projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'pm-cpufreq'
[linux-2.6-block.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
e58627d1 41#define MGMT_REVISION 10
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
04124681
GP		 271static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
272 u16 data_len)
a38528f1
JH		 273{
274 struct mgmt_rp_read_version rp;
275
276 BT_DBG("sock %p", sk);
277
278 rp.version = MGMT_VERSION;
dcf4adbf 279 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 280
2a1afb5a
JH		 281 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
282 &rp, sizeof(rp));
a38528f1
JH		 283}
284
04124681
GP		 285static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
286 u16 data_len)
e70bb2e8
JH		 287{
288 struct mgmt_rp_read_commands *rp;
99c679ac 289 u16 num_commands, num_events;
e70bb2e8
JH		 290 size_t rp_size;
291 int i, err;
292
293 BT_DBG("sock %p", sk);
294
99c679ac
MH		 295 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
296 num_commands = ARRAY_SIZE(mgmt_commands);
297 num_events = ARRAY_SIZE(mgmt_events);
298 } else {
299 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
300 num_events = ARRAY_SIZE(mgmt_untrusted_events);
301 }
302
e70bb2e8
JH		 303 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
304
305 rp = kmalloc(rp_size, GFP_KERNEL);
306 if (!rp)
307 return -ENOMEM;
308
dcf4adbf
JP		 309 rp->num_commands = cpu_to_le16(num_commands);
310 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 311
99c679ac
MH		 312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 __le16 *opcode = rp->opcodes;
314
315 for (i = 0; i < num_commands; i++, opcode++)
316 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 317
99c679ac
MH		 318 for (i = 0; i < num_events; i++, opcode++)
319 put_unaligned_le16(mgmt_events[i], opcode);
320 } else {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
325
326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
328 }
e70bb2e8 329
2a1afb5a
JH		 330 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
331 rp, rp_size);
e70bb2e8
JH		 332 kfree(rp);
333
334 return err;
335}
336
04124681
GP		 337static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
338 u16 data_len)
faba42eb 339{
faba42eb 340 struct mgmt_rp_read_index_list *rp;
8035ded4 341 struct hci_dev *d;
a38528f1 342 size_t rp_len;
faba42eb 343 u16 count;
476e44cb 344 int err;
faba42eb
JH		 345
346 BT_DBG("sock %p", sk);
347
348 read_lock(&hci_dev_list_lock);
349
350 count = 0;
bb4b2a9a 351 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 352 if (d->dev_type == HCI_BREDR &&
d7a5a11d 353 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 354 count++;
faba42eb
JH		 355 }
356
a38528f1
JH		 357 rp_len = sizeof(*rp) + (2 * count);
358 rp = kmalloc(rp_len, GFP_ATOMIC);
359 if (!rp) {
b2c60d42 360 read_unlock(&hci_dev_list_lock);
faba42eb 361 return -ENOMEM;
b2c60d42 362 }
faba42eb 363
476e44cb 364 count = 0;
8035ded4 365 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 366 if (hci_dev_test_flag(d, HCI_SETUP) ||
367 hci_dev_test_flag(d, HCI_CONFIG) ||
368 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 369 continue;
370
73d1df2a
MH		 371 /* Devices marked as raw-only are neither configured
372 * nor unconfigured controllers.
373 */
374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 375 continue;
376
73d1df2a 377 if (d->dev_type == HCI_BREDR &&
d7a5a11d 378 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 379 rp->index[count++] = cpu_to_le16(d->id);
380 BT_DBG("Added hci%u", d->id);
381 }
faba42eb
JH		 382 }
383
476e44cb
JH		 384 rp->num_controllers = cpu_to_le16(count);
385 rp_len = sizeof(*rp) + (2 * count);
386
faba42eb
JH		 387 read_unlock(&hci_dev_list_lock);
388
2a1afb5a
JH		 389 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
390 0, rp, rp_len);
faba42eb 391
a38528f1
JH		 392 kfree(rp);
393
394 return err;
faba42eb
JH		 395}
396
73d1df2a
MH		 397static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
398 void *data, u16 data_len)
399{
400 struct mgmt_rp_read_unconf_index_list *rp;
401 struct hci_dev *d;
402 size_t rp_len;
403 u16 count;
404 int err;
405
406 BT_DBG("sock %p", sk);
407
408 read_lock(&hci_dev_list_lock);
409
410 count = 0;
411 list_for_each_entry(d, &hci_dev_list, list) {
412 if (d->dev_type == HCI_BREDR &&
d7a5a11d 413 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 414 count++;
415 }
416
417 rp_len = sizeof(*rp) + (2 * count);
418 rp = kmalloc(rp_len, GFP_ATOMIC);
419 if (!rp) {
420 read_unlock(&hci_dev_list_lock);
421 return -ENOMEM;
422 }
423
424 count = 0;
425 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 426 if (hci_dev_test_flag(d, HCI_SETUP) ||
427 hci_dev_test_flag(d, HCI_CONFIG) ||
428 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 429 continue;
430
431 /* Devices marked as raw-only are neither configured
432 * nor unconfigured controllers.
433 */
434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
435 continue;
436
437 if (d->dev_type == HCI_BREDR &&
d7a5a11d 438 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 439 rp->index[count++] = cpu_to_le16(d->id);
440 BT_DBG("Added hci%u", d->id);
441 }
442 }
443
444 rp->num_controllers = cpu_to_le16(count);
445 rp_len = sizeof(*rp) + (2 * count);
446
447 read_unlock(&hci_dev_list_lock);
448
2a1afb5a
JH		 449 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
450 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 451
452 kfree(rp);
453
454 return err;
455}
456
96f1474a
MH		 457static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
458 void *data, u16 data_len)
459{
460 struct mgmt_rp_read_ext_index_list *rp;
461 struct hci_dev *d;
462 size_t rp_len;
463 u16 count;
464 int err;
465
466 BT_DBG("sock %p", sk);
467
468 read_lock(&hci_dev_list_lock);
469
470 count = 0;
471 list_for_each_entry(d, &hci_dev_list, list) {
472 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
473 count++;
474 }
475
476 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
477 rp = kmalloc(rp_len, GFP_ATOMIC);
478 if (!rp) {
479 read_unlock(&hci_dev_list_lock);
480 return -ENOMEM;
481 }
482
483 count = 0;
484 list_for_each_entry(d, &hci_dev_list, list) {
485 if (hci_dev_test_flag(d, HCI_SETUP) ||
486 hci_dev_test_flag(d, HCI_CONFIG) ||
487 hci_dev_test_flag(d, HCI_USER_CHANNEL))
488 continue;
489
490 /* Devices marked as raw-only are neither configured
491 * nor unconfigured controllers.
492 */
493 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
494 continue;
495
496 if (d->dev_type == HCI_BREDR) {
497 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
498 rp->entry[count].type = 0x01;
499 else
500 rp->entry[count].type = 0x00;
501 } else if (d->dev_type == HCI_AMP) {
502 rp->entry[count].type = 0x02;
503 } else {
504 continue;
505 }
506
507 rp->entry[count].bus = d->bus;
508 rp->entry[count++].index = cpu_to_le16(d->id);
509 BT_DBG("Added hci%u", d->id);
510 }
511
512 rp->num_controllers = cpu_to_le16(count);
513 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
514
515 read_unlock(&hci_dev_list_lock);
516
517 /* If this command is called at least once, then all the
518 * default index and unconfigured index events are disabled
519 * and from now on only extended index events are used.
520 */
521 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
522 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
523 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
524
525 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
526 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
527
528 kfree(rp);
529
530 return err;
531}
532
dbece37a
MH		 533static bool is_configured(struct hci_dev *hdev)
534{
535 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 536 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 537 return false;
538
539 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
540 !bacmp(&hdev->public_addr, BDADDR_ANY))
541 return false;
542
543 return true;
544}
545
89bc22d2
MH		 546static __le32 get_missing_options(struct hci_dev *hdev)
547{
548 u32 options = 0;
549
dbece37a 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 552 options |= MGMT_OPTION_EXTERNAL_CONFIG;
553
89bc22d2
MH		 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 options |= MGMT_OPTION_PUBLIC_ADDRESS;
557
558 return cpu_to_le32(options);
559}
560
f4537c04
MH		 561static int new_options(struct hci_dev *hdev, struct sock *skip)
562{
563 __le32 options = get_missing_options(hdev);
564
f6b7712e
MH		 565 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
566 sizeof(options), skip);
f4537c04
MH		 567}
568
dbece37a
MH		 569static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
570{
571 __le32 options = get_missing_options(hdev);
572
2a1afb5a
JH		 573 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
574 sizeof(options));
dbece37a
MH		 575}
576
9fc3bfb6
MH		 577static int read_config_info(struct sock *sk, struct hci_dev *hdev,
578 void *data, u16 data_len)
579{
580 struct mgmt_rp_read_config_info rp;
89bc22d2 581 u32 options = 0;
9fc3bfb6
MH		 582
583 BT_DBG("sock %p %s", sk, hdev->name);
584
585 hci_dev_lock(hdev);
586
587 memset(&rp, 0, sizeof(rp));
588 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 589
eb1904f4
MH		 590 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
591 options |= MGMT_OPTION_EXTERNAL_CONFIG;
592
9fc3bfb6 593 if (hdev->set_bdaddr)
89bc22d2
MH		 594 options |= MGMT_OPTION_PUBLIC_ADDRESS;
595
596 rp.supported_options = cpu_to_le32(options);
597 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 598
599 hci_dev_unlock(hdev);
600
2a1afb5a
JH		 601 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
602 &rp, sizeof(rp));
9fc3bfb6
MH		 603}
604
69ab39ea
JH		 605static u32 get_supported_settings(struct hci_dev *hdev)
606{
607 u32 settings = 0;
608
609 settings |= MGMT_SETTING_POWERED;
b2939475 610 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 611 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 612 settings |= MGMT_SETTING_CONNECTABLE;
613 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 614
ed3fa31f 615 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 616 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
617 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 618 settings |= MGMT_SETTING_BREDR;
619 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 620
621 if (lmp_ssp_capable(hdev)) {
622 settings |= MGMT_SETTING_SSP;
623 settings |= MGMT_SETTING_HS;
624 }
e98d2ce2 625
05b3c3e7 626 if (lmp_sc_capable(hdev))
e98d2ce2 627 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 628 }
d7b7e796 629
eeca6f89 630 if (lmp_le_capable(hdev)) {
9d42820f 631 settings |= MGMT_SETTING_LE;
eeca6f89 632 settings |= MGMT_SETTING_ADVERTISING;
a3209694 633 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 634 settings |= MGMT_SETTING_PRIVACY;
93690c22 635 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 636 }
69ab39ea 637
eb1904f4
MH		 638 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
639 hdev->set_bdaddr)
9fc3bfb6
MH		 640 settings |= MGMT_SETTING_CONFIGURATION;
641
69ab39ea
JH		 642 return settings;
643}
644
645static u32 get_current_settings(struct hci_dev *hdev)
646{
647 u32 settings = 0;
648
f1f0eb02 649 if (hdev_is_powered(hdev))
f0d4b78a
MH		 650 settings |= MGMT_SETTING_POWERED;
651
d7a5a11d 652 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 653 settings |= MGMT_SETTING_CONNECTABLE;
654
d7a5a11d 655 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 656 settings |= MGMT_SETTING_FAST_CONNECTABLE;
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 659 settings |= MGMT_SETTING_DISCOVERABLE;
660
d7a5a11d 661 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 662 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 665 settings |= MGMT_SETTING_BREDR;
666
d7a5a11d 667 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 668 settings |= MGMT_SETTING_LE;
669
d7a5a11d 670 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 671 settings |= MGMT_SETTING_LINK_SECURITY;
672
d7a5a11d 673 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 674 settings |= MGMT_SETTING_SSP;
675
d7a5a11d 676 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 677 settings |= MGMT_SETTING_HS;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 680 settings |= MGMT_SETTING_ADVERTISING;
681
d7a5a11d 682 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 683 settings |= MGMT_SETTING_SECURE_CONN;
684
d7a5a11d 685 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 686 settings |= MGMT_SETTING_DEBUG_KEYS;
687
d7a5a11d 688 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 689 settings |= MGMT_SETTING_PRIVACY;
690
93690c22
MH		 691 /* The current setting for static address has two purposes. The
692 * first is to indicate if the static address will be used and
693 * the second is to indicate if it is actually set.
694 *
695 * This means if the static address is not configured, this flag
08dc0e98 696 * will never be set. If the address is configured, then if the
93690c22
MH		 697 * address is actually used decides if the flag is set or not.
698 *
699 * For single mode LE only controllers and dual-mode controllers
700 * with BR/EDR disabled, the existence of the static address will
701 * be evaluated.
702 */
b7cb93e5 703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 704 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 705 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
706 if (bacmp(&hdev->static_addr, BDADDR_ANY))
707 settings |= MGMT_SETTING_STATIC_ADDRESS;
708 }
709
69ab39ea
JH		 710 return settings;
711}
712
ef580372
JH		 713#define PNP_INFO_SVCLASS_ID 0x1200
714
213202ed
JH		 715static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
716{
717 u8 *ptr = data, *uuids_start = NULL;
718 struct bt_uuid *uuid;
719
720 if (len < 4)
721 return ptr;
722
723 list_for_each_entry(uuid, &hdev->uuids, list) {
724 u16 uuid16;
725
726 if (uuid->size != 16)
727 continue;
728
729 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
730 if (uuid16 < 0x1100)
731 continue;
732
733 if (uuid16 == PNP_INFO_SVCLASS_ID)
734 continue;
735
736 if (!uuids_start) {
737 uuids_start = ptr;
738 uuids_start[0] = 1;
739 uuids_start[1] = EIR_UUID16_ALL;
740 ptr += 2;
741 }
742
743 /* Stop if not enough space to put next UUID */
744 if ((ptr - data) + sizeof(u16) > len) {
745 uuids_start[1] = EIR_UUID16_SOME;
746 break;
747 }
748
749 *ptr++ = (uuid16 & 0x00ff);
750 *ptr++ = (uuid16 & 0xff00) >> 8;
751 uuids_start[0] += sizeof(uuid16);
752 }
753
754 return ptr;
755}
756
cdf1963f
JH		 757static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
758{
759 u8 *ptr = data, *uuids_start = NULL;
760 struct bt_uuid *uuid;
761
762 if (len < 6)
763 return ptr;
764
765 list_for_each_entry(uuid, &hdev->uuids, list) {
766 if (uuid->size != 32)
767 continue;
768
769 if (!uuids_start) {
770 uuids_start = ptr;
771 uuids_start[0] = 1;
772 uuids_start[1] = EIR_UUID32_ALL;
773 ptr += 2;
774 }
775
776 /* Stop if not enough space to put next UUID */
777 if ((ptr - data) + sizeof(u32) > len) {
778 uuids_start[1] = EIR_UUID32_SOME;
779 break;
780 }
781
782 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
783 ptr += sizeof(u32);
784 uuids_start[0] += sizeof(u32);
785 }
786
787 return ptr;
788}
789
c00d575b
JH		 790static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
791{
792 u8 *ptr = data, *uuids_start = NULL;
793 struct bt_uuid *uuid;
794
795 if (len < 18)
796 return ptr;
797
798 list_for_each_entry(uuid, &hdev->uuids, list) {
799 if (uuid->size != 128)
800 continue;
801
802 if (!uuids_start) {
803 uuids_start = ptr;
804 uuids_start[0] = 1;
805 uuids_start[1] = EIR_UUID128_ALL;
806 ptr += 2;
807 }
808
809 /* Stop if not enough space to put next UUID */
810 if ((ptr - data) + 16 > len) {
811 uuids_start[1] = EIR_UUID128_SOME;
812 break;
813 }
814
815 memcpy(ptr, uuid->uuid, 16);
816 ptr += 16;
817 uuids_start[0] += 16;
818 }
819
820 return ptr;
821}
822
333ae95d
JH		 823static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
824{
825 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
826}
827
333ae95d
JH		 828static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
829 struct hci_dev *hdev,
830 const void *data)
831{
832 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
833}
834
91aa9bb2
FG		 835static u8 get_current_adv_instance(struct hci_dev *hdev)
836{
837 /* The "Set Advertising" setting supersedes the "Add Advertising"
838 * setting. Here we set the advertising data based on which
839 * setting was set. When neither apply, default to the global settings,
840 * represented by instance "0".
841 */
842 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
843 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
3ff37e6b 844 return hdev->cur_adv_instance;
91aa9bb2
FG		 845
846 return 0x00;
847}
848
4117ed70 849static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 850{
7a5f4990
MH		 851 u8 ad_len = 0;
852 size_t name_len;
853
854 name_len = strlen(hdev->dev_name);
855 if (name_len > 0) {
856 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
857
858 if (name_len > max_len) {
859 name_len = max_len;
860 ptr[1] = EIR_NAME_SHORT;
861 } else
862 ptr[1] = EIR_NAME_COMPLETE;
863
864 ptr[0] = name_len + 1;
865
866 memcpy(ptr + 2, hdev->dev_name, name_len);
867
868 ad_len += (name_len + 2);
869 ptr += (name_len + 2);
870 }
871
872 return ad_len;
f14d8f64
MH		 873}
874
ca21fbe9
FG		 875static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
876 u8 *ptr)
4117ed70 877{
ca21fbe9
FG		 878 struct adv_info *adv_instance;
879
880 adv_instance = hci_find_adv_instance(hdev, instance);
881 if (!adv_instance)
882 return 0;
883
4117ed70
AU		 884 /* TODO: Set the appropriate entries based on advertising instance flags
885 * here once flags other than 0 are supported.
886 */
ca21fbe9
FG		 887 memcpy(ptr, adv_instance->scan_rsp_data,
888 adv_instance->scan_rsp_len);
4117ed70 889
ca21fbe9 890 return adv_instance->scan_rsp_len;
4117ed70
AU		 891}
892
efae002c 893static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
f14d8f64
MH		 894{
895 struct hci_dev *hdev = req->hdev;
896 struct hci_cp_le_set_scan_rsp_data cp;
897 u8 len;
898
d7a5a11d 899 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 900 return;
901
902 memset(&cp, 0, sizeof(cp));
903
4117ed70 904 if (instance)
ca21fbe9 905 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
4117ed70
AU		 906 else
907 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 908
eb438b5f 909 if (hdev->scan_rsp_data_len == len &&
4117ed70 910 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 911 return;
912
eb438b5f
JH		 913 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
914 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 915
916 cp.length = len;
917
918 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
919}
920
4117ed70
AU		 921static void update_scan_rsp_data(struct hci_request *req)
922{
efae002c 923 update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
4117ed70
AU		 924}
925
9a43e25f
JH		 926static u8 get_adv_discov_flags(struct hci_dev *hdev)
927{
3b0602cd 928 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 929
930 /* If there's a pending mgmt command the flags will not yet have
931 * their final values, so check for this first.
932 */
333ae95d 933 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 934 if (cmd) {
935 struct mgmt_mode *cp = cmd->param;
936 if (cp->val == 0x01)
937 return LE_AD_GENERAL;
938 else if (cp->val == 0x02)
939 return LE_AD_LIMITED;
940 } else {
d7a5a11d 941 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 942 return LE_AD_LIMITED;
d7a5a11d 943 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 944 return LE_AD_GENERAL;
945 }
946
947 return 0;
948}
949
fdf51784
AU		 950static bool get_connectable(struct hci_dev *hdev)
951{
952 struct mgmt_pending_cmd *cmd;
441ad2d0 953
fdf51784
AU		 954 /* If there's a pending mgmt command the flag will not yet have
955 * it's final value, so check for this first.
956 */
957 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
958 if (cmd) {
959 struct mgmt_mode *cp = cmd->param;
441ad2d0 960
fdf51784 961 return cp->val;
441ad2d0
MH		 962 }
963
fdf51784
AU		 964 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
965}
441ad2d0 966
fdf51784
AU		 967static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
968{
969 u32 flags;
411b4121 970 struct adv_info *adv_instance;
441ad2d0 971
bea28e65
FG		 972 if (instance == 0x00) {
973 /* Instance 0 always manages the "Tx Power" and "Flags"
974 * fields
975 */
976 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
411b4121 977
bea28e65
FG		 978 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
979 * corresponds to the "connectable" instance flag.
980 */
981 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
982 flags |= MGMT_ADV_FLAG_CONNECTABLE;
fdf51784 983
bea28e65 984 return flags;
411b4121 985 }
fdf51784 986
bea28e65 987 adv_instance = hci_find_adv_instance(hdev, instance);
fdf51784 988
bea28e65
FG		 989 /* Return 0 when we got an invalid instance identifier. */
990 if (!adv_instance)
991 return 0;
fdf51784 992
bea28e65 993 return adv_instance->flags;
441ad2d0
MH		 994}
995
7b683b74 996static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
c7d4883b 997{
7b683b74
FG		 998 u8 instance = get_current_adv_instance(hdev);
999 struct adv_info *adv_instance;
1000
1001 /* Ignore instance 0 */
1002 if (instance == 0x00)
1003 return 0;
1004
1005 adv_instance = hci_find_adv_instance(hdev, instance);
1006 if (!adv_instance)
c7d4883b
AU		 1007 return 0;
1008
1009 /* TODO: Take into account the "appearance" and "local-name" flags here.
1010 * These are currently being ignored as they are not supported.
1011 */
7b683b74 1012 return adv_instance->scan_rsp_len;
c7d4883b
AU		 1013}
1014
fdf51784 1015static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1016{
f63ba24b 1017 struct adv_info *adv_instance = NULL;
b44133ff 1018 u8 ad_len = 0, flags = 0;
f63ba24b
FG		 1019 u32 instance_flags;
1020
1021 /* Return 0 when the current instance identifier is invalid. */
1022 if (instance) {
1023 adv_instance = hci_find_adv_instance(hdev, instance);
1024 if (!adv_instance)
1025 return 0;
1026 }
1027
1028 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1029
807ec772
AU		 1030 /* The Add Advertising command allows userspace to set both the general
1031 * and limited discoverable flags.
1032 */
fdf51784 1033 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1034 flags |= LE_AD_GENERAL;
1035
fdf51784 1036 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1037 flags |= LE_AD_LIMITED;
1038
fdf51784 1039 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1040 /* If a discovery flag wasn't provided, simply use the global
1041 * settings.
1042 */
1043 if (!flags)
1044 flags |= get_adv_discov_flags(hdev);
1045
b44133ff
AU		 1046 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1047 flags |= LE_AD_NO_BREDR;
1048
fdf51784
AU		 1049 /* If flags would still be empty, then there is no need to
1050 * include the "Flags" AD field".
