err = schedule_adv_instance(&req, instance, true);
4849
4850 if (!err)
4851 err = hci_req_run(&req, enable_advertising_instance);
24b4f38f 4852
7816b820 4853 if (err)
24b4f38f
AU		 4854 BT_ERR("Failed to re-configure advertising");
4855
3ad67582
JK		 4856unlock:
4857 hci_dev_unlock(hdev);
4375f103
JH		 4858}
4859
21b5187f
MH		 4860static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4861 u16 len)
4375f103
JH		 4862{
4863 struct mgmt_mode *cp = data;
3b0602cd 4864 struct mgmt_pending_cmd *cmd;
4375f103 4865 struct hci_request req;
cc91cb04 4866 u8 val, status;
4375f103
JH		 4867 int err;
4868
4869 BT_DBG("request for %s", hdev->name);
4870
e6fe7986
JH		 4871 status = mgmt_le_support(hdev);
4872 if (status)
a69e8375
JH		 4873 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4874 status);
4375f103 4875
cc91cb04 4876 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4878 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4879
4880 hci_dev_lock(hdev);
4881
4882 val = !!cp->val;
4375f103 4883
f74ca9b8
JH		 4884 /* The following conditions are ones which mean that we should
4885 * not do any HCI communication but directly send a mgmt
4886 * response to user space (after toggling the flag if
4887 * necessary).
4888 */
cc91cb04 4889 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4890 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4891 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4892 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4893 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4894 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4895 bool changed;
4375f103 4896
cc91cb04 4897 if (cp->val) {
238be788 4898 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4899 if (cp->val == 0x02)
a1536da2 4900 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4901 else
a358dc11 4902 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4903 } else {
a69d8927 4904 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4905 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4906 }
4907
4908 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4909 if (err < 0)
4910 goto unlock;
4911
4912 if (changed)
4913 err = new_settings(hdev, sk);
4914
4915 goto unlock;
4916 }
4917
333ae95d
JH		 4918 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4919 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4920 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4921 MGMT_STATUS_BUSY);
4375f103
JH		 4922 goto unlock;
4923 }
4924
4925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4926 if (!cmd) {
4927 err = -ENOMEM;
4928 goto unlock;
4929 }
4930
4931 hci_req_init(&req, hdev);
4932
cc91cb04 4933 if (cp->val == 0x02)
a1536da2 4934 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4935 else
a358dc11 4936 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4937
7816b820
FG		 4938 cancel_adv_timeout(hdev);
4939
24b4f38f 4940 if (val) {
7816b820
FG		 4941 /* Switch to instance "0" for the Set Advertising setting.
4942 * We cannot use update_[adv|scan_rsp]_data() here as the
4943 * HCI_ADVERTISING flag is not yet set.
4944 */
efae002c
FG		 4945 update_inst_adv_data(&req, 0x00);
4946 update_inst_scan_rsp_data(&req, 0x00);
bba3aa55 4947 enable_advertising(&req);
24b4f38f 4948 } else {
bba3aa55 4949 disable_advertising(&req);
24b4f38f 4950 }
4375f103
JH		 4951
4952 err = hci_req_run(&req, set_advertising_complete);
4953 if (err < 0)
4954 mgmt_pending_remove(cmd);
4955
4956unlock:
4957 hci_dev_unlock(hdev);
4958 return err;
4959}
4960
d13eafce
MH		 4961static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4962 void *data, u16 len)
4963{
4964 struct mgmt_cp_set_static_address *cp = data;
4965 int err;
4966
4967 BT_DBG("%s", hdev->name);
4968
62af4443 4969 if (!lmp_le_capable(hdev))
a69e8375
JH		 4970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4971 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4972
4973 if (hdev_is_powered(hdev))
a69e8375
JH		 4974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4975 MGMT_STATUS_REJECTED);
d13eafce
MH		 4976
4977 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4978 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4979 return mgmt_cmd_status(sk, hdev->id,
4980 MGMT_OP_SET_STATIC_ADDRESS,
4981 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4982
4983 /* Two most significant bits shall be set */
4984 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4985 return mgmt_cmd_status(sk, hdev->id,
4986 MGMT_OP_SET_STATIC_ADDRESS,
4987 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4988 }
4989
4990 hci_dev_lock(hdev);
4991
4992 bacpy(&hdev->static_addr, &cp->bdaddr);
4993
93690c22
MH		 4994 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4995 if (err < 0)
4996 goto unlock;
4997
4998 err = new_settings(hdev, sk);
d13eafce 4999
93690c22 5000unlock:
d13eafce 5001 hci_dev_unlock(hdev);
d13eafce
MH		 5002 return err;
5003}
5004
14b49b9a
MH		 5005static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5006 void *data, u16 len)
5007{
5008 struct mgmt_cp_set_scan_params *cp = data;
5009 __u16 interval, window;
5010 int err;
5011
5012 BT_DBG("%s", hdev->name);
5013
5014 if (!lmp_le_capable(hdev))
a69e8375
JH		 5015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5016 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 5017
5018 interval = __le16_to_cpu(cp->interval);
5019
5020 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 5021 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5022 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 5023
5024 window = __le16_to_cpu(cp->window);
5025
5026 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 5027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5028 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 5029
899e1075 5030 if (window > interval)
a69e8375
JH		 5031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5032 MGMT_STATUS_INVALID_PARAMS);
899e1075 5033
14b49b9a
MH		 5034 hci_dev_lock(hdev);
5035
5036 hdev->le_scan_interval = interval;
5037 hdev->le_scan_window = window;
5038
2a1afb5a
JH		 5039 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5040 NULL, 0);
14b49b9a 5041
dd2ef8e2
AG		 5042 /* If background scan is running, restart it so new parameters are
5043 * loaded.
5044 */
d7a5a11d 5045 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 5046 hdev->discovery.state == DISCOVERY_STOPPED) {
5047 struct hci_request req;
5048
5049 hci_req_init(&req, hdev);
5050
5051 hci_req_add_le_scan_disable(&req);
5052 hci_req_add_le_passive_scan(&req);
5053
5054 hci_req_run(&req, NULL);
5055 }
5056
14b49b9a
MH		 5057 hci_dev_unlock(hdev);
5058
5059 return err;
5060}
5061
1904a853
MH		 5062static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5063 u16 opcode)
33e38b3e 5064{
3b0602cd 5065 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 5066
5067 BT_DBG("status 0x%02x", status);
5068
5069 hci_dev_lock(hdev);
5070
333ae95d 5071 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 5072 if (!cmd)
5073 goto unlock;
5074
5075 if (status) {
a69e8375
JH		 5076 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5077 mgmt_status(status));
33e38b3e 5078 } else {
1a4d3c4b
JH		 5079 struct mgmt_mode *cp = cmd->param;
5080
5081 if (cp->val)
a1536da2 5082 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5083 else
a358dc11 5084 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5085
33e38b3e
JH		 5086 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5087 new_settings(hdev, cmd->sk);
5088 }
5089
5090 mgmt_pending_remove(cmd);
5091
5092unlock:
5093 hci_dev_unlock(hdev);
5094}
5095
bdb6d971 5096static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 5097 void *data, u16 len)
f6422ec6 5098{
650f726d 5099 struct mgmt_mode *cp = data;
3b0602cd 5100 struct mgmt_pending_cmd *cmd;
33e38b3e 5101 struct hci_request req;
f6422ec6
AJ		 5102 int err;
5103
bdb6d971 5104 BT_DBG("%s", hdev->name);
f6422ec6 5105
d7a5a11d 5106 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 5107 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 5108 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5109 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 5110
a7e80f25 5111 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5112 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5113 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 5114
f6422ec6
AJ		 5115 hci_dev_lock(hdev);
5116
333ae95d 5117 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 5118 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5119 MGMT_STATUS_BUSY);
05cbf29f
JH		 5120 goto unlock;
5121 }
5122
d7a5a11d 5123 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 5124 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5125 hdev);
5126 goto unlock;
5127 }
5128
406ef2a6 5129 if (!hdev_is_powered(hdev)) {
ce05d603 5130 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 5131 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5132 hdev);
5133 new_settings(hdev, sk);
5134 goto unlock;
5135 }
5136
33e38b3e
JH		 5137 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5138 data, len);
5139 if (!cmd) {
5140 err = -ENOMEM;
5141 goto unlock;
f6422ec6
AJ		 5142 }
5143
33e38b3e
JH		 5144 hci_req_init(&req, hdev);
5145
406d7804 5146 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 5147
5148 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 5149 if (err < 0) {
a69e8375
JH		 5150 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5151 MGMT_STATUS_FAILED);
33e38b3e 5152 mgmt_pending_remove(cmd);
f6422ec6
AJ		 5153 }
5154
33e38b3e 5155unlock:
f6422ec6 5156 hci_dev_unlock(hdev);
33e38b3e 5157
f6422ec6
AJ		 5158 return err;
5159}
5160
1904a853 5161static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 5162{
3b0602cd 5163 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5164
5165 BT_DBG("status 0x%02x", status);
5166
5167 hci_dev_lock(hdev);
5168
333ae95d 5169 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 5170 if (!cmd)
5171 goto unlock;
5172
5173 if (status) {
5174 u8 mgmt_err = mgmt_status(status);
5175
5176 /* We need to restore the flag if related HCI commands
5177 * failed.
5178 */
a358dc11 5179 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 5180
a69e8375 5181 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 5182 } else {
5183 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5184 new_settings(hdev, cmd->sk);
5185 }
5186
5187 mgmt_pending_remove(cmd);
5188
5189unlock:
5190 hci_dev_unlock(hdev);
5191}
5192
5193static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5194{
5195 struct mgmt_mode *cp = data;
3b0602cd 5196 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5197 struct hci_request req;
5198 int err;
5199
5200 BT_DBG("request for %s", hdev->name);
5201
5202 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 5203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5204 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 5205
d7a5a11d 5206 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5208 MGMT_STATUS_REJECTED);
0663ca2a
JH		 5209
5210 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5212 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 5213
5214 hci_dev_lock(hdev);
5215
d7a5a11d 5216 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5217 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5218 goto unlock;
5219 }
5220
5221 if (!hdev_is_powered(hdev)) {
5222 if (!cp->val) {
a358dc11
MH		 5223 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5224 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5225 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5226 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5227 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5228 }
5229
ce05d603 5230 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5231
5232 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5233 if (err < 0)
5234 goto unlock;
5235
5236 err = new_settings(hdev, sk);
5237 goto unlock;
5238 }
5239
5240 /* Reject disabling when powered on */
5241 if (!cp->val) {
a69e8375
JH		 5242 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5243 MGMT_STATUS_REJECTED);
0663ca2a 5244 goto unlock;
111e4bcc
MH		 5245 } else {
5246 /* When configuring a dual-mode controller to operate
5247 * with LE only and using a static address, then switching
5248 * BR/EDR back on is not allowed.
5249 *
5250 * Dual-mode controllers shall operate with the public
5251 * address as its identity address for BR/EDR and LE. So
5252 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5253 *
5254 * The same restrictions applies when secure connections
5255 * has been enabled. For BR/EDR this is a controller feature
5256 * while for LE it is a host stack feature. This means that
5257 * switching BR/EDR back on when secure connections has been
5258 * enabled is not a supported transaction.
111e4bcc 5259 */
d7a5a11d 5260 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5261 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5262 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5263 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5264 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5265 goto unlock;
5266 }
0663ca2a
JH		 5267 }
5268
333ae95d 5269 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5270 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5271 MGMT_STATUS_BUSY);
0663ca2a
JH		 5272 goto unlock;
5273 }
5274
5275 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5276 if (!cmd) {
5277 err = -ENOMEM;
5278 goto unlock;
5279 }
5280
5947f4bc 5281 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5282 * generates the correct flags.
5283 */
a1536da2 5284 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5285
5286 hci_req_init(&req, hdev);
aa8af46e 5287
432df05e 5288 write_fast_connectable(&req, false);
1d2dc5b7 5289 __hci_update_page_scan(&req);
aa8af46e 5290
f14d8f64
MH		 5291 /* Since only the advertising data flags will change, there
5292 * is no need to update the scan response data.
5293 */
5947f4bc 5294 update_adv_data(&req);
aa8af46e 5295
0663ca2a
JH		 5296 err = hci_req_run(&req, set_bredr_complete);
5297 if (err < 0)
5298 mgmt_pending_remove(cmd);
5299
5300unlock:
5301 hci_dev_unlock(hdev);
5302 return err;
5303}
5304
a1443f5a
JH		 5305static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5306{
3b0602cd 5307 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5308 struct mgmt_mode *cp;
5309
5310 BT_DBG("%s status %u", hdev->name, status);
5311
5312 hci_dev_lock(hdev);
5313
333ae95d 5314 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5315 if (!cmd)
5316 goto unlock;
5317
5318 if (status) {
a69e8375
JH		 5319 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5320 mgmt_status(status));
a1443f5a
JH		 5321 goto remove;
5322 }
5323
5324 cp = cmd->param;
5325
5326 switch (cp->val) {
5327 case 0x00:
a358dc11
MH		 5328 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5329 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5330 break;
5331 case 0x01:
a1536da2 5332 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5333 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5334 break;
5335 case 0x02:
a1536da2
MH		 5336 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5337 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5338 break;
5339 }
5340
5341 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5342 new_settings(hdev, cmd->sk);
5343
5344remove:
5345 mgmt_pending_remove(cmd);
5346unlock:
5347 hci_dev_unlock(hdev);
5348}
5349
eac83dc6
MH		 5350static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5351 void *data, u16 len)
5352{
5353 struct mgmt_mode *cp = data;
3b0602cd 5354 struct mgmt_pending_cmd *cmd;
a1443f5a 5355 struct hci_request req;
a3209694 5356 u8 val;
eac83dc6
MH		 5357 int err;
5358
5359 BT_DBG("request for %s", hdev->name);
5360
05b3c3e7 5361 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5362 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5364 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5365
d7a5a11d 5366 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5367 lmp_sc_capable(hdev) &&
d7a5a11d 5368 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5369 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5370 MGMT_STATUS_REJECTED);
ed93ec69 5371
0ab04a9c 5372 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5374 MGMT_STATUS_INVALID_PARAMS);
5375
5376 hci_dev_lock(hdev);
5377
05b3c3e7 5378 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5379 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5380 bool changed;
5381
0ab04a9c 5382 if (cp->val) {
238be788
MH		 5383 changed = !hci_dev_test_and_set_flag(hdev,
5384 HCI_SC_ENABLED);
0ab04a9c 5385 if (cp->val == 0x02)
a1536da2 5386 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5387 else
a358dc11 5388 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5389 } else {
a69d8927
MH		 5390 changed = hci_dev_test_and_clear_flag(hdev,
5391 HCI_SC_ENABLED);
a358dc11 5392 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5393 }
eac83dc6
MH		 5394
5395 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5396 if (err < 0)
5397 goto failed;
5398
5399 if (changed)
5400 err = new_settings(hdev, sk);
5401
5402 goto failed;
5403 }
5404
333ae95d 5405 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5406 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5407 MGMT_STATUS_BUSY);
eac83dc6
MH		 5408 goto failed;
5409 }
5410
0ab04a9c
MH		 5411 val = !!cp->val;
5412
d7a5a11d
MH		 5413 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5414 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5415 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5416 goto failed;
5417 }
5418
5419 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5420 if (!cmd) {
5421 err = -ENOMEM;
5422 goto failed;
5423 }
5424
a1443f5a
JH		 5425 hci_req_init(&req, hdev);
5426 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5427 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5428 if (err < 0) {
5429 mgmt_pending_remove(cmd);
5430 goto failed;
5431 }
5432
5433failed:
5434 hci_dev_unlock(hdev);
5435 return err;
5436}
5437
4e39ac81
MH		 5438static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5439 void *data, u16 len)
5440{
5441 struct mgmt_mode *cp = data;
b9710979 5442 bool changed, use_changed;
4e39ac81
MH		 5443 int err;
5444
5445 BT_DBG("request for %s", hdev->name);
5446
b9710979 5447 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5448 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5449 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5450
5451 hci_dev_lock(hdev);
5452
5453 if (cp->val)
238be788 5454 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5455 else
a69d8927
MH		 5456 changed = hci_dev_test_and_clear_flag(hdev,
5457 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5458
b9710979 5459 if (cp->val == 0x02)
238be788
MH		 5460 use_changed = !hci_dev_test_and_set_flag(hdev,
5461 HCI_USE_DEBUG_KEYS);
b9710979 5462 else
a69d8927
MH		 5463 use_changed = hci_dev_test_and_clear_flag(hdev,
5464 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5465
5466 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5467 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5468 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5469 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5470 sizeof(mode), &mode);
5471 }
5472
4e39ac81
MH		 5473 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5474 if (err < 0)
5475 goto unlock;
5476
5477 if (changed)
5478 err = new_settings(hdev, sk);
5479
5480unlock:
5481 hci_dev_unlock(hdev);
5482 return err;
5483}
5484
62b04cd1
JH		 5485static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5486 u16 len)
5487{
5488 struct mgmt_cp_set_privacy *cp = cp_data;
5489 bool changed;
5490 int err;
5491
5492 BT_DBG("request for %s", hdev->name);
5493
5494 if (!lmp_le_capable(hdev))
a69e8375
JH		 5495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5496 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5497
5498 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5499 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5500 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5501
5502 if (hdev_is_powered(hdev))
a69e8375
JH		 5503 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5504 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5505
5506 hci_dev_lock(hdev);
5507
c21c0ea0
JH		 5508 /* If user space supports this command it is also expected to
5509 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5510 */
a1536da2 5511 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5512
62b04cd1 5513 if (cp->privacy) {
238be788 5514 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5515 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5516 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5517 } else {
a69d8927 5518 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5519 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5520 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5521 }
5522
5523 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5524 if (err < 0)
5525 goto unlock;
5526
5527 if (changed)
5528 err = new_settings(hdev, sk);
5529
5530unlock:
5531 hci_dev_unlock(hdev);
5532 return err;
5533}
5534
41edf160
JH		 5535static bool irk_is_valid(struct mgmt_irk_info *irk)
5536{
5537 switch (irk->addr.type) {
5538 case BDADDR_LE_PUBLIC:
5539 return true;
5540
5541 case BDADDR_LE_RANDOM:
5542 /* Two most significant bits shall be set */
5543 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5544 return false;
5545 return true;
5546 }
5547
5548 return false;
5549}
5550
5551static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5552 u16 len)
5553{
5554 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5555 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5556 sizeof(struct mgmt_irk_info));
41edf160
JH		 5557 u16 irk_count, expected_len;
5558 int i, err;
5559
5560 BT_DBG("request for %s", hdev->name);
5561
5562 if (!lmp_le_capable(hdev))
a69e8375
JH		 5563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5564 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5565
5566 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5567 if (irk_count > max_irk_count) {
5568 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5570 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5571 }
41edf160
JH		 5572
5573 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5574 if (expected_len != len) {
5575 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5576 expected_len, len);
a69e8375
JH		 5577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5578 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5579 }
5580
5581 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5582
5583 for (i = 0; i < irk_count; i++) {
5584 struct mgmt_irk_info *key = &cp->irks[i];
5585
5586 if (!irk_is_valid(key))
a69e8375
JH		 5587 return mgmt_cmd_status(sk, hdev->id,
5588 MGMT_OP_LOAD_IRKS,
5589 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5590 }
5591
5592 hci_dev_lock(hdev);
5593
5594 hci_smp_irks_clear(hdev);
5595
5596 for (i = 0; i < irk_count; i++) {
5597 struct mgmt_irk_info *irk = &cp->irks[i];
5598 u8 addr_type;
5599
5600 if (irk->addr.type == BDADDR_LE_PUBLIC)
5601 addr_type = ADDR_LE_DEV_PUBLIC;
5602 else
5603 addr_type = ADDR_LE_DEV_RANDOM;
5604
5605 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5606 BDADDR_ANY);
5607 }
5608
a1536da2 5609 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5610
2a1afb5a 5611 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5612
5613 hci_dev_unlock(hdev);
5614
5615 return err;
5616}
5617
3f706b72
JH		 5618static bool ltk_is_valid(struct mgmt_ltk_info *key)
5619{
5620 if (key->master != 0x00 && key->master != 0x01)
5621 return false;
490cb0b3
MH		 5622
5623 switch (key->addr.type) {
5624 case BDADDR_LE_PUBLIC:
5625 return true;
5626
5627 case BDADDR_LE_RANDOM:
5628 /* Two most significant bits shall be set */
5629 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5630 return false;
5631 return true;
5632 }
5633
5634 return false;
3f706b72
JH		 5635}
5636
bdb6d971 5637static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5638 void *cp_data, u16 len)
346af67b 5639{
346af67b 5640 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5641 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5642 sizeof(struct mgmt_ltk_info));
346af67b 5643 u16 key_count, expected_len;
715a5bf2 5644 int i, err;
346af67b 5645
cf99ba13
MH		 5646 BT_DBG("request for %s", hdev->name);
5647
5648 if (!lmp_le_capable(hdev))
a69e8375
JH		 5649 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5650 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5651
1f350c87 5652 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5653 if (key_count > max_key_count) {
5654 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5655 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5656 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5657 }
346af67b
VCG		 5658
5659 expected_len = sizeof(*cp) + key_count *
5660 sizeof(struct mgmt_ltk_info);
5661 if (expected_len != len) {
5662 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5663 expected_len, len);
a69e8375
JH		 5664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5665 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5666 }
5667
bdb6d971 5668 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5669
54ad6d8a
JH		 5670 for (i = 0; i < key_count; i++) {
5671 struct mgmt_ltk_info *key = &cp->keys[i];
5672
3f706b72 5673 if (!ltk_is_valid(key))
a69e8375
JH		 5674 return mgmt_cmd_status(sk, hdev->id,
5675 MGMT_OP_LOAD_LONG_TERM_KEYS,
5676 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5677 }
5678
346af67b
VCG		 5679 hci_dev_lock(hdev);
5680
5681 hci_smp_ltks_clear(hdev);
5682
5683 for (i = 0; i < key_count; i++) {
5684 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5685 u8 type, addr_type, authenticated;
79d95a19
MH		 5686
5687 if (key->addr.type == BDADDR_LE_PUBLIC)
5688 addr_type = ADDR_LE_DEV_PUBLIC;
5689 else
5690 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5691
61b43357
JH		 5692 switch (key->type) {
5693 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5694 authenticated = 0x00;
23fb8de3 5695 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5696 break;
5697 case MGMT_LTK_AUTHENTICATED:
d7b25450 5698 authenticated = 0x01;
23fb8de3
JH		 5699 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5700 break;
5701 case MGMT_LTK_P256_UNAUTH:
5702 authenticated = 0x00;
5703 type = SMP_LTK_P256;
61b43357 5704 break;
23fb8de3
JH		 5705 case MGMT_LTK_P256_AUTH:
5706 authenticated = 0x01;
5707 type = SMP_LTK_P256;
61b43357 5708 break;
23fb8de3
JH		 5709 case MGMT_LTK_P256_DEBUG:
5710 authenticated = 0x00;
5711 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5712 default:
5713 continue;
5714 }
d7b25450 5715
35d70271 5716 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5717 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5718 key->rand);
346af67b
VCG		 5719 }
5720
2a1afb5a 5721 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5722 NULL, 0);
5723
346af67b 5724 hci_dev_unlock(hdev);
346af67b 5725
715a5bf2 5726 return err;
346af67b
VCG		 5727}
5728
3b0602cd 5729static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5730{
dd983808 5731 struct hci_conn *conn = cmd->user_data;
9981bdb0 5732 struct mgmt_rp_get_conn_info rp;
9df74653 5733 int err;
dd983808 5734
9981bdb0 5735 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5736
9981bdb0 5737 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5738 rp.rssi = conn->rssi;
9981bdb0
JH		 5739 rp.tx_power = conn->tx_power;
5740 rp.max_tx_power = conn->max_tx_power;
5741 } else {
5742 rp.rssi = HCI_RSSI_INVALID;
5743 rp.tx_power = HCI_TX_POWER_INVALID;
5744 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5745 }
5746
2a1afb5a
JH		 5747 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5748 status, &rp, sizeof(rp));
dd983808
AK		 5749
5750 hci_conn_drop(conn);
f8aaf9b6 5751 hci_conn_put(conn);
9df74653
JH		 5752
5753 return err;
dd983808
AK		 5754}
5755
1904a853
MH		 5756static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5757 u16 opcode)
dd983808
AK		 5758{
5759 struct hci_cp_read_rssi *cp;
3b0602cd 5760 struct mgmt_pending_cmd *cmd;
dd983808 5761 struct hci_conn *conn;
dd983808 5762 u16 handle;
9981bdb0 5763 u8 status;
dd983808 5764
9981bdb0 5765 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5766
5767 hci_dev_lock(hdev);
5768
dd983808
AK		 5769 /* Commands sent in request are either Read RSSI or Read Transmit Power
5770 * Level so we check which one was last sent to retrieve connection
5771 * handle. Both commands have handle as first parameter so it's safe to
5772 * cast data on the same command struct.
5773 *
5774 * First command sent is always Read RSSI and we fail only if it fails.
5775 * In other case we simply override error to indicate success as we
5776 * already remembered if TX power value is actually valid.
5777 */
5778 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5779 if (!cp) {
5780 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5781 status = MGMT_STATUS_SUCCESS;
5782 } else {
5783 status = mgmt_status(hci_status);
dd983808
AK		 5784 }
5785
5786 if (!cp) {
9981bdb0 5787 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5788 goto unlock;
5789 }
5790
5791 handle = __le16_to_cpu(cp->handle);
5792 conn = hci_conn_hash_lookup_handle(hdev, handle);
5793 if (!conn) {
9981bdb0 5794 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5795 goto unlock;
5796 }
5797
333ae95d 5798 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5799 if (!cmd)
5800 goto unlock;
dd983808 5801
9981bdb0
JH		 5802 cmd->cmd_complete(cmd, status);
5803 mgmt_pending_remove(cmd);
dd983808
AK		 5804
5805unlock:
5806 hci_dev_unlock(hdev);
5807}
5808
5809static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5810 u16 len)
5811{
5812 struct mgmt_cp_get_conn_info *cp = data;
5813 struct mgmt_rp_get_conn_info rp;
5814 struct hci_conn *conn;
5815 unsigned long conn_info_age;
5816 int err = 0;
5817
5818 BT_DBG("%s", hdev->name);
5819
5820 memset(&rp, 0, sizeof(rp));
5821 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5822 rp.addr.type = cp->addr.type;
5823
5824 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5825 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5826 MGMT_STATUS_INVALID_PARAMS,
5827 &rp, sizeof(rp));
dd983808
AK		 5828
5829 hci_dev_lock(hdev);
5830
5831 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5832 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5833 MGMT_STATUS_NOT_POWERED, &rp,
5834 sizeof(rp));
dd983808
AK		 5835 goto unlock;
5836 }
5837
5838 if (cp->addr.type == BDADDR_BREDR)
5839 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5840 &cp->addr.bdaddr);
5841 else
5842 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5843
5844 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5845 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5846 MGMT_STATUS_NOT_CONNECTED, &rp,
5847 sizeof(rp));
dd983808
AK		 5848 goto unlock;
5849 }
5850
333ae95d 5851 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5852 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5853 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5854 goto unlock;
5855 }
5856
dd983808
AK		 5857 /* To avoid client trying to guess when to poll again for information we
5858 * calculate conn info age as random value between min/max set in hdev.
5859 */
5860 conn_info_age = hdev->conn_info_min_age +
5861 prandom_u32_max(hdev->conn_info_max_age -
5862 hdev->conn_info_min_age);
5863
5864 /* Query controller to refresh cached values if they are too old or were
5865 * never read.
5866 */
f4e2dd53
AK		 5867 if (time_after(jiffies, conn->conn_info_timestamp +
5868 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5869 !conn->conn_info_timestamp) {
5870 struct hci_request req;
5871 struct hci_cp_read_tx_power req_txp_cp;
5872 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5873 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5874
5875 hci_req_init(&req, hdev);
5876 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5877 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5878 &req_rssi_cp);
5879
f7faab0c
AK		 5880 /* For LE links TX power does not change thus we don't need to
5881 * query for it once value is known.