1051 */
1052 if (flags) {
1053 ptr[0] = 0x02;
1054 ptr[1] = EIR_FLAGS;
1055 ptr[2] = flags;
b44133ff 1056
fdf51784
AU		 1057 ad_len += 3;
1058 ptr += 3;
1059 }
b44133ff
AU		 1060 }
1061
f63ba24b
FG		 1062 if (adv_instance) {
1063 memcpy(ptr, adv_instance->adv_data,
1064 adv_instance->adv_data_len);
1065 ad_len += adv_instance->adv_data_len;
1066 ptr += adv_instance->adv_data_len;
38c8af60
MH		 1067 }
1068
fdf51784 1069 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1070 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1071 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1072 ptr[0] = 0x02;
1073 ptr[1] = EIR_TX_POWER;
1074 ptr[2] = (u8)hdev->adv_tx_power;
1075
1076 ad_len += 3;
1077 ptr += 3;
1078 }
1079
b44133ff 1080 return ad_len;
24b4f38f
AU		 1081}
1082
efae002c 1083static void update_inst_adv_data(struct hci_request *req, u8 instance)
441ad2d0
MH		 1084{
1085 struct hci_dev *hdev = req->hdev;
1086 struct hci_cp_le_set_adv_data cp;
1087 u8 len;
1088
d7a5a11d 1089 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1090 return;
1091
1092 memset(&cp, 0, sizeof(cp));
1093
fdf51784 1094 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1095
24b4f38f 1096 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1097 if (hdev->adv_data_len == len &&
1098 memcmp(cp.data, hdev->adv_data, len) == 0)
1099 return;
1100
1101 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1102 hdev->adv_data_len = len;
1103
1104 cp.length = len;
1105
1106 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1107}
1108
e7a685d3
AU		 1109static void update_adv_data(struct hci_request *req)
1110{
efae002c 1111 update_inst_adv_data(req, get_current_adv_instance(req->hdev));
24b4f38f
AU		 1112}
1113
bc6d2d04
JH		 1114int mgmt_update_adv_data(struct hci_dev *hdev)
1115{
1116 struct hci_request req;
1117
1118 hci_req_init(&req, hdev);
1119 update_adv_data(&req);
1120
1121 return hci_req_run(&req, NULL);
1122}
1123
ef580372
JH		 1124static void create_eir(struct hci_dev *hdev, u8 *data)
1125{
1126 u8 *ptr = data;
ef580372
JH		 1127 size_t name_len;
1128
1129 name_len = strlen(hdev->dev_name);
1130
1131 if (name_len > 0) {
1132 /* EIR Data type */
1133 if (name_len > 48) {
1134 name_len = 48;
1135 ptr[1] = EIR_NAME_SHORT;
1136 } else
1137 ptr[1] = EIR_NAME_COMPLETE;
1138
1139 /* EIR Data length */
1140 ptr[0] = name_len + 1;
1141
1142 memcpy(ptr + 2, hdev->dev_name, name_len);
1143
ef580372
JH		 1144 ptr += (name_len + 2);
1145 }
1146
bbaf444a 1147 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1148 ptr[0] = 2;
1149 ptr[1] = EIR_TX_POWER;
1150 ptr[2] = (u8) hdev->inq_tx_power;
1151
91c4e9b1
MH		 1152 ptr += 3;
1153 }
1154
2b9be137
MH		 1155 if (hdev->devid_source > 0) {
1156 ptr[0] = 9;
1157 ptr[1] = EIR_DEVICE_ID;
1158
1159 put_unaligned_le16(hdev->devid_source, ptr + 2);
1160 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1161 put_unaligned_le16(hdev->devid_product, ptr + 6);
1162 put_unaligned_le16(hdev->devid_version, ptr + 8);
1163
2b9be137
MH		 1164 ptr += 10;
1165 }
1166
213202ed 1167 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1168 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1169 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1170}
1171
890ea898 1172static void update_eir(struct hci_request *req)
ef580372 1173{
890ea898 1174 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1175 struct hci_cp_write_eir cp;
1176
504c8dcd 1177 if (!hdev_is_powered(hdev))
890ea898 1178 return;
7770c4aa 1179
976eb20e 1180 if (!lmp_ext_inq_capable(hdev))
890ea898 1181 return;
ef580372 1182
d7a5a11d 1183 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1184 return;
ef580372 1185
d7a5a11d 1186 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1187 return;
ef580372
JH		 1188
1189 memset(&cp, 0, sizeof(cp));
1190
1191 create_eir(hdev, cp.data);
1192
1193 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1194 return;
ef580372
JH		 1195
1196 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1197
890ea898 1198 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1199}
1200
1201static u8 get_service_classes(struct hci_dev *hdev)
1202{
1203 struct bt_uuid *uuid;
1204 u8 val = 0;
1205
1206 list_for_each_entry(uuid, &hdev->uuids, list)
1207 val |= uuid->svc_hint;
1208
1209 return val;
1210}
1211
890ea898 1212static void update_class(struct hci_request *req)
ef580372 1213{
890ea898 1214 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1215 u8 cod[3];
1216
1217 BT_DBG("%s", hdev->name);
1218
504c8dcd 1219 if (!hdev_is_powered(hdev))
890ea898 1220 return;
7770c4aa 1221
d7a5a11d 1222 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1223 return;
1224
d7a5a11d 1225 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1226 return;
ef580372
JH		 1227
1228 cod[0] = hdev->minor_class;
1229 cod[1] = hdev->major_class;
1230 cod[2] = get_service_classes(hdev);
1231
d7a5a11d 1232 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1233 cod[1] |= 0x20;
1234
ef580372 1235 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1236 return;
ef580372 1237
890ea898 1238 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1239}
1240
0ec5ae84
JH		 1241static void disable_advertising(struct hci_request *req)
1242{
1243 u8 enable = 0x00;
1244
1245 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1246}
1247
199a2fb1
JH		 1248static void enable_advertising(struct hci_request *req)
1249{
1250 struct hci_dev *hdev = req->hdev;
1251 struct hci_cp_le_set_adv_param cp;
8f2a0601 1252 u8 own_addr_type, enable = 0x01;
a4858cb9 1253 bool connectable;
e7a685d3
AU		 1254 u8 instance;
1255 u32 flags;
199a2fb1 1256
0ec5ae84
JH		 1257 if (hci_conn_num(hdev, LE_LINK) > 0)
1258 return;
1259
d7a5a11d 1260 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1261 disable_advertising(req);
1262
5ce194c4 1263 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1264 * hci_update_random_address knows that it's safe to go ahead
1265 * and write a new random address. The flag will be set back on
1266 * as soon as the SET_ADV_ENABLE HCI command completes.
1267 */
a358dc11 1268 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1269
e7a685d3
AU		 1270 instance = get_current_adv_instance(hdev);
1271 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1272
1273 /* If the "connectable" instance flag was not set, then choose between
1274 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1275 */
1276 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1277 get_connectable(hdev);
8f2a0601 1278
a4858cb9
JH		 1279 /* Set require_privacy to true only when non-connectable
1280 * advertising is used. In that case it is fine to use a
1281 * non-resolvable private address.
1282 */
1283 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1284 return;
1285
41c90c18 1286 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1287 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1288 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1289
1290 if (connectable)
1291 cp.type = LE_ADV_IND;
7b683b74 1292 else if (get_cur_adv_instance_scan_rsp_len(hdev))
c7d4883b
AU		 1293 cp.type = LE_ADV_SCAN_IND;
1294 else
1295 cp.type = LE_ADV_NONCONN_IND;
1296
8f2a0601 1297 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1298 cp.channel_map = hdev->le_adv_channel_map;
1299
1300 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1301
1302 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1303}
1304
7d78525d
JH		 1305static void service_cache_off(struct work_struct *work)
1306{
1307 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1308 service_cache.work);
890ea898 1309 struct hci_request req;
7d78525d 1310
a69d8927 1311 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1312 return;
1313
890ea898
JH		 1314 hci_req_init(&req, hdev);
1315
7d78525d
JH		 1316 hci_dev_lock(hdev);
1317
890ea898
JH		 1318 update_eir(&req);
1319 update_class(&req);
7d78525d
JH		 1320
1321 hci_dev_unlock(hdev);
890ea898
JH		 1322
1323 hci_req_run(&req, NULL);
7d78525d
JH		 1324}
1325
d6bfd59c
JH		 1326static void rpa_expired(struct work_struct *work)
1327{
1328 struct hci_dev *hdev = container_of(work, struct hci_dev,
1329 rpa_expired.work);
1330 struct hci_request req;
1331
1332 BT_DBG("");
1333
a1536da2 1334 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1335
d7a5a11d 1336 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1337 return;
1338
1339 /* The generation of a new RPA and programming it into the
1340 * controller happens in the enable_advertising() function.
1341 */
d6bfd59c 1342 hci_req_init(&req, hdev);
d6bfd59c 1343 enable_advertising(&req);
d6bfd59c
JH		 1344 hci_req_run(&req, NULL);
1345}
1346
6a919082 1347static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1348{
238be788 1349 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1350 return;
1351
4f87da80 1352 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1353 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1354
4f87da80
JH		 1355 /* Non-mgmt controlled devices get this bit set
1356 * implicitly so that pairing works for them, however
1357 * for mgmt we require user-space to explicitly enable
1358 * it
1359 */
a358dc11 1360 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1361}
1362
0f4e68cf 1363static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1364 void *data, u16 data_len)
0381101f 1365{
a38528f1 1366 struct mgmt_rp_read_info rp;
f7b64e69 1367
bdb6d971 1368 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1369
09fd0de5 1370 hci_dev_lock(hdev);
f7b64e69 1371
dc4fe30b
JH		 1372 memset(&rp, 0, sizeof(rp));
1373
69ab39ea 1374 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1375
69ab39ea 1376 rp.version = hdev->hci_ver;
eb55ef07 1377 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1378
1379 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1380 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1381
a38528f1 1382 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1383
dc4fe30b 1384 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1385 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1386
09fd0de5 1387 hci_dev_unlock(hdev);
0381101f 1388
2a1afb5a
JH		 1389 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1390 sizeof(rp));
0381101f
JH		 1391}
1392
69ab39ea 1393static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1394{
69ab39ea 1395 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1396
2a1afb5a
JH		 1397 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1398 sizeof(settings));
8680570b
JH		 1399}
1400
1904a853 1401static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1402{
1403 BT_DBG("%s status 0x%02x", hdev->name, status);
1404
a3172b7e
JH		 1405 if (hci_conn_count(hdev) == 0) {
1406 cancel_delayed_work(&hdev->power_off);
8b064a3a 1407 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1408 }
8b064a3a
JH		 1409}
1410
23a48093 1411static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1412{
1413 struct hci_dev *hdev = req->hdev;
1414 struct hci_cp_remote_name_req_cancel cp;
1415 struct inquiry_entry *e;
1416
1417 switch (hdev->discovery.state) {
1418 case DISCOVERY_FINDING:
07d2334a 1419 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1420 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1421
1422 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1423 cancel_delayed_work(&hdev->le_scan_disable);
1424 hci_req_add_le_scan_disable(req);
1425 }
1426
23a48093 1427 return true;
21a60d30
JH		 1428
1429 case DISCOVERY_RESOLVING:
1430 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1431 NAME_PENDING);
1432 if (!e)
23a48093 1433 break;
21a60d30
JH		 1434
1435 bacpy(&cp.bdaddr, &e->data.bdaddr);
1436 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1437 &cp);
1438
23a48093 1439 return true;
21a60d30
JH		 1440
1441 default:
1442 /* Passive scanning */
d7a5a11d 1443 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1444 hci_req_add_le_scan_disable(req);
23a48093
JH		 1445 return true;
1446 }
1447
21a60d30
JH		 1448 break;
1449 }
23a48093
JH		 1450
1451 return false;
21a60d30
JH		 1452}
1453
912098a6
AU		 1454static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1455 u8 instance)
1456{
1457 struct mgmt_ev_advertising_added ev;
1458
1459 ev.instance = instance;
1460
1461 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1462}
1463
1464static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1465 u8 instance)
1466{
1467 struct mgmt_ev_advertising_removed ev;
1468
1469 ev.instance = instance;
1470
1471 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1472}
1473
7816b820
FG		 1474static int schedule_adv_instance(struct hci_request *req, u8 instance,
1475 bool force) {
1476 struct hci_dev *hdev = req->hdev;
1477 struct adv_info *adv_instance = NULL;
1478 u16 timeout;
1479
1480 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1481 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1482 return -EPERM;
1483
1484 if (hdev->adv_instance_timeout)
1485 return -EBUSY;
1486
1487 adv_instance = hci_find_adv_instance(hdev, instance);
1488 if (!adv_instance)
1489 return -ENOENT;
1490
1491 /* A zero timeout means unlimited advertising. As long as there is
1492 * only one instance, duration should be ignored. We still set a timeout
1493 * in case further instances are being added later on.
1494 *
1495 * If the remaining lifetime of the instance is more than the duration
1496 * then the timeout corresponds to the duration, otherwise it will be
1497 * reduced to the remaining instance lifetime.
1498 */
1499 if (adv_instance->timeout == 0 ||
1500 adv_instance->duration <= adv_instance->remaining_time)
1501 timeout = adv_instance->duration;
1502 else
1503 timeout = adv_instance->remaining_time;
1504
1505 /* The remaining time is being reduced unless the instance is being
1506 * advertised without time limit.
1507 */
1508 if (adv_instance->timeout)
1509 adv_instance->remaining_time =
1510 adv_instance->remaining_time - timeout;
1511
1512 hdev->adv_instance_timeout = timeout;
1513 queue_delayed_work(hdev->workqueue,
1514 &hdev->adv_instance_expire,
1515 msecs_to_jiffies(timeout * 1000));
1516
1517 /* If we're just re-scheduling the same instance again then do not
1518 * execute any HCI commands. This happens when a single instance is
1519 * being advertised.
1520 */
1521 if (!force && hdev->cur_adv_instance == instance &&
1522 hci_dev_test_flag(hdev, HCI_LE_ADV))
1523 return 0;
1524
1525 hdev->cur_adv_instance = instance;
1526 update_adv_data(req);
1527 update_scan_rsp_data(req);
1528 enable_advertising(req);
1529
1530 return 0;
1531}
1532
1533static void cancel_adv_timeout(struct hci_dev *hdev)
1534{
1535 if (hdev->adv_instance_timeout) {
1536 hdev->adv_instance_timeout = 0;
1537 cancel_delayed_work(&hdev->adv_instance_expire);
1538 }
1539}
1540
847818d9
FG		 1541/* For a single instance:
1542 * - force == true: The instance will be removed even when its remaining
1543 * lifetime is not zero.
1544 * - force == false: the instance will be deactivated but kept stored unless
1545 * the remaining lifetime is zero.
1546 *
1547 * For instance == 0x00:
1548 * - force == true: All instances will be removed regardless of their timeout
1549 * setting.
1550 * - force == false: Only instances that have a timeout will be removed.
1551 */
1552static void clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1553 u8 instance, bool force)
912098a6 1554{
847818d9
FG		 1555 struct adv_info *adv_instance, *n, *next_instance = NULL;
1556 int err;
1557 u8 rem_inst;
912098a6 1558
847818d9
FG		 1559 /* Cancel any timeout concerning the removed instance(s). */
1560 if (!instance || hdev->cur_adv_instance == instance)
1561 cancel_adv_timeout(hdev);
912098a6 1562
847818d9
FG		 1563 /* Get the next instance to advertise BEFORE we remove
1564 * the current one. This can be the same instance again
1565 * if there is only one instance.
1566 */
1567 if (instance && hdev->cur_adv_instance == instance)
1568 next_instance = hci_get_next_instance(hdev, instance);
912098a6 1569
847818d9
FG		 1570 if (instance == 0x00) {
1571 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1572 list) {
1573 if (!(force || adv_instance->timeout))
1574 continue;
912098a6 1575
847818d9
FG		 1576 rem_inst = adv_instance->instance;
1577 err = hci_remove_adv_instance(hdev, rem_inst);
1578 if (!err)
1579 advertising_removed(NULL, hdev, rem_inst);
1580 }
1581 hdev->cur_adv_instance = 0x00;
1582 } else {
1583 adv_instance = hci_find_adv_instance(hdev, instance);
1584
1585 if (force || (adv_instance && adv_instance->timeout &&
1586 !adv_instance->remaining_time)) {
1587 /* Don't advertise a removed instance. */
1588 if (next_instance &&
1589 next_instance->instance == instance)
1590 next_instance = NULL;
1591
1592 err = hci_remove_adv_instance(hdev, instance);
1593 if (!err)
1594 advertising_removed(NULL, hdev, instance);
1595 }
1596 }
1597
1598 if (list_empty(&hdev->adv_instances)) {
1599 hdev->cur_adv_instance = 0x00;
1600 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1601 }
1602
1603 if (!req || !hdev_is_powered(hdev) ||
912098a6
AU		 1604 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1605 return;
1606
847818d9
FG		 1607 if (next_instance)
1608 schedule_adv_instance(req, next_instance->instance, false);
912098a6
AU		 1609}
1610
8b064a3a
JH		 1611static int clean_up_hci_state(struct hci_dev *hdev)
1612{
1613 struct hci_request req;
1614 struct hci_conn *conn;
23a48093
JH		 1615 bool discov_stopped;
1616 int err;
8b064a3a
JH		 1617
1618 hci_req_init(&req, hdev);
1619
1620 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1621 test_bit(HCI_PSCAN, &hdev->flags)) {
1622 u8 scan = 0x00;
1623 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1624 }
1625
847818d9 1626 clear_adv_instance(hdev, NULL, 0x00, false);
912098a6 1627
d7a5a11d 1628 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1629 disable_advertising(&req);
1630
23a48093 1631 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1632
1633 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1634 struct hci_cp_disconnect dc;
c9910d0f
JH		 1635 struct hci_cp_reject_conn_req rej;
1636
1637 switch (conn->state) {
1638 case BT_CONNECTED:
1639 case BT_CONFIG:
1640 dc.handle = cpu_to_le16(conn->handle);
1641 dc.reason = 0x15; /* Terminated due to Power Off */
1642 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1643 break;
1644 case BT_CONNECT:
1645 if (conn->type == LE_LINK)
1646 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1647 0, NULL);
1648 else if (conn->type == ACL_LINK)
1649 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1650 6, &conn->dst);
1651 break;
1652 case BT_CONNECT2:
1653 bacpy(&rej.bdaddr, &conn->dst);
1654 rej.reason = 0x15; /* Terminated due to Power Off */
1655 if (conn->type == ACL_LINK)
1656 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1657 sizeof(rej), &rej);
1658 else if (conn->type == SCO_LINK)
1659 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1660 sizeof(rej), &rej);
1661 break;
1662 }
8b064a3a
JH		 1663 }
1664
23a48093
JH		 1665 err = hci_req_run(&req, clean_up_hci_complete);
1666 if (!err && discov_stopped)
1667 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1668
1669 return err;
8b064a3a
JH		 1670}
1671
bdb6d971 1672static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1673 u16 len)
eec8d2bc 1674{
650f726d 1675 struct mgmt_mode *cp = data;
3b0602cd 1676 struct mgmt_pending_cmd *cmd;
4b34ee78 1677 int err;
eec8d2bc 1678
bdb6d971 1679 BT_DBG("request for %s", hdev->name);
eec8d2bc 1680
a7e80f25 1681 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1682 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1683 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1684
09fd0de5 1685 hci_dev_lock(hdev);
eec8d2bc 1686
333ae95d 1687 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1688 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1689 MGMT_STATUS_BUSY);
87b95ba6
JH		 1690 goto failed;
1691 }
1692
a69d8927 1693 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1694 cancel_delayed_work(&hdev->power_off);
1695
1696 if (cp->val) {
a1d70450
JH		 1697 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1698 data, len);
1699 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1700 goto failed;
1701 }
1702 }
1703
4b34ee78 1704 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1705 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1706 goto failed;
1707 }
1708
2e58ef3e 1709 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1710 if (!cmd) {
1711 err = -ENOMEM;
eec8d2bc 1712 goto failed;
366a0336 1713 }
eec8d2bc 1714
8b064a3a 1715 if (cp->val) {
19202573 1716 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1717 err = 0;
1718 } else {
1719 /* Disconnect connections, stop scans, etc */
1720 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1721 if (!err)
1722 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1723 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1724
8b064a3a
JH		 1725 /* ENODATA means there were no HCI commands queued */
1726 if (err == -ENODATA) {
a3172b7e 1727 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1728 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1729 err = 0;
1730 }
1731 }
eec8d2bc
JH		 1732
1733failed:
09fd0de5 1734 hci_dev_unlock(hdev);
366a0336 1735 return err;
eec8d2bc
JH		 1736}
1737
beadb2bd
JH		 1738static int new_settings(struct hci_dev *hdev, struct sock *skip)
1739{
f6b7712e 1740 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1741
f6b7712e
MH		 1742 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1743 sizeof(ev), skip);
beadb2bd
JH		 1744}
1745
91a668b0
JH		 1746int mgmt_new_settings(struct hci_dev *hdev)
1747{
1748 return new_settings(hdev, NULL);
1749}
1750
bd99abdd
JH		 1751struct cmd_lookup {
1752 struct sock *sk;
1753 struct hci_dev *hdev;
1754 u8 mgmt_status;
1755};
1756
3b0602cd 1757static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1758{
1759 struct cmd_lookup *match = data;
1760
1761 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1762
1763 list_del(&cmd->list);
1764
1765 if (match->sk == NULL) {
1766 match->sk = cmd->sk;
1767 sock_hold(match->sk);
1768 }
1769
1770 mgmt_pending_free(cmd);
1771}
1772
3b0602cd 1773static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1774{
1775 u8 *status = data;
1776
a69e8375 1777 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1778 mgmt_pending_remove(cmd);
1779}
1780
3b0602cd 1781static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1782{
1783 if (cmd->cmd_complete) {
1784 u8 *status = data;
1785
1786 cmd->cmd_complete(cmd, *status);
1787 mgmt_pending_remove(cmd);
1788
1789 return;
1790 }
1791
1792 cmd_status_rsp(cmd, data);
1793}
1794
3b0602cd 1795static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1796{
2a1afb5a
JH		 1797 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1798 cmd->param, cmd->param_len);
f5818c22
JH		 1799}
1800
3b0602cd 1801static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1802{
2a1afb5a
JH		 1803 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1804 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1805}
1806
e6fe7986
JH		 1807static u8 mgmt_bredr_support(struct hci_dev *hdev)
1808{
1809 if (!lmp_bredr_capable(hdev))
1810 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1811 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1812 return MGMT_STATUS_REJECTED;
1813 else
1814 return MGMT_STATUS_SUCCESS;
1815}
1816
1817static u8 mgmt_le_support(struct hci_dev *hdev)
1818{
1819 if (!lmp_le_capable(hdev))
1820 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1821 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1822 return MGMT_STATUS_REJECTED;
1823 else
1824 return MGMT_STATUS_SUCCESS;
1825}
1826
1904a853
MH		 1827static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1828 u16 opcode)
bfaf8c9f 1829{
3b0602cd 1830 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1831 struct mgmt_mode *cp;
970ba524 1832 struct hci_request req;
bfaf8c9f
JH		 1833 bool changed;
1834
1835 BT_DBG("status 0x%02x", status);
1836
1837 hci_dev_lock(hdev);
1838
333ae95d 1839 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1840 if (!cmd)
1841 goto unlock;
1842
1843 if (status) {
1844 u8 mgmt_err = mgmt_status(status);
a69e8375 1845 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1846 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1847 goto remove_cmd;
1848 }
1849
1850 cp = cmd->param;
d4462a07 1851 if (cp->val) {
238be788 1852 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1853
1854 if (hdev->discov_timeout > 0) {
1855 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1856 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1857 to);
1858 }
1859 } else {
a69d8927 1860 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1861 }
bfaf8c9f
JH		 1862
1863 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1864
1865 if (changed)
1866 new_settings(hdev, cmd->sk);
1867
970ba524
MH		 1868 /* When the discoverable mode gets changed, make sure
1869 * that class of device has the limited discoverable
432df05e
JH		 1870 * bit correctly set. Also update page scan based on whitelist
1871 * entries.
970ba524
MH		 1872 */
1873 hci_req_init(&req, hdev);
1d2dc5b7 1874 __hci_update_page_scan(&req);
970ba524
MH		 1875 update_class(&req);
1876 hci_req_run(&req, NULL);
1877
bfaf8c9f
JH		 1878remove_cmd:
1879 mgmt_pending_remove(cmd);
1880
1881unlock:
1882 hci_dev_unlock(hdev);
1883}
1884
bdb6d971 1885static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1886 u16 len)
73f22f62 1887{
650f726d 1888 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1889 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1890 struct hci_request req;
5e5282bb 1891 u16 timeout;
9a43e25f 1892 u8 scan;
73f22f62
JH		 1893 int err;
1894
bdb6d971 1895 BT_DBG("request for %s", hdev->name);
73f22f62 1896
d7a5a11d
MH		 1897 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1898 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1899 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1900 MGMT_STATUS_REJECTED);
33c525c0 1901
310a3d48 1902 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1903 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1904 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1905
1f350c87 1906 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1907
1908 /* Disabling discoverable requires that no timeout is set,
1909 * and enabling limited discoverable requires a timeout.
1910 */
1911 if ((cp->val == 0x00 && timeout > 0) ||
1912 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1913 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1914 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1915
09fd0de5 1916 hci_dev_lock(hdev);
73f22f62 1917
5e5282bb 1918 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1920 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1921 goto failed;
1922 }
1923
333ae95d
JH		 1924 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1925 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1926 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1927 MGMT_STATUS_BUSY);
73f22f62
JH		 1928 goto failed;
1929 }
1930
d7a5a11d 1931 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1933 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1934 goto failed;
1935 }
1936
1937 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1938 bool changed = false;
1939
310a3d48
MH		 1940 /* Setting limited discoverable when powered off is
1941 * not a valid operation since it requires a timeout
1942 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1943 */
d7a5a11d 1944 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1945 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1946 changed = true;
1947 }
1948
5e5282bb 1949 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1950 if (err < 0)
1951 goto failed;
1952
1953 if (changed)
1954 err = new_settings(hdev, sk);
1955
5e5282bb
JH		 1956 goto failed;
1957 }
1958
310a3d48
MH		 1959 /* If the current mode is the same, then just update the timeout
1960 * value with the new value. And if only the timeout gets updated,
1961 * then no need for any HCI transactions.
1962 */
d7a5a11d
MH		 1963 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1964 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1965 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1966 cancel_delayed_work(&hdev->discov_off);
1967 hdev->discov_timeout = timeout;
955638ec 1968
36261547
MH		 1969 if (cp->val && hdev->discov_timeout > 0) {
1970 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1971 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1972 to);
955638ec
MH		 1973 }
1974
69ab39ea 1975 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1976 goto failed;
1977 }
1978
2e58ef3e 1979 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1980 if (!cmd) {
1981 err = -ENOMEM;
73f22f62 1982 goto failed;
366a0336 1983 }
73f22f62 1984
310a3d48
MH		 1985 /* Cancel any potential discoverable timeout that might be
1986 * still active and store new timeout value. The arming of
1987 * the timeout happens in the complete handler.
1988 */
1989 cancel_delayed_work(&hdev->discov_off);
1990 hdev->discov_timeout = timeout;
1991
b456f87c
JH		 1992 /* Limited discoverable mode */
1993 if (cp->val == 0x02)
a1536da2 1994 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1995 else
a358dc11 1996 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1997
bfaf8c9f
JH		 1998 hci_req_init(&req, hdev);
1999
9a43e25f
JH		 2000 /* The procedure for LE-only controllers is much simpler - just
2001 * update the advertising data.