5882 */
5883 if (!bdaddr_type_is_le(cp->addr.type) ||
5884 conn->tx_power == HCI_TX_POWER_INVALID) {
5885 req_txp_cp.handle = cpu_to_le16(conn->handle);
5886 req_txp_cp.type = 0x00;
5887 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5888 sizeof(req_txp_cp), &req_txp_cp);
5889 }
dd983808 5890
eed5daf3
AK		 5891 /* Max TX power needs to be read only once per connection */
5892 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5893 req_txp_cp.handle = cpu_to_le16(conn->handle);
5894 req_txp_cp.type = 0x01;
5895 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5896 sizeof(req_txp_cp), &req_txp_cp);
5897 }
5898
dd983808
AK		 5899 err = hci_req_run(&req, conn_info_refresh_complete);
5900 if (err < 0)
5901 goto unlock;
5902
5903 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5904 data, len);
5905 if (!cmd) {
5906 err = -ENOMEM;
5907 goto unlock;
5908 }
5909
5910 hci_conn_hold(conn);
f8aaf9b6 5911 cmd->user_data = hci_conn_get(conn);
9981bdb0 5912 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5913
5914 conn->conn_info_timestamp = jiffies;
5915 } else {
5916 /* Cache is valid, just reply with values cached in hci_conn */
5917 rp.rssi = conn->rssi;
5918 rp.tx_power = conn->tx_power;
eed5daf3 5919 rp.max_tx_power = conn->max_tx_power;
dd983808 5920
2a1afb5a
JH		 5921 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5922 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5923 }
5924
5925unlock:
5926 hci_dev_unlock(hdev);
5927 return err;
5928}
5929
3b0602cd 5930static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5931{
69487371 5932 struct hci_conn *conn = cmd->user_data;
95868426 5933 struct mgmt_rp_get_clock_info rp;
69487371 5934 struct hci_dev *hdev;
9df74653 5935 int err;
69487371
JH		 5936
5937 memset(&rp, 0, sizeof(rp));
5938 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5939
5940 if (status)
5941 goto complete;
5942
5943 hdev = hci_dev_get(cmd->index);
5944 if (hdev) {
5945 rp.local_clock = cpu_to_le32(hdev->clock);
5946 hci_dev_put(hdev);
5947 }
5948
5949 if (conn) {
5950 rp.piconet_clock = cpu_to_le32(conn->clock);
5951 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5952 }
5953
5954complete:
2a1afb5a
JH		 5955 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5956 sizeof(rp));
69487371
JH		 5957
5958 if (conn) {
5959 hci_conn_drop(conn);
5960 hci_conn_put(conn);
5961 }
9df74653
JH		 5962
5963 return err;
69487371
JH		 5964}
5965
1904a853 5966static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5967{
95868426 5968 struct hci_cp_read_clock *hci_cp;
3b0602cd 5969 struct mgmt_pending_cmd *cmd;
95868426
JH		 5970 struct hci_conn *conn;
5971
5972 BT_DBG("%s status %u", hdev->name, status);
5973
5974 hci_dev_lock(hdev);
5975
5976 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5977 if (!hci_cp)
5978 goto unlock;
5979
5980 if (hci_cp->which) {
5981 u16 handle = __le16_to_cpu(hci_cp->handle);
5982 conn = hci_conn_hash_lookup_handle(hdev, handle);
5983 } else {
5984 conn = NULL;
5985 }
5986
333ae95d 5987 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5988 if (!cmd)
5989 goto unlock;
5990
69487371 5991 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5992 mgmt_pending_remove(cmd);
95868426
JH		 5993
5994unlock:
5995 hci_dev_unlock(hdev);
5996}
5997
5998static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5999 u16 len)
6000{
6001 struct mgmt_cp_get_clock_info *cp = data;
6002 struct mgmt_rp_get_clock_info rp;
6003 struct hci_cp_read_clock hci_cp;
3b0602cd 6004 struct mgmt_pending_cmd *cmd;
95868426
JH		 6005 struct hci_request req;
6006 struct hci_conn *conn;
6007 int err;
6008
6009 BT_DBG("%s", hdev->name);
6010
6011 memset(&rp, 0, sizeof(rp));
6012 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6013 rp.addr.type = cp->addr.type;
6014
6015 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 6016 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6017 MGMT_STATUS_INVALID_PARAMS,
6018 &rp, sizeof(rp));
95868426
JH		 6019
6020 hci_dev_lock(hdev);
6021
6022 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 6023 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6024 MGMT_STATUS_NOT_POWERED, &rp,
6025 sizeof(rp));
95868426
JH		 6026 goto unlock;
6027 }
6028
6029 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6030 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6031 &cp->addr.bdaddr);
6032 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 6033 err = mgmt_cmd_complete(sk, hdev->id,
6034 MGMT_OP_GET_CLOCK_INFO,
6035 MGMT_STATUS_NOT_CONNECTED,
6036 &rp, sizeof(rp));
95868426
JH		 6037 goto unlock;
6038 }
6039 } else {
6040 conn = NULL;
6041 }
6042
6043 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6044 if (!cmd) {
6045 err = -ENOMEM;
6046 goto unlock;
6047 }
6048
69487371
JH		 6049 cmd->cmd_complete = clock_info_cmd_complete;
6050
95868426
JH		 6051 hci_req_init(&req, hdev);
6052
6053 memset(&hci_cp, 0, sizeof(hci_cp));
6054 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6055
6056 if (conn) {
6057 hci_conn_hold(conn);
f8aaf9b6 6058 cmd->user_data = hci_conn_get(conn);
95868426
JH		 6059
6060 hci_cp.handle = cpu_to_le16(conn->handle);
6061 hci_cp.which = 0x01; /* Piconet clock */
6062 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6063 }
6064
6065 err = hci_req_run(&req, get_clock_info_complete);
6066 if (err < 0)
6067 mgmt_pending_remove(cmd);
6068
6069unlock:
6070 hci_dev_unlock(hdev);
6071 return err;
6072}
6073
5a154e6f
JH		 6074static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6075{
6076 struct hci_conn *conn;
6077
6078 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6079 if (!conn)
6080 return false;
6081
6082 if (conn->dst_type != type)
6083 return false;
6084
6085 if (conn->state != BT_CONNECTED)
6086 return false;
6087
6088 return true;
6089}
6090
6091/* This function requires the caller holds hdev->lock */
6092static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6093 u8 addr_type, u8 auto_connect)
6094{
6095 struct hci_dev *hdev = req->hdev;
6096 struct hci_conn_params *params;
6097
6098 params = hci_conn_params_add(hdev, addr, addr_type);
6099 if (!params)
6100 return -EIO;
6101
6102 if (params->auto_connect == auto_connect)
6103 return 0;
6104
6105 list_del_init(&params->action);
6106
6107 switch (auto_connect) {
6108 case HCI_AUTO_CONN_DISABLED:
6109 case HCI_AUTO_CONN_LINK_LOSS:
28a667c9
JP		 6110 /* If auto connect is being disabled when we're trying to
6111 * connect to device, keep connecting.
6112 */
6113 if (params->explicit_connect)
6114 list_add(&params->action, &hdev->pend_le_conns);
6115
5a154e6f
JH		 6116 __hci_update_background_scan(req);
6117 break;
6118 case HCI_AUTO_CONN_REPORT:
6119 list_add(&params->action, &hdev->pend_le_reports);
6120 __hci_update_background_scan(req);
6121 break;
6122 case HCI_AUTO_CONN_DIRECT:
6123 case HCI_AUTO_CONN_ALWAYS:
6124 if (!is_connected(hdev, addr, addr_type)) {
6125 list_add(&params->action, &hdev->pend_le_conns);
6126 __hci_update_background_scan(req);
6127 }
6128 break;
6129 }
6130
6131 params->auto_connect = auto_connect;
6132
6133 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6134 auto_connect);
6135
6136 return 0;
6137}
6138
8afef092
MH		 6139static void device_added(struct sock *sk, struct hci_dev *hdev,
6140 bdaddr_t *bdaddr, u8 type, u8 action)
6141{
6142 struct mgmt_ev_device_added ev;
6143
6144 bacpy(&ev.addr.bdaddr, bdaddr);
6145 ev.addr.type = type;
6146 ev.action = action;
6147
6148 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6149}
6150
1904a853 6151static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 6152{
3b0602cd 6153 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 6154
6155 BT_DBG("status 0x%02x", status);
6156
6157 hci_dev_lock(hdev);
6158
333ae95d 6159 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 6160 if (!cmd)
6161 goto unlock;
6162
6163 cmd->cmd_complete(cmd, mgmt_status(status));
6164 mgmt_pending_remove(cmd);
6165
6166unlock:
6167 hci_dev_unlock(hdev);
6168}
6169
2faade53
MH		 6170static int add_device(struct sock *sk, struct hci_dev *hdev,
6171 void *data, u16 len)
6172{
6173 struct mgmt_cp_add_device *cp = data;
3b0602cd 6174 struct mgmt_pending_cmd *cmd;
5a154e6f 6175 struct hci_request req;
2faade53
MH		 6176 u8 auto_conn, addr_type;
6177 int err;
6178
6179 BT_DBG("%s", hdev->name);
6180
6659358e 6181 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 6182 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 6183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6184 MGMT_STATUS_INVALID_PARAMS,
6185 &cp->addr, sizeof(cp->addr));
2faade53 6186
4b9e7e75 6187 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 6188 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6189 MGMT_STATUS_INVALID_PARAMS,
6190 &cp->addr, sizeof(cp->addr));
2faade53 6191
5a154e6f
JH		 6192 hci_req_init(&req, hdev);
6193
2faade53
MH		 6194 hci_dev_lock(hdev);
6195
5a154e6f
JH		 6196 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6197 if (!cmd) {
6198 err = -ENOMEM;
6199 goto unlock;
6200 }
6201
6202 cmd->cmd_complete = addr_cmd_complete;
6203
6659358e 6204 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 6205 /* Only incoming connections action is supported for now */
6659358e 6206 if (cp->action != 0x01) {
9df74653
JH		 6207 err = cmd->cmd_complete(cmd,
6208 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 6209 mgmt_pending_remove(cmd);
6659358e
JH		 6210 goto unlock;
6211 }
6212
6213 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6214 cp->addr.type);
6215 if (err)
6216 goto unlock;
a397407f 6217
5a154e6f 6218 __hci_update_page_scan(&req);
a397407f 6219
6659358e
JH		 6220 goto added;
6221 }
6222
2faade53
MH		 6223 if (cp->addr.type == BDADDR_LE_PUBLIC)
6224 addr_type = ADDR_LE_DEV_PUBLIC;
6225 else
6226 addr_type = ADDR_LE_DEV_RANDOM;
6227
4b9e7e75 6228 if (cp->action == 0x02)
2faade53 6229 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6230 else if (cp->action == 0x01)
6231 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6232 else
a3451d27 6233 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6234
9a0a8a8e
JP		 6235 /* Kernel internally uses conn_params with resolvable private
6236 * address, but Add Device allows only identity addresses.
6237 * Make sure it is enforced before calling
6238 * hci_conn_params_lookup.
6239 */
6240 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6241 err = cmd->cmd_complete(cmd, MGMT_STATUS_INVALID_PARAMS);
6242 mgmt_pending_remove(cmd);
6243 goto unlock;
6244 }
6245
bf5b3c8b
MH		 6246 /* If the connection parameters don't exist for this device,
6247 * they will be created and configured with defaults.
6248 */
5a154e6f 6249 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6250 auto_conn) < 0) {
9df74653 6251 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6252 mgmt_pending_remove(cmd);
2faade53
MH		 6253 goto unlock;
6254 }
6255
6659358e 6256added:
8afef092
MH		 6257 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6258
5a154e6f
JH		 6259 err = hci_req_run(&req, add_device_complete);
6260 if (err < 0) {
6261 /* ENODATA means no HCI commands were needed (e.g. if
6262 * the adapter is powered off).
6263 */
9df74653
JH		 6264 if (err == -ENODATA)
6265 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6266 mgmt_pending_remove(cmd);
6267 }
2faade53
MH		 6268
6269unlock:
6270 hci_dev_unlock(hdev);
6271 return err;
6272}
6273
8afef092
MH		 6274static void device_removed(struct sock *sk, struct hci_dev *hdev,
6275 bdaddr_t *bdaddr, u8 type)
6276{
6277 struct mgmt_ev_device_removed ev;
6278
6279 bacpy(&ev.addr.bdaddr, bdaddr);
6280 ev.addr.type = type;
6281
6282 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6283}
6284
1904a853 6285static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6286{
3b0602cd 6287 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6288
6289 BT_DBG("status 0x%02x", status);
6290
6291 hci_dev_lock(hdev);
6292
333ae95d 6293 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6294 if (!cmd)
6295 goto unlock;
6296
6297 cmd->cmd_complete(cmd, mgmt_status(status));
6298 mgmt_pending_remove(cmd);
6299
6300unlock:
6301 hci_dev_unlock(hdev);
6302}
6303
2faade53
MH		 6304static int remove_device(struct sock *sk, struct hci_dev *hdev,
6305 void *data, u16 len)
6306{
6307 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6308 struct mgmt_pending_cmd *cmd;
51ef3ebe 6309 struct hci_request req;
2faade53
MH		 6310 int err;
6311
6312 BT_DBG("%s", hdev->name);
6313
51ef3ebe
JH		 6314 hci_req_init(&req, hdev);
6315
2faade53
MH		 6316 hci_dev_lock(hdev);
6317
51ef3ebe
JH		 6318 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6319 if (!cmd) {
6320 err = -ENOMEM;
6321 goto unlock;
6322 }
6323
6324 cmd->cmd_complete = addr_cmd_complete;
6325
2faade53 6326 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6327 struct hci_conn_params *params;
2faade53
MH		 6328 u8 addr_type;
6329
6659358e 6330 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6331 err = cmd->cmd_complete(cmd,
6332 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6333 mgmt_pending_remove(cmd);
2faade53
MH		 6334 goto unlock;
6335 }
6336
6659358e
JH		 6337 if (cp->addr.type == BDADDR_BREDR) {
6338 err = hci_bdaddr_list_del(&hdev->whitelist,
6339 &cp->addr.bdaddr,
6340 cp->addr.type);
6341 if (err) {
9df74653
JH		 6342 err = cmd->cmd_complete(cmd,
6343 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6344 mgmt_pending_remove(cmd);
6659358e
JH		 6345 goto unlock;
6346 }
6347
51ef3ebe 6348 __hci_update_page_scan(&req);
a397407f 6349
6659358e
JH		 6350 device_removed(sk, hdev, &cp->addr.bdaddr,
6351 cp->addr.type);
6352 goto complete;
6353 }
6354
2faade53
MH		 6355 if (cp->addr.type == BDADDR_LE_PUBLIC)
6356 addr_type = ADDR_LE_DEV_PUBLIC;
6357 else
6358 addr_type = ADDR_LE_DEV_RANDOM;
6359
9a0a8a8e
JP		 6360 /* Kernel internally uses conn_params with resolvable private
6361 * address, but Remove Device allows only identity addresses.
6362 * Make sure it is enforced before calling
6363 * hci_conn_params_lookup.
6364 */
6365 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6366 err = cmd->cmd_complete(cmd,
6367 MGMT_STATUS_INVALID_PARAMS);
6368 mgmt_pending_remove(cmd);
6369 goto unlock;
6370 }
6371
c71593dd
JH		 6372 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6373 addr_type);
6374 if (!params) {
9df74653
JH		 6375 err = cmd->cmd_complete(cmd,
6376 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6377 mgmt_pending_remove(cmd);
c71593dd
JH		 6378 goto unlock;
6379 }
6380
6381 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 6382 err = cmd->cmd_complete(cmd,
6383 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6384 mgmt_pending_remove(cmd);
c71593dd
JH		 6385 goto unlock;
6386 }
6387
d1dbf12e 6388 list_del(&params->action);
c71593dd
JH		 6389 list_del(&params->list);
6390 kfree(params);
51ef3ebe 6391 __hci_update_background_scan(&req);
8afef092
MH		 6392
6393 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6394 } else {
19de0825 6395 struct hci_conn_params *p, *tmp;
6659358e 6396 struct bdaddr_list *b, *btmp;
19de0825 6397
2faade53 6398 if (cp->addr.type) {
9df74653
JH		 6399 err = cmd->cmd_complete(cmd,
6400 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6401 mgmt_pending_remove(cmd);
2faade53
MH		 6402 goto unlock;
6403 }
6404
6659358e
JH		 6405 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6406 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6407 list_del(&b->list);
6408 kfree(b);
6409 }
6410
51ef3ebe 6411 __hci_update_page_scan(&req);
a397407f 6412
19de0825
JH		 6413 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6414 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6415 continue;
6416 device_removed(sk, hdev, &p->addr, p->addr_type);
6417 list_del(&p->action);
6418 list_del(&p->list);
6419 kfree(p);
6420 }
6421
6422 BT_DBG("All LE connection parameters were removed");
6423
51ef3ebe 6424 __hci_update_background_scan(&req);
2faade53
MH		 6425 }
6426
6659358e 6427complete:
51ef3ebe
JH		 6428 err = hci_req_run(&req, remove_device_complete);
6429 if (err < 0) {
6430 /* ENODATA means no HCI commands were needed (e.g. if
6431 * the adapter is powered off).
6432 */
9df74653
JH		 6433 if (err == -ENODATA)
6434 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6435 mgmt_pending_remove(cmd);
6436 }
2faade53
MH		 6437
6438unlock:
6439 hci_dev_unlock(hdev);
6440 return err;
6441}
6442
a26f3dcf
JH		 6443static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6444 u16 len)
6445{
6446 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6447 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6448 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6449 u16 param_count, expected_len;
6450 int i;
6451
6452 if (!lmp_le_capable(hdev))
a69e8375
JH		 6453 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6454 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6455
6456 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6457 if (param_count > max_param_count) {
6458 BT_ERR("load_conn_param: too big param_count value %u",
6459 param_count);
a69e8375
JH		 6460 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6461 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6462 }
a26f3dcf
JH		 6463
6464 expected_len = sizeof(*cp) + param_count *
6465 sizeof(struct mgmt_conn_param);
6466 if (expected_len != len) {
6467 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6468 expected_len, len);
a69e8375
JH		 6469 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6470 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6471 }
6472
6473 BT_DBG("%s param_count %u", hdev->name, param_count);
6474
6475 hci_dev_lock(hdev);
6476
6477 hci_conn_params_clear_disabled(hdev);
6478
6479 for (i = 0; i < param_count; i++) {
6480 struct mgmt_conn_param *param = &cp->params[i];
6481 struct hci_conn_params *hci_param;
6482 u16 min, max, latency, timeout;
6483 u8 addr_type;
6484
6485 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6486 param->addr.type);
6487
6488 if (param->addr.type == BDADDR_LE_PUBLIC) {
6489 addr_type = ADDR_LE_DEV_PUBLIC;
6490 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6491 addr_type = ADDR_LE_DEV_RANDOM;
6492 } else {
6493 BT_ERR("Ignoring invalid connection parameters");
6494 continue;
6495 }
6496
6497 min = le16_to_cpu(param->min_interval);
6498 max = le16_to_cpu(param->max_interval);
6499 latency = le16_to_cpu(param->latency);
6500 timeout = le16_to_cpu(param->timeout);
6501
6502 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6503 min, max, latency, timeout);
6504
6505 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6506 BT_ERR("Ignoring invalid connection parameters");
6507 continue;
6508 }
6509
6510 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6511 addr_type);
6512 if (!hci_param) {
6513 BT_ERR("Failed to add connection parameters");
6514 continue;
6515 }
6516
6517 hci_param->conn_min_interval = min;
6518 hci_param->conn_max_interval = max;
6519 hci_param->conn_latency = latency;
6520 hci_param->supervision_timeout = timeout;
6521 }
6522
6523 hci_dev_unlock(hdev);
6524
2a1afb5a
JH		 6525 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6526 NULL, 0);
a26f3dcf
JH		 6527}
6528
dbece37a
MH		 6529static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6530 void *data, u16 len)
6531{
6532 struct mgmt_cp_set_external_config *cp = data;
6533 bool changed;
6534 int err;
6535
6536 BT_DBG("%s", hdev->name);
6537
6538 if (hdev_is_powered(hdev))
a69e8375
JH		 6539 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6540 MGMT_STATUS_REJECTED);
dbece37a
MH		 6541
6542 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6543 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6544 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6545
6546 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6547 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6548 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6549
6550 hci_dev_lock(hdev);
6551
6552 if (cp->config)
238be788 6553 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6554 else
a69d8927 6555 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6556
6557 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6558 if (err < 0)
6559 goto unlock;
6560
6561 if (!changed)
6562 goto unlock;
6563
f4537c04
MH		 6564 err = new_options(hdev, sk);
6565
d7a5a11d 6566 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6567 mgmt_index_removed(hdev);
d603b76b 6568
516018a9 6569 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6570 hci_dev_set_flag(hdev, HCI_CONFIG);
6571 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6572
6573 queue_work(hdev->req_workqueue, &hdev->power_on);
6574 } else {
5ea234d3 6575 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6576 mgmt_index_added(hdev);
6577 }
dbece37a
MH		 6578 }
6579
6580unlock:
6581 hci_dev_unlock(hdev);
6582 return err;
6583}
6584
9713c17b
MH		 6585static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6586 void *data, u16 len)
6587{
6588 struct mgmt_cp_set_public_address *cp = data;
6589 bool changed;
6590 int err;
6591
6592 BT_DBG("%s", hdev->name);
6593
6594 if (hdev_is_powered(hdev))
a69e8375
JH		 6595 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6596 MGMT_STATUS_REJECTED);
9713c17b
MH		 6597
6598 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6599 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6600 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6601
6602 if (!hdev->set_bdaddr)
a69e8375
JH		 6603 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6604 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6605
6606 hci_dev_lock(hdev);
6607
6608 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6609 bacpy(&hdev->public_addr, &cp->bdaddr);
6610
6611 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6612 if (err < 0)
6613 goto unlock;
6614
6615 if (!changed)
6616 goto unlock;
6617
d7a5a11d 6618 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6619 err = new_options(hdev, sk);
6620
6621 if (is_configured(hdev)) {
6622 mgmt_index_removed(hdev);
6623
a358dc11 6624 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6625
a1536da2
MH		 6626 hci_dev_set_flag(hdev, HCI_CONFIG);
6627 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6628
6629 queue_work(hdev->req_workqueue, &hdev->power_on);
6630 }
6631
6632unlock:
6633 hci_dev_unlock(hdev);
6634 return err;
6635}
6636
bea41609
MH		 6637static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6638 u8 data_len)
6639{
6640 eir[eir_len++] = sizeof(type) + data_len;
6641 eir[eir_len++] = type;
6642 memcpy(&eir[eir_len], data, data_len);
6643 eir_len += data_len;
6644
6645 return eir_len;
6646}
6647
40f66c05
JH		 6648static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6649 u16 opcode, struct sk_buff *skb)
6650{
6651 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6652 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6653 u8 *h192, *r192, *h256, *r256;
6654 struct mgmt_pending_cmd *cmd;
6655 u16 eir_len;
6656 int err;
6657
6658 BT_DBG("%s status %u", hdev->name, status);
6659
6660 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6661 if (!cmd)
6662 return;
6663
6664 mgmt_cp = cmd->param;
6665
6666 if (status) {
6667 status = mgmt_status(status);
6668 eir_len = 0;
6669
6670 h192 = NULL;
6671 r192 = NULL;
6672 h256 = NULL;
6673 r256 = NULL;
6674 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6675 struct hci_rp_read_local_oob_data *rp;
6676
6677 if (skb->len != sizeof(*rp)) {
6678 status = MGMT_STATUS_FAILED;
6679 eir_len = 0;
6680 } else {
6681 status = MGMT_STATUS_SUCCESS;
6682 rp = (void *)skb->data;
6683
6684 eir_len = 5 + 18 + 18;
6685 h192 = rp->hash;
6686 r192 = rp->rand;
6687 h256 = NULL;
6688 r256 = NULL;
6689 }
6690 } else {
6691 struct hci_rp_read_local_oob_ext_data *rp;
6692
6693 if (skb->len != sizeof(*rp)) {
6694 status = MGMT_STATUS_FAILED;
6695 eir_len = 0;
6696 } else {
6697 status = MGMT_STATUS_SUCCESS;
6698 rp = (void *)skb->data;
6699
6700 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6701 eir_len = 5 + 18 + 18;
6702 h192 = NULL;
6703 r192 = NULL;
6704 } else {
6705 eir_len = 5 + 18 + 18 + 18 + 18;
6706 h192 = rp->hash192;
6707 r192 = rp->rand192;
6708 }
6709
6710 h256 = rp->hash256;
6711 r256 = rp->rand256;
6712 }
6713 }
6714
6715 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6716 if (!mgmt_rp)
6717 goto done;
6718
6719 if (status)
6720 goto send_rsp;
6721
6722 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6723 hdev->dev_class, 3);
6724
6725 if (h192 && r192) {
6726 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6727 EIR_SSP_HASH_C192, h192, 16);
6728 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6729 EIR_SSP_RAND_R192, r192, 16);
6730 }
6731
6732 if (h256 && r256) {
6733 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6734 EIR_SSP_HASH_C256, h256, 16);
6735 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6736 EIR_SSP_RAND_R256, r256, 16);
6737 }
6738
6739send_rsp:
6740 mgmt_rp->type = mgmt_cp->type;
6741 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6742
6743 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6744 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6745 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6746 if (err < 0 || status)
6747 goto done;
6748
6749 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6750
6751 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6752 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6753 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6754done:
6755 kfree(mgmt_rp);
6756 mgmt_pending_remove(cmd);
6757}
6758
6759static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6760 struct mgmt_cp_read_local_oob_ext_data *cp)
6761{
6762 struct mgmt_pending_cmd *cmd;
6763 struct hci_request req;
6764 int err;
6765
6766 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6767 cp, sizeof(*cp));
6768 if (!cmd)
6769 return -ENOMEM;
6770
6771 hci_req_init(&req, hdev);
6772
6773 if (bredr_sc_enabled(hdev))
6774 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6775 else
6776 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6777
6778 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6779 if (err < 0) {
6780 mgmt_pending_remove(cmd);
6781 return err;
6782 }
6783
6784 return 0;
6785}
6786
4f0f155c
MH		 6787static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6788 void *data, u16 data_len)
6789{
6790 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6791 struct mgmt_rp_read_local_oob_ext_data *rp;
6792 size_t rp_len;
6793 u16 eir_len;
0821a2c5 6794 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6795 int err;
6796
6797 BT_DBG("%s", hdev->name);
6798
57b0d3e8
MH		 6799 if (hdev_is_powered(hdev)) {
6800 switch (cp->type) {
6801 case BIT(BDADDR_BREDR):
6802 status = mgmt_bredr_support(hdev);
6803 if (status)
6804 eir_len = 0;
6805 else
6806 eir_len = 5;
6807 break;
6808 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6809 status = mgmt_le_support(hdev);
6810 if (status)
6811 eir_len = 0;
6812 else
6813 eir_len = 9 + 3 + 18 + 18 + 3;
6814 break;
6815 default:
6816 status = MGMT_STATUS_INVALID_PARAMS;
6817 eir_len = 0;
6818 break;
6819 }
6820 } else {
6821 status = MGMT_STATUS_NOT_POWERED;
6822 eir_len = 0;
4f0f155c
MH		 6823 }
6824
4f0f155c
MH		 6825 rp_len = sizeof(*rp) + eir_len;
6826 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 6827 if (!rp)
4f0f155c 6828 return -ENOMEM;
efcd8c98 6829
57b0d3e8
MH		 6830 if (status)
6831 goto complete;
6832
efcd8c98 6833 hci_dev_lock(hdev);
4f0f155c
MH		 6834
6835 eir_len = 0;
6836 switch (cp->type) {
6837 case BIT(BDADDR_BREDR):
40f66c05
JH		 6838 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6839 err = read_local_ssp_oob_req(hdev, sk, cp);
6840 hci_dev_unlock(hdev);
6841 if (!err)
6842 goto done;
6843
6844 status = MGMT_STATUS_FAILED;
6845 goto complete;
6846 } else {
6847 eir_len = eir_append_data(rp->eir, eir_len,
6848 EIR_CLASS_OF_DEV,
6849 hdev->dev_class, 3);
6850 }
4f0f155c
MH		 6851 break;
6852 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6853 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6854 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 6855 hci_dev_unlock(hdev);
57b0d3e8
MH		 6856 status = MGMT_STATUS_FAILED;
6857 goto complete;
0821a2c5
MH		 6858 }
6859
e213568a
MH		 6860 /* This should return the active RPA, but since the RPA
6861 * is only programmed on demand, it is really hard to fill
6862 * this in at the moment. For now disallow retrieving
6863 * local out-of-band data when privacy is in use.