2002 */
d7a5a11d 2003 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 2004 goto update_ad;
2005
73f22f62
JH		 2006 scan = SCAN_PAGE;
2007
310a3d48
MH		 2008 if (cp->val) {
2009 struct hci_cp_write_current_iac_lap hci_cp;
2010
2011 if (cp->val == 0x02) {
2012 /* Limited discoverable mode */
33337dcb 2013 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 2014 hci_cp.iac_lap[0] = 0x00; /* LIAC */
2015 hci_cp.iac_lap[1] = 0x8b;
2016 hci_cp.iac_lap[2] = 0x9e;
2017 hci_cp.iac_lap[3] = 0x33; /* GIAC */
2018 hci_cp.iac_lap[4] = 0x8b;
2019 hci_cp.iac_lap[5] = 0x9e;
2020 } else {
2021 /* General discoverable mode */
310a3d48
MH		 2022 hci_cp.num_iac = 1;
2023 hci_cp.iac_lap[0] = 0x33; /* GIAC */
2024 hci_cp.iac_lap[1] = 0x8b;
2025 hci_cp.iac_lap[2] = 0x9e;
2026 }
2027
2028 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2029 (hci_cp.num_iac * 3) + 1, &hci_cp);
2030
73f22f62 2031 scan |= SCAN_INQUIRY;
310a3d48 2032 } else {
a358dc11 2033 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 2034 }
73f22f62 2035
310a3d48 2036 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 2037
9a43e25f
JH		 2038update_ad:
2039 update_adv_data(&req);
2040
bfaf8c9f 2041 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 2042 if (err < 0)
a664b5bc 2043 mgmt_pending_remove(cmd);
73f22f62
JH		 2044
2045failed:
09fd0de5 2046 hci_dev_unlock(hdev);
73f22f62
JH		 2047 return err;
2048}
2049
406d7804
JH		 2050static void write_fast_connectable(struct hci_request *req, bool enable)
2051{
bd98b996 2052 struct hci_dev *hdev = req->hdev;
406d7804
JH		 2053 struct hci_cp_write_page_scan_activity acp;
2054 u8 type;
2055
d7a5a11d 2056 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 2057 return;
2058
4c01f8b8
JH		 2059 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2060 return;
2061
406d7804
JH		 2062 if (enable) {
2063 type = PAGE_SCAN_TYPE_INTERLACED;
2064
2065 /* 160 msec page scan interval */
dcf4adbf 2066 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 2067 } else {
2068 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2069
2070 /* default 1.28 sec page scan */
dcf4adbf 2071 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 2072 }
2073
dcf4adbf 2074 acp.window = cpu_to_le16(0x0012);
406d7804 2075
bd98b996
JH		 2076 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2077 __cpu_to_le16(hdev->page_scan_window) != acp.window)
2078 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2079 sizeof(acp), &acp);
2080
2081 if (hdev->page_scan_type != type)
2082 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 2083}
2084
1904a853
MH		 2085static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2086 u16 opcode)
2b76f453 2087{
3b0602cd 2088 struct mgmt_pending_cmd *cmd;
d7b856f9 2089 struct mgmt_mode *cp;
bc6d2d04 2090 bool conn_changed, discov_changed;
2b76f453
JH		 2091
2092 BT_DBG("status 0x%02x", status);
2093
2094 hci_dev_lock(hdev);
2095
333ae95d 2096 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 2097 if (!cmd)
2098 goto unlock;
2099
37438c1f
JH		 2100 if (status) {
2101 u8 mgmt_err = mgmt_status(status);
a69e8375 2102 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 2103 goto remove_cmd;
2104 }
2105
d7b856f9 2106 cp = cmd->param;
bc6d2d04 2107 if (cp->val) {
238be788
MH		 2108 conn_changed = !hci_dev_test_and_set_flag(hdev,
2109 HCI_CONNECTABLE);
bc6d2d04
JH		 2110 discov_changed = false;
2111 } else {
a69d8927
MH		 2112 conn_changed = hci_dev_test_and_clear_flag(hdev,
2113 HCI_CONNECTABLE);
2114 discov_changed = hci_dev_test_and_clear_flag(hdev,
2115 HCI_DISCOVERABLE);
bc6d2d04 2116 }
d7b856f9 2117
2b76f453
JH		 2118 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2119
bc6d2d04 2120 if (conn_changed || discov_changed) {
d7b856f9 2121 new_settings(hdev, cmd->sk);
1d2dc5b7 2122 hci_update_page_scan(hdev);
bc6d2d04
JH		 2123 if (discov_changed)
2124 mgmt_update_adv_data(hdev);
2b7be33e
JH		 2125 hci_update_background_scan(hdev);
2126 }
d7b856f9 2127
37438c1f 2128remove_cmd:
2b76f453
JH		 2129 mgmt_pending_remove(cmd);
2130
2131unlock:
2132 hci_dev_unlock(hdev);
2133}
2134
e8ba3a1f
JH		 2135static int set_connectable_update_settings(struct hci_dev *hdev,
2136 struct sock *sk, u8 val)
2137{
2138 bool changed = false;
2139 int err;
2140
d7a5a11d 2141 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2142 changed = true;
2143
2144 if (val) {
a1536da2 2145 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2146 } else {
a358dc11
MH		 2147 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2148 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2149 }
2150
2151 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2152 if (err < 0)
2153 return err;
2154
562064e6 2155 if (changed) {
1d2dc5b7 2156 hci_update_page_scan(hdev);
562064e6 2157 hci_update_background_scan(hdev);
e8ba3a1f 2158 return new_settings(hdev, sk);
562064e6 2159 }
e8ba3a1f
JH		 2160
2161 return 0;
2162}
2163
bdb6d971 2164static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2165 u16 len)
9fbcbb45 2166{
650f726d 2167 struct mgmt_mode *cp = data;
3b0602cd 2168 struct mgmt_pending_cmd *cmd;
2b76f453 2169 struct hci_request req;
1987fdc7 2170 u8 scan;
9fbcbb45
JH		 2171 int err;
2172
bdb6d971 2173 BT_DBG("request for %s", hdev->name);
9fbcbb45 2174
d7a5a11d
MH		 2175 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2176 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2177 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2178 MGMT_STATUS_REJECTED);
33c525c0 2179
a7e80f25 2180 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2181 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2182 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2183
09fd0de5 2184 hci_dev_lock(hdev);
9fbcbb45 2185
4b34ee78 2186 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2187 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2188 goto failed;
2189 }
2190
333ae95d
JH		 2191 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2192 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2193 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2194 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2195 goto failed;
2196 }
2197
2e58ef3e 2198 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2199 if (!cmd) {
2200 err = -ENOMEM;
9fbcbb45 2201 goto failed;
366a0336 2202 }
9fbcbb45 2203
9b74246f 2204 hci_req_init(&req, hdev);
9fbcbb45 2205
9a43e25f
JH		 2206 /* If BR/EDR is not enabled and we disable advertising as a
2207 * by-product of disabling connectable, we need to update the
2208 * advertising flags.
2209 */
d7a5a11d 2210 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2211 if (!cp->val) {
a358dc11
MH		 2212 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2213 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2214 }
2215 update_adv_data(&req);
2216 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2217 if (cp->val) {
2218 scan = SCAN_PAGE;
2219 } else {
3bd27240
JH		 2220 /* If we don't have any whitelist entries just
2221 * disable all scanning. If there are entries
2222 * and we had both page and inquiry scanning
2223 * enabled then fall back to only page scanning.
2224 * Otherwise no changes are needed.
2225 */
2226 if (list_empty(&hdev->whitelist))
2227 scan = SCAN_DISABLED;
2228 else if (test_bit(HCI_ISCAN, &hdev->flags))
2229 scan = SCAN_PAGE;
2230 else
2231 goto no_scan_update;
9b74246f
JH		 2232
2233 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2234 hdev->discov_timeout > 0)
9b74246f
JH		 2235 cancel_delayed_work(&hdev->discov_off);
2236 }
2b76f453 2237
9b74246f
JH		 2238 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2239 }
2b76f453 2240
3bd27240 2241no_scan_update:
e8b1202c 2242 /* Update the advertising parameters if necessary */
880897d4
AU		 2243 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2244 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2245 enable_advertising(&req);
1987fdc7 2246
2b76f453 2247 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2248 if (err < 0) {
a664b5bc 2249 mgmt_pending_remove(cmd);
9b74246f 2250 if (err == -ENODATA)
a81070ba
JH		 2251 err = set_connectable_update_settings(hdev, sk,
2252 cp->val);
9b74246f
JH		 2253 goto failed;
2254 }
9fbcbb45
JH		 2255
2256failed:
09fd0de5 2257 hci_dev_unlock(hdev);
9fbcbb45
JH		 2258 return err;
2259}
2260
b2939475 2261static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2262 u16 len)
c542a06c 2263{
650f726d 2264 struct mgmt_mode *cp = data;
55594356 2265 bool changed;
c542a06c
JH		 2266 int err;
2267
bdb6d971 2268 BT_DBG("request for %s", hdev->name);
c542a06c 2269
a7e80f25 2270 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2271 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2272 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2273
09fd0de5 2274 hci_dev_lock(hdev);
c542a06c
JH		 2275
2276 if (cp->val)
238be788 2277 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2278 else
a69d8927 2279 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2280
b2939475 2281 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2282 if (err < 0)
55594356 2283 goto unlock;
c542a06c 2284
55594356
MH		 2285 if (changed)
2286 err = new_settings(hdev, sk);
c542a06c 2287
55594356 2288unlock:
09fd0de5 2289 hci_dev_unlock(hdev);
c542a06c
JH		 2290 return err;
2291}
2292
04124681
GP		 2293static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2294 u16 len)
33ef95ed
JH		 2295{
2296 struct mgmt_mode *cp = data;
3b0602cd 2297 struct mgmt_pending_cmd *cmd;
e6fe7986 2298 u8 val, status;
33ef95ed
JH		 2299 int err;
2300
bdb6d971 2301 BT_DBG("request for %s", hdev->name);
33ef95ed 2302
e6fe7986
JH		 2303 status = mgmt_bredr_support(hdev);
2304 if (status)
a69e8375
JH		 2305 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2306 status);
33c525c0 2307
a7e80f25 2308 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2309 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2310 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2311
33ef95ed
JH		 2312 hci_dev_lock(hdev);
2313
4b34ee78 2314 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2315 bool changed = false;
2316
d7a5a11d 2317 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2318 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2319 changed = true;
2320 }
2321
2322 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2323 if (err < 0)
2324 goto failed;
2325
2326 if (changed)
2327 err = new_settings(hdev, sk);
2328
33ef95ed
JH		 2329 goto failed;
2330 }
2331
333ae95d 2332 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2333 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2334 MGMT_STATUS_BUSY);
33ef95ed
JH		 2335 goto failed;
2336 }
2337
2338 val = !!cp->val;
2339
2340 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2341 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2342 goto failed;
2343 }
2344
2345 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2346 if (!cmd) {
2347 err = -ENOMEM;
2348 goto failed;
2349 }
2350
2351 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2352 if (err < 0) {
2353 mgmt_pending_remove(cmd);
2354 goto failed;
2355 }
2356
2357failed:
2358 hci_dev_unlock(hdev);
33ef95ed
JH		 2359 return err;
2360}
2361
bdb6d971 2362static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2363{
2364 struct mgmt_mode *cp = data;
3b0602cd 2365 struct mgmt_pending_cmd *cmd;
72ef0c1a 2366 u8 status;
ed2c4ee3
JH		 2367 int err;
2368
bdb6d971 2369 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2370
cdba5281
MH		 2371 status = mgmt_bredr_support(hdev);
2372 if (status)
a69e8375 2373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2374
13ecd8b6 2375 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2376 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2377 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2378
a7e80f25 2379 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2380 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2381 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2382
13ecd8b6 2383 hci_dev_lock(hdev);
6c8f12c1 2384
4b34ee78 2385 if (!hdev_is_powered(hdev)) {
9ecb3e24 2386 bool changed;
c0ecddc2 2387
9ecb3e24 2388 if (cp->val) {
238be788
MH		 2389 changed = !hci_dev_test_and_set_flag(hdev,
2390 HCI_SSP_ENABLED);
9ecb3e24 2391 } else {
a69d8927
MH		 2392 changed = hci_dev_test_and_clear_flag(hdev,
2393 HCI_SSP_ENABLED);
9ecb3e24 2394 if (!changed)
a69d8927
MH		 2395 changed = hci_dev_test_and_clear_flag(hdev,
2396 HCI_HS_ENABLED);
9ecb3e24 2397 else
a358dc11 2398 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2399 }
2400
2401 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2402 if (err < 0)
2403 goto failed;
2404
2405 if (changed)
2406 err = new_settings(hdev, sk);
2407
ed2c4ee3
JH		 2408 goto failed;
2409 }
2410
333ae95d 2411 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2413 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2414 goto failed;
2415 }
2416
d7a5a11d 2417 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2418 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2419 goto failed;
2420 }
2421
2422 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2423 if (!cmd) {
2424 err = -ENOMEM;
2425 goto failed;
2426 }
2427
d7a5a11d 2428 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2429 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2430 sizeof(cp->val), &cp->val);
2431
72ef0c1a 2432 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2433 if (err < 0) {
2434 mgmt_pending_remove(cmd);
2435 goto failed;
2436 }
2437
2438failed:
2439 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2440 return err;
2441}
2442
bdb6d971 2443static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2444{
2445 struct mgmt_mode *cp = data;
ee392693 2446 bool changed;
e6fe7986 2447 u8 status;
ee392693 2448 int err;
6d80dfd0 2449
bdb6d971 2450 BT_DBG("request for %s", hdev->name);
6d80dfd0 2451
e6fe7986
JH		 2452 status = mgmt_bredr_support(hdev);
2453 if (status)
a69e8375 2454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2455
9ecb3e24 2456 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2458 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2459
d7a5a11d 2460 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2462 MGMT_STATUS_REJECTED);
9ecb3e24 2463
a7e80f25 2464 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2465 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2466 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2467
ee392693
MH		 2468 hci_dev_lock(hdev);
2469
333ae95d 2470 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2471 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2472 MGMT_STATUS_BUSY);
a2cb01de
JH		 2473 goto unlock;
2474 }
2475
a0cdf960 2476 if (cp->val) {
238be788 2477 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2478 } else {
2479 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2480 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2481 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2482 goto unlock;
2483 }
2484
a69d8927 2485 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2486 }
ee392693
MH		 2487
2488 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2489 if (err < 0)
2490 goto unlock;
2491
2492 if (changed)
2493 err = new_settings(hdev, sk);
6d80dfd0 2494
ee392693
MH		 2495unlock:
2496 hci_dev_unlock(hdev);
2497 return err;
6d80dfd0
JH		 2498}
2499
1904a853 2500static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2501{
2502 struct cmd_lookup match = { NULL, hdev };
2503
3ad67582
JK		 2504 hci_dev_lock(hdev);
2505
416a4ae5
JH		 2506 if (status) {
2507 u8 mgmt_err = mgmt_status(status);
2508
2509 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2510 &mgmt_err);
3ad67582 2511 goto unlock;
416a4ae5
JH		 2512 }
2513
2514 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2515
2516 new_settings(hdev, match.sk);
2517
2518 if (match.sk)
2519 sock_put(match.sk);
441ad2d0
MH		 2520
2521 /* Make sure the controller has a good default for
2522 * advertising data. Restrict the update to when LE
2523 * has actually been enabled. During power on, the
2524 * update in powered_update_hci will take care of it.
2525 */
d7a5a11d 2526 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2527 struct hci_request req;
2528
441ad2d0 2529 hci_req_init(&req, hdev);
5947f4bc 2530 update_adv_data(&req);
f14d8f64 2531 update_scan_rsp_data(&req);
2cf22218 2532 __hci_update_background_scan(&req);
441ad2d0 2533 hci_req_run(&req, NULL);
441ad2d0 2534 }
3ad67582
JK		 2535
2536unlock:
2537 hci_dev_unlock(hdev);
416a4ae5
JH		 2538}
2539
bdb6d971 2540static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2541{
2542 struct mgmt_mode *cp = data;
2543 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2544 struct mgmt_pending_cmd *cmd;
416a4ae5 2545 struct hci_request req;
06199cf8 2546 int err;
0b60eba1 2547 u8 val, enabled;
06199cf8 2548
bdb6d971 2549 BT_DBG("request for %s", hdev->name);
06199cf8 2550
13ecd8b6 2551 if (!lmp_le_capable(hdev))
a69e8375
JH		 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2553 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2554
a7e80f25 2555 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2557 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2558
e7844ee5
MH		 2559 /* Bluetooth single mode LE only controllers or dual-mode
2560 * controllers configured as LE only devices, do not allow
2561 * switching LE off. These have either LE enabled explicitly
2562 * or BR/EDR has been previously switched off.
2563 *
2564 * When trying to enable an already enabled LE, then gracefully
2565 * send a positive response. Trying to disable it however will
2566 * result into rejection.
2567 */
2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2569 if (cp->val == 0x01)
2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2571
a69e8375
JH		 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2573 MGMT_STATUS_REJECTED);
e7844ee5 2574 }
c73eee91 2575
13ecd8b6 2576 hci_dev_lock(hdev);
06199cf8
JH		 2577
2578 val = !!cp->val;
ffa88e02 2579 enabled = lmp_host_le_capable(hdev);
06199cf8 2580
847818d9
FG		 2581 if (!val)
2582 clear_adv_instance(hdev, NULL, 0x00, true);
2583
0b60eba1 2584 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2585 bool changed = false;
2586
d7a5a11d 2587 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2588 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2589 changed = true;
2590 }
2591
d7a5a11d 2592 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2593 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2594 changed = true;
2595 }
2596
06199cf8
JH		 2597 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2598 if (err < 0)
1de028ce 2599 goto unlock;
06199cf8
JH		 2600
2601 if (changed)
2602 err = new_settings(hdev, sk);
2603
1de028ce 2604 goto unlock;
06199cf8
JH		 2605 }
2606
333ae95d
JH		 2607 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2608 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2610 MGMT_STATUS_BUSY);
1de028ce 2611 goto unlock;
06199cf8
JH		 2612 }
2613
2614 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2615 if (!cmd) {
2616 err = -ENOMEM;
1de028ce 2617 goto unlock;
06199cf8
JH		 2618 }
2619
441ad2d0
MH		 2620 hci_req_init(&req, hdev);
2621
06199cf8
JH		 2622 memset(&hci_cp, 0, sizeof(hci_cp));
2623
2624 if (val) {
2625 hci_cp.le = val;
32226e4f 2626 hci_cp.simul = 0x00;
441ad2d0 2627 } else {
d7a5a11d 2628 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2629 disable_advertising(&req);
06199cf8
JH		 2630 }
2631
416a4ae5
JH		 2632 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2633 &hci_cp);
2634
2635 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2636 if (err < 0)
06199cf8 2637 mgmt_pending_remove(cmd);
06199cf8 2638
1de028ce
JH		 2639unlock:
2640 hci_dev_unlock(hdev);
06199cf8
JH		 2641 return err;
2642}
2643
0cab9c80
JH		 2644/* This is a helper function to test for pending mgmt commands that can
2645 * cause CoD or EIR HCI commands. We can only allow one such pending
2646 * mgmt command at a time since otherwise we cannot easily track what
2647 * the current values are, will be, and based on that calculate if a new
2648 * HCI command needs to be sent and if yes with what value.
2649 */
2650static bool pending_eir_or_class(struct hci_dev *hdev)
2651{
3b0602cd 2652 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2653
2654 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2655 switch (cmd->opcode) {
2656 case MGMT_OP_ADD_UUID:
2657 case MGMT_OP_REMOVE_UUID:
2658 case MGMT_OP_SET_DEV_CLASS:
2659 case MGMT_OP_SET_POWERED:
2660 return true;
2661 }
2662 }
2663
2664 return false;
2665}
2666
83be8eca
JH		 2667static const u8 bluetooth_base_uuid[] = {
2668 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2669 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2670};
2671
2672static u8 get_uuid_size(const u8 *uuid)
2673{
2674 u32 val;
2675
2676 if (memcmp(uuid, bluetooth_base_uuid, 12))
2677 return 128;
2678
2679 val = get_unaligned_le32(&uuid[12]);
2680 if (val > 0xffff)
2681 return 32;
2682
2683 return 16;
2684}
2685
92da6097
JH		 2686static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2687{
3b0602cd 2688 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2689
2690 hci_dev_lock(hdev);
2691
333ae95d 2692 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2693 if (!cmd)
2694 goto unlock;
2695
2a1afb5a
JH		 2696 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2697 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2698
2699 mgmt_pending_remove(cmd);
2700
2701unlock:
2702 hci_dev_unlock(hdev);
2703}
2704
1904a853 2705static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2706{
2707 BT_DBG("status 0x%02x", status);
2708
2709 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2710}
2711
bdb6d971 2712static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2713{
650f726d 2714 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2715 struct mgmt_pending_cmd *cmd;
890ea898 2716 struct hci_request req;
2aeb9a1a 2717 struct bt_uuid *uuid;
2aeb9a1a
JH		 2718 int err;
2719
bdb6d971 2720 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2721
09fd0de5 2722 hci_dev_lock(hdev);
2aeb9a1a 2723
0cab9c80 2724 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2725 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2726 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2727 goto failed;
2728 }
2729
92c4c204 2730 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2731 if (!uuid) {
2732 err = -ENOMEM;
2733 goto failed;
2734 }
2735
2736 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2737 uuid->svc_hint = cp->svc_hint;
83be8eca 2738 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2739
de66aa63 2740 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2741
890ea898 2742 hci_req_init(&req, hdev);
1aff6f09 2743
890ea898
JH		 2744 update_class(&req);
2745 update_eir(&req);
2746
92da6097
JH		 2747 err = hci_req_run(&req, add_uuid_complete);
2748 if (err < 0) {
2749 if (err != -ENODATA)
2750 goto failed;
80a1e1db 2751
2a1afb5a
JH		 2752 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2753 hdev->dev_class, 3);
90e70454
JH		 2754 goto failed;
2755 }
2756
2757 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2758 if (!cmd) {
90e70454 2759 err = -ENOMEM;
890ea898
JH		 2760 goto failed;
2761 }
2762
2763 err = 0;
2aeb9a1a
JH		 2764
2765failed:
09fd0de5 2766 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2767 return err;
2768}
2769
24b78d0f
JH		 2770static bool enable_service_cache(struct hci_dev *hdev)
2771{
2772 if (!hdev_is_powered(hdev))
2773 return false;
2774
238be788 2775 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2776 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2777 CACHE_TIMEOUT);
24b78d0f
JH		 2778 return true;
2779 }
2780
2781 return false;
2782}
2783
1904a853 2784static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2785{
2786 BT_DBG("status 0x%02x", status);
2787
2788 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2789}
2790
bdb6d971 2791static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2792 u16 len)
2aeb9a1a 2793{
650f726d 2794 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2795 struct mgmt_pending_cmd *cmd;
056341c8 2796 struct bt_uuid *match, *tmp;
2aeb9a1a 2797 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2798 struct hci_request req;
2aeb9a1a
JH		 2799 int err, found;
2800
bdb6d971 2801 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2802
09fd0de5 2803 hci_dev_lock(hdev);
2aeb9a1a 2804
0cab9c80 2805 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2806 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2807 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2808 goto unlock;
2809 }
2810
2aeb9a1a 2811 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2812 hci_uuids_clear(hdev);
4004b6d9 2813
24b78d0f 2814 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2815 err = mgmt_cmd_complete(sk, hdev->id,
2816 MGMT_OP_REMOVE_UUID,
2817 0, hdev->dev_class, 3);
24b78d0f
JH		 2818 goto unlock;
2819 }
4004b6d9 2820
9246a869 2821 goto update_class;
2aeb9a1a
JH		 2822 }
2823
2824 found = 0;
2825
056341c8 2826 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2827 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2828 continue;
2829
2830 list_del(&match->list);
482049f7 2831 kfree(match);
2aeb9a1a
JH		 2832 found++;
2833 }
2834
2835 if (found == 0) {
a69e8375
JH		 2836 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2837 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2838 goto unlock;
2839 }
2840
9246a869 2841update_class:
890ea898 2842 hci_req_init(&req, hdev);
1aff6f09 2843
890ea898
JH		 2844 update_class(&req);
2845 update_eir(&req);
2846
92da6097
JH		 2847 err = hci_req_run(&req, remove_uuid_complete);
2848 if (err < 0) {
2849 if (err != -ENODATA)
2850 goto unlock;
80a1e1db 2851
2a1afb5a
JH		 2852 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2853 hdev->dev_class, 3);
90e70454
JH		 2854 goto unlock;
2855 }
2856
2857 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2858 if (!cmd) {
90e70454 2859 err = -ENOMEM;
890ea898
JH		 2860 goto unlock;
2861 }
2862
2863 err = 0;
2aeb9a1a
JH		 2864
2865unlock:
09fd0de5 2866 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2867 return err;
2868}
2869
1904a853 2870static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2871{
2872 BT_DBG("status 0x%02x", status);
2873
2874 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2875}
2876
bdb6d971 2877static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2878 u16 len)
1aff6f09 2879{
650f726d 2880 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2881 struct mgmt_pending_cmd *cmd;
890ea898 2882 struct hci_request req;
1aff6f09
JH		 2883 int err;
2884
bdb6d971 2885 BT_DBG("request for %s", hdev->name);
1aff6f09 2886
6203fc98 2887 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2888 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2889 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2890
0cab9c80 2891 hci_dev_lock(hdev);
ee98f473 2892
0cab9c80 2893 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2894 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2895 MGMT_STATUS_BUSY);
0cab9c80
JH		 2896 goto unlock;
2897 }
c95f0ba7 2898
0cab9c80 2899 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2900 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2901 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2902 goto unlock;
2903 }
575b3a02 2904
932f5ff5
JH		 2905 hdev->major_class = cp->major;
2906 hdev->minor_class = cp->minor;
2907
b5235a65 2908 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2909 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2910 hdev->dev_class, 3);
b5235a65
JH		 2911 goto unlock;
2912 }
2913
890ea898
JH		 2914 hci_req_init(&req, hdev);
2915
a69d8927 2916 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2917 hci_dev_unlock(hdev);
2918 cancel_delayed_work_sync(&hdev->service_cache);
2919 hci_dev_lock(hdev);
890ea898 2920 update_eir(&req);
7d78525d 2921 }
14c0b608 2922
890ea898
JH		 2923 update_class(&req);
2924
92da6097
JH		 2925 err = hci_req_run(&req, set_class_complete);
2926 if (err < 0) {
2927 if (err != -ENODATA)
2928 goto unlock;
1aff6f09 2929
2a1afb5a
JH		 2930 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2931 hdev->dev_class, 3);
90e70454
JH		 2932 goto unlock;
2933 }
2934
2935 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2936 if (!cmd) {
90e70454 2937 err = -ENOMEM;
890ea898
JH		 2938 goto unlock;
2939 }
2940
2941 err = 0;
1aff6f09 2942
b5235a65 2943unlock:
09fd0de5 2944 hci_dev_unlock(hdev);
1aff6f09
JH		 2945 return err;
2946}
2947
bdb6d971 2948static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2949 u16 len)
55ed8ca1 2950{
650f726d 2951 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2952 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2953 sizeof(struct mgmt_link_key_info));
4e51eae9 2954 u16 key_count, expected_len;
b1de97d8 2955 bool changed;
a492cd52 2956 int i;
55ed8ca1 2957
9060d5cf
MH		 2958 BT_DBG("request for %s", hdev->name);
2959
2960 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2962 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2963
1f350c87 2964 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2965 if (key_count > max_key_count) {
2966 BT_ERR("load_link_keys: too big key_count value %u",
2967 key_count);
a69e8375
JH		 2968 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2969 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2970 }
55ed8ca1 2971
86742e1e
JH		 2972 expected_len = sizeof(*cp) + key_count *
2973 sizeof(struct mgmt_link_key_info);
a492cd52 2974 if (expected_len != len) {
86742e1e 2975 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2976 expected_len, len);
a69e8375
JH		 2977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2978 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2979 }
2980
4ae14301 2981 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2983 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2984
bdb6d971 2985 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2986 key_count);
55ed8ca1 2987
4ee71b20
JH		 2988 for (i = 0; i < key_count; i++) {
2989 struct mgmt_link_key_info *key = &cp->keys[i];
2990
8e991132 2991 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2992 return mgmt_cmd_status(sk, hdev->id,
2993 MGMT_OP_LOAD_LINK_KEYS,
2994 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2995 }
2996
09fd0de5 2997 hci_dev_lock(hdev);
55ed8ca1
JH		 2998
2999 hci_link_keys_clear(hdev);
3000
55ed8ca1 3001 if (cp->debug_keys)
238be788 3002 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 3003 else
a69d8927
MH		 3004 changed = hci_dev_test_and_clear_flag(hdev,
3005 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 3006
3007 if (changed)
3008 new_settings(hdev, NULL);
55ed8ca1 3009
a492cd52 3010 for (i = 0; i < key_count; i++) {
86742e1e 3011 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 3012
58e9293c
JH		 3013 /* Always ignore debug keys and require a new pairing if
3014 * the user wants to use them.