6864 *
6865 * Returning the identity address will not help here since
6866 * pairing happens before the identity resolving key is
6867 * known and thus the connection establishment happens
6868 * based on the RPA and not the identity address.
6869 */
4f0f155c 6870 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
e213568a
MH		 6871 hci_dev_unlock(hdev);
6872 status = MGMT_STATUS_REJECTED;
6873 goto complete;
6874 }
6875
6876 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6877 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6878 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6879 bacmp(&hdev->static_addr, BDADDR_ANY))) {
4f0f155c
MH		 6880 memcpy(addr, &hdev->static_addr, 6);
6881 addr[6] = 0x01;
6882 } else {
6883 memcpy(addr, &hdev->bdaddr, 6);
6884 addr[6] = 0x00;
6885 }
6886
6887 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6888 addr, sizeof(addr));
6889
6890 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6891 role = 0x02;
6892 else
6893 role = 0x01;
6894
6895 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6896 &role, sizeof(role));
6897
5082a599
MH		 6898 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6899 eir_len = eir_append_data(rp->eir, eir_len,
6900 EIR_LE_SC_CONFIRM,
6901 hash, sizeof(hash));
0821a2c5 6902
5082a599
MH		 6903 eir_len = eir_append_data(rp->eir, eir_len,
6904 EIR_LE_SC_RANDOM,
6905 rand, sizeof(rand));
6906 }
0821a2c5 6907
4f0f155c
MH		 6908 flags = get_adv_discov_flags(hdev);
6909
6910 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6911 flags |= LE_AD_NO_BREDR;
6912
6913 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6914 &flags, sizeof(flags));
6915 break;
6916 }
6917
4f0f155c
MH		 6918 hci_dev_unlock(hdev);
6919
72000df2
MH		 6920 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6921
57b0d3e8
MH		 6922 status = MGMT_STATUS_SUCCESS;
6923
6924complete:
efcd8c98
MH		 6925 rp->type = cp->type;
6926 rp->eir_len = cpu_to_le16(eir_len);
6927
4f0f155c 6928 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 6929 status, rp, sizeof(*rp) + eir_len);
6930 if (err < 0 || status)
72000df2
MH		 6931 goto done;
6932
6933 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6934 rp, sizeof(*rp) + eir_len,
6935 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6936
0821a2c5 6937done:
4f0f155c
MH		 6938 kfree(rp);
6939
6940 return err;
6941}
6942
089fa8c0
AU		 6943static u32 get_supported_adv_flags(struct hci_dev *hdev)
6944{
6945 u32 flags = 0;
6946
6947 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6948 flags |= MGMT_ADV_FLAG_DISCOV;
6949 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6950 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6951
6952 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6953 flags |= MGMT_ADV_FLAG_TX_POWER;
6954
6955 return flags;
6956}
6957
d3d5305b
MH		 6958static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6959 void *data, u16 data_len)
6960{
6961 struct mgmt_rp_read_adv_features *rp;
6962 size_t rp_len;
286e0c83 6963 int err, i;
24b4f38f 6964 bool instance;
286e0c83 6965 struct adv_info *adv_instance;
089fa8c0 6966 u32 supported_flags;
d3d5305b
MH		 6967
6968 BT_DBG("%s", hdev->name);
6969
089fa8c0
AU		 6970 if (!lmp_le_capable(hdev))
6971 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6972 MGMT_STATUS_REJECTED);
6973
d3d5305b
MH		 6974 hci_dev_lock(hdev);
6975
6976 rp_len = sizeof(*rp);
24b4f38f 6977
24b4f38f
AU		 6978 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6979 if (instance)
286e0c83 6980 rp_len += hdev->adv_instance_cnt;
24b4f38f 6981
d3d5305b
MH		 6982 rp = kmalloc(rp_len, GFP_ATOMIC);
6983 if (!rp) {
6984 hci_dev_unlock(hdev);
6985 return -ENOMEM;
6986 }
6987
089fa8c0
AU		 6988 supported_flags = get_supported_adv_flags(hdev);
6989
6990 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6991 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6992 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
d2609b34 6993 rp->max_instances = HCI_MAX_ADV_INSTANCES;
24b4f38f 6994
24b4f38f 6995 if (instance) {
286e0c83
FG		 6996 i = 0;
6997 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6998 if (i >= hdev->adv_instance_cnt)
6999 break;
7000
7001 rp->instance[i] = adv_instance->instance;
7002 i++;
7003 }
7004 rp->num_instances = hdev->adv_instance_cnt;
24b4f38f
AU		 7005 } else {
7006 rp->num_instances = 0;
7007 }
d3d5305b
MH		 7008
7009 hci_dev_unlock(hdev);
7010
7011 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7012 MGMT_STATUS_SUCCESS, rp, rp_len);
7013
7014 kfree(rp);
7015
7016 return err;
7017}
7018
4117ed70 7019static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 7020 u8 len, bool is_adv_data)
24b4f38f 7021{
4117ed70 7022 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 7023 int i, cur_len;
b44133ff 7024 bool flags_managed = false;
5507e358 7025 bool tx_power_managed = false;
67e0c0cd
AU		 7026 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
7027 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 7028
807ec772 7029 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 7030 flags_managed = true;
7031 max_len -= 3;
7032 }
24b4f38f 7033
5507e358
AU		 7034 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
7035 tx_power_managed = true;
7036 max_len -= 3;
7037 }
7038
4117ed70 7039 if (len > max_len)
24b4f38f
AU		 7040 return false;
7041
4117ed70
AU		 7042 /* Make sure that the data is correctly formatted. */
7043 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7044 cur_len = data[i];
24b4f38f 7045
b44133ff
AU		 7046 if (flags_managed && data[i + 1] == EIR_FLAGS)
7047 return false;
7048
5507e358
AU		 7049 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
7050 return false;
7051
24b4f38f
AU		 7052 /* If the current field length would exceed the total data
7053 * length, then it's invalid.
7054 */
4117ed70 7055 if (i + cur_len >= len)
24b4f38f
AU		 7056 return false;
7057 }
7058
7059 return true;
7060}
7061
24b4f38f
AU		 7062static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7063 u16 opcode)
7064{
7065 struct mgmt_pending_cmd *cmd;
fffd38bc 7066 struct mgmt_cp_add_advertising *cp;
24b4f38f 7067 struct mgmt_rp_add_advertising rp;
fffd38bc
FG		 7068 struct adv_info *adv_instance, *n;
7069 u8 instance;
24b4f38f
AU		 7070
7071 BT_DBG("status %d", status);
7072
7073 hci_dev_lock(hdev);
7074
7075 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7076
fffd38bc 7077 if (status)
24b4f38f 7078 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
fffd38bc
FG		 7079
7080 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7081 if (!adv_instance->pending)
7082 continue;
7083
7084 if (!status) {
7085 adv_instance->pending = false;
7086 continue;
7087 }
7088
7089 instance = adv_instance->instance;
7090
7091 if (hdev->cur_adv_instance == instance)
7092 cancel_adv_timeout(hdev);
7093
7094 hci_remove_adv_instance(hdev, instance);
7095 advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
24b4f38f
AU		 7096 }
7097
7098 if (!cmd)
7099 goto unlock;
7100
fffd38bc
FG		 7101 cp = cmd->param;
7102 rp.instance = cp->instance;
24b4f38f
AU		 7103
7104 if (status)
7105 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7106 mgmt_status(status));
7107 else
7108 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7109 mgmt_status(status), &rp, sizeof(rp));
7110
7111 mgmt_pending_remove(cmd);
7112
7113unlock:
7114 hci_dev_unlock(hdev);
7115}
7116
5d900e46 7117void mgmt_adv_timeout_expired(struct hci_dev *hdev)
912098a6 7118{
847818d9
FG		 7119 u8 instance;
7120 struct hci_request req;
7121
5d900e46 7122 hdev->adv_instance_timeout = 0;
912098a6 7123
847818d9
FG		 7124 instance = get_current_adv_instance(hdev);
7125 if (instance == 0x00)
7126 return;
7127
912098a6 7128 hci_dev_lock(hdev);
847818d9
FG		 7129 hci_req_init(&req, hdev);
7130
7131 clear_adv_instance(hdev, &req, instance, false);
7132
7133 if (list_empty(&hdev->adv_instances))
7134 disable_advertising(&req);
7135
7136 if (!skb_queue_empty(&req.cmd_q))
7137 hci_req_run(&req, NULL);
7138
912098a6
AU		 7139 hci_dev_unlock(hdev);
7140}
7141
24b4f38f
AU		 7142static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7143 void *data, u16 data_len)
7144{
7145 struct mgmt_cp_add_advertising *cp = data;
7146 struct mgmt_rp_add_advertising rp;
7147 u32 flags;
089fa8c0 7148 u32 supported_flags;
24b4f38f 7149 u8 status;
fffd38bc
FG		 7150 u16 timeout, duration;
7151 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7152 u8 schedule_instance = 0;
7153 struct adv_info *next_instance;
24b4f38f
AU		 7154 int err;
7155 struct mgmt_pending_cmd *cmd;
7156 struct hci_request req;
7157
7158 BT_DBG("%s", hdev->name);
7159
7160 status = mgmt_le_support(hdev);
7161 if (status)
7162 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7163 status);
7164
7165 flags = __le32_to_cpu(cp->flags);
912098a6 7166 timeout = __le16_to_cpu(cp->timeout);
fffd38bc 7167 duration = __le16_to_cpu(cp->duration);
24b4f38f 7168
fffd38bc
FG		 7169 /* The current implementation only supports a subset of the specified
7170 * flags.
089fa8c0
AU		 7171 */
7172 supported_flags = get_supported_adv_flags(hdev);
fffd38bc 7173 if (flags & ~supported_flags)
24b4f38f
AU		 7174 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7175 MGMT_STATUS_INVALID_PARAMS);
7176
7177 hci_dev_lock(hdev);
7178
912098a6
AU		 7179 if (timeout && !hdev_is_powered(hdev)) {
7180 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7181 MGMT_STATUS_REJECTED);
7182 goto unlock;
7183 }
7184
24b4f38f 7185 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 7186 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 7187 pending_find(MGMT_OP_SET_LE, hdev)) {
7188 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7189 MGMT_STATUS_BUSY);
7190 goto unlock;
7191 }
7192
b44133ff 7193 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 7194 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 7195 cp->scan_rsp_len, false)) {
24b4f38f
AU		 7196 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7197 MGMT_STATUS_INVALID_PARAMS);
7198 goto unlock;
7199 }
7200
fffd38bc
FG		 7201 err = hci_add_adv_instance(hdev, cp->instance, flags,
7202 cp->adv_data_len, cp->data,
7203 cp->scan_rsp_len,
7204 cp->data + cp->adv_data_len,
7205 timeout, duration);
7206 if (err < 0) {
7207 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7208 MGMT_STATUS_FAILED);
7209 goto unlock;
7210 }
24b4f38f 7211
fffd38bc
FG		 7212 /* Only trigger an advertising added event if a new instance was
7213 * actually added.
7214 */
7215 if (hdev->adv_instance_cnt > prev_instance_cnt)
7216 advertising_added(sk, hdev, cp->instance);
912098a6 7217
fffd38bc 7218 hci_dev_set_flag(hdev, HCI_ADVERTISING_INSTANCE);
912098a6 7219
fffd38bc
FG		 7220 if (hdev->cur_adv_instance == cp->instance) {
7221 /* If the currently advertised instance is being changed then
7222 * cancel the current advertising and schedule the next
7223 * instance. If there is only one instance then the overridden
7224 * advertising data will be visible right away.
7225 */
7226 cancel_adv_timeout(hdev);
912098a6 7227
fffd38bc
FG		 7228 next_instance = hci_get_next_instance(hdev, cp->instance);
7229 if (next_instance)
7230 schedule_instance = next_instance->instance;
7231 } else if (!hdev->adv_instance_timeout) {
7232 /* Immediately advertise the new instance if no other
7233 * instance is currently being advertised.
7234 */
7235 schedule_instance = cp->instance;
7236 }
24b4f38f 7237
fffd38bc
FG		 7238 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7239 * there is no instance to be advertised then we have no HCI
7240 * communication to make. Simply return.
24b4f38f
AU		 7241 */
7242 if (!hdev_is_powered(hdev) ||
fffd38bc
FG		 7243 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7244 !schedule_instance) {
7245 rp.instance = cp->instance;
24b4f38f
AU		 7246 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7247 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7248 goto unlock;
7249 }
7250
7251 /* We're good to go, update advertising data, parameters, and start
7252 * advertising.
7253 */
7254 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7255 data_len);
7256 if (!cmd) {
7257 err = -ENOMEM;
7258 goto unlock;
7259 }
7260
7261 hci_req_init(&req, hdev);
7262
fffd38bc
FG		 7263 err = schedule_adv_instance(&req, schedule_instance, true);
7264
7265 if (!err)
7266 err = hci_req_run(&req, add_advertising_complete);
24b4f38f 7267
24b4f38f
AU		 7268 if (err < 0)
7269 mgmt_pending_remove(cmd);
7270
7271unlock:
7272 hci_dev_unlock(hdev);
7273
7274 return err;
7275}
7276
da929335
AU		 7277static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7278 u16 opcode)
7279{
7280 struct mgmt_pending_cmd *cmd;
01948331 7281 struct mgmt_cp_remove_advertising *cp;
da929335
AU		 7282 struct mgmt_rp_remove_advertising rp;
7283
7284 BT_DBG("status %d", status);
7285
7286 hci_dev_lock(hdev);
7287
7288 /* A failure status here only means that we failed to disable
7289 * advertising. Otherwise, the advertising instance has been removed,
7290 * so report success.