3015 */
3016 if (key->type == HCI_LK_DEBUG_COMBINATION)
3017 continue;
3018
7652ff6a
JH		 3019 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3020 key->type, key->pin_len, NULL);
55ed8ca1
JH		 3021 }
3022
2a1afb5a 3023 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 3024
09fd0de5 3025 hci_dev_unlock(hdev);
55ed8ca1 3026
a492cd52 3027 return 0;
55ed8ca1
JH		 3028}
3029
b1078ad0 3030static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 3031 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 3032{
3033 struct mgmt_ev_device_unpaired ev;
3034
3035 bacpy(&ev.addr.bdaddr, bdaddr);
3036 ev.addr.type = addr_type;
3037
3038 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 3039 skip_sk);
b1078ad0
JH		 3040}
3041
bdb6d971 3042static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3043 u16 len)
55ed8ca1 3044{
124f6e35
JH		 3045 struct mgmt_cp_unpair_device *cp = data;
3046 struct mgmt_rp_unpair_device rp;
a8a1d19e 3047 struct hci_cp_disconnect dc;
3b0602cd 3048 struct mgmt_pending_cmd *cmd;
55ed8ca1 3049 struct hci_conn *conn;
55ed8ca1
JH		 3050 int err;
3051
a8a1d19e 3052 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 3053 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3054 rp.addr.type = cp->addr.type;
a8a1d19e 3055
4ee71b20 3056 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3057 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3058 MGMT_STATUS_INVALID_PARAMS,
3059 &rp, sizeof(rp));
4ee71b20 3060
118da70b 3061 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 3062 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3063 MGMT_STATUS_INVALID_PARAMS,
3064 &rp, sizeof(rp));
118da70b 3065
4ee71b20
JH		 3066 hci_dev_lock(hdev);
3067
86a8cfc6 3068 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3070 MGMT_STATUS_NOT_POWERED, &rp,
3071 sizeof(rp));
86a8cfc6
JH		 3072 goto unlock;
3073 }
3074
e0b2b27e 3075 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 3076 /* If disconnection is requested, then look up the
3077 * connection. If the remote device is connected, it
3078 * will be later used to terminate the link.
3079 *
3080 * Setting it to NULL explicitly will cause no
3081 * termination of the link.
3082 */
3083 if (cp->disconnect)
3084 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3085 &cp->addr.bdaddr);
3086 else
3087 conn = NULL;
3088
124f6e35 3089 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 3090 } else {
3091 u8 addr_type;
3092
89cbb063
AA		 3093 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
3094 &cp->addr.bdaddr);
3095 if (conn) {
3096 /* Defer clearing up the connection parameters
3097 * until closing to give a chance of keeping
3098 * them if a repairing happens.
3099 */
3100 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3101
3102 /* If disconnection is not requested, then
3103 * clear the connection variable so that the
3104 * link is not terminated.
3105 */
3106 if (!cp->disconnect)
3107 conn = NULL;
3108 }
3109
e0b2b27e
JH		 3110 if (cp->addr.type == BDADDR_LE_PUBLIC)
3111 addr_type = ADDR_LE_DEV_PUBLIC;
3112 else
3113 addr_type = ADDR_LE_DEV_RANDOM;
3114
a7ec7338
JH		 3115 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
3116
e0b2b27e
JH		 3117 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
3118 }
b0dbfb46 3119
55ed8ca1 3120 if (err < 0) {
2a1afb5a
JH		 3121 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3122 MGMT_STATUS_NOT_PAIRED, &rp,
3123 sizeof(rp));
55ed8ca1
JH		 3124 goto unlock;
3125 }
3126
89cbb063
AA		 3127 /* If the connection variable is set, then termination of the
3128 * link is requested.
3129 */
a8a1d19e 3130 if (!conn) {
2a1afb5a
JH		 3131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3132 &rp, sizeof(rp));
b1078ad0 3133 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3134 goto unlock;
3135 }
55ed8ca1 3136
124f6e35 3137 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3138 sizeof(*cp));
a8a1d19e
JH		 3139 if (!cmd) {
3140 err = -ENOMEM;
3141 goto unlock;
55ed8ca1
JH		 3142 }
3143
d8b7b1e4
JH		 3144 cmd->cmd_complete = addr_cmd_complete;
3145
eb55ef07 3146 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3147 dc.reason = 0x13; /* Remote User Terminated Connection */
3148 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3149 if (err < 0)
3150 mgmt_pending_remove(cmd);
3151
55ed8ca1 3152unlock:
09fd0de5 3153 hci_dev_unlock(hdev);
55ed8ca1
JH		 3154 return err;
3155}
3156
bdb6d971 3157static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3158 u16 len)
8962ee74 3159{
650f726d 3160 struct mgmt_cp_disconnect *cp = data;
06a63b19 3161 struct mgmt_rp_disconnect rp;
3b0602cd 3162 struct mgmt_pending_cmd *cmd;
8962ee74 3163 struct hci_conn *conn;
8962ee74
JH		 3164 int err;
3165
3166 BT_DBG("");
3167
06a63b19
JH		 3168 memset(&rp, 0, sizeof(rp));
3169 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3170 rp.addr.type = cp->addr.type;
3171
4ee71b20 3172 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3174 MGMT_STATUS_INVALID_PARAMS,
3175 &rp, sizeof(rp));
4ee71b20 3176
09fd0de5 3177 hci_dev_lock(hdev);
8962ee74
JH		 3178
3179 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3181 MGMT_STATUS_NOT_POWERED, &rp,
3182 sizeof(rp));
8962ee74
JH		 3183 goto failed;
3184 }
3185
333ae95d 3186 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3188 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3189 goto failed;
3190 }
3191
591f47f3 3192 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3193 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3194 &cp->addr.bdaddr);
88c3df13
JH		 3195 else
3196 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 3197
f960727e 3198 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3199 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3200 MGMT_STATUS_NOT_CONNECTED, &rp,
3201 sizeof(rp));
8962ee74
JH		 3202 goto failed;
3203 }
3204
2e58ef3e 3205 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3206 if (!cmd) {
3207 err = -ENOMEM;
8962ee74 3208 goto failed;
366a0336 3209 }
8962ee74 3210
f5818c22
JH		 3211 cmd->cmd_complete = generic_cmd_complete;
3212
e3f2f92a 3213 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3214 if (err < 0)
a664b5bc 3215 mgmt_pending_remove(cmd);
8962ee74
JH		 3216
3217failed:
09fd0de5 3218 hci_dev_unlock(hdev);
8962ee74
JH		 3219 return err;
3220}
3221
57c1477c 3222static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3223{
3224 switch (link_type) {
3225 case LE_LINK:
48264f06
JH		 3226 switch (addr_type) {
3227 case ADDR_LE_DEV_PUBLIC:
591f47f3 3228 return BDADDR_LE_PUBLIC;
0ed09148 3229
48264f06 3230 default:
0ed09148 3231 /* Fallback to LE Random address type */
591f47f3 3232 return BDADDR_LE_RANDOM;
48264f06 3233 }
0ed09148 3234
4c659c39 3235 default:
0ed09148 3236 /* Fallback to BR/EDR type */
591f47f3 3237 return BDADDR_BREDR;
4c659c39
JH		 3238 }
3239}
3240
04124681
GP		 3241static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3242 u16 data_len)
2784eb41 3243{
2784eb41 3244 struct mgmt_rp_get_connections *rp;
8035ded4 3245 struct hci_conn *c;
a38528f1 3246 size_t rp_len;
60fc5fb6
JH		 3247 int err;
3248 u16 i;
2784eb41
JH		 3249
3250 BT_DBG("");
3251
09fd0de5 3252 hci_dev_lock(hdev);
2784eb41 3253
5f97c1df 3254 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3255 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3256 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3257 goto unlock;
3258 }
3259
60fc5fb6 3260 i = 0;
b644ba33
JH		 3261 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3262 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3263 i++;
2784eb41
JH		 3264 }
3265
60fc5fb6 3266 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3267 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3268 if (!rp) {
2784eb41
JH		 3269 err = -ENOMEM;
3270 goto unlock;
3271 }
3272
2784eb41 3273 i = 0;
4c659c39 3274 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3275 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3276 continue;
4c659c39 3277 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3278 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3279 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3280 continue;
3281 i++;
3282 }
3283
eb55ef07 3284 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3285
4c659c39
JH		 3286 /* Recalculate length in case of filtered SCO connections, etc */
3287 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3288
2a1afb5a
JH		 3289 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3290 rp_len);
2784eb41 3291
a38528f1 3292 kfree(rp);
5f97c1df
JH		 3293
3294unlock:
09fd0de5 3295 hci_dev_unlock(hdev);
2784eb41
JH		 3296 return err;
3297}
3298
bdb6d971 3299static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3300 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3301{
3b0602cd 3302 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3303 int err;
3304
2e58ef3e 3305 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3306 sizeof(*cp));
96d97a67
WR		 3307 if (!cmd)
3308 return -ENOMEM;
3309
d8457698 3310 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3311 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3312 if (err < 0)
3313 mgmt_pending_remove(cmd);
3314
3315 return err;
3316}
3317
bdb6d971 3318static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3319 u16 len)
980e1a53 3320{
96d97a67 3321 struct hci_conn *conn;
650f726d 3322 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3323 struct hci_cp_pin_code_reply reply;
3b0602cd 3324 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3325 int err;
3326
3327 BT_DBG("");
3328
09fd0de5 3329 hci_dev_lock(hdev);
980e1a53 3330
4b34ee78 3331 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3332 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3333 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3334 goto failed;
3335 }
3336
d8457698 3337 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3338 if (!conn) {
a69e8375
JH		 3339 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3340 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3341 goto failed;
3342 }
3343
3344 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3345 struct mgmt_cp_pin_code_neg_reply ncp;
3346
3347 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3348
3349 BT_ERR("PIN code is not 16 bytes long");
3350
bdb6d971 3351 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3352 if (err >= 0)
a69e8375
JH		 3353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3354 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3355
3356 goto failed;
3357 }
3358
00abfe44 3359 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3360 if (!cmd) {
3361 err = -ENOMEM;
980e1a53 3362 goto failed;
366a0336 3363 }
980e1a53 3364
7776d1d8
JH		 3365 cmd->cmd_complete = addr_cmd_complete;
3366
d8457698 3367 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3368 reply.pin_len = cp->pin_len;
24718ca5 3369 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3370
3371 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3372 if (err < 0)
a664b5bc 3373 mgmt_pending_remove(cmd);
980e1a53
JH		 3374
3375failed:
09fd0de5 3376 hci_dev_unlock(hdev);
980e1a53
JH		 3377 return err;
3378}
3379
04124681
GP		 3380static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3381 u16 len)
17fa4b9d 3382{
650f726d 3383 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3384
3385 BT_DBG("");
3386
4ec86d4c 3387 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3388 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3389 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3390
09fd0de5 3391 hci_dev_lock(hdev);
17fa4b9d
JH		 3392
3393 hdev->io_capability = cp->io_capability;
3394
3395 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3396 hdev->io_capability);
17fa4b9d 3397
09fd0de5 3398 hci_dev_unlock(hdev);
17fa4b9d 3399
2a1afb5a
JH		 3400 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3401 NULL, 0);
17fa4b9d
JH		 3402}
3403
3b0602cd 3404static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3405{
3406 struct hci_dev *hdev = conn->hdev;
3b0602cd 3407 struct mgmt_pending_cmd *cmd;
e9a416b5 3408
2e58ef3e 3409 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3410 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3411 continue;
3412
e9a416b5
JH		 3413 if (cmd->user_data != conn)
3414 continue;
3415
3416 return cmd;
3417 }
3418
3419 return NULL;
3420}
3421
3b0602cd 3422static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3423{
3424 struct mgmt_rp_pair_device rp;
3425 struct hci_conn *conn = cmd->user_data;
9df74653 3426 int err;
e9a416b5 3427
61b1a7fb
JH		 3428 bacpy(&rp.addr.bdaddr, &conn->dst);
3429 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3430
2a1afb5a
JH		 3431 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3432 status, &rp, sizeof(rp));
e9a416b5
JH		 3433
3434 /* So we don't get further callbacks for this connection */
3435 conn->connect_cfm_cb = NULL;
3436 conn->security_cfm_cb = NULL;
3437 conn->disconn_cfm_cb = NULL;
3438
76a68ba0 3439 hci_conn_drop(conn);
89cbb063
AA		 3440
3441 /* The device is paired so there is no need to remove
3442 * its connection parameters anymore.
3443 */
3444 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3445
3446 hci_conn_put(conn);
9df74653
JH		 3447
3448 return err;
e9a416b5
JH		 3449}
3450
f4a407be
JH		 3451void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3452{
3453 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3454 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3455
3456 cmd = find_pairing(conn);
a511b35b 3457 if (cmd) {
04ab2749 3458 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3459 mgmt_pending_remove(cmd);
3460 }
f4a407be
JH		 3461}
3462
e9a416b5
JH		 3463static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3464{
3b0602cd 3465 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3466
3467 BT_DBG("status %u", status);
3468
3469 cmd = find_pairing(conn);
a511b35b 3470 if (!cmd) {
e9a416b5 3471 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3472 return;
3473 }
3474
3475 cmd->cmd_complete(cmd, mgmt_status(status));
3476 mgmt_pending_remove(cmd);
e9a416b5
JH		 3477}
3478
f4a407be 3479static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3480{
3b0602cd 3481 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3482
3483 BT_DBG("status %u", status);
3484
3485 if (!status)
3486 return;
3487
3488 cmd = find_pairing(conn);
a511b35b 3489 if (!cmd) {
4c47d739 3490 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3491 return;
3492 }
3493
3494 cmd->cmd_complete(cmd, mgmt_status(status));
3495 mgmt_pending_remove(cmd);
4c47d739
VA		 3496}
3497
bdb6d971 3498static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3499 u16 len)
e9a416b5 3500{
650f726d 3501 struct mgmt_cp_pair_device *cp = data;
1425acb7 3502 struct mgmt_rp_pair_device rp;
3b0602cd 3503 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3504 u8 sec_level, auth_type;
3505 struct hci_conn *conn;
e9a416b5
JH		 3506 int err;
3507
3508 BT_DBG("");
3509
f950a30e
SJ		 3510 memset(&rp, 0, sizeof(rp));
3511 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3512 rp.addr.type = cp->addr.type;
3513
4ee71b20 3514 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3515 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3516 MGMT_STATUS_INVALID_PARAMS,
3517 &rp, sizeof(rp));
4ee71b20 3518
4ec86d4c 3519 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3520 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3521 MGMT_STATUS_INVALID_PARAMS,
3522 &rp, sizeof(rp));
4ec86d4c 3523
09fd0de5 3524 hci_dev_lock(hdev);
e9a416b5 3525
5f97c1df 3526 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3527 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3528 MGMT_STATUS_NOT_POWERED, &rp,
3529 sizeof(rp));
5f97c1df
JH		 3530 goto unlock;
3531 }
3532
55e76b38
JH		 3533 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3534 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3535 MGMT_STATUS_ALREADY_PAIRED, &rp,
3536 sizeof(rp));
3537 goto unlock;
3538 }
3539
c908df36 3540 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3541 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3542
6f77d8c7 3543 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3544 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3545 auth_type);
6f77d8c7
AG		 3546 } else {
3547 u8 addr_type;
3548
3549 /* Convert from L2CAP channel address type to HCI address type
3550 */
3551 if (cp->addr.type == BDADDR_LE_PUBLIC)
3552 addr_type = ADDR_LE_DEV_PUBLIC;
3553 else
3554 addr_type = ADDR_LE_DEV_RANDOM;
3555
7c264b10
MH		 3556 /* When pairing a new device, it is expected to remember
3557 * this device for future connections. Adding the connection
3558 * parameter information ahead of time allows tracking
3559 * of the slave preferred values and will speed up any
3560 * further connection establishment.
3561 *
3562 * If connection parameters already exist, then they
3563 * will be kept and this function does nothing.
3564 */
3565 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3566
6f77d8c7 3567 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3568 sec_level, HCI_LE_CONN_TIMEOUT,
3569 HCI_ROLE_MASTER);
6f77d8c7 3570 }
7a512d01 3571
30e76272 3572 if (IS_ERR(conn)) {
489dc48e
AK		 3573 int status;
3574
3575 if (PTR_ERR(conn) == -EBUSY)
3576 status = MGMT_STATUS_BUSY;
faa81030
LR		 3577 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3578 status = MGMT_STATUS_NOT_SUPPORTED;
3579 else if (PTR_ERR(conn) == -ECONNREFUSED)
3580 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3581 else
3582 status = MGMT_STATUS_CONNECT_FAILED;
3583
2a1afb5a
JH		 3584 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3585 status, &rp, sizeof(rp));
e9a416b5
JH		 3586 goto unlock;
3587 }
3588
3589 if (conn->connect_cfm_cb) {
76a68ba0 3590 hci_conn_drop(conn);
2a1afb5a
JH		 3591 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3592 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3593 goto unlock;
3594 }
3595
2e58ef3e 3596 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3597 if (!cmd) {
3598 err = -ENOMEM;
76a68ba0 3599 hci_conn_drop(conn);
e9a416b5
JH		 3600 goto unlock;
3601 }
3602
04ab2749
JH		 3603 cmd->cmd_complete = pairing_complete;
3604
7a512d01 3605 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3606 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3607 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3608 conn->security_cfm_cb = pairing_complete_cb;
3609 conn->disconn_cfm_cb = pairing_complete_cb;
3610 } else {
3611 conn->connect_cfm_cb = le_pairing_complete_cb;
3612 conn->security_cfm_cb = le_pairing_complete_cb;
3613 conn->disconn_cfm_cb = le_pairing_complete_cb;
3614 }
7a512d01 3615
e9a416b5 3616 conn->io_capability = cp->io_cap;
f8aaf9b6 3617 cmd->user_data = hci_conn_get(conn);
e9a416b5 3618
6f78fd4b 3619 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3620 hci_conn_security(conn, sec_level, auth_type, true)) {
3621 cmd->cmd_complete(cmd, 0);
3622 mgmt_pending_remove(cmd);
3623 }
e9a416b5
JH		 3624
3625 err = 0;
3626
3627unlock:
09fd0de5 3628 hci_dev_unlock(hdev);
e9a416b5
JH		 3629 return err;
3630}
3631
04124681
GP		 3632static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3633 u16 len)
28424707 3634{
0f4e68cf 3635 struct mgmt_addr_info *addr = data;
3b0602cd 3636 struct mgmt_pending_cmd *cmd;
28424707
JH		 3637 struct hci_conn *conn;
3638 int err;
3639
3640 BT_DBG("");
3641
28424707
JH		 3642 hci_dev_lock(hdev);
3643
5f97c1df 3644 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3645 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3646 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3647 goto unlock;
3648 }
3649
333ae95d 3650 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3651 if (!cmd) {
a69e8375
JH		 3652 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3653 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3654 goto unlock;
3655 }
3656
3657 conn = cmd->user_data;
3658
3659 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3660 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3661 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3662 goto unlock;
3663 }
3664
a511b35b
JH		 3665 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3666 mgmt_pending_remove(cmd);
28424707 3667
2a1afb5a
JH		 3668 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3669 addr, sizeof(*addr));
28424707
JH		 3670unlock:
3671 hci_dev_unlock(hdev);
28424707
JH		 3672 return err;
3673}
3674
bdb6d971 3675static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3676 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3677 u16 hci_op, __le32 passkey)
a5c29683 3678{
3b0602cd 3679 struct mgmt_pending_cmd *cmd;
0df4c185 3680 struct hci_conn *conn;
a5c29683
JH		 3681 int err;
3682
09fd0de5 3683 hci_dev_lock(hdev);
08ba5382 3684
4b34ee78 3685 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3686 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3687 MGMT_STATUS_NOT_POWERED, addr,
3688 sizeof(*addr));
0df4c185 3689 goto done;
a5c29683
JH		 3690 }
3691
1707c60e
JH		 3692 if (addr->type == BDADDR_BREDR)
3693 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3694 else
1707c60e 3695 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3696
3697 if (!conn) {
2a1afb5a
JH		 3698 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3699 MGMT_STATUS_NOT_CONNECTED, addr,
3700 sizeof(*addr));
272d90df
JH		 3701 goto done;
3702 }
47c15e2b 3703
1707c60e 3704 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3705 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3706 if (!err)
2a1afb5a
JH		 3707 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3708 MGMT_STATUS_SUCCESS, addr,
3709 sizeof(*addr));
5fe57d9e 3710 else
2a1afb5a
JH		 3711 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3712 MGMT_STATUS_FAILED, addr,
3713 sizeof(*addr));
47c15e2b 3714
47c15e2b
BG		 3715 goto done;
3716 }
3717
1707c60e 3718 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3719 if (!cmd) {
3720 err = -ENOMEM;
0df4c185 3721 goto done;
a5c29683
JH		 3722 }
3723
7776d1d8
JH		 3724 cmd->cmd_complete = addr_cmd_complete;
3725
0df4c185 3726 /* Continue with pairing via HCI */
604086b7
BG		 3727 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3728 struct hci_cp_user_passkey_reply cp;
3729
1707c60e 3730 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3731 cp.passkey = passkey;
3732 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3733 } else
1707c60e
JH		 3734 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3735 &addr->bdaddr);
604086b7 3736
a664b5bc
JH		 3737 if (err < 0)
3738 mgmt_pending_remove(cmd);
a5c29683 3739
0df4c185 3740done:
09fd0de5 3741 hci_dev_unlock(hdev);
a5c29683
JH		 3742 return err;
3743}
3744
afeb019d
JK		 3745static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3746 void *data, u16 len)
3747{
3748 struct mgmt_cp_pin_code_neg_reply *cp = data;
3749
3750 BT_DBG("");
3751
1707c60e 3752 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3753 MGMT_OP_PIN_CODE_NEG_REPLY,
3754 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3755}
3756
04124681
GP		 3757static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3758 u16 len)
0df4c185 3759{
650f726d 3760 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3761
3762 BT_DBG("");
3763
3764 if (len != sizeof(*cp))
a69e8375
JH		 3765 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3766 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3767
1707c60e 3768 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3769 MGMT_OP_USER_CONFIRM_REPLY,
3770 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3771}
3772
bdb6d971 3773static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3774 void *data, u16 len)
0df4c185 3775{
c9c2659f 3776 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3777
3778 BT_DBG("");
3779
1707c60e 3780 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3781 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3782 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3783}
3784
04124681
GP		 3785static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3786 u16 len)
604086b7 3787{
650f726d 3788 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3789
3790 BT_DBG("");
3791
1707c60e 3792 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3793 MGMT_OP_USER_PASSKEY_REPLY,
3794 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3795}
3796
bdb6d971 3797static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3798 void *data, u16 len)
604086b7 3799{
650f726d 3800 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3801
3802 BT_DBG("");
3803
1707c60e 3804 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3805 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3806 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3807}
3808
13928971 3809static void update_name(struct hci_request *req)
2b4bf397 3810{
13928971 3811 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3812 struct hci_cp_write_local_name cp;
3813
13928971 3814 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3815
890ea898 3816 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3817}
3818
1904a853 3819static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3820{
3821 struct mgmt_cp_set_local_name *cp;
3b0602cd 3822 struct mgmt_pending_cmd *cmd;
13928971
JH		 3823
3824 BT_DBG("status 0x%02x", status);
3825
3826 hci_dev_lock(hdev);
3827
333ae95d 3828 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3829 if (!cmd)
3830 goto unlock;
3831
3832 cp = cmd->param;
3833
3834 if (status)
a69e8375
JH		 3835 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3836 mgmt_status(status));
13928971 3837 else
2a1afb5a
JH		 3838 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3839 cp, sizeof(*cp));
13928971
JH		 3840
3841 mgmt_pending_remove(cmd);
3842
3843unlock:
3844 hci_dev_unlock(hdev);
3845}
3846
bdb6d971 3847static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3848 u16 len)
b312b161 3849{
2b4bf397 3850 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3851 struct mgmt_pending_cmd *cmd;
890ea898 3852 struct hci_request req;
b312b161
JH		 3853 int err;
3854
3855 BT_DBG("");
3856
09fd0de5 3857 hci_dev_lock(hdev);
b312b161 3858
b3f2ca94
JH		 3859 /* If the old values are the same as the new ones just return a
3860 * direct command complete event.
3861 */
3862 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3863 !memcmp(hdev->short_name, cp->short_name,
3864 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3865 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3866 data, len);
b3f2ca94
JH		 3867 goto failed;
3868 }
3869
2b4bf397 3870 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3871
b5235a65 3872 if (!hdev_is_powered(hdev)) {
2b4bf397 3873 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3874
2a1afb5a
JH		 3875 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3876 data, len);
28cc7bde
JH		 3877 if (err < 0)
3878 goto failed;
3879
f6b7712e
MH		 3880 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3881 data, len, sk);
28cc7bde 3882
b5235a65
JH		 3883 goto failed;
3884 }
3885
28cc7bde 3886 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3887 if (!cmd) {
3888 err = -ENOMEM;
3889 goto failed;
3890 }
3891
13928971
JH		 3892 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3893
890ea898 3894 hci_req_init(&req, hdev);
3f985050
JH		 3895
3896 if (lmp_bredr_capable(hdev)) {
3897 update_name(&req);
3898 update_eir(&req);
3899 }
3900
7a5f4990
MH		 3901 /* The name is stored in the scan response data and so
3902 * no need to udpate the advertising data here.
3903 */
3f985050 3904 if (lmp_le_capable(hdev))
7a5f4990 3905 update_scan_rsp_data(&req);
3f985050 3906
13928971 3907 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3908 if (err < 0)
3909 mgmt_pending_remove(cmd);
3910
3911failed:
09fd0de5 3912 hci_dev_unlock(hdev);
b312b161
JH		 3913 return err;
3914}
3915
1b9441f8
JH		 3916static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3917 u16 opcode, struct sk_buff *skb)
3918{
3919 struct mgmt_rp_read_local_oob_data mgmt_rp;
3920 size_t rp_size = sizeof(mgmt_rp);
3921 struct mgmt_pending_cmd *cmd;
3922
3923 BT_DBG("%s status %u", hdev->name, status);
3924
3925 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3926 if (!cmd)
3927 return;
3928
3929 if (status || !skb) {
3930 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3931 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3932 goto remove;
3933 }
3934
3935 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3936
3937 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3938 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3939
3940 if (skb->len < sizeof(*rp)) {
3941 mgmt_cmd_status(cmd->sk, hdev->id,
3942 MGMT_OP_READ_LOCAL_OOB_DATA,
3943 MGMT_STATUS_FAILED);
3944 goto remove;
3945 }
3946
3947 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3948 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3949
3950 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3951 } else {
3952 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3953
3954 if (skb->len < sizeof(*rp)) {
3955 mgmt_cmd_status(cmd->sk, hdev->id,
3956 MGMT_OP_READ_LOCAL_OOB_DATA,
3957 MGMT_STATUS_FAILED);
3958 goto remove;
3959 }
3960
3961 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3962 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3963
3964 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3965 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3966 }
3967
3968 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3969 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3970
3971remove:
3972 mgmt_pending_remove(cmd);
3973}
3974
0f4e68cf 3975static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3976 void *data, u16 data_len)
c35938b2 3977{
3b0602cd 3978 struct mgmt_pending_cmd *cmd;
1b9441f8 3979 struct hci_request req;
c35938b2
SJ		 3980 int err;
3981
bdb6d971 3982 BT_DBG("%s", hdev->name);
c35938b2 3983
09fd0de5 3984 hci_dev_lock(hdev);
c35938b2 3985
4b34ee78 3986 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3987 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3988 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3989 goto unlock;
3990 }
3991
9a1a1996 3992 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3993 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3994 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3995 goto unlock;
3996 }
3997
333ae95d 3998 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3999 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4000 MGMT_STATUS_BUSY);
c35938b2
SJ		 4001 goto unlock;
4002 }
4003
2e58ef3e 4004 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 4005 if (!cmd) {
4006 err = -ENOMEM;
4007 goto unlock;
4008 }
4009
1b9441f8
JH		 4010 hci_req_init(&req, hdev);
4011
710f11c0 4012 if (bredr_sc_enabled(hdev))
1b9441f8 4013 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4d2d2796 4014 else
1b9441f8 4015 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4d2d2796 4016
1b9441f8 4017 err = hci_req_run_skb(&req, read_local_oob_data_complete);
c35938b2
SJ		 4018 if (err < 0)
4019 mgmt_pending_remove(cmd);
4020
4021unlock:
09fd0de5 4022 hci_dev_unlock(hdev);
c35938b2
SJ		 4023 return err;
4024}
4025
bdb6d971 4026static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 4027 void *data, u16 len)
2763eda6 4028{
5d57e796 4029 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 4030 int err;
4031
bdb6d971 4032 BT_DBG("%s ", hdev->name);
2763eda6 4033
5d57e796 4034 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 4035 return mgmt_cmd_complete(sk, hdev->id,
4036 MGMT_OP_ADD_REMOTE_OOB_DATA,
4037 MGMT_STATUS_INVALID_PARAMS,
4038 addr, sizeof(*addr));
5d57e796 4039
09fd0de5 4040 hci_dev_lock(hdev);
2763eda6 4041
ec109113
MH		 4042 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4043 struct mgmt_cp_add_remote_oob_data *cp = data;
4044 u8 status;
bf1e3541 4045
c19a495c 4046 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 4047 err = mgmt_cmd_complete(sk, hdev->id,
4048 MGMT_OP_ADD_REMOTE_OOB_DATA,
4049 MGMT_STATUS_INVALID_PARAMS,
4050 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 4051 goto unlock;
4052 }
4053
ec109113 4054 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 4055 cp->addr.type, cp->hash,
4056 cp->rand, NULL, NULL);
ec109113
MH		 4057 if (err < 0)
4058 status = MGMT_STATUS_FAILED;
4059 else
4060 status = MGMT_STATUS_SUCCESS;
4061
2a1afb5a
JH		 4062 err = mgmt_cmd_complete(sk, hdev->id,
4063 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4064 &cp->addr, sizeof(cp->addr));
ec109113
MH		 4065 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4066 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 4067 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 4068 u8 status;
4069
86df9200 4070 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 4071 /* Enforce zero-valued 192-bit parameters as
4072 * long as legacy SMP OOB isn't implemented.
4073 */
4074 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4075 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 4076 err = mgmt_cmd_complete(sk, hdev->id,
4077 MGMT_OP_ADD_REMOTE_OOB_DATA,
4078 MGMT_STATUS_INVALID_PARAMS,
4079 addr, sizeof(*addr));
d25b78e2
JH		 4080 goto unlock;
4081 }
4082
86df9200
JH		 4083 rand192 = NULL;
4084 hash192 = NULL;
4085 } else {
41bcfd50
MH		 4086 /* In case one of the P-192 values is set to zero,
4087 * then just disable OOB data for P-192.
4088 */
4089 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4090 !memcmp(cp->hash192, ZERO_KEY, 16)) {
4091 rand192 = NULL;
4092 hash192 = NULL;
4093 } else {
4094 rand192 = cp->rand192;
4095 hash192 = cp->hash192;
4096 }
4097 }
4098
4099 /* In case one of the P-256 values is set to zero, then just
4100 * disable OOB data for P-256.
4101 */
4102 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4103 !memcmp(cp->hash256, ZERO_KEY, 16)) {
4104 rand256 = NULL;
4105 hash256 = NULL;
4106 } else {
4107 rand256 = cp->rand256;
4108 hash256 = cp->hash256;
86df9200
JH		 4109 }
4110
81328d5c 4111 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 4112 cp->addr.type, hash192, rand192,
41bcfd50 4113 hash256, rand256);
ec109113
MH		 4114 if (err < 0)
4115 status = MGMT_STATUS_FAILED;
4116 else
4117 status = MGMT_STATUS_SUCCESS;
4118
2a1afb5a
JH		 4119 err = mgmt_cmd_complete(sk, hdev->id,
4120 MGMT_OP_ADD_REMOTE_OOB_DATA,
4121 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 4122 } else {
4123 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 4124 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4125 MGMT_STATUS_INVALID_PARAMS);
ec109113 4126 }
2763eda6 4127
c19a495c 4128unlock:
09fd0de5 4129 hci_dev_unlock(hdev);
2763eda6
SJ		 4130 return err;
4131}
4132
bdb6d971 4133static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 4134 void *data, u16 len)
2763eda6 4135{
650f726d 4136 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 4137 u8 status;
2763eda6
SJ		 4138 int err;
4139
bdb6d971 4140 BT_DBG("%s", hdev->name);
2763eda6 4141
c19a495c 4142 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 4143 return mgmt_cmd_complete(sk, hdev->id,
4144 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4145 MGMT_STATUS_INVALID_PARAMS,
4146 &cp->addr, sizeof(cp->addr));
c19a495c 4147
09fd0de5 4148 hci_dev_lock(hdev);
2763eda6 4149
eedbd581
JH		 4150 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4151 hci_remote_oob_data_clear(hdev);
4152 status = MGMT_STATUS_SUCCESS;
4153 goto done;
4154 }
4155
6928a924 4156 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 4157 if (err < 0)
bf1e3541 4158 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 4159 else
a6785be2 4160 status = MGMT_STATUS_SUCCESS;
bf1e3541 4161
eedbd581 4162done:
2a1afb5a
JH		 4163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4164 status, &cp->addr, sizeof(cp->addr));
2763eda6 4165
09fd0de5 4166 hci_dev_unlock(hdev);
2763eda6
SJ		 4167 return err;
4168}
4169
812abb13 4170static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 4171{
8019044d 4172 struct hci_dev *hdev = req->hdev;
812abb13 4173 struct hci_cp_inquiry cp;
8019044d
MH		 4174 /* General inquiry access code (GIAC) */
4175 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 4176
4177 *status = mgmt_bredr_support(hdev);
4178 if (*status)
4179 return false;
4180
4181 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4182 *status = MGMT_STATUS_BUSY;
4183 return false;
4184 }
4185
4186 hci_inquiry_cache_flush(hdev);
4187
4188 memset(&cp, 0, sizeof(cp));
4189 memcpy(&cp.lap, lap, sizeof(cp.lap));
4190 cp.length = DISCOV_BREDR_INQUIRY_LEN;
4191
4192 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4193
4194 return true;
4195}
4196
4197static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4198{
4199 struct hci_dev *hdev = req->hdev;
4200 struct hci_cp_le_set_scan_param param_cp;
4201 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4202 u8 own_addr_type;
41dc2bd6
AG		 4203 int err;
4204
812abb13
JP		 4205 *status = mgmt_le_support(hdev);
4206 if (*status)
4207 return false;
41dc2bd6 4208
812abb13
JP		 4209 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4210 /* Don't let discovery abort an outgoing connection attempt
4211 * that's using directed advertising.
4212 */
4213 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4214 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4215 return false;
4216 }
41dc2bd6 4217
9d5fc2f2 4218 cancel_adv_timeout(hdev);
812abb13
JP		 4219 disable_advertising(req);
4220 }
41dc2bd6 4221
812abb13
JP		 4222 /* If controller is scanning, it means the background scanning is
4223 * running. Thus, we should temporarily stop it in order to set the
4224 * discovery scanning parameters.
4225 */
4226 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4227 hci_req_add_le_scan_disable(req);
41dc2bd6 4228
812abb13
JP		 4229 /* All active scans will be done with either a resolvable private
4230 * address (when privacy feature has been enabled) or non-resolvable
4231 * private address.
4232 */
4233 err = hci_update_random_address(req, true, &own_addr_type);
4234 if (err < 0) {
4235 *status = MGMT_STATUS_FAILED;
4236 return false;
4237 }
8019044d 4238
812abb13
JP		 4239 memset(&param_cp, 0, sizeof(param_cp));
4240 param_cp.type = LE_SCAN_ACTIVE;
4241 param_cp.interval = cpu_to_le16(interval);
4242 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4243 param_cp.own_address_type = own_addr_type;
8019044d 4244
812abb13
JP		 4245 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4246 &param_cp);
8019044d 4247
812abb13
JP		 4248 memset(&enable_cp, 0, sizeof(enable_cp));
4249 enable_cp.enable = LE_SCAN_ENABLE;
4250 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4251
812abb13
JP		 4252 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4253 &enable_cp);
4254
4255 return true;
4256}
8019044d 4257
812abb13
JP		 4258static bool trigger_discovery(struct hci_request *req, u8 *status)
4259{
4260 struct hci_dev *hdev = req->hdev;
8019044d 4261
812abb13
JP		 4262 switch (hdev->discovery.type) {
4263 case DISCOV_TYPE_BREDR:
4264 if (!trigger_bredr_inquiry(req, status))
4265 return false;
4266 break;
4267
4268 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4269 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4270 &hdev->quirks)) {
4271 /* During simultaneous discovery, we double LE scan
4272 * interval. We must leave some time for the controller
4273 * to do BR/EDR inquiry.
4274 */
4275 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4276 status))
4277 return false;
4278
4279 if (!trigger_bredr_inquiry(req, status))
4280 return false;
4281
4282 return true;
4283 }
4284
812abb13
JP		 4285 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4286 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4287 return false;
4288 }
812abb13 4289 /* fall through */
8019044d 4290
812abb13
JP		 4291 case DISCOV_TYPE_LE:
4292 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4293 return false;
8019044d
MH		 4294 break;
4295
4296 default:
4297 *status = MGMT_STATUS_INVALID_PARAMS;
4298 return false;
4299 }
4300
4301 return true;
41dc2bd6
AG		 4302}
4303
1904a853
MH		 4304static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4305 u16 opcode)
7c307720 4306{
3b0602cd 4307 struct mgmt_pending_cmd *cmd;
11e6e25d 4308 unsigned long timeout;
ae55f598 4309
7c307720
AG		 4310 BT_DBG("status %d", status);
4311
11e6e25d 4312 hci_dev_lock(hdev);
41dc2bd6 4313
333ae95d 4314 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4315 if (!cmd)
333ae95d 4316 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4317
11e6e25d 4318 if (cmd) {
2922a94f 4319 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4320 mgmt_pending_remove(cmd);
4321 }
7c307720
AG		 4322
4323 if (status) {
11e6e25d
MH		 4324 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4325 goto unlock;
7c307720
AG		 4326 }
4327
7c307720 4328 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4329
2d28cfe7
JP		 4330 /* If the scan involves LE scan, pick proper timeout to schedule
4331 * hdev->le_scan_disable that will stop it.
4332 */
7c307720
AG		 4333 switch (hdev->discovery.type) {
4334 case DISCOV_TYPE_LE:
3d5a76f0 4335 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4336 break;
7c307720 4337 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4338 /* When running simultaneous discovery, the LE scanning time
4339 * should occupy the whole discovery time sine BR/EDR inquiry
4340 * and LE scanning are scheduled by the controller.
4341 *
4342 * For interleaving discovery in comparison, BR/EDR inquiry
4343 * and LE scanning are done sequentially with separate
4344 * timeouts.
4345 */
4346 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4347 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4348 else
4349 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4350 break;
7c307720 4351 case DISCOV_TYPE_BREDR:
11e6e25d 4352 timeout = 0;
7c307720 4353 break;
7c307720
AG		 4354 default:
4355 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4356 timeout = 0;
4357 break;
7c307720 4358 }
ae55f598 4359
2d28cfe7
JP		 4360 if (timeout) {
4361 /* When service discovery is used and the controller has
4362 * a strict duplicate filter, it is important to remember
4363 * the start and duration of the scan. This is required
4364 * for restarting scanning during the discovery phase.
4365 */
4366 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4367 &hdev->quirks) &&
82f8b651 4368 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4369 hdev->discovery.scan_start = jiffies;
4370 hdev->discovery.scan_duration = timeout;
4371 }
4372
11e6e25d
MH		 4373 queue_delayed_work(hdev->workqueue,
4374 &hdev->le_scan_disable, timeout);
2d28cfe7 4375 }
ae55f598 4376
11e6e25d
MH		 4377unlock:
4378 hci_dev_unlock(hdev);
7c307720
AG		 4379}
4380
bdb6d971 4381static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4382 void *data, u16 len)
14a53664 4383{
650f726d 4384 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4385 struct mgmt_pending_cmd *cmd;
7c307720 4386 struct hci_request req;
8019044d 4387 u8 status;
14a53664
JH		 4388 int err;
4389
bdb6d971 4390 BT_DBG("%s", hdev->name);
14a53664 4391
09fd0de5 4392 hci_dev_lock(hdev);
14a53664 4393
4b34ee78 4394 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4395 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4396 MGMT_STATUS_NOT_POWERED,
4397 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4398 goto failed;
4399 }
4400
f5a969f2 4401 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4402 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4404 MGMT_STATUS_BUSY, &cp->type,
4405 sizeof(cp->type));
642be6c7
AG		 4406 goto failed;
4407 }
4408
2922a94f 4409 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4410 if (!cmd) {
4411 err = -ENOMEM;
4412 goto failed;
4413 }
4414
2922a94f
JH		 4415 cmd->cmd_complete = generic_cmd_complete;
4416
22078800
MH		 4417 /* Clear the discovery filter first to free any previously
4418 * allocated memory for the UUID list.
4419 */
4420 hci_discovery_filter_clear(hdev);
4421
4aab14e5 4422 hdev->discovery.type = cp->type;
da25cf6a 4423 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4424
7c307720
AG		 4425 hci_req_init(&req, hdev);
4426
8019044d 4427 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4428 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4429 status, &cp->type, sizeof(cp->type));
04106755
JH		 4430 mgmt_pending_remove(cmd);
4431 goto failed;
f39799f5 4432 }
04106755 4433
7c307720 4434 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4435 if (err < 0) {
14a53664 4436 mgmt_pending_remove(cmd);
f5a969f2
MH		 4437 goto failed;
4438 }
7c307720 4439
f5a969f2 4440 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4441
14a53664 4442failed:
09fd0de5 4443 hci_dev_unlock(hdev);
14a53664
JH		 4444 return err;
4445}
f39799f5 4446
3b0602cd
JH		 4447static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4448 u8 status)
2922a94f 4449{
2a1afb5a
JH		 4450 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4451 cmd->param, 1);
2922a94f 4452}
04106755 4453
66ea9427
JP		 4454static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4455 void *data, u16 len)
4456{
4457 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4458 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4459 struct hci_request req;
4460 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4461 u16 uuid_count, expected_len;
4462 u8 status;
4463 int err;
04106755 4464
66ea9427 4465 BT_DBG("%s", hdev->name);
e8bb6b97 4466
66ea9427 4467 hci_dev_lock(hdev);
7c307720 4468
66ea9427 4469 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4470 err = mgmt_cmd_complete(sk, hdev->id,
4471 MGMT_OP_START_SERVICE_DISCOVERY,
4472 MGMT_STATUS_NOT_POWERED,
4473 &cp->type, sizeof(cp->type));
66ea9427
JP		 4474 goto failed;
4475 }
7c307720 4476
66ea9427 4477 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4478 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4479 err = mgmt_cmd_complete(sk, hdev->id,
4480 MGMT_OP_START_SERVICE_DISCOVERY,
4481 MGMT_STATUS_BUSY, &cp->type,
4482 sizeof(cp->type));
66ea9427
JP		 4483 goto failed;
4484 }
d9483943 4485
66ea9427
JP		 4486 uuid_count = __le16_to_cpu(cp->uuid_count);
4487 if (uuid_count > max_uuid_count) {
4488 BT_ERR("service_discovery: too big uuid_count value %u",
4489 uuid_count);
2a1afb5a
JH		 4490 err = mgmt_cmd_complete(sk, hdev->id,
4491 MGMT_OP_START_SERVICE_DISCOVERY,
4492 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4493 sizeof(cp->type));
66ea9427
JP		 4494 goto failed;
4495 }
4496
4497 expected_len = sizeof(*cp) + uuid_count * 16;
4498 if (expected_len != len) {
4499 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4500 expected_len, len);
2a1afb5a
JH		 4501 err = mgmt_cmd_complete(sk, hdev->id,
4502 MGMT_OP_START_SERVICE_DISCOVERY,
4503 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4504 sizeof(cp->type));
66ea9427
JP		 4505 goto failed;
4506 }
4507
4508 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4509 hdev, data, len);
66ea9427
JP		 4510 if (!cmd) {
4511 err = -ENOMEM;
4512 goto failed;
4513 }
4514
2922a94f
JH		 4515 cmd->cmd_complete = service_discovery_cmd_complete;
4516
22078800
MH		 4517 /* Clear the discovery filter first to free any previously
4518 * allocated memory for the UUID list.
4519 */
4520 hci_discovery_filter_clear(hdev);
4521
82f8b651 4522 hdev->discovery.result_filtering = true;
66ea9427
JP		 4523 hdev->discovery.type = cp->type;
4524 hdev->discovery.rssi = cp->rssi;
4525 hdev->discovery.uuid_count = uuid_count;
4526
4527 if (uuid_count > 0) {
4528 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4529 GFP_KERNEL);
4530 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4531 err = mgmt_cmd_complete(sk, hdev->id,
4532 MGMT_OP_START_SERVICE_DISCOVERY,
4533 MGMT_STATUS_FAILED,
4534 &cp->type, sizeof(cp->type));
d9483943
JH		 4535 mgmt_pending_remove(cmd);
4536 goto failed;
4537 }
66ea9427 4538 }
d9483943 4539
66ea9427 4540 hci_req_init(&req, hdev);
5e0452c0 4541
66ea9427 4542 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4543 err = mgmt_cmd_complete(sk, hdev->id,
4544 MGMT_OP_START_SERVICE_DISCOVERY,
4545 status, &cp->type, sizeof(cp->type));
04106755
JH		 4546 mgmt_pending_remove(cmd);
4547 goto failed;
f39799f5 4548 }
3fd24153 4549
7c307720 4550 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4551 if (err < 0) {
14a53664 4552 mgmt_pending_remove(cmd);
66ea9427
JP		 4553 goto failed;
4554 }
4555
4556 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4557
4558failed:
09fd0de5 4559 hci_dev_unlock(hdev);
14a53664
JH		 4560 return err;
4561}
4562
1904a853 4563static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4564{
3b0602cd 4565 struct mgmt_pending_cmd *cmd;
1183fdca 4566
0e05bba6
AG		 4567 BT_DBG("status %d", status);
4568
4569 hci_dev_lock(hdev);
4570
333ae95d 4571 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4572 if (cmd) {
2922a94f 4573 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4574 mgmt_pending_remove(cmd);
0e05bba6
AG		 4575 }
4576
11e6e25d
MH		 4577 if (!status)
4578 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4579
0e05bba6
AG		 4580 hci_dev_unlock(hdev);
4581}
4582
bdb6d971 4583static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4584 u16 len)
14a53664 4585{
d930650b 4586 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4587 struct mgmt_pending_cmd *cmd;
0e05bba6 4588 struct hci_request req;
14a53664
JH		 4589 int err;
4590
bdb6d971 4591 BT_DBG("%s", hdev->name);
14a53664 4592
09fd0de5 4593 hci_dev_lock(hdev);
14a53664 4594
30dc78e1 4595 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4596 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4597 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4598 sizeof(mgmt_cp->type));
d930650b
JH		 4599 goto unlock;
4600 }
4601
4602 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4603 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4604 MGMT_STATUS_INVALID_PARAMS,
4605 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4606 goto unlock;
ff9ef578
JH		 4607 }
4608
2922a94f 4609 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4610 if (!cmd) {
4611 err = -ENOMEM;
30dc78e1
JH		 4612 goto unlock;
4613 }
4614
2922a94f
JH		 4615 cmd->cmd_complete = generic_cmd_complete;
4616
0e05bba6
AG		 4617 hci_req_init(&req, hdev);
4618
21a60d30 4619 hci_stop_discovery(&req);
e0d9727e 4620
21a60d30
JH		 4621 err = hci_req_run(&req, stop_discovery_complete);
4622 if (!err) {
4623 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4624 goto unlock;
14a53664
JH		 4625 }
4626
21a60d30
JH		 4627 mgmt_pending_remove(cmd);
4628
4629 /* If no HCI commands were sent we're done */
4630 if (err == -ENODATA) {
2a1afb5a
JH		 4631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4632 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4633 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4634 }
14a53664 4635
30dc78e1 4636unlock:
09fd0de5 4637 hci_dev_unlock(hdev);
14a53664
JH		 4638 return err;
4639}
4640
bdb6d971 4641static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4642 u16 len)
561aafbc 4643{
650f726d 4644 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4645 struct inquiry_entry *e;
561aafbc
JH		 4646 int err;
4647
bdb6d971 4648 BT_DBG("%s", hdev->name);
561aafbc 4649
561aafbc
JH		 4650 hci_dev_lock(hdev);
4651
30dc78e1 4652 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4653 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4654 MGMT_STATUS_FAILED, &cp->addr,
4655 sizeof(cp->addr));
30dc78e1
JH		 4656 goto failed;
4657 }
4658
a198e7b1 4659 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4660 if (!e) {
2a1afb5a
JH		 4661 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4662 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4663 sizeof(cp->addr));
561aafbc
JH		 4664 goto failed;
4665 }
4666
4667 if (cp->name_known) {
4668 e->name_state = NAME_KNOWN;
4669 list_del(&e->list);
4670 } else {
4671 e->name_state = NAME_NEEDED;
a3d4e20a 4672 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4673 }
4674
2a1afb5a
JH		 4675 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4676 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4677
4678failed:
4679 hci_dev_unlock(hdev);
561aafbc
JH		 4680 return err;
4681}
4682
bdb6d971 4683static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4684 u16 len)
7fbec224 4685{
650f726d 4686 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4687 u8 status;
7fbec224
AJ		 4688 int err;
4689
bdb6d971 4690 BT_DBG("%s", hdev->name);
7fbec224 4691
4ee71b20 4692 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4693 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4694 MGMT_STATUS_INVALID_PARAMS,
4695 &cp->addr, sizeof(cp->addr));
4ee71b20 4696
09fd0de5 4697 hci_dev_lock(hdev);
5e762444 4698
dcc36c16
JH		 4699 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4700 cp->addr.type);
2a8357f2 4701 if (err < 0) {
f0eeea8b 4702 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4703 goto done;
4704 }
4705
4706 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4707 sk);
4708 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4709
2a8357f2 4710done:
2a1afb5a
JH		 4711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4712 &cp->addr, sizeof(cp->addr));
5e762444 4713
09fd0de5 4714 hci_dev_unlock(hdev);
7fbec224
AJ		 4715
4716 return err;
4717}
4718
bdb6d971 4719static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4720 u16 len)
7fbec224 4721{
650f726d 4722 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4723 u8 status;
7fbec224
AJ		 4724 int err;
4725
bdb6d971 4726 BT_DBG("%s", hdev->name);
7fbec224 4727
4ee71b20 4728 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4729 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4730 MGMT_STATUS_INVALID_PARAMS,
4731 &cp->addr, sizeof(cp->addr));
4ee71b20 4732
09fd0de5 4733 hci_dev_lock(hdev);
5e762444 4734
dcc36c16
JH		 4735 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4736 cp->addr.type);
2a8357f2 4737 if (err < 0) {
f0eeea8b 4738 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4739 goto done;
4740 }
4741
4742 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4743 sk);
4744 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4745
2a8357f2 4746done:
2a1afb5a
JH		 4747 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4748 &cp->addr, sizeof(cp->addr));
5e762444 4749
09fd0de5 4750 hci_dev_unlock(hdev);
7fbec224
AJ		 4751
4752 return err;
4753}
4754
cdbaccca
MH		 4755static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4756 u16 len)
4757{
4758 struct mgmt_cp_set_device_id *cp = data;
890ea898 4759 struct hci_request req;
cdbaccca 4760 int err;
c72d4b8a 4761 __u16 source;
cdbaccca
MH		 4762
4763 BT_DBG("%s", hdev->name);
4764
c72d4b8a
SJ		 4765 source = __le16_to_cpu(cp->source);
4766
4767 if (source > 0x0002)
a69e8375
JH		 4768 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4769 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4770
cdbaccca
MH		 4771 hci_dev_lock(hdev);
4772
c72d4b8a 4773 hdev->devid_source = source;
cdbaccca
MH		 4774 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4775 hdev->devid_product = __le16_to_cpu(cp->product);
4776 hdev->devid_version = __le16_to_cpu(cp->version);
4777
2a1afb5a
JH		 4778 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4779 NULL, 0);
cdbaccca 4780
890ea898
JH		 4781 hci_req_init(&req, hdev);
4782 update_eir(&req);
4783 hci_req_run(&req, NULL);
cdbaccca
MH		 4784
4785 hci_dev_unlock(hdev);
4786
4787 return err;
4788}
4789
24b4f38f
AU		 4790static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4791 u16 opcode)
4792{
4793 BT_DBG("status %d", status);
4794}
4795
1904a853
MH		 4796static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4797 u16 opcode)
4375f103
JH		 4798{
4799 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4800 struct hci_request req;
7816b820
FG		 4801 u8 instance;
4802 struct adv_info *adv_instance;
4803 int err;
4375f103 4804
3ad67582
JK		 4805 hci_dev_lock(hdev);
4806
4375f103
JH		 4807 if (status) {
4808 u8 mgmt_err = mgmt_status(status);
4809
4810 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4811 cmd_status_rsp, &mgmt_err);
3ad67582 4812 goto unlock;
4375f103
JH		 4813 }
4814
d7a5a11d 4815 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4816 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4817 else
a358dc11 4818 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4819
4375f103
JH		 4820 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4821 &match);
4822
4823 new_settings(hdev, match.sk);
4824
4825 if (match.sk)
4826 sock_put(match.sk);
3ad67582 4827
24b4f38f 4828 /* If "Set Advertising" was just disabled and instance advertising was
7816b820 4829 * set up earlier, then re-enable multi-instance advertising.