7291 */
7292 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7293 if (!cmd)
7294 goto unlock;
7295
01948331
FG		 7296 cp = cmd->param;
7297 rp.instance = cp->instance;
da929335
AU		 7298
7299 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7300 &rp, sizeof(rp));
7301 mgmt_pending_remove(cmd);
7302
7303unlock:
7304 hci_dev_unlock(hdev);
7305}
7306
7307static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7308 void *data, u16 data_len)
7309{
7310 struct mgmt_cp_remove_advertising *cp = data;
7311 struct mgmt_rp_remove_advertising rp;
da929335
AU		 7312 struct mgmt_pending_cmd *cmd;
7313 struct hci_request req;
952497b1 7314 int err;
da929335
AU		 7315
7316 BT_DBG("%s", hdev->name);
7317
da929335
AU		 7318 hci_dev_lock(hdev);
7319
952497b1 7320 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
01948331
FG		 7321 err = mgmt_cmd_status(sk, hdev->id,
7322 MGMT_OP_REMOVE_ADVERTISING,
7323 MGMT_STATUS_INVALID_PARAMS);
7324 goto unlock;
7325 }
7326
da929335
AU		 7327 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7328 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7329 pending_find(MGMT_OP_SET_LE, hdev)) {
7330 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7331 MGMT_STATUS_BUSY);
7332 goto unlock;
7333 }
7334
7335 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7336 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7337 MGMT_STATUS_INVALID_PARAMS);
7338 goto unlock;
7339 }
7340
01948331 7341 hci_req_init(&req, hdev);
da929335 7342
01948331 7343 clear_adv_instance(hdev, &req, cp->instance, true);
da929335 7344
01948331
FG		 7345 if (list_empty(&hdev->adv_instances))
7346 disable_advertising(&req);
da929335 7347
01948331
FG		 7348 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7349 * flag is set or the device isn't powered then we have no HCI
7350 * communication to make. Simply return.
da929335 7351 */
01948331
FG		 7352 if (skb_queue_empty(&req.cmd_q) ||
7353 !hdev_is_powered(hdev) ||
da929335 7354 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
01948331 7355 rp.instance = cp->instance;
da929335
AU		 7356 err = mgmt_cmd_complete(sk, hdev->id,
7357 MGMT_OP_REMOVE_ADVERTISING,
7358 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7359 goto unlock;
7360 }
7361
7362 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7363 data_len);
7364 if (!cmd) {
7365 err = -ENOMEM;
7366 goto unlock;
7367 }
7368
da929335
AU		 7369 err = hci_req_run(&req, remove_advertising_complete);
7370 if (err < 0)
7371 mgmt_pending_remove(cmd);
7372
7373unlock:
7374 hci_dev_unlock(hdev);
7375
7376 return err;
7377}
7378
6d785aa3 7379static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 7380 { NULL }, /* 0x0000 (no command) */
b9a245fb 7381 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 7382 HCI_MGMT_NO_HDEV |
7383 HCI_MGMT_UNTRUSTED },
b9a245fb 7384 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 7385 HCI_MGMT_NO_HDEV |
7386 HCI_MGMT_UNTRUSTED },
b9a245fb 7387 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 7388 HCI_MGMT_NO_HDEV |
7389 HCI_MGMT_UNTRUSTED },
7390 { read_controller_info, MGMT_READ_INFO_SIZE,
7391 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 7392 { set_powered, MGMT_SETTING_SIZE },
7393 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
7394 { set_connectable, MGMT_SETTING_SIZE },
7395 { set_fast_connectable, MGMT_SETTING_SIZE },
7396 { set_bondable, MGMT_SETTING_SIZE },
7397 { set_link_security, MGMT_SETTING_SIZE },
7398 { set_ssp, MGMT_SETTING_SIZE },
7399 { set_hs, MGMT_SETTING_SIZE },
7400 { set_le, MGMT_SETTING_SIZE },
7401 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
7402 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
7403 { add_uuid, MGMT_ADD_UUID_SIZE },
7404 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 7405 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
7406 HCI_MGMT_VAR_LEN },
7407 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7408 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7409 { disconnect, MGMT_DISCONNECT_SIZE },
7410 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
7411 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
7412 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7413 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
7414 { pair_device, MGMT_PAIR_DEVICE_SIZE },
7415 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7416 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
7417 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
7418 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7419 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
7420 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 7421 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7422 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7423 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7424 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7425 { start_discovery, MGMT_START_DISCOVERY_SIZE },
7426 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
7427 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
7428 { block_device, MGMT_BLOCK_DEVICE_SIZE },
7429 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
7430 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
7431 { set_advertising, MGMT_SETTING_SIZE },
7432 { set_bredr, MGMT_SETTING_SIZE },
7433 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
7434 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
7435 { set_secure_conn, MGMT_SETTING_SIZE },
7436 { set_debug_keys, MGMT_SETTING_SIZE },
7437 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 7438 { load_irks, MGMT_LOAD_IRKS_SIZE,
7439 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7440 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
7441 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
7442 { add_device, MGMT_ADD_DEVICE_SIZE },
7443 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 7444 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
7445 HCI_MGMT_VAR_LEN },
7446 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 7447 HCI_MGMT_NO_HDEV |
7448 HCI_MGMT_UNTRUSTED },
b9a245fb 7449 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 7450 HCI_MGMT_UNCONFIGURED |
7451 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 7452 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7453 HCI_MGMT_UNCONFIGURED },
7454 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7455 HCI_MGMT_UNCONFIGURED },
7456 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7457 HCI_MGMT_VAR_LEN },
4f0f155c 7458 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7459 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7460 HCI_MGMT_NO_HDEV |
7461 HCI_MGMT_UNTRUSTED },
d3d5305b 7462 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7463 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7464 HCI_MGMT_VAR_LEN },
da929335 7465 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7466};
7467
bf6b56db 7468void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7469{
ced85549 7470 struct mgmt_ev_ext_index ev;
bb4b2a9a 7471
0602a8ad
MH		 7472 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7473 return;
7474
f9207338
MH		 7475 switch (hdev->dev_type) {
7476 case HCI_BREDR:
7477 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7478 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7479 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7480 ev.type = 0x01;
f9207338
MH		 7481 } else {
7482 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7483 HCI_MGMT_INDEX_EVENTS);
ced85549 7484 ev.type = 0x00;
f9207338
MH		 7485 }
7486 break;
ced85549
MH		 7487 case HCI_AMP:
7488 ev.type = 0x02;
7489 break;
7490 default:
7491 return;
f9207338 7492 }
ced85549
MH		 7493
7494 ev.bus = hdev->bus;
7495
7496 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7497 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7498}
7499
bf6b56db 7500void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7501{
ced85549 7502 struct mgmt_ev_ext_index ev;
5f159032 7503 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7504
0602a8ad
MH		 7505 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7506 return;
7507
f9207338
MH		 7508 switch (hdev->dev_type) {
7509 case HCI_BREDR:
7510 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7511
f9207338
MH		 7512 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7513 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7514 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7515 ev.type = 0x01;
f9207338
MH		 7516 } else {
7517 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7518 HCI_MGMT_INDEX_EVENTS);
ced85549 7519 ev.type = 0x00;
f9207338
MH		 7520 }
7521 break;
ced85549
MH		 7522 case HCI_AMP:
7523 ev.type = 0x02;
7524 break;
7525 default:
7526 return;
f9207338 7527 }
ced85549
MH		 7528
7529 ev.bus = hdev->bus;
7530
7531 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7532 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7533}
7534
6046dc3e 7535/* This function requires the caller holds hdev->lock */
2cf22218 7536static void restart_le_actions(struct hci_request *req)
6046dc3e 7537{
2cf22218 7538 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7539 struct hci_conn_params *p;
7540
7541 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7542 /* Needed for AUTO_OFF case where might not "really"
7543 * have been powered off.
7544 */
7545 list_del_init(&p->action);
7546
7547 switch (p->auto_connect) {
4b9e7e75 7548 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7549 case HCI_AUTO_CONN_ALWAYS:
7550 list_add(&p->action, &hdev->pend_le_conns);
7551 break;
7552 case HCI_AUTO_CONN_REPORT:
7553 list_add(&p->action, &hdev->pend_le_reports);
7554 break;
7555 default:
7556 break;
c83ed19d 7557 }
6046dc3e 7558 }
c83ed19d 7559
2cf22218 7560 __hci_update_background_scan(req);
6046dc3e
AG		 7561}
7562
1904a853 7563static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7564{
7565 struct cmd_lookup match = { NULL, hdev };
7566
7567 BT_DBG("status 0x%02x", status);
7568
162a3bac
MH		 7569 if (!status) {
7570 /* Register the available SMP channels (BR/EDR and LE) only
7571 * when successfully powering on the controller. This late
7572 * registration is required so that LE SMP can clearly
7573 * decide if the public address or static address is used.
7574 */
7575 smp_register(hdev);
7576 }
7577
229ab39c
JH		 7578 hci_dev_lock(hdev);
7579
7580 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7581
7582 new_settings(hdev, match.sk);
7583
7584 hci_dev_unlock(hdev);
7585
7586 if (match.sk)
7587 sock_put(match.sk);
7588}
7589
70da6243 7590static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7591{
890ea898 7592 struct hci_request req;
320b3bf7 7593 struct adv_info *adv_instance;
70da6243 7594 u8 link_sec;
5add6af8 7595
890ea898
JH		 7596 hci_req_init(&req, hdev);
7597
d7a5a11d 7598 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7599 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7600 u8 mode = 0x01;
5e5282bb 7601
574ea3c7
MH		 7602 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7603
7604 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7605 u8 support = 0x01;
5add6af8 7606
574ea3c7
MH		 7607 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7608 sizeof(support), &support);
7609 }
ec6f99b8
JH		 7610 }
7611
d7a5a11d 7612 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7613 lmp_bredr_capable(hdev)) {
70da6243 7614 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7615
32226e4f
MH		 7616 cp.le = 0x01;
7617 cp.simul = 0x00;
3d1cbdd6 7618
70da6243
JH		 7619 /* Check first if we already have the right
7620 * host state (host features set)
7621 */
7622 if (cp.le != lmp_host_le_capable(hdev) ||
7623 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7624 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7625 sizeof(cp), &cp);
70da6243 7626 }
3d1cbdd6 7627
d13eafce 7628 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7629 /* Make sure the controller has a good default for
7630 * advertising data. This also applies to the case
7631 * where BR/EDR was toggled during the AUTO_OFF phase.
7632 */
320b3bf7
FG		 7633 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7634 (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7635 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))) {
5947f4bc 7636 update_adv_data(&req);
f14d8f64
MH		 7637 update_scan_rsp_data(&req);
7638 }
441ad2d0 7639
320b3bf7
FG		 7640 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7641 hdev->cur_adv_instance == 0x00 &&
7642 !list_empty(&hdev->adv_instances)) {
7643 adv_instance = list_first_entry(&hdev->adv_instances,
7644 struct adv_info, list);
7645 hdev->cur_adv_instance = adv_instance->instance;
7646 }
7647
7648 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
bba3aa55 7649 enable_advertising(&req);
320b3bf7
FG		 7650 else if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7651 hdev->cur_adv_instance)
7652 schedule_adv_instance(&req, hdev->cur_adv_instance,
7653 true);
2cf22218
JH		 7654
7655 restart_le_actions(&req);
eeca6f89
JH		 7656 }
7657
d7a5a11d 7658 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7659 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7660 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7661 sizeof(link_sec), &link_sec);
562fcc24 7662
70da6243 7663 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7664 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7665 write_fast_connectable(&req, true);
7666 else
7667 write_fast_connectable(&req, false);
1d2dc5b7 7668 __hci_update_page_scan(&req);
890ea898 7669 update_class(&req);
13928971 7670 update_name(&req);
890ea898 7671 update_eir(&req);
70da6243 7672 }
562fcc24 7673
229ab39c 7674 return hci_req_run(&req, powered_complete);
70da6243 7675}
562fcc24 7676
70da6243
JH		 7677int mgmt_powered(struct hci_dev *hdev, u8 powered)
7678{
7679 struct cmd_lookup match = { NULL, hdev };
9845904f 7680 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7681 int err;
f0ff92fb 7682
d7a5a11d 7683 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7684 return 0;
7685
70da6243 7686 if (powered) {
229ab39c
JH		 7687 if (powered_update_hci(hdev) == 0)
7688 return 0;
fe038884 7689
229ab39c
JH		 7690 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7691 &match);
7692 goto new_settings;
b24752fe
JH		 7693 }
7694
229ab39c 7695 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7696
7697 /* If the power off is because of hdev unregistration let
7698 * use the appropriate INVALID_INDEX status. Otherwise use
7699 * NOT_POWERED. We cover both scenarios here since later in
7700 * mgmt_index_removed() any hci_conn callbacks will have already
7701 * been triggered, potentially causing misleading DISCONNECTED
7702 * status responses.
7703 */
d7a5a11d 7704 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7705 status = MGMT_STATUS_INVALID_INDEX;
7706 else
7707 status = MGMT_STATUS_NOT_POWERED;
7708
7709 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7710
7711 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7712 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7713 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7714
7715new_settings:
beadb2bd 7716 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7717
7718 if (match.sk)
7719 sock_put(match.sk);
7720
7bb895d6 7721 return err;
5add6af8 7722}
73f22f62 7723
3eec705e 7724void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7725{
3b0602cd 7726 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7727 u8 status;
7728
333ae95d 7729 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7730 if (!cmd)
3eec705e 7731 return;
96570ffc
JH		 7732
7733 if (err == -ERFKILL)
7734 status = MGMT_STATUS_RFKILLED;
7735 else
7736 status = MGMT_STATUS_FAILED;
7737
a69e8375 7738 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7739
7740 mgmt_pending_remove(cmd);
96570ffc
JH		 7741}
7742
d1967ff8
MH		 7743void mgmt_discoverable_timeout(struct hci_dev *hdev)
7744{
7745 struct hci_request req;
d1967ff8
MH		 7746
7747 hci_dev_lock(hdev);
7748
7749 /* When discoverable timeout triggers, then just make sure
7750 * the limited discoverable flag is cleared. Even in the case
7751 * of a timeout triggered from general discoverable, it is
7752 * safe to unconditionally clear the flag.