24b4f38f
AU		 4830 */
4831 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7816b820
FG		 4832 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4833 list_empty(&hdev->adv_instances))
24b4f38f
AU		 4834 goto unlock;
4835
7816b820
FG		 4836 instance = hdev->cur_adv_instance;
4837 if (!instance) {
4838 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4839 struct adv_info, list);
4840 if (!adv_instance)
4841 goto unlock;
4842
4843 instance = adv_instance->instance;
4844 }
4845
24b4f38f
AU		 4846 hci_req_init(&req, hdev);
4847
7816b820
FG		 4848 err = schedule_adv_instance(&req, instance, true);
4849
4850 if (!err)
4851 err = hci_req_run(&req, enable_advertising_instance);
24b4f38f 4852
7816b820 4853 if (err)
24b4f38f
AU		 4854 BT_ERR("Failed to re-configure advertising");
4855
3ad67582
JK		 4856unlock:
4857 hci_dev_unlock(hdev);
4375f103
JH		 4858}
4859
21b5187f
MH		 4860static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4861 u16 len)
4375f103
JH		 4862{
4863 struct mgmt_mode *cp = data;
3b0602cd 4864 struct mgmt_pending_cmd *cmd;
4375f103 4865 struct hci_request req;
cc91cb04 4866 u8 val, status;
4375f103
JH		 4867 int err;
4868
4869 BT_DBG("request for %s", hdev->name);
4870
e6fe7986
JH		 4871 status = mgmt_le_support(hdev);
4872 if (status)
a69e8375
JH		 4873 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4874 status);
4375f103 4875
cc91cb04 4876 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4878 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4879
4880 hci_dev_lock(hdev);
4881
4882 val = !!cp->val;
4375f103 4883
f74ca9b8
JH		 4884 /* The following conditions are ones which mean that we should
4885 * not do any HCI communication but directly send a mgmt
4886 * response to user space (after toggling the flag if
4887 * necessary).
4888 */
cc91cb04 4889 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4890 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4891 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4892 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4893 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4894 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4895 bool changed;
4375f103 4896
cc91cb04 4897 if (cp->val) {
238be788 4898 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4899 if (cp->val == 0x02)
a1536da2 4900 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4901 else
a358dc11 4902 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4903 } else {
a69d8927 4904 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4905 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4906 }
4907
4908 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4909 if (err < 0)
4910 goto unlock;
4911
4912 if (changed)
4913 err = new_settings(hdev, sk);
4914
4915 goto unlock;
4916 }
4917
333ae95d
JH		 4918 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4919 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4920 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4921 MGMT_STATUS_BUSY);
4375f103
JH		 4922 goto unlock;
4923 }
4924
4925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4926 if (!cmd) {
4927 err = -ENOMEM;
4928 goto unlock;
4929 }
4930
4931 hci_req_init(&req, hdev);
4932
cc91cb04 4933 if (cp->val == 0x02)
a1536da2 4934 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4935 else
a358dc11 4936 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4937
7816b820
FG		 4938 cancel_adv_timeout(hdev);
4939
24b4f38f 4940 if (val) {
7816b820
FG		 4941 /* Switch to instance "0" for the Set Advertising setting.
4942 * We cannot use update_[adv|scan_rsp]_data() here as the
4943 * HCI_ADVERTISING flag is not yet set.
4944 */
efae002c
FG		 4945 update_inst_adv_data(&req, 0x00);
4946 update_inst_scan_rsp_data(&req, 0x00);
bba3aa55 4947 enable_advertising(&req);
24b4f38f 4948 } else {
bba3aa55 4949 disable_advertising(&req);
24b4f38f 4950 }
4375f103
JH		 4951
4952 err = hci_req_run(&req, set_advertising_complete);
4953 if (err < 0)
4954 mgmt_pending_remove(cmd);
4955
4956unlock:
4957 hci_dev_unlock(hdev);
4958 return err;
4959}
4960
d13eafce
MH		 4961static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4962 void *data, u16 len)
4963{
4964 struct mgmt_cp_set_static_address *cp = data;
4965 int err;
4966
4967 BT_DBG("%s", hdev->name);
4968
62af4443 4969 if (!lmp_le_capable(hdev))
a69e8375
JH		 4970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4971 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4972
4973 if (hdev_is_powered(hdev))
a69e8375
JH		 4974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4975 MGMT_STATUS_REJECTED);
d13eafce
MH		 4976
4977 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4978 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4979 return mgmt_cmd_status(sk, hdev->id,
4980 MGMT_OP_SET_STATIC_ADDRESS,
4981 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4982
4983 /* Two most significant bits shall be set */
4984 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4985 return mgmt_cmd_status(sk, hdev->id,
4986 MGMT_OP_SET_STATIC_ADDRESS,
4987 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4988 }
4989
4990 hci_dev_lock(hdev);
4991
4992 bacpy(&hdev->static_addr, &cp->bdaddr);
4993
93690c22
MH		 4994 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4995 if (err < 0)
4996 goto unlock;
4997
4998 err = new_settings(hdev, sk);
d13eafce 4999
93690c22 5000unlock:
d13eafce 5001 hci_dev_unlock(hdev);
d13eafce
MH		 5002 return err;
5003}
5004
14b49b9a
MH		 5005static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5006 void *data, u16 len)
5007{
5008 struct mgmt_cp_set_scan_params *cp = data;
5009 __u16 interval, window;
5010 int err;
5011
5012 BT_DBG("%s", hdev->name);
5013
5014 if (!lmp_le_capable(hdev))
a69e8375
JH		 5015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5016 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 5017
5018 interval = __le16_to_cpu(cp->interval);
5019
5020 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 5021 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5022 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 5023
5024 window = __le16_to_cpu(cp->window);
5025
5026 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 5027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5028 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 5029
899e1075 5030 if (window > interval)
a69e8375
JH		 5031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5032 MGMT_STATUS_INVALID_PARAMS);
899e1075 5033
14b49b9a
MH		 5034 hci_dev_lock(hdev);
5035
5036 hdev->le_scan_interval = interval;
5037 hdev->le_scan_window = window;
5038
2a1afb5a
JH		 5039 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5040 NULL, 0);
14b49b9a 5041
dd2ef8e2
AG		 5042 /* If background scan is running, restart it so new parameters are
5043 * loaded.
5044 */
d7a5a11d 5045 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 5046 hdev->discovery.state == DISCOVERY_STOPPED) {
5047 struct hci_request req;
5048
5049 hci_req_init(&req, hdev);
5050
5051 hci_req_add_le_scan_disable(&req);
5052 hci_req_add_le_passive_scan(&req);
5053
5054 hci_req_run(&req, NULL);
5055 }
5056
14b49b9a
MH		 5057 hci_dev_unlock(hdev);
5058
5059 return err;
5060}
5061
1904a853
MH		 5062static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5063 u16 opcode)
33e38b3e 5064{
3b0602cd 5065 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 5066
5067 BT_DBG("status 0x%02x", status);
5068
5069 hci_dev_lock(hdev);
5070
333ae95d 5071 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 5072 if (!cmd)
5073 goto unlock;
5074
5075 if (status) {
a69e8375
JH		 5076 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5077 mgmt_status(status));
33e38b3e 5078 } else {
1a4d3c4b
JH		 5079 struct mgmt_mode *cp = cmd->param;
5080
5081 if (cp->val)
a1536da2 5082 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5083 else
a358dc11 5084 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5085
33e38b3e
JH		 5086 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5087 new_settings(hdev, cmd->sk);
5088 }
5089
5090 mgmt_pending_remove(cmd);
5091
5092unlock:
5093 hci_dev_unlock(hdev);
5094}
5095
bdb6d971 5096static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 5097 void *data, u16 len)
f6422ec6 5098{
650f726d 5099 struct mgmt_mode *cp = data;
3b0602cd 5100 struct mgmt_pending_cmd *cmd;
33e38b3e 5101 struct hci_request req;
f6422ec6
AJ		 5102 int err;
5103
bdb6d971 5104 BT_DBG("%s", hdev->name);
f6422ec6 5105
d7a5a11d 5106 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 5107 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 5108 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5109 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 5110
a7e80f25 5111 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5112 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5113 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 5114
f6422ec6
AJ		 5115 hci_dev_lock(hdev);
5116
333ae95d 5117 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 5118 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5119 MGMT_STATUS_BUSY);
05cbf29f
JH		 5120 goto unlock;
5121 }
5122
d7a5a11d 5123 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 5124 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5125 hdev);
5126 goto unlock;
5127 }
5128
406ef2a6 5129 if (!hdev_is_powered(hdev)) {
ce05d603 5130 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 5131 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5132 hdev);
5133 new_settings(hdev, sk);
5134 goto unlock;
5135 }
5136
33e38b3e
JH		 5137 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5138 data, len);
5139 if (!cmd) {
5140 err = -ENOMEM;
5141 goto unlock;
f6422ec6
AJ		 5142 }
5143
33e38b3e
JH		 5144 hci_req_init(&req, hdev);
5145
406d7804 5146 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 5147
5148 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 5149 if (err < 0) {
a69e8375
JH		 5150 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5151 MGMT_STATUS_FAILED);
33e38b3e 5152 mgmt_pending_remove(cmd);
f6422ec6
AJ		 5153 }
5154
33e38b3e 5155unlock:
f6422ec6 5156 hci_dev_unlock(hdev);
33e38b3e 5157
f6422ec6
AJ		 5158 return err;
5159}
5160
1904a853 5161static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 5162{
3b0602cd 5163 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5164
5165 BT_DBG("status 0x%02x", status);
5166
5167 hci_dev_lock(hdev);
5168
333ae95d 5169 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 5170 if (!cmd)
5171 goto unlock;
5172
5173 if (status) {
5174 u8 mgmt_err = mgmt_status(status);
5175
5176 /* We need to restore the flag if related HCI commands
5177 * failed.
5178 */
a358dc11 5179 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 5180
a69e8375 5181 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 5182 } else {
5183 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5184 new_settings(hdev, cmd->sk);
5185 }
5186
5187 mgmt_pending_remove(cmd);
5188
5189unlock:
5190 hci_dev_unlock(hdev);
5191}
5192
5193static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5194{
5195 struct mgmt_mode *cp = data;
3b0602cd 5196 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5197 struct hci_request req;
5198 int err;
5199
5200 BT_DBG("request for %s", hdev->name);
5201
5202 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 5203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5204 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 5205
d7a5a11d 5206 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5208 MGMT_STATUS_REJECTED);
0663ca2a
JH		 5209
5210 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5212 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 5213
5214 hci_dev_lock(hdev);
5215
d7a5a11d 5216 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5217 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5218 goto unlock;
5219 }
5220
5221 if (!hdev_is_powered(hdev)) {
5222 if (!cp->val) {
a358dc11
MH		 5223 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5224 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5225 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5226 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5227 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5228 }
5229
ce05d603 5230 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5231
5232 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5233 if (err < 0)
5234 goto unlock;
5235
5236 err = new_settings(hdev, sk);
5237 goto unlock;
5238 }
5239
5240 /* Reject disabling when powered on */
5241 if (!cp->val) {
a69e8375
JH		 5242 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5243 MGMT_STATUS_REJECTED);
0663ca2a 5244 goto unlock;
111e4bcc
MH		 5245 } else {
5246 /* When configuring a dual-mode controller to operate
5247 * with LE only and using a static address, then switching
5248 * BR/EDR back on is not allowed.
5249 *
5250 * Dual-mode controllers shall operate with the public
5251 * address as its identity address for BR/EDR and LE. So
5252 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5253 *
5254 * The same restrictions applies when secure connections
5255 * has been enabled. For BR/EDR this is a controller feature
5256 * while for LE it is a host stack feature. This means that
5257 * switching BR/EDR back on when secure connections has been
5258 * enabled is not a supported transaction.
111e4bcc 5259 */
d7a5a11d 5260 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5261 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5262 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5263 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5264 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5265 goto unlock;
5266 }
0663ca2a
JH		 5267 }
5268
333ae95d 5269 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5270 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5271 MGMT_STATUS_BUSY);
0663ca2a
JH		 5272 goto unlock;
5273 }
5274
5275 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5276 if (!cmd) {
5277 err = -ENOMEM;
5278 goto unlock;
5279 }
5280
5947f4bc 5281 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5282 * generates the correct flags.
5283 */
a1536da2 5284 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5285
5286 hci_req_init(&req, hdev);
aa8af46e 5287
432df05e 5288 write_fast_connectable(&req, false);
1d2dc5b7 5289 __hci_update_page_scan(&req);
aa8af46e 5290
f14d8f64
MH		 5291 /* Since only the advertising data flags will change, there
5292 * is no need to update the scan response data.
5293 */
5947f4bc 5294 update_adv_data(&req);
aa8af46e 5295
0663ca2a
JH		 5296 err = hci_req_run(&req, set_bredr_complete);
5297 if (err < 0)
5298 mgmt_pending_remove(cmd);
5299
5300unlock:
5301 hci_dev_unlock(hdev);
5302 return err;
5303}
5304
a1443f5a
JH		 5305static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5306{
3b0602cd 5307 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5308 struct mgmt_mode *cp;
5309
5310 BT_DBG("%s status %u", hdev->name, status);
5311
5312 hci_dev_lock(hdev);
5313
333ae95d 5314 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5315 if (!cmd)
5316 goto unlock;
5317
5318 if (status) {
a69e8375
JH		 5319 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5320 mgmt_status(status));
a1443f5a
JH		 5321 goto remove;
5322 }
5323
5324 cp = cmd->param;
5325
5326 switch (cp->val) {
5327 case 0x00:
a358dc11
MH		 5328 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5329 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5330 break;
5331 case 0x01:
a1536da2 5332 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5333 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5334 break;
5335 case 0x02:
a1536da2
MH		 5336 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5337 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5338 break;
5339 }
5340
5341 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5342 new_settings(hdev, cmd->sk);
5343
5344remove:
5345 mgmt_pending_remove(cmd);
5346unlock:
5347 hci_dev_unlock(hdev);
5348}
5349
eac83dc6
MH		 5350static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5351 void *data, u16 len)
5352{
5353 struct mgmt_mode *cp = data;
3b0602cd 5354 struct mgmt_pending_cmd *cmd;
a1443f5a 5355 struct hci_request req;
a3209694 5356 u8 val;
eac83dc6
MH		 5357 int err;
5358
5359 BT_DBG("request for %s", hdev->name);
5360
05b3c3e7 5361 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5362 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5364 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5365
d7a5a11d 5366 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5367 lmp_sc_capable(hdev) &&
d7a5a11d 5368 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5369 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5370 MGMT_STATUS_REJECTED);
ed93ec69 5371
0ab04a9c 5372 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5374 MGMT_STATUS_INVALID_PARAMS);
5375
5376 hci_dev_lock(hdev);
5377
05b3c3e7 5378 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5379 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5380 bool changed;
5381
0ab04a9c 5382 if (cp->val) {
238be788
MH		 5383 changed = !hci_dev_test_and_set_flag(hdev,
5384 HCI_SC_ENABLED);
0ab04a9c 5385 if (cp->val == 0x02)
a1536da2 5386 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5387 else
a358dc11 5388 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5389 } else {
a69d8927
MH		 5390 changed = hci_dev_test_and_clear_flag(hdev,
5391 HCI_SC_ENABLED);
a358dc11 5392 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5393 }
eac83dc6
MH		 5394
5395 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5396 if (err < 0)
5397 goto failed;
5398
5399 if (changed)
5400 err = new_settings(hdev, sk);
5401
5402 goto failed;
5403 }
5404
333ae95d 5405 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5406 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5407 MGMT_STATUS_BUSY);
eac83dc6
MH		 5408 goto failed;
5409 }
5410
0ab04a9c
MH		 5411 val = !!cp->val;
5412
d7a5a11d
MH		 5413 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5414 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5415 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5416 goto failed;
5417 }
5418
5419 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5420 if (!cmd) {
5421 err = -ENOMEM;
5422 goto failed;
5423 }
5424
a1443f5a
JH		 5425 hci_req_init(&req, hdev);
5426 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5427 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5428 if (err < 0) {
5429 mgmt_pending_remove(cmd);
5430 goto failed;
5431 }
5432
5433failed:
5434 hci_dev_unlock(hdev);
5435 return err;
5436}
5437
4e39ac81
MH		 5438static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5439 void *data, u16 len)
5440{
5441 struct mgmt_mode *cp = data;
b9710979 5442 bool changed, use_changed;
4e39ac81
MH		 5443 int err;
5444
5445 BT_DBG("request for %s", hdev->name);
5446
b9710979 5447 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5448 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5449 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5450
5451 hci_dev_lock(hdev);
5452
5453 if (cp->val)
238be788 5454 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5455 else
a69d8927
MH		 5456 changed = hci_dev_test_and_clear_flag(hdev,
5457 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5458
b9710979 5459 if (cp->val == 0x02)
238be788
MH		 5460 use_changed = !hci_dev_test_and_set_flag(hdev,
5461 HCI_USE_DEBUG_KEYS);
b9710979 5462 else
a69d8927
MH		 5463 use_changed = hci_dev_test_and_clear_flag(hdev,
5464 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5465
5466 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5467 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5468 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5469 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5470 sizeof(mode), &mode);
5471 }
5472
4e39ac81
MH		 5473 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5474 if (err < 0)
5475 goto unlock;
5476
5477 if (changed)
5478 err = new_settings(hdev, sk);
5479
5480unlock:
5481 hci_dev_unlock(hdev);
5482 return err;
5483}
5484
62b04cd1
JH		 5485static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5486 u16 len)
5487{
5488 struct mgmt_cp_set_privacy *cp = cp_data;
5489 bool changed;
5490 int err;
5491
5492 BT_DBG("request for %s", hdev->name);
5493
5494 if (!lmp_le_capable(hdev))
a69e8375
JH		 5495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5496 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5497
5498 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5499 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5500 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5501
5502 if (hdev_is_powered(hdev))
a69e8375
JH		 5503 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5504 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5505
5506 hci_dev_lock(hdev);
5507
c21c0ea0
JH		 5508 /* If user space supports this command it is also expected to
5509 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5510 */
a1536da2 5511 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5512
62b04cd1 5513 if (cp->privacy) {
238be788 5514 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5515 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5516 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5517 } else {
a69d8927 5518 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5519 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5520 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5521 }
5522
5523 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5524 if (err < 0)
5525 goto unlock;
5526
5527 if (changed)
5528 err = new_settings(hdev, sk);
5529
5530unlock:
5531 hci_dev_unlock(hdev);
5532 return err;
5533}
5534
41edf160
JH		 5535static bool irk_is_valid(struct mgmt_irk_info *irk)
5536{
5537 switch (irk->addr.type) {
5538 case BDADDR_LE_PUBLIC:
5539 return true;
5540
5541 case BDADDR_LE_RANDOM:
5542 /* Two most significant bits shall be set */
5543 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5544 return false;
5545 return true;
5546 }
5547
5548 return false;
5549}
5550
5551static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5552 u16 len)
5553{
5554 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5555 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5556 sizeof(struct mgmt_irk_info));
41edf160
JH		 5557 u16 irk_count, expected_len;
5558 int i, err;
5559
5560 BT_DBG("request for %s", hdev->name);
5561
5562 if (!lmp_le_capable(hdev))
a69e8375
JH		 5563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5564 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5565
5566 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5567 if (irk_count > max_irk_count) {
5568 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5570 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5571 }
41edf160
JH		 5572
5573 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5574 if (expected_len != len) {
5575 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5576 expected_len, len);
a69e8375
JH		 5577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5578 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5579 }
5580
5581 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5582
5583 for (i = 0; i < irk_count; i++) {
5584 struct mgmt_irk_info *key = &cp->irks[i];
5585
5586 if (!irk_is_valid(key))
a69e8375
JH		 5587 return mgmt_cmd_status(sk, hdev->id,
5588 MGMT_OP_LOAD_IRKS,
5589 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5590 }
5591
5592 hci_dev_lock(hdev);
5593
5594 hci_smp_irks_clear(hdev);
5595
5596 for (i = 0; i < irk_count; i++) {
5597 struct mgmt_irk_info *irk = &cp->irks[i];
5598 u8 addr_type;
5599
5600 if (irk->addr.type == BDADDR_LE_PUBLIC)
5601 addr_type = ADDR_LE_DEV_PUBLIC;
5602 else
5603 addr_type = ADDR_LE_DEV_RANDOM;
5604
5605 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5606 BDADDR_ANY);
5607 }
5608
a1536da2 5609 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5610
2a1afb5a 5611 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5612
5613 hci_dev_unlock(hdev);
5614
5615 return err;
5616}
5617
3f706b72
JH		 5618static bool ltk_is_valid(struct mgmt_ltk_info *key)
5619{
5620 if (key->master != 0x00 && key->master != 0x01)
5621 return false;
490cb0b3
MH		 5622
5623 switch (key->addr.type) {
5624 case BDADDR_LE_PUBLIC:
5625 return true;
5626
5627 case BDADDR_LE_RANDOM:
5628 /* Two most significant bits shall be set */
5629 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5630 return false;
5631 return true;
5632 }
5633
5634 return false;
3f706b72
JH		 5635}
5636
bdb6d971 5637static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5638 void *cp_data, u16 len)
346af67b 5639{
346af67b 5640 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5641 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5642 sizeof(struct mgmt_ltk_info));
346af67b 5643 u16 key_count, expected_len;
715a5bf2 5644 int i, err;
346af67b 5645
cf99ba13
MH		 5646 BT_DBG("request for %s", hdev->name);
5647
5648 if (!lmp_le_capable(hdev))
a69e8375
JH		 5649 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5650 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5651
1f350c87 5652 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5653 if (key_count > max_key_count) {
5654 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5655 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5656 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5657 }
346af67b
VCG		 5658
5659 expected_len = sizeof(*cp) + key_count *
5660 sizeof(struct mgmt_ltk_info);
5661 if (expected_len != len) {
5662 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5663 expected_len, len);
a69e8375
JH		 5664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5665 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5666 }
5667
bdb6d971 5668 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5669
54ad6d8a
JH		 5670 for (i = 0; i < key_count; i++) {
5671 struct mgmt_ltk_info *key = &cp->keys[i];
5672
3f706b72 5673 if (!ltk_is_valid(key))
a69e8375
JH		 5674 return mgmt_cmd_status(sk, hdev->id,
5675 MGMT_OP_LOAD_LONG_TERM_KEYS,
5676 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5677 }
5678
346af67b
VCG		 5679 hci_dev_lock(hdev);
5680
5681 hci_smp_ltks_clear(hdev);
5682
5683 for (i = 0; i < key_count; i++) {
5684 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5685 u8 type, addr_type, authenticated;
79d95a19
MH		 5686
5687 if (key->addr.type == BDADDR_LE_PUBLIC)
5688 addr_type = ADDR_LE_DEV_PUBLIC;
5689 else
5690 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5691
61b43357
JH		 5692 switch (key->type) {
5693 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5694 authenticated = 0x00;
23fb8de3 5695 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5696 break;
5697 case MGMT_LTK_AUTHENTICATED:
d7b25450 5698 authenticated = 0x01;
23fb8de3
JH		 5699 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5700 break;
5701 case MGMT_LTK_P256_UNAUTH:
5702 authenticated = 0x00;
5703 type = SMP_LTK_P256;
61b43357 5704 break;
23fb8de3
JH		 5705 case MGMT_LTK_P256_AUTH:
5706 authenticated = 0x01;
5707 type = SMP_LTK_P256;
61b43357 5708 break;
23fb8de3
JH		 5709 case MGMT_LTK_P256_DEBUG:
5710 authenticated = 0x00;
5711 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5712 default:
5713 continue;
5714 }
d7b25450 5715
35d70271 5716 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5717 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5718 key->rand);
346af67b
VCG		 5719 }
5720
2a1afb5a 5721 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5722 NULL, 0);
5723
346af67b 5724 hci_dev_unlock(hdev);
346af67b 5725
715a5bf2 5726 return err;
346af67b
VCG		 5727}
5728
3b0602cd 5729static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5730{
dd983808 5731 struct hci_conn *conn = cmd->user_data;
9981bdb0 5732 struct mgmt_rp_get_conn_info rp;
9df74653 5733 int err;
dd983808 5734
9981bdb0 5735 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5736
9981bdb0 5737 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5738 rp.rssi = conn->rssi;
9981bdb0
JH		 5739 rp.tx_power = conn->tx_power;
5740 rp.max_tx_power = conn->max_tx_power;
5741 } else {
5742 rp.rssi = HCI_RSSI_INVALID;
5743 rp.tx_power = HCI_TX_POWER_INVALID;
5744 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5745 }
5746
2a1afb5a
JH		 5747 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5748 status, &rp, sizeof(rp));
dd983808
AK		 5749
5750 hci_conn_drop(conn);
f8aaf9b6 5751 hci_conn_put(conn);
9df74653
JH		 5752
5753 return err;
dd983808
AK		 5754}
5755
1904a853
MH		 5756static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5757 u16 opcode)
dd983808
AK		 5758{
5759 struct hci_cp_read_rssi *cp;
3b0602cd 5760 struct mgmt_pending_cmd *cmd;
dd983808 5761 struct hci_conn *conn;
dd983808 5762 u16 handle;
9981bdb0 5763 u8 status;
dd983808 5764
9981bdb0 5765 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5766
5767 hci_dev_lock(hdev);
5768
dd983808
AK		 5769 /* Commands sent in request are either Read RSSI or Read Transmit Power
5770 * Level so we check which one was last sent to retrieve connection
5771 * handle. Both commands have handle as first parameter so it's safe to
5772 * cast data on the same command struct.