7753 */
a358dc11
MH		 7754 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7755 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7756
7757 hci_req_init(&req, hdev);
d7a5a11d 7758 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7759 u8 scan = SCAN_PAGE;
7760 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7761 sizeof(scan), &scan);
7762 }
d1967ff8 7763 update_class(&req);
24b4f38f
AU		 7764
7765 /* Advertising instances don't use the global discoverable setting, so
7766 * only update AD if advertising was enabled using Set Advertising.
7767 */
7768 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7769 update_adv_data(&req);
7770
d1967ff8
MH		 7771 hci_req_run(&req, NULL);
7772
7773 hdev->discov_timeout = 0;
7774
9a43e25f
JH		 7775 new_settings(hdev, NULL);
7776
d1967ff8
MH		 7777 hci_dev_unlock(hdev);
7778}
7779
dc4a5ee2
MH		 7780void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7781 bool persistent)
55ed8ca1 7782{
86742e1e 7783 struct mgmt_ev_new_link_key ev;
55ed8ca1 7784
a492cd52 7785 memset(&ev, 0, sizeof(ev));
55ed8ca1 7786
a492cd52 7787 ev.store_hint = persistent;
d753fdc4 7788 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7789 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7790 ev.key.type = key->type;
9b3b4460 7791 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7792 ev.key.pin_len = key->pin_len;
55ed8ca1 7793
dc4a5ee2 7794 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7795}
f7520543 7796
d7b25450
JH		 7797static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7798{
23fb8de3
JH		 7799 switch (ltk->type) {
7800 case SMP_LTK:
7801 case SMP_LTK_SLAVE:
7802 if (ltk->authenticated)
7803 return MGMT_LTK_AUTHENTICATED;
7804 return MGMT_LTK_UNAUTHENTICATED;
7805 case SMP_LTK_P256:
7806 if (ltk->authenticated)
7807 return MGMT_LTK_P256_AUTH;
7808 return MGMT_LTK_P256_UNAUTH;
7809 case SMP_LTK_P256_DEBUG:
7810 return MGMT_LTK_P256_DEBUG;
7811 }
d7b25450
JH		 7812
7813 return MGMT_LTK_UNAUTHENTICATED;
7814}
7815
53ac6ab6 7816void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7817{
7818 struct mgmt_ev_new_long_term_key ev;
7819
7820 memset(&ev, 0, sizeof(ev));
7821
5192d301 7822 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7823 * without providing an identity resolving key don't require
5192d301
MH		 7824 * to store long term keys. Their addresses will change the
7825 * next time around.
7826 *
7827 * Only when a remote device provides an identity address
7828 * make sure the long term key is stored. If the remote
7829 * identity is known, the long term keys are internally
7830 * mapped to the identity address. So allow static random
7831 * and public addresses here.
7832 */
ba74b666
JH		 7833 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7834 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7835 ev.store_hint = 0x00;
7836 else
53ac6ab6 7837 ev.store_hint = persistent;
ba74b666 7838
346af67b 7839 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7840 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7841 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7842 ev.key.enc_size = key->enc_size;
7843 ev.key.ediv = key->ediv;
fe39c7b2 7844 ev.key.rand = key->rand;
346af67b 7845
2ceba539 7846 if (key->type == SMP_LTK)
346af67b
VCG		 7847 ev.key.master = 1;
7848
1fc62c52
JH		 7849 /* Make sure we copy only the significant bytes based on the
7850 * encryption key size, and set the rest of the value to zeroes.
7851 */
7852 memcpy(ev.key.val, key->val, sizeof(key->enc_size));
7853 memset(ev.key.val + key->enc_size, 0,
7854 sizeof(ev.key.val) - key->enc_size);
346af67b 7855
083368f7 7856 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7857}
7858
95fbac8a
JH		 7859void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7860{
7861 struct mgmt_ev_new_irk ev;
7862
7863 memset(&ev, 0, sizeof(ev));
7864
bab6d1e5
MH		 7865 /* For identity resolving keys from devices that are already
7866 * using a public address or static random address, do not
7867 * ask for storing this key. The identity resolving key really
f72186d2 7868 * is only mandatory for devices using resolvable random
bab6d1e5
MH		 7869 * addresses.
7870 *
7871 * Storing all identity resolving keys has the downside that
7872 * they will be also loaded on next boot of they system. More
7873 * identity resolving keys, means more time during scanning is
7874 * needed to actually resolve these addresses.
7875 */
7876 if (bacmp(&irk->rpa, BDADDR_ANY))
7877 ev.store_hint = 0x01;
7878 else
7879 ev.store_hint = 0x00;
7880
95fbac8a
JH		 7881 bacpy(&ev.rpa, &irk->rpa);
7882 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7883 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7884 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7885
7886 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7887}
7888
53ac6ab6
MH		 7889void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7890 bool persistent)
7ee4ea36
MH		 7891{
7892 struct mgmt_ev_new_csrk ev;
7893
7894 memset(&ev, 0, sizeof(ev));
7895
7896 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7897 * without providing an identity resolving key don't require
7ee4ea36
MH		 7898 * to store signature resolving keys. Their addresses will change
7899 * the next time around.
7900 *
7901 * Only when a remote device provides an identity address
7902 * make sure the signature resolving key is stored. So allow
7903 * static random and public addresses here.
7904 */
7905 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7906 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7907 ev.store_hint = 0x00;
7908 else
53ac6ab6 7909 ev.store_hint = persistent;
7ee4ea36
MH		 7910
7911 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7912 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7913 ev.key.type = csrk->type;
7ee4ea36
MH		 7914 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7915
7916 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7917}
7918
ffb5a827 7919void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7920 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7921 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7922{
7923 struct mgmt_ev_new_conn_param ev;
7924
c103aea6
JH		 7925 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7926 return;
7927
ffb5a827
AG		 7928 memset(&ev, 0, sizeof(ev));
7929 bacpy(&ev.addr.bdaddr, bdaddr);
7930 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7931 ev.store_hint = store_hint;
ffb5a827
AG		 7932 ev.min_interval = cpu_to_le16(min_interval);
7933 ev.max_interval = cpu_to_le16(max_interval);
7934 ev.latency = cpu_to_le16(latency);
7935 ev.timeout = cpu_to_le16(timeout);
7936
7937 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7938}
7939
48ec92fa
AA		 7940void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7941 u32 flags, u8 *name, u8 name_len)
f7520543 7942{
b644ba33
JH		 7943 char buf[512];
7944 struct mgmt_ev_device_connected *ev = (void *) buf;
7945 u16 eir_len = 0;
f7520543 7946
48ec92fa
AA		 7947 bacpy(&ev->addr.bdaddr, &conn->dst);
7948 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7949
c95f0ba7 7950 ev->flags = __cpu_to_le32(flags);
08c79b61 7951
fd45ada9
AA		 7952 /* We must ensure that the EIR Data fields are ordered and
7953 * unique. Keep it simple for now and avoid the problem by not
7954 * adding any BR/EDR data to the LE adv.
7955 */
7956 if (conn->le_adv_data_len > 0) {
7957 memcpy(&ev->eir[eir_len],
7958 conn->le_adv_data, conn->le_adv_data_len);
7959 eir_len = conn->le_adv_data_len;
7960 } else {
7961 if (name_len > 0)
7962 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7963 name, name_len);
b644ba33 7964
ddbea5cf 7965 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7966 eir_len = eir_append_data(ev->eir, eir_len,
7967 EIR_CLASS_OF_DEV,
7968 conn->dev_class, 3);
7969 }
b644ba33 7970
eb55ef07 7971 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7972
ecd90ae7
MH		 7973 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7974 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7975}
7976
3b0602cd 7977static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7978{
8962ee74 7979 struct sock **sk = data;
8962ee74 7980
f5818c22 7981 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7982
7983 *sk = cmd->sk;
7984 sock_hold(*sk);
7985
a664b5bc 7986 mgmt_pending_remove(cmd);
8962ee74
JH		 7987}
7988
3b0602cd 7989static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7990{
b1078ad0 7991 struct hci_dev *hdev = data;
124f6e35 7992 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7993
b1078ad0
JH		 7994 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7995
d8b7b1e4 7996 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7997 mgmt_pending_remove(cmd);
7998}
7999
84c61d92
JH		 8000bool mgmt_powering_down(struct hci_dev *hdev)
8001{
3b0602cd 8002 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 8003 struct mgmt_mode *cp;
8004
333ae95d 8005 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 8006 if (!cmd)
8007 return false;
8008
8009 cp = cmd->param;
8010 if (!cp->val)
8011 return true;
8012
8013 return false;
8014}
8015
9b80ec5e 8016void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 8017 u8 link_type, u8 addr_type, u8 reason,
8018 bool mgmt_connected)
f7520543 8019{
f0d6a0ea 8020 struct mgmt_ev_device_disconnected ev;
8962ee74 8021 struct sock *sk = NULL;
8962ee74 8022
84c61d92
JH		 8023 /* The connection is still in hci_conn_hash so test for 1
8024 * instead of 0 to know if this is the last one.
8025 */
8026 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8027 cancel_delayed_work(&hdev->power_off);
8028 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 8029 }
8030
12d4a3b2
JH		 8031 if (!mgmt_connected)
8032 return;
8033
57eb776f
AG		 8034 if (link_type != ACL_LINK && link_type != LE_LINK)
8035 return;
8036
744cf19e 8037 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 8038
f0d6a0ea
MA		 8039 bacpy(&ev.addr.bdaddr, bdaddr);
8040 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8041 ev.reason = reason;
f7520543 8042
9b80ec5e 8043 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 8044
8045 if (sk)
d97dcb66 8046 sock_put(sk);
8962ee74 8047
124f6e35 8048 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 8049 hdev);
8962ee74
JH		 8050}
8051
7892924c
MH		 8052void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8053 u8 link_type, u8 addr_type, u8 status)
8962ee74 8054{
3655bba8
AG		 8055 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8056 struct mgmt_cp_disconnect *cp;
3b0602cd 8057 struct mgmt_pending_cmd *cmd;
8962ee74 8058
36a75f1b
JD		 8059 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8060 hdev);
8061
333ae95d 8062 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 8063 if (!cmd)
7892924c 8064 return;
8962ee74 8065
3655bba8
AG		 8066 cp = cmd->param;
8067
8068 if (bacmp(bdaddr, &cp->addr.bdaddr))
8069 return;
8070
8071 if (cp->addr.type != bdaddr_type)
8072 return;
8073
f5818c22 8074 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8075 mgmt_pending_remove(cmd);
f7520543 8076}
17d5c04c 8077
445608d0
MH		 8078void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8079 u8 addr_type, u8 status)
17d5c04c
JH		 8080{
8081 struct mgmt_ev_connect_failed ev;
c9910d0f 8082
84c61d92
JH		 8083 /* The connection is still in hci_conn_hash so test for 1
8084 * instead of 0 to know if this is the last one.