5773 *
5774 * First command sent is always Read RSSI and we fail only if it fails.
5775 * In other case we simply override error to indicate success as we
5776 * already remembered if TX power value is actually valid.
5777 */
5778 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5779 if (!cp) {
5780 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5781 status = MGMT_STATUS_SUCCESS;
5782 } else {
5783 status = mgmt_status(hci_status);
dd983808
AK		 5784 }
5785
5786 if (!cp) {
9981bdb0 5787 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5788 goto unlock;
5789 }
5790
5791 handle = __le16_to_cpu(cp->handle);
5792 conn = hci_conn_hash_lookup_handle(hdev, handle);
5793 if (!conn) {
9981bdb0 5794 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5795 goto unlock;
5796 }
5797
333ae95d 5798 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5799 if (!cmd)
5800 goto unlock;
dd983808 5801
9981bdb0
JH		 5802 cmd->cmd_complete(cmd, status);
5803 mgmt_pending_remove(cmd);
dd983808
AK		 5804
5805unlock:
5806 hci_dev_unlock(hdev);
5807}
5808
5809static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5810 u16 len)
5811{
5812 struct mgmt_cp_get_conn_info *cp = data;
5813 struct mgmt_rp_get_conn_info rp;
5814 struct hci_conn *conn;
5815 unsigned long conn_info_age;
5816 int err = 0;
5817
5818 BT_DBG("%s", hdev->name);
5819
5820 memset(&rp, 0, sizeof(rp));
5821 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5822 rp.addr.type = cp->addr.type;
5823
5824 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5825 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5826 MGMT_STATUS_INVALID_PARAMS,
5827 &rp, sizeof(rp));
dd983808
AK		 5828
5829 hci_dev_lock(hdev);
5830
5831 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5832 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5833 MGMT_STATUS_NOT_POWERED, &rp,
5834 sizeof(rp));
dd983808
AK		 5835 goto unlock;
5836 }
5837
5838 if (cp->addr.type == BDADDR_BREDR)
5839 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5840 &cp->addr.bdaddr);
5841 else
5842 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5843
5844 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5845 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5846 MGMT_STATUS_NOT_CONNECTED, &rp,
5847 sizeof(rp));
dd983808
AK		 5848 goto unlock;
5849 }
5850
333ae95d 5851 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5852 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5853 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5854 goto unlock;
5855 }
5856
dd983808
AK		 5857 /* To avoid client trying to guess when to poll again for information we
5858 * calculate conn info age as random value between min/max set in hdev.
5859 */
5860 conn_info_age = hdev->conn_info_min_age +
5861 prandom_u32_max(hdev->conn_info_max_age -
5862 hdev->conn_info_min_age);
5863
5864 /* Query controller to refresh cached values if they are too old or were
5865 * never read.
5866 */
f4e2dd53
AK		 5867 if (time_after(jiffies, conn->conn_info_timestamp +
5868 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5869 !conn->conn_info_timestamp) {
5870 struct hci_request req;
5871 struct hci_cp_read_tx_power req_txp_cp;
5872 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5873 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5874
5875 hci_req_init(&req, hdev);
5876 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5877 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5878 &req_rssi_cp);
5879
f7faab0c
AK		 5880 /* For LE links TX power does not change thus we don't need to
5881 * query for it once value is known.
5882 */
5883 if (!bdaddr_type_is_le(cp->addr.type) ||
5884 conn->tx_power == HCI_TX_POWER_INVALID) {
5885 req_txp_cp.handle = cpu_to_le16(conn->handle);
5886 req_txp_cp.type = 0x00;
5887 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5888 sizeof(req_txp_cp), &req_txp_cp);
5889 }
dd983808 5890
eed5daf3
AK		 5891 /* Max TX power needs to be read only once per connection */
5892 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5893 req_txp_cp.handle = cpu_to_le16(conn->handle);
5894 req_txp_cp.type = 0x01;
5895 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5896 sizeof(req_txp_cp), &req_txp_cp);
5897 }
5898
dd983808
AK		 5899 err = hci_req_run(&req, conn_info_refresh_complete);
5900 if (err < 0)
5901 goto unlock;
5902
5903 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5904 data, len);
5905 if (!cmd) {
5906 err = -ENOMEM;
5907 goto unlock;
5908 }
5909
5910 hci_conn_hold(conn);
f8aaf9b6 5911 cmd->user_data = hci_conn_get(conn);
9981bdb0 5912 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5913
5914 conn->conn_info_timestamp = jiffies;
5915 } else {
5916 /* Cache is valid, just reply with values cached in hci_conn */
5917 rp.rssi = conn->rssi;
5918 rp.tx_power = conn->tx_power;
eed5daf3 5919 rp.max_tx_power = conn->max_tx_power;
dd983808 5920
2a1afb5a
JH		 5921 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5922 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5923 }
5924
5925unlock:
5926 hci_dev_unlock(hdev);
5927 return err;
5928}
5929
3b0602cd 5930static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5931{
69487371 5932 struct hci_conn *conn = cmd->user_data;
95868426 5933 struct mgmt_rp_get_clock_info rp;
69487371 5934 struct hci_dev *hdev;
9df74653 5935 int err;
69487371
JH		 5936
5937 memset(&rp, 0, sizeof(rp));
5938 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5939
5940 if (status)
5941 goto complete;
5942
5943 hdev = hci_dev_get(cmd->index);
5944 if (hdev) {
5945 rp.local_clock = cpu_to_le32(hdev->clock);
5946 hci_dev_put(hdev);
5947 }
5948
5949 if (conn) {
5950 rp.piconet_clock = cpu_to_le32(conn->clock);
5951 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5952 }
5953
5954complete:
2a1afb5a
JH		 5955 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5956 sizeof(rp));
69487371
JH		 5957
5958 if (conn) {
5959 hci_conn_drop(conn);
5960 hci_conn_put(conn);
5961 }
9df74653
JH		 5962
5963 return err;
69487371
JH		 5964}
5965
1904a853 5966static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5967{
95868426 5968 struct hci_cp_read_clock *hci_cp;
3b0602cd 5969 struct mgmt_pending_cmd *cmd;
95868426
JH		 5970 struct hci_conn *conn;
5971
5972 BT_DBG("%s status %u", hdev->name, status);
5973
5974 hci_dev_lock(hdev);
5975
5976 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5977 if (!hci_cp)
5978 goto unlock;
5979
5980 if (hci_cp->which) {
5981 u16 handle = __le16_to_cpu(hci_cp->handle);
5982 conn = hci_conn_hash_lookup_handle(hdev, handle);
5983 } else {
5984 conn = NULL;
5985 }
5986
333ae95d 5987 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5988 if (!cmd)
5989 goto unlock;
5990
69487371 5991 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5992 mgmt_pending_remove(cmd);
95868426
JH		 5993
5994unlock:
5995 hci_dev_unlock(hdev);
5996}
5997
5998static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5999 u16 len)
6000{
6001 struct mgmt_cp_get_clock_info *cp = data;
6002 struct mgmt_rp_get_clock_info rp;
6003 struct hci_cp_read_clock hci_cp;
3b0602cd 6004 struct mgmt_pending_cmd *cmd;
95868426
JH		 6005 struct hci_request req;
6006 struct hci_conn *conn;
6007 int err;
6008
6009 BT_DBG("%s", hdev->name);
6010
6011 memset(&rp, 0, sizeof(rp));
6012 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6013 rp.addr.type = cp->addr.type;
6014
6015 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 6016 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6017 MGMT_STATUS_INVALID_PARAMS,
6018 &rp, sizeof(rp));
95868426
JH		 6019
6020 hci_dev_lock(hdev);
6021
6022 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 6023 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6024 MGMT_STATUS_NOT_POWERED, &rp,
6025 sizeof(rp));
95868426
JH		 6026 goto unlock;
6027 }
6028
6029 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6030 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6031 &cp->addr.bdaddr);
6032 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 6033 err = mgmt_cmd_complete(sk, hdev->id,
6034 MGMT_OP_GET_CLOCK_INFO,
6035 MGMT_STATUS_NOT_CONNECTED,
6036 &rp, sizeof(rp));
95868426
JH		 6037 goto unlock;
6038 }
6039 } else {
6040 conn = NULL;
6041 }
6042
6043 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6044 if (!cmd) {
6045 err = -ENOMEM;
6046 goto unlock;
6047 }
6048
69487371
JH		 6049 cmd->cmd_complete = clock_info_cmd_complete;
6050
95868426
JH		 6051 hci_req_init(&req, hdev);
6052
6053 memset(&hci_cp, 0, sizeof(hci_cp));
6054 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6055
6056 if (conn) {
6057 hci_conn_hold(conn);
f8aaf9b6 6058 cmd->user_data = hci_conn_get(conn);
95868426
JH		 6059
6060 hci_cp.handle = cpu_to_le16(conn->handle);
6061 hci_cp.which = 0x01; /* Piconet clock */
6062 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6063 }
6064
6065 err = hci_req_run(&req, get_clock_info_complete);
6066 if (err < 0)
6067 mgmt_pending_remove(cmd);
6068
6069unlock:
6070 hci_dev_unlock(hdev);
6071 return err;
6072}
6073
5a154e6f
JH		 6074static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6075{
6076 struct hci_conn *conn;
6077
6078 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6079 if (!conn)
6080 return false;
6081
6082 if (conn->dst_type != type)
6083 return false;
6084
6085 if (conn->state != BT_CONNECTED)
6086 return false;
6087
6088 return true;
6089}
6090
6091/* This function requires the caller holds hdev->lock */
6092static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6093 u8 addr_type, u8 auto_connect)
6094{
6095 struct hci_dev *hdev = req->hdev;
6096 struct hci_conn_params *params;
6097
6098 params = hci_conn_params_add(hdev, addr, addr_type);
6099 if (!params)
6100 return -EIO;
6101
6102 if (params->auto_connect == auto_connect)
6103 return 0;
6104
6105 list_del_init(&params->action);
6106
6107 switch (auto_connect) {
6108 case HCI_AUTO_CONN_DISABLED:
6109 case HCI_AUTO_CONN_LINK_LOSS:
6110 __hci_update_background_scan(req);
6111 break;
6112 case HCI_AUTO_CONN_REPORT:
6113 list_add(&params->action, &hdev->pend_le_reports);
6114 __hci_update_background_scan(req);
6115 break;
6116 case HCI_AUTO_CONN_DIRECT:
6117 case HCI_AUTO_CONN_ALWAYS:
6118 if (!is_connected(hdev, addr, addr_type)) {
6119 list_add(&params->action, &hdev->pend_le_conns);
6120 __hci_update_background_scan(req);
6121 }
6122 break;
6123 }
6124
6125 params->auto_connect = auto_connect;
6126
6127 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6128 auto_connect);
6129
6130 return 0;
6131}
6132
8afef092
MH		 6133static void device_added(struct sock *sk, struct hci_dev *hdev,
6134 bdaddr_t *bdaddr, u8 type, u8 action)
6135{
6136 struct mgmt_ev_device_added ev;
6137
6138 bacpy(&ev.addr.bdaddr, bdaddr);
6139 ev.addr.type = type;
6140 ev.action = action;
6141
6142 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6143}
6144
1904a853 6145static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 6146{
3b0602cd 6147 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 6148
6149 BT_DBG("status 0x%02x", status);
6150
6151 hci_dev_lock(hdev);
6152
333ae95d 6153 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 6154 if (!cmd)
6155 goto unlock;
6156
6157 cmd->cmd_complete(cmd, mgmt_status(status));
6158 mgmt_pending_remove(cmd);
6159
6160unlock:
6161 hci_dev_unlock(hdev);
6162}
6163
2faade53
MH		 6164static int add_device(struct sock *sk, struct hci_dev *hdev,
6165 void *data, u16 len)
6166{
6167 struct mgmt_cp_add_device *cp = data;
3b0602cd 6168 struct mgmt_pending_cmd *cmd;
5a154e6f 6169 struct hci_request req;
2faade53
MH		 6170 u8 auto_conn, addr_type;
6171 int err;
6172
6173 BT_DBG("%s", hdev->name);
6174
6659358e 6175 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 6176 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 6177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6178 MGMT_STATUS_INVALID_PARAMS,
6179 &cp->addr, sizeof(cp->addr));
2faade53 6180
4b9e7e75 6181 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 6182 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6183 MGMT_STATUS_INVALID_PARAMS,
6184 &cp->addr, sizeof(cp->addr));
2faade53 6185
5a154e6f
JH		 6186 hci_req_init(&req, hdev);
6187
2faade53
MH		 6188 hci_dev_lock(hdev);
6189
5a154e6f
JH		 6190 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6191 if (!cmd) {
6192 err = -ENOMEM;
6193 goto unlock;
6194 }
6195
6196 cmd->cmd_complete = addr_cmd_complete;
6197
6659358e 6198 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 6199 /* Only incoming connections action is supported for now */
6659358e 6200 if (cp->action != 0x01) {
9df74653
JH		 6201 err = cmd->cmd_complete(cmd,
6202 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 6203 mgmt_pending_remove(cmd);
6659358e
JH		 6204 goto unlock;
6205 }
6206
6207 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6208 cp->addr.type);
6209 if (err)
6210 goto unlock;
a397407f 6211
5a154e6f 6212 __hci_update_page_scan(&req);
a397407f 6213
6659358e
JH		 6214 goto added;
6215 }
6216
2faade53
MH		 6217 if (cp->addr.type == BDADDR_LE_PUBLIC)
6218 addr_type = ADDR_LE_DEV_PUBLIC;
6219 else
6220 addr_type = ADDR_LE_DEV_RANDOM;
6221
4b9e7e75 6222 if (cp->action == 0x02)
2faade53 6223 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6224 else if (cp->action == 0x01)
6225 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6226 else
a3451d27 6227 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6228
bf5b3c8b
MH		 6229 /* If the connection parameters don't exist for this device,
6230 * they will be created and configured with defaults.
6231 */
5a154e6f 6232 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6233 auto_conn) < 0) {
9df74653 6234 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6235 mgmt_pending_remove(cmd);
2faade53
MH		 6236 goto unlock;
6237 }
6238
6659358e 6239added:
8afef092
MH		 6240 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6241
5a154e6f
JH		 6242 err = hci_req_run(&req, add_device_complete);
6243 if (err < 0) {
6244 /* ENODATA means no HCI commands were needed (e.g. if
6245 * the adapter is powered off).
6246 */
9df74653
JH		 6247 if (err == -ENODATA)
6248 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6249 mgmt_pending_remove(cmd);
6250 }
2faade53
MH		 6251
6252unlock:
6253 hci_dev_unlock(hdev);
6254 return err;
6255}
6256
8afef092
MH		 6257static void device_removed(struct sock *sk, struct hci_dev *hdev,
6258 bdaddr_t *bdaddr, u8 type)
6259{
6260 struct mgmt_ev_device_removed ev;
6261
6262 bacpy(&ev.addr.bdaddr, bdaddr);
6263 ev.addr.type = type;
6264
6265 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6266}
6267
1904a853 6268static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6269{
3b0602cd 6270 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6271
6272 BT_DBG("status 0x%02x", status);
6273
6274 hci_dev_lock(hdev);
6275
333ae95d 6276 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6277 if (!cmd)
6278 goto unlock;
6279
6280 cmd->cmd_complete(cmd, mgmt_status(status));
6281 mgmt_pending_remove(cmd);
6282
6283unlock:
6284 hci_dev_unlock(hdev);
6285}
6286
2faade53
MH		 6287static int remove_device(struct sock *sk, struct hci_dev *hdev,
6288 void *data, u16 len)
6289{
6290 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6291 struct mgmt_pending_cmd *cmd;
51ef3ebe 6292 struct hci_request req;
2faade53
MH		 6293 int err;
6294
6295 BT_DBG("%s", hdev->name);
6296
51ef3ebe
JH		 6297 hci_req_init(&req, hdev);
6298
2faade53
MH		 6299 hci_dev_lock(hdev);
6300
51ef3ebe
JH		 6301 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6302 if (!cmd) {
6303 err = -ENOMEM;
6304 goto unlock;
6305 }
6306
6307 cmd->cmd_complete = addr_cmd_complete;
6308
2faade53 6309 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6310 struct hci_conn_params *params;
2faade53
MH		 6311 u8 addr_type;
6312
6659358e 6313 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6314 err = cmd->cmd_complete(cmd,
6315 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6316 mgmt_pending_remove(cmd);
2faade53
MH		 6317 goto unlock;
6318 }
6319
6659358e
JH		 6320 if (cp->addr.type == BDADDR_BREDR) {
6321 err = hci_bdaddr_list_del(&hdev->whitelist,
6322 &cp->addr.bdaddr,
6323 cp->addr.type);
6324 if (err) {
9df74653
JH		 6325 err = cmd->cmd_complete(cmd,
6326 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6327 mgmt_pending_remove(cmd);
6659358e
JH		 6328 goto unlock;
6329 }
6330
51ef3ebe 6331 __hci_update_page_scan(&req);
a397407f 6332
6659358e
JH		 6333 device_removed(sk, hdev, &cp->addr.bdaddr,
6334 cp->addr.type);
6335 goto complete;
6336 }
6337
2faade53
MH		 6338 if (cp->addr.type == BDADDR_LE_PUBLIC)
6339 addr_type = ADDR_LE_DEV_PUBLIC;
6340 else
6341 addr_type = ADDR_LE_DEV_RANDOM;
6342
c71593dd
JH		 6343 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6344 addr_type);
6345 if (!params) {
9df74653
JH		 6346 err = cmd->cmd_complete(cmd,
6347 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6348 mgmt_pending_remove(cmd);
c71593dd
JH		 6349 goto unlock;
6350 }
6351
6352 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 6353 err = cmd->cmd_complete(cmd,
6354 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6355 mgmt_pending_remove(cmd);
c71593dd
JH		 6356 goto unlock;
6357 }
6358
d1dbf12e 6359 list_del(&params->action);
c71593dd
JH		 6360 list_del(&params->list);
6361 kfree(params);
51ef3ebe 6362 __hci_update_background_scan(&req);
8afef092
MH		 6363
6364 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6365 } else {
19de0825 6366 struct hci_conn_params *p, *tmp;
6659358e 6367 struct bdaddr_list *b, *btmp;
19de0825 6368
2faade53 6369 if (cp->addr.type) {
9df74653
JH		 6370 err = cmd->cmd_complete(cmd,
6371 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6372 mgmt_pending_remove(cmd);
2faade53
MH		 6373 goto unlock;
6374 }
6375
6659358e
JH		 6376 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6377 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6378 list_del(&b->list);
6379 kfree(b);
6380 }
6381
51ef3ebe 6382 __hci_update_page_scan(&req);
a397407f 6383
19de0825
JH		 6384 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6385 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6386 continue;
6387 device_removed(sk, hdev, &p->addr, p->addr_type);
6388 list_del(&p->action);
6389 list_del(&p->list);
6390 kfree(p);
6391 }
6392
6393 BT_DBG("All LE connection parameters were removed");
6394
51ef3ebe 6395 __hci_update_background_scan(&req);
2faade53
MH		 6396 }
6397
6659358e 6398complete:
51ef3ebe
JH		 6399 err = hci_req_run(&req, remove_device_complete);
6400 if (err < 0) {
6401 /* ENODATA means no HCI commands were needed (e.g. if
6402 * the adapter is powered off).