8085 */
8086 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8087 cancel_delayed_work(&hdev->power_off);
8088 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 8089 }
17d5c04c 8090
4c659c39 8091 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8092 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 8093 ev.status = mgmt_status(status);
17d5c04c 8094
445608d0 8095 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 8096}
980e1a53 8097
ce0e4a0d 8098void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 8099{
8100 struct mgmt_ev_pin_code_request ev;
8101
d8457698 8102 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 8103 ev.addr.type = BDADDR_BREDR;
a770bb5a 8104 ev.secure = secure;
980e1a53 8105
ce0e4a0d 8106 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 8107}
8108
e669cf80
MH		 8109void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8110 u8 status)
980e1a53 8111{
3b0602cd 8112 struct mgmt_pending_cmd *cmd;
980e1a53 8113
333ae95d 8114 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 8115 if (!cmd)
e669cf80 8116 return;
980e1a53 8117
7776d1d8 8118 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8119 mgmt_pending_remove(cmd);
980e1a53
JH		 8120}
8121
3eb38528
MH		 8122void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8123 u8 status)
980e1a53 8124{
3b0602cd 8125 struct mgmt_pending_cmd *cmd;
980e1a53 8126
333ae95d 8127 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 8128 if (!cmd)
3eb38528 8129 return;
980e1a53 8130
7776d1d8 8131 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8132 mgmt_pending_remove(cmd);
980e1a53 8133}
a5c29683 8134
744cf19e 8135int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 8136 u8 link_type, u8 addr_type, u32 value,
04124681 8137 u8 confirm_hint)
a5c29683
JH		 8138{
8139 struct mgmt_ev_user_confirm_request ev;
8140
744cf19e 8141 BT_DBG("%s", hdev->name);
a5c29683 8142
272d90df 8143 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8144 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 8145 ev.confirm_hint = confirm_hint;
39adbffe 8146 ev.value = cpu_to_le32(value);
a5c29683 8147
744cf19e 8148 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 8149 NULL);
a5c29683
JH		 8150}
8151
272d90df 8152int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 8153 u8 link_type, u8 addr_type)
604086b7
BG		 8154{
8155 struct mgmt_ev_user_passkey_request ev;
8156
8157 BT_DBG("%s", hdev->name);
8158
272d90df 8159 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8160 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 8161
8162 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 8163 NULL);
604086b7
BG		 8164}
8165
0df4c185 8166static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 8167 u8 link_type, u8 addr_type, u8 status,
8168 u8 opcode)
a5c29683 8169{
3b0602cd 8170 struct mgmt_pending_cmd *cmd;
a5c29683 8171
333ae95d 8172 cmd = pending_find(opcode, hdev);
a5c29683
JH		 8173 if (!cmd)
8174 return -ENOENT;
8175
7776d1d8 8176 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8177 mgmt_pending_remove(cmd);
a5c29683 8178
7776d1d8 8179 return 0;
a5c29683
JH		 8180}
8181
744cf19e 8182int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8183 u8 link_type, u8 addr_type, u8 status)
a5c29683 8184{
272d90df 8185 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8186 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 8187}
8188
272d90df 8189int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8190 u8 link_type, u8 addr_type, u8 status)
a5c29683 8191{
272d90df 8192 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8193 status,
8194 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 8195}
2a611692 8196
604086b7 8197int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8198 u8 link_type, u8 addr_type, u8 status)
604086b7 8199{
272d90df 8200 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8201 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 8202}
8203
272d90df 8204int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8205 u8 link_type, u8 addr_type, u8 status)
604086b7 8206{
272d90df 8207 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8208 status,
8209 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 8210}
8211
92a25256
JH		 8212int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8213 u8 link_type, u8 addr_type, u32 passkey,
8214 u8 entered)
8215{
8216 struct mgmt_ev_passkey_notify ev;
8217
8218 BT_DBG("%s", hdev->name);
8219
8220 bacpy(&ev.addr.bdaddr, bdaddr);
8221 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8222 ev.passkey = __cpu_to_le32(passkey);
8223 ev.entered = entered;
8224
8225 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8226}
8227
e1e930f5 8228void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 8229{
8230 struct mgmt_ev_auth_failed ev;
3b0602cd 8231 struct mgmt_pending_cmd *cmd;
e1e930f5 8232 u8 status = mgmt_status(hci_status);
2a611692 8233
e1e930f5
JH		 8234 bacpy(&ev.addr.bdaddr, &conn->dst);
8235 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8236 ev.status = status;
2a611692 8237
e1e930f5
JH		 8238 cmd = find_pairing(conn);
8239
8240 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8241 cmd ? cmd->sk : NULL);
8242
a511b35b
JH		 8243 if (cmd) {
8244 cmd->cmd_complete(cmd, status);
8245 mgmt_pending_remove(cmd);
8246 }
2a611692 8247}
b312b161 8248
464996ae 8249void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 8250{
8251 struct cmd_lookup match = { NULL, hdev };
464996ae 8252 bool changed;
33ef95ed
JH		 8253
8254 if (status) {
8255 u8 mgmt_err = mgmt_status(status);
8256 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 8257 cmd_status_rsp, &mgmt_err);
464996ae 8258 return;
33ef95ed
JH		 8259 }
8260
464996ae 8261 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 8262 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 8263 else
a69d8927 8264 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 8265
33ef95ed 8266 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 8267 &match);
33ef95ed 8268
47990ea0 8269 if (changed)
464996ae 8270 new_settings(hdev, match.sk);
33ef95ed
JH		 8271
8272 if (match.sk)
8273 sock_put(match.sk);
33ef95ed
JH		 8274}
8275
890ea898 8276static void clear_eir(struct hci_request *req)
cacaf52f 8277{
890ea898 8278 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 8279 struct hci_cp_write_eir cp;
8280
976eb20e 8281 if (!lmp_ext_inq_capable(hdev))
890ea898 8282 return;
cacaf52f 8283
c80da27e
JH		 8284 memset(hdev->eir, 0, sizeof(hdev->eir));
8285
cacaf52f
JH		 8286 memset(&cp, 0, sizeof(cp));
8287
890ea898 8288 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 8289}
8290
3e248560 8291void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 8292{
8293 struct cmd_lookup match = { NULL, hdev };
890ea898 8294 struct hci_request req;
c0ecddc2 8295 bool changed = false;
ed2c4ee3
JH		 8296
8297 if (status) {
8298 u8 mgmt_err = mgmt_status(status);
c0ecddc2 8299
a69d8927
MH		 8300 if (enable && hci_dev_test_and_clear_flag(hdev,
8301 HCI_SSP_ENABLED)) {
a358dc11 8302 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 8303 new_settings(hdev, NULL);
9ecb3e24 8304 }
c0ecddc2 8305
04124681
GP		 8306 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8307 &mgmt_err);
3e248560 8308 return;
c0ecddc2
JH		 8309 }
8310
8311 if (enable) {
238be788 8312 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 8313 } else {
a69d8927 8314 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 8315 if (!changed)
a69d8927
MH		 8316 changed = hci_dev_test_and_clear_flag(hdev,
8317 HCI_HS_ENABLED);
9ecb3e24 8318 else
a358dc11 8319 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 8320 }
8321
8322 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8323
c0ecddc2 8324 if (changed)
3e248560 8325 new_settings(hdev, match.sk);
ed2c4ee3 8326
5fc6ebb1 8327 if (match.sk)
ed2c4ee3
JH		 8328 sock_put(match.sk);
8329
890ea898
JH		 8330 hci_req_init(&req, hdev);
8331
d7a5a11d
MH		 8332 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8333 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 8334 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8335 sizeof(enable), &enable);
890ea898 8336 update_eir(&req);
3769972b 8337 } else {
890ea898 8338 clear_eir(&req);
3769972b 8339 }
890ea898
JH		 8340
8341 hci_req_run(&req, NULL);
ed2c4ee3
JH		 8342}
8343
3b0602cd 8344static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 8345{
8346 struct cmd_lookup *match = data;
8347
90e70454
JH		 8348 if (match->sk == NULL) {
8349 match->sk = cmd->sk;
8350 sock_hold(match->sk);
8351 }
90e70454
JH		 8352}
8353
4e1b0245
MH		 8354void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8355 u8 status)
7f9a903c 8356{
90e70454 8357 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 8358
92da6097
JH		 8359 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8360 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8361 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 8362
8363 if (!status)
f6b7712e
MH		 8364 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8365 dev_class, 3, NULL);
90e70454
JH		 8366
8367 if (match.sk)
8368 sock_put(match.sk);
7f9a903c
MH		 8369}
8370
7667da34 8371void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 8372{
b312b161 8373 struct mgmt_cp_set_local_name ev;
3b0602cd 8374 struct mgmt_pending_cmd *cmd;
28cc7bde 8375
13928971 8376 if (status)
7667da34 8377 return;
b312b161
JH		 8378
8379 memset(&ev, 0, sizeof(ev));
8380 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 8381 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 8382
333ae95d 8383 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 8384 if (!cmd) {
8385 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 8386
13928971
JH		 8387 /* If this is a HCI command related to powering on the
8388 * HCI dev don't send any mgmt signals.
8389 */
333ae95d 8390 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 8391 return;
890ea898 8392 }
b312b161 8393
f6b7712e
MH		 8394 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8395 cmd ? cmd->sk : NULL);
b312b161 8396}
c35938b2 8397
799ce93d
JP		 8398static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8399{
8400 int i;
8401
8402 for (i = 0; i < uuid_count; i++) {
8403 if (!memcmp(uuid, uuids[i], 16))
8404 return true;
8405 }
8406
8407 return false;
8408}
8409
b487b9ce
MH		 8410static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8411{
799ce93d
JP		 8412 u16 parsed = 0;
8413
8414 while (parsed < eir_len) {
8415 u8 field_len = eir[0];
8416 u8 uuid[16];
8417 int i;
8418
8419 if (field_len == 0)
8420 break;
8421
8422 if (eir_len - parsed < field_len + 1)
8423 break;
8424
8425 switch (eir[1]) {
8426 case EIR_UUID16_ALL:
8427 case EIR_UUID16_SOME:
8428 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 8429 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8430 uuid[13] = eir[i + 3];
8431 uuid[12] = eir[i + 2];
8432 if (has_uuid(uuid, uuid_count, uuids))
8433 return true;
8434 }
8435 break;
8436 case EIR_UUID32_ALL:
8437 case EIR_UUID32_SOME:
8438 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8439 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8440 uuid[15] = eir[i + 5];
8441 uuid[14] = eir[i + 4];
8442 uuid[13] = eir[i + 3];
8443 uuid[12] = eir[i + 2];
8444 if (has_uuid(uuid, uuid_count, uuids))
8445 return true;
8446 }
8447 break;
8448 case EIR_UUID128_ALL:
8449 case EIR_UUID128_SOME:
8450 for (i = 0; i + 17 <= field_len; i += 16) {
8451 memcpy(uuid, eir + i + 2, 16);
8452 if (has_uuid(uuid, uuid_count, uuids))
8453 return true;
8454 }
8455 break;
8456 }
8457
8458 parsed += field_len + 1;
8459 eir += field_len + 1;
8460 }
8461
b487b9ce
MH		 8462 return false;
8463}
8464
4b0e0ced
JP		 8465static void restart_le_scan(struct hci_dev *hdev)
8466{
8467 /* If controller is not scanning we are done. */
d7a5a11d 8468 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8469 return;
8470
8471 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8472 hdev->discovery.scan_start +
8473 hdev->discovery.scan_duration))
8474 return;
8475
8476 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8477 DISCOV_LE_RESTART_DELAY);
8478}
8479
48f86b7f
JP		 8480static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8481 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8482{
48f86b7f
JP		 8483 /* If a RSSI threshold has been specified, and
8484 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8485 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8486 * is set, let it through for further processing, as we might need to
8487 * restart the scan.
efb2513f
MH		 8488 *
8489 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8490 * the results are also dropped.
bda157a4
MH		 8491 */
8492 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8493 (rssi == HCI_RSSI_INVALID ||
8494 (rssi < hdev->discovery.rssi &&
8495 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8496 return false;
efb2513f 8497
2976cdeb
JP		 8498 if (hdev->discovery.uuid_count != 0) {
8499 /* If a list of UUIDs is provided in filter, results with no
8500 * matching UUID should be dropped.
b487b9ce 8501 */
2976cdeb
JP		 8502 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8503 hdev->discovery.uuids) &&
8504 !eir_has_uuids(scan_rsp, scan_rsp_len,
8505 hdev->discovery.uuid_count,
8506 hdev->discovery.uuids))
8507 return false;
b487b9ce 8508 }
5d2e9fad 8509
2976cdeb
JP		 8510 /* If duplicate filtering does not report RSSI changes, then restart
8511 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8512 */
2976cdeb
JP		 8513 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8514 restart_le_scan(hdev);
8515
8516 /* Validate RSSI value against the RSSI threshold once more. */
8517 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8518 rssi < hdev->discovery.rssi)
8519 return false;
8520 }
48f86b7f
JP		 8521
8522 return true;
8523}
8524
8525void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8526 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8527 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8528{
8529 char buf[512];
8530 struct mgmt_ev_device_found *ev = (void *)buf;
8531 size_t ev_size;
8532
8533 /* Don't send events for a non-kernel initiated discovery. With
8534 * LE one exception is if we have pend_le_reports > 0 in which
8535 * case we're doing passive scanning and want these events.
8536 */
8537 if (!hci_discovery_active(hdev)) {
8538 if (link_type == ACL_LINK)
8539 return;
8540 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8541 return;
8542 }
8543
82f8b651 8544 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8545 /* We are using service discovery */
8546 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8547 scan_rsp_len))
8548 return;
8549 }
8550
8551 /* Make sure that the buffer is big enough. The 5 extra bytes
8552 * are for the potential CoD field.
8553 */
8554 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8555 return;
8556
48f86b7f
JP		 8557 memset(buf, 0, sizeof(buf));
8558
8559 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8560 * RSSI value was reported as 0 when not available. This behavior
8561 * is kept when using device discovery. This is required for full
8562 * backwards compatibility with the API.
8563 *
8564 * However when using service discovery, the value 127 will be
8565 * returned when the RSSI is not available.
8566 */
8567 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8568 link_type == ACL_LINK)
8569 rssi = 0;
8570
8571 bacpy(&ev->addr.bdaddr, bdaddr);
8572 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8573 ev->rssi = rssi;
8574 ev->flags = cpu_to_le32(flags);
8575
8576 if (eir_len > 0)
8577 /* Copy EIR or advertising data into event */
8578 memcpy(ev->eir, eir, eir_len);
8579
8580 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8581 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8582 dev_class, 3);
8583
8584 if (scan_rsp_len > 0)
8585 /* Append scan response data to event */
8586 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8587
5d2e9fad
JH		 8588 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8589 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8590
901801b9 8591 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8592}
a88a9652 8593
9cf12aee
MH		 8594void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8595 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8596{
b644ba33
JH		 8597 struct mgmt_ev_device_found *ev;
8598 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8599 u16 eir_len;
a88a9652 8600
b644ba33 8601 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8602
b644ba33
JH		 8603 memset(buf, 0, sizeof(buf));
8604
8605 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8606 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8607 ev->rssi = rssi;
8608
8609 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8610 name_len);
b644ba33 8611
eb55ef07 8612 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8613
9cf12aee 8614 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8615}
314b2381 8616
2f1e063b 8617void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8618{
f963e8e9 8619 struct mgmt_ev_discovering ev;
164a6e78 8620
343fb145
AG		 8621 BT_DBG("%s discovering %u", hdev->name, discovering);
8622
f963e8e9
JH		 8623 memset(&ev, 0, sizeof(ev));
8624 ev.type = hdev->discovery.type;
8625 ev.discovering = discovering;
8626
2f1e063b 8627 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8628}
5e762444 8629
1904a853 8630static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8631{
8632 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8633}
8634
8635void mgmt_reenable_advertising(struct hci_dev *hdev)
8636{
8637 struct hci_request req;
eb6f95f9 8638 u8 instance;
5976e608 8639
24b4f38f
AU		 8640 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8641 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8642 return;
8643
eb6f95f9
FG		 8644 instance = get_current_adv_instance(hdev);
8645
5976e608 8646 hci_req_init(&req, hdev);
eb6f95f9
FG		 8647
8648 if (instance) {
8649 schedule_adv_instance(&req, instance, true);
8650 } else {
8651 update_adv_data(&req);
8652 update_scan_rsp_data(&req);
8653 enable_advertising(&req);
8654 }
8655
0ec5ae84 8656 hci_req_run(&req, adv_enable_complete);
5976e608 8657}
6d785aa3
JH		 8658
8659static struct hci_mgmt_chan chan = {
8660 .channel = HCI_CHANNEL_CONTROL,
8661 .handler_count = ARRAY_SIZE(mgmt_handlers),
8662 .handlers = mgmt_handlers,
88b94ce9 8663 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8664};
8665
8666int mgmt_init(void)
8667{
8668 return hci_mgmt_chan_register(&chan);
8669}
8670
8671void mgmt_exit(void)
8672{
8673 hci_mgmt_chan_unregister(&chan);
8674}
Linux kernel - Deliverables
This page took 1.12352 seconds and 5 git commands to generate.