6403 */
9df74653
JH		 6404 if (err == -ENODATA)
6405 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6406 mgmt_pending_remove(cmd);
6407 }
2faade53
MH		 6408
6409unlock:
6410 hci_dev_unlock(hdev);
6411 return err;
6412}
6413
a26f3dcf
JH		 6414static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6415 u16 len)
6416{
6417 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6418 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6419 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6420 u16 param_count, expected_len;
6421 int i;
6422
6423 if (!lmp_le_capable(hdev))
a69e8375
JH		 6424 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6425 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6426
6427 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6428 if (param_count > max_param_count) {
6429 BT_ERR("load_conn_param: too big param_count value %u",
6430 param_count);
a69e8375
JH		 6431 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6432 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6433 }
a26f3dcf
JH		 6434
6435 expected_len = sizeof(*cp) + param_count *
6436 sizeof(struct mgmt_conn_param);
6437 if (expected_len != len) {
6438 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6439 expected_len, len);
a69e8375
JH		 6440 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6441 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6442 }
6443
6444 BT_DBG("%s param_count %u", hdev->name, param_count);
6445
6446 hci_dev_lock(hdev);
6447
6448 hci_conn_params_clear_disabled(hdev);
6449
6450 for (i = 0; i < param_count; i++) {
6451 struct mgmt_conn_param *param = &cp->params[i];
6452 struct hci_conn_params *hci_param;
6453 u16 min, max, latency, timeout;
6454 u8 addr_type;
6455
6456 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6457 param->addr.type);
6458
6459 if (param->addr.type == BDADDR_LE_PUBLIC) {
6460 addr_type = ADDR_LE_DEV_PUBLIC;
6461 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6462 addr_type = ADDR_LE_DEV_RANDOM;
6463 } else {
6464 BT_ERR("Ignoring invalid connection parameters");
6465 continue;
6466 }
6467
6468 min = le16_to_cpu(param->min_interval);
6469 max = le16_to_cpu(param->max_interval);
6470 latency = le16_to_cpu(param->latency);
6471 timeout = le16_to_cpu(param->timeout);
6472
6473 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6474 min, max, latency, timeout);
6475
6476 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6477 BT_ERR("Ignoring invalid connection parameters");
6478 continue;
6479 }
6480
6481 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6482 addr_type);
6483 if (!hci_param) {
6484 BT_ERR("Failed to add connection parameters");
6485 continue;
6486 }
6487
6488 hci_param->conn_min_interval = min;
6489 hci_param->conn_max_interval = max;
6490 hci_param->conn_latency = latency;
6491 hci_param->supervision_timeout = timeout;
6492 }
6493
6494 hci_dev_unlock(hdev);
6495
2a1afb5a
JH		 6496 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6497 NULL, 0);
a26f3dcf
JH		 6498}
6499
dbece37a
MH		 6500static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6501 void *data, u16 len)
6502{
6503 struct mgmt_cp_set_external_config *cp = data;
6504 bool changed;
6505 int err;
6506
6507 BT_DBG("%s", hdev->name);
6508
6509 if (hdev_is_powered(hdev))
a69e8375
JH		 6510 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6511 MGMT_STATUS_REJECTED);
dbece37a
MH		 6512
6513 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6515 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6516
6517 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6518 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6519 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6520
6521 hci_dev_lock(hdev);
6522
6523 if (cp->config)
238be788 6524 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6525 else
a69d8927 6526 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6527
6528 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6529 if (err < 0)
6530 goto unlock;
6531
6532 if (!changed)
6533 goto unlock;
6534
f4537c04
MH		 6535 err = new_options(hdev, sk);
6536
d7a5a11d 6537 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6538 mgmt_index_removed(hdev);
d603b76b 6539
516018a9 6540 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6541 hci_dev_set_flag(hdev, HCI_CONFIG);
6542 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6543
6544 queue_work(hdev->req_workqueue, &hdev->power_on);
6545 } else {
5ea234d3 6546 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6547 mgmt_index_added(hdev);
6548 }
dbece37a
MH		 6549 }
6550
6551unlock:
6552 hci_dev_unlock(hdev);
6553 return err;
6554}
6555
9713c17b
MH		 6556static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6557 void *data, u16 len)
6558{
6559 struct mgmt_cp_set_public_address *cp = data;
6560 bool changed;
6561 int err;
6562
6563 BT_DBG("%s", hdev->name);
6564
6565 if (hdev_is_powered(hdev))
a69e8375
JH		 6566 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6567 MGMT_STATUS_REJECTED);
9713c17b
MH		 6568
6569 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6570 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6571 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6572
6573 if (!hdev->set_bdaddr)
a69e8375
JH		 6574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6575 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6576
6577 hci_dev_lock(hdev);
6578
6579 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6580 bacpy(&hdev->public_addr, &cp->bdaddr);
6581
6582 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6583 if (err < 0)
6584 goto unlock;
6585
6586 if (!changed)
6587 goto unlock;
6588
d7a5a11d 6589 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6590 err = new_options(hdev, sk);
6591
6592 if (is_configured(hdev)) {
6593 mgmt_index_removed(hdev);
6594
a358dc11 6595 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6596
a1536da2
MH		 6597 hci_dev_set_flag(hdev, HCI_CONFIG);
6598 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6599
6600 queue_work(hdev->req_workqueue, &hdev->power_on);
6601 }
6602
6603unlock:
6604 hci_dev_unlock(hdev);
6605 return err;
6606}
6607
bea41609
MH		 6608static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6609 u8 data_len)
6610{
6611 eir[eir_len++] = sizeof(type) + data_len;
6612 eir[eir_len++] = type;
6613 memcpy(&eir[eir_len], data, data_len);
6614 eir_len += data_len;
6615
6616 return eir_len;
6617}
6618
40f66c05
JH		 6619static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6620 u16 opcode, struct sk_buff *skb)
6621{
6622 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6623 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6624 u8 *h192, *r192, *h256, *r256;
6625 struct mgmt_pending_cmd *cmd;
6626 u16 eir_len;
6627 int err;
6628
6629 BT_DBG("%s status %u", hdev->name, status);
6630
6631 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6632 if (!cmd)
6633 return;
6634
6635 mgmt_cp = cmd->param;
6636
6637 if (status) {
6638 status = mgmt_status(status);
6639 eir_len = 0;
6640
6641 h192 = NULL;
6642 r192 = NULL;
6643 h256 = NULL;
6644 r256 = NULL;
6645 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6646 struct hci_rp_read_local_oob_data *rp;
6647
6648 if (skb->len != sizeof(*rp)) {
6649 status = MGMT_STATUS_FAILED;
6650 eir_len = 0;
6651 } else {
6652 status = MGMT_STATUS_SUCCESS;
6653 rp = (void *)skb->data;
6654
6655 eir_len = 5 + 18 + 18;
6656 h192 = rp->hash;
6657 r192 = rp->rand;
6658 h256 = NULL;
6659 r256 = NULL;
6660 }
6661 } else {
6662 struct hci_rp_read_local_oob_ext_data *rp;
6663
6664 if (skb->len != sizeof(*rp)) {
6665 status = MGMT_STATUS_FAILED;
6666 eir_len = 0;
6667 } else {
6668 status = MGMT_STATUS_SUCCESS;
6669 rp = (void *)skb->data;
6670
6671 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6672 eir_len = 5 + 18 + 18;
6673 h192 = NULL;
6674 r192 = NULL;
6675 } else {
6676 eir_len = 5 + 18 + 18 + 18 + 18;
6677 h192 = rp->hash192;
6678 r192 = rp->rand192;
6679 }
6680
6681 h256 = rp->hash256;
6682 r256 = rp->rand256;
6683 }
6684 }
6685
6686 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6687 if (!mgmt_rp)
6688 goto done;
6689
6690 if (status)
6691 goto send_rsp;
6692
6693 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6694 hdev->dev_class, 3);
6695
6696 if (h192 && r192) {
6697 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6698 EIR_SSP_HASH_C192, h192, 16);
6699 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6700 EIR_SSP_RAND_R192, r192, 16);
6701 }
6702
6703 if (h256 && r256) {
6704 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6705 EIR_SSP_HASH_C256, h256, 16);
6706 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6707 EIR_SSP_RAND_R256, r256, 16);
6708 }
6709
6710send_rsp:
6711 mgmt_rp->type = mgmt_cp->type;
6712 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6713
6714 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6715 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6716 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6717 if (err < 0 || status)
6718 goto done;
6719
6720 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6721
6722 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6723 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6724 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6725done:
6726 kfree(mgmt_rp);
6727 mgmt_pending_remove(cmd);
6728}
6729
6730static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6731 struct mgmt_cp_read_local_oob_ext_data *cp)
6732{
6733 struct mgmt_pending_cmd *cmd;
6734 struct hci_request req;
6735 int err;
6736
6737 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6738 cp, sizeof(*cp));
6739 if (!cmd)
6740 return -ENOMEM;
6741
6742 hci_req_init(&req, hdev);
6743
6744 if (bredr_sc_enabled(hdev))
6745 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6746 else
6747 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6748
6749 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6750 if (err < 0) {
6751 mgmt_pending_remove(cmd);
6752 return err;
6753 }
6754
6755 return 0;
6756}
6757
4f0f155c
MH		 6758static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6759 void *data, u16 data_len)
6760{
6761 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6762 struct mgmt_rp_read_local_oob_ext_data *rp;
6763 size_t rp_len;
6764 u16 eir_len;
0821a2c5 6765 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6766 int err;
6767
6768 BT_DBG("%s", hdev->name);
6769
57b0d3e8
MH		 6770 if (hdev_is_powered(hdev)) {
6771 switch (cp->type) {
6772 case BIT(BDADDR_BREDR):
6773 status = mgmt_bredr_support(hdev);
6774 if (status)
6775 eir_len = 0;
6776 else
6777 eir_len = 5;
6778 break;
6779 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6780 status = mgmt_le_support(hdev);
6781 if (status)
6782 eir_len = 0;
6783 else
6784 eir_len = 9 + 3 + 18 + 18 + 3;
6785 break;
6786 default:
6787 status = MGMT_STATUS_INVALID_PARAMS;
6788 eir_len = 0;
6789 break;
6790 }
6791 } else {
6792 status = MGMT_STATUS_NOT_POWERED;
6793 eir_len = 0;
4f0f155c
MH		 6794 }
6795
4f0f155c
MH		 6796 rp_len = sizeof(*rp) + eir_len;
6797 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 6798 if (!rp)
4f0f155c 6799 return -ENOMEM;
efcd8c98 6800
57b0d3e8
MH		 6801 if (status)
6802 goto complete;
6803
efcd8c98 6804 hci_dev_lock(hdev);
4f0f155c
MH		 6805
6806 eir_len = 0;
6807 switch (cp->type) {
6808 case BIT(BDADDR_BREDR):
40f66c05
JH		 6809 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6810 err = read_local_ssp_oob_req(hdev, sk, cp);
6811 hci_dev_unlock(hdev);
6812 if (!err)
6813 goto done;
6814
6815 status = MGMT_STATUS_FAILED;
6816 goto complete;
6817 } else {
6818 eir_len = eir_append_data(rp->eir, eir_len,
6819 EIR_CLASS_OF_DEV,
6820 hdev->dev_class, 3);
6821 }
4f0f155c
MH		 6822 break;
6823 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6824 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6825 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 6826 hci_dev_unlock(hdev);
57b0d3e8
MH		 6827 status = MGMT_STATUS_FAILED;
6828 goto complete;
0821a2c5
MH		 6829 }
6830
e213568a
MH		 6831 /* This should return the active RPA, but since the RPA
6832 * is only programmed on demand, it is really hard to fill
6833 * this in at the moment. For now disallow retrieving
6834 * local out-of-band data when privacy is in use.
6835 *
6836 * Returning the identity address will not help here since
6837 * pairing happens before the identity resolving key is
6838 * known and thus the connection establishment happens
6839 * based on the RPA and not the identity address.
6840 */
4f0f155c 6841 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
e213568a
MH		 6842 hci_dev_unlock(hdev);
6843 status = MGMT_STATUS_REJECTED;
6844 goto complete;
6845 }
6846
6847 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6848 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6849 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6850 bacmp(&hdev->static_addr, BDADDR_ANY))) {
4f0f155c
MH		 6851 memcpy(addr, &hdev->static_addr, 6);
6852 addr[6] = 0x01;
6853 } else {
6854 memcpy(addr, &hdev->bdaddr, 6);
6855 addr[6] = 0x00;
6856 }
6857
6858 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6859 addr, sizeof(addr));
6860
6861 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6862 role = 0x02;
6863 else
6864 role = 0x01;
6865
6866 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6867 &role, sizeof(role));
6868
5082a599
MH		 6869 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6870 eir_len = eir_append_data(rp->eir, eir_len,
6871 EIR_LE_SC_CONFIRM,
6872 hash, sizeof(hash));
0821a2c5 6873
5082a599
MH		 6874 eir_len = eir_append_data(rp->eir, eir_len,
6875 EIR_LE_SC_RANDOM,
6876 rand, sizeof(rand));
6877 }
0821a2c5 6878
4f0f155c
MH		 6879 flags = get_adv_discov_flags(hdev);
6880
6881 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6882 flags |= LE_AD_NO_BREDR;
6883
6884 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6885 &flags, sizeof(flags));
6886 break;
6887 }
6888
4f0f155c
MH		 6889 hci_dev_unlock(hdev);
6890
72000df2
MH		 6891 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6892
57b0d3e8
MH		 6893 status = MGMT_STATUS_SUCCESS;
6894
6895complete:
efcd8c98
MH		 6896 rp->type = cp->type;
6897 rp->eir_len = cpu_to_le16(eir_len);
6898
4f0f155c 6899 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 6900 status, rp, sizeof(*rp) + eir_len);
6901 if (err < 0 || status)
72000df2
MH		 6902 goto done;
6903
6904 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6905 rp, sizeof(*rp) + eir_len,
6906 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6907
0821a2c5 6908done:
4f0f155c
MH		 6909 kfree(rp);
6910
6911 return err;
6912}
6913
089fa8c0
AU		 6914static u32 get_supported_adv_flags(struct hci_dev *hdev)
6915{
6916 u32 flags = 0;
6917
6918 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6919 flags |= MGMT_ADV_FLAG_DISCOV;
6920 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6921 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6922
6923 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6924 flags |= MGMT_ADV_FLAG_TX_POWER;
6925
6926 return flags;
6927}
6928
d3d5305b
MH		 6929static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6930 void *data, u16 data_len)
6931{
6932 struct mgmt_rp_read_adv_features *rp;
6933 size_t rp_len;
286e0c83 6934 int err, i;
24b4f38f 6935 bool instance;
286e0c83 6936 struct adv_info *adv_instance;
089fa8c0 6937 u32 supported_flags;
d3d5305b
MH		 6938
6939 BT_DBG("%s", hdev->name);
6940
089fa8c0
AU		 6941 if (!lmp_le_capable(hdev))
6942 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6943 MGMT_STATUS_REJECTED);
6944
d3d5305b
MH		 6945 hci_dev_lock(hdev);
6946
6947 rp_len = sizeof(*rp);
24b4f38f 6948
24b4f38f
AU		 6949 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6950 if (instance)
286e0c83 6951 rp_len += hdev->adv_instance_cnt;
24b4f38f 6952
d3d5305b
MH		 6953 rp = kmalloc(rp_len, GFP_ATOMIC);
6954 if (!rp) {
6955 hci_dev_unlock(hdev);
6956 return -ENOMEM;
6957 }
6958
089fa8c0
AU		 6959 supported_flags = get_supported_adv_flags(hdev);
6960
6961 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6962 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6963 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
d2609b34 6964 rp->max_instances = HCI_MAX_ADV_INSTANCES;
24b4f38f 6965
24b4f38f 6966 if (instance) {
286e0c83
FG		 6967 i = 0;
6968 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6969 if (i >= hdev->adv_instance_cnt)
6970 break;
6971
6972 rp->instance[i] = adv_instance->instance;
6973 i++;
6974 }
6975 rp->num_instances = hdev->adv_instance_cnt;
24b4f38f
AU		 6976 } else {
6977 rp->num_instances = 0;
6978 }
d3d5305b
MH		 6979
6980 hci_dev_unlock(hdev);
6981
6982 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6983 MGMT_STATUS_SUCCESS, rp, rp_len);
6984
6985 kfree(rp);
6986
6987 return err;
6988}
6989
4117ed70 6990static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 6991 u8 len, bool is_adv_data)
24b4f38f 6992{
4117ed70 6993 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 6994 int i, cur_len;
b44133ff 6995 bool flags_managed = false;
5507e358 6996 bool tx_power_managed = false;
67e0c0cd
AU		 6997 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6998 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 6999
807ec772 7000 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 7001 flags_managed = true;
7002 max_len -= 3;
7003 }
24b4f38f 7004
5507e358
AU		 7005 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
7006 tx_power_managed = true;
7007 max_len -= 3;
7008 }
7009
4117ed70 7010 if (len > max_len)
24b4f38f
AU		 7011 return false;
7012
4117ed70
AU		 7013 /* Make sure that the data is correctly formatted. */
7014 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7015 cur_len = data[i];
24b4f38f 7016
b44133ff
AU		 7017 if (flags_managed && data[i + 1] == EIR_FLAGS)
7018 return false;
7019
5507e358
AU		 7020 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
7021 return false;
7022
24b4f38f
AU		 7023 /* If the current field length would exceed the total data
7024 * length, then it's invalid.
7025 */
4117ed70 7026 if (i + cur_len >= len)
24b4f38f
AU		 7027 return false;
7028 }
7029
7030 return true;
7031}
7032
24b4f38f
AU		 7033static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7034 u16 opcode)
7035{
7036 struct mgmt_pending_cmd *cmd;
fffd38bc 7037 struct mgmt_cp_add_advertising *cp;
24b4f38f 7038 struct mgmt_rp_add_advertising rp;
fffd38bc
FG		 7039 struct adv_info *adv_instance, *n;
7040 u8 instance;
24b4f38f
AU		 7041
7042 BT_DBG("status %d", status);
7043
7044 hci_dev_lock(hdev);
7045
7046 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7047
fffd38bc 7048 if (status)
24b4f38f 7049 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
fffd38bc
FG		 7050
7051 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7052 if (!adv_instance->pending)
7053 continue;
7054
7055 if (!status) {
7056 adv_instance->pending = false;
7057 continue;
7058 }
7059
7060 instance = adv_instance->instance;
7061
7062 if (hdev->cur_adv_instance == instance)
7063 cancel_adv_timeout(hdev);
7064
7065 hci_remove_adv_instance(hdev, instance);
7066 advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
24b4f38f
AU		 7067 }
7068
7069 if (!cmd)
7070 goto unlock;
7071
fffd38bc
FG		 7072 cp = cmd->param;
7073 rp.instance = cp->instance;
24b4f38f
AU		 7074
7075 if (status)
7076 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7077 mgmt_status(status));
7078 else
7079 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7080 mgmt_status(status), &rp, sizeof(rp));
7081
7082 mgmt_pending_remove(cmd);
7083
7084unlock:
7085 hci_dev_unlock(hdev);
7086}
7087
5d900e46 7088void mgmt_adv_timeout_expired(struct hci_dev *hdev)
912098a6 7089{
847818d9
FG		 7090 u8 instance;
7091 struct hci_request req;
7092
5d900e46 7093 hdev->adv_instance_timeout = 0;
912098a6 7094
847818d9
FG		 7095 instance = get_current_adv_instance(hdev);
7096 if (instance == 0x00)
7097 return;
7098
912098a6 7099 hci_dev_lock(hdev);
847818d9
FG		 7100 hci_req_init(&req, hdev);
7101
7102 clear_adv_instance(hdev, &req, instance, false);
7103
7104 if (list_empty(&hdev->adv_instances))
7105 disable_advertising(&req);
7106
7107 if (!skb_queue_empty(&req.cmd_q))
7108 hci_req_run(&req, NULL);
7109
912098a6
AU		 7110 hci_dev_unlock(hdev);
7111}
7112
24b4f38f
AU		 7113static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7114 void *data, u16 data_len)
7115{
7116 struct mgmt_cp_add_advertising *cp = data;
7117 struct mgmt_rp_add_advertising rp;
7118 u32 flags;
089fa8c0 7119 u32 supported_flags;
24b4f38f 7120 u8 status;
fffd38bc
FG		 7121 u16 timeout, duration;
7122 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7123 u8 schedule_instance = 0;
7124 struct adv_info *next_instance;
24b4f38f
AU		 7125 int err;
7126 struct mgmt_pending_cmd *cmd;
7127 struct hci_request req;
7128
7129 BT_DBG("%s", hdev->name);
7130
7131 status = mgmt_le_support(hdev);
7132 if (status)
7133 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7134 status);
7135
7136 flags = __le32_to_cpu(cp->flags);
912098a6 7137 timeout = __le16_to_cpu(cp->timeout);
fffd38bc 7138 duration = __le16_to_cpu(cp->duration);
24b4f38f 7139
fffd38bc
FG		 7140 /* The current implementation only supports a subset of the specified
7141 * flags.
089fa8c0
AU		 7142 */
7143 supported_flags = get_supported_adv_flags(hdev);
fffd38bc 7144 if (flags & ~supported_flags)
24b4f38f
AU		 7145 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7146 MGMT_STATUS_INVALID_PARAMS);
7147
7148 hci_dev_lock(hdev);
7149
912098a6
AU		 7150 if (timeout && !hdev_is_powered(hdev)) {
7151 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7152 MGMT_STATUS_REJECTED);
7153 goto unlock;
7154 }
7155
24b4f38f 7156 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 7157 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 7158 pending_find(MGMT_OP_SET_LE, hdev)) {
7159 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7160 MGMT_STATUS_BUSY);
7161 goto unlock;
7162 }
7163
b44133ff 7164 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 7165 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 7166 cp->scan_rsp_len, false)) {
24b4f38f
AU		 7167 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7168 MGMT_STATUS_INVALID_PARAMS);
7169 goto unlock;
7170 }
7171
fffd38bc
FG		 7172 err = hci_add_adv_instance(hdev, cp->instance, flags,
7173 cp->adv_data_len, cp->data,
7174 cp->scan_rsp_len,
7175 cp->data + cp->adv_data_len,
7176 timeout, duration);
7177 if (err < 0) {
7178 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7179 MGMT_STATUS_FAILED);
7180 goto unlock;
7181 }
24b4f38f 7182
fffd38bc
FG		 7183 /* Only trigger an advertising added event if a new instance was
7184 * actually added.
7185 */
7186 if (hdev->adv_instance_cnt > prev_instance_cnt)
7187 advertising_added(sk, hdev, cp->instance);
912098a6 7188
fffd38bc 7189 hci_dev_set_flag(hdev, HCI_ADVERTISING_INSTANCE);
912098a6 7190
fffd38bc
FG		 7191 if (hdev->cur_adv_instance == cp->instance) {
7192 /* If the currently advertised instance is being changed then
7193 * cancel the current advertising and schedule the next
7194 * instance. If there is only one instance then the overridden
7195 * advertising data will be visible right away.
7196 */
7197 cancel_adv_timeout(hdev);
912098a6 7198
fffd38bc
FG		 7199 next_instance = hci_get_next_instance(hdev, cp->instance);
7200 if (next_instance)
7201 schedule_instance = next_instance->instance;
7202 } else if (!hdev->adv_instance_timeout) {
7203 /* Immediately advertise the new instance if no other
7204 * instance is currently being advertised.
7205 */
7206 schedule_instance = cp->instance;
7207 }
24b4f38f 7208
fffd38bc
FG		 7209 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7210 * there is no instance to be advertised then we have no HCI
7211 * communication to make. Simply return.
24b4f38f
AU		 7212 */
7213 if (!hdev_is_powered(hdev) ||
fffd38bc
FG		 7214 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7215 !schedule_instance) {
7216 rp.instance = cp->instance;
24b4f38f
AU		 7217 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7218 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7219 goto unlock;
7220 }
7221
7222 /* We're good to go, update advertising data, parameters, and start
7223 * advertising.
7224 */
7225 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7226 data_len);
7227 if (!cmd) {
7228 err = -ENOMEM;
7229 goto unlock;
7230 }
7231
7232 hci_req_init(&req, hdev);
7233
fffd38bc
FG		 7234 err = schedule_adv_instance(&req, schedule_instance, true);
7235
7236 if (!err)
7237 err = hci_req_run(&req, add_advertising_complete);
24b4f38f 7238
24b4f38f
AU		 7239 if (err < 0)
7240 mgmt_pending_remove(cmd);
7241
7242unlock:
7243 hci_dev_unlock(hdev);
7244
7245 return err;
7246}
7247
da929335
AU		 7248static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7249 u16 opcode)
7250{
7251 struct mgmt_pending_cmd *cmd;
01948331 7252 struct mgmt_cp_remove_advertising *cp;
da929335
AU		 7253 struct mgmt_rp_remove_advertising rp;
7254
7255 BT_DBG("status %d", status);
7256
7257 hci_dev_lock(hdev);
7258
7259 /* A failure status here only means that we failed to disable
7260 * advertising. Otherwise, the advertising instance has been removed,
7261 * so report success.
7262 */
7263 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7264 if (!cmd)
7265 goto unlock;
7266
01948331
FG		 7267 cp = cmd->param;
7268 rp.instance = cp->instance;
da929335
AU		 7269
7270 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7271 &rp, sizeof(rp));
7272 mgmt_pending_remove(cmd);
7273
7274unlock:
7275 hci_dev_unlock(hdev);
7276}
7277
7278static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7279 void *data, u16 data_len)
7280{
7281 struct mgmt_cp_remove_advertising *cp = data;
7282 struct mgmt_rp_remove_advertising rp;
da929335
AU		 7283 struct mgmt_pending_cmd *cmd;
7284 struct hci_request req;
952497b1 7285 int err;
da929335
AU		 7286
7287 BT_DBG("%s", hdev->name);
7288
da929335
AU		 7289 hci_dev_lock(hdev);
7290
952497b1 7291 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
01948331
FG		 7292 err = mgmt_cmd_status(sk, hdev->id,
7293 MGMT_OP_REMOVE_ADVERTISING,
7294 MGMT_STATUS_INVALID_PARAMS);
7295 goto unlock;
7296 }
7297
da929335
AU		 7298 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7299 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7300 pending_find(MGMT_OP_SET_LE, hdev)) {
7301 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7302 MGMT_STATUS_BUSY);
7303 goto unlock;
7304 }
7305
7306 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7307 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7308 MGMT_STATUS_INVALID_PARAMS);
7309 goto unlock;
7310 }
7311
01948331 7312 hci_req_init(&req, hdev);
da929335 7313
01948331 7314 clear_adv_instance(hdev, &req, cp->instance, true);
da929335 7315
01948331
FG		 7316 if (list_empty(&hdev->adv_instances))
7317 disable_advertising(&req);
da929335 7318
01948331
FG		 7319 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7320 * flag is set or the device isn't powered then we have no HCI
7321 * communication to make. Simply return.
da929335 7322 */
01948331
FG		 7323 if (skb_queue_empty(&req.cmd_q) ||
7324 !hdev_is_powered(hdev) ||
da929335 7325 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
01948331 7326 rp.instance = cp->instance;
da929335
AU		 7327 err = mgmt_cmd_complete(sk, hdev->id,
7328 MGMT_OP_REMOVE_ADVERTISING,
7329 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7330 goto unlock;
7331 }
7332
7333 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7334 data_len);
7335 if (!cmd) {
7336 err = -ENOMEM;
7337 goto unlock;
7338 }
7339
da929335
AU		 7340 err = hci_req_run(&req, remove_advertising_complete);
7341 if (err < 0)
7342 mgmt_pending_remove(cmd);
7343
7344unlock:
7345 hci_dev_unlock(hdev);
7346
7347 return err;
7348}
7349
6d785aa3 7350static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 7351 { NULL }, /* 0x0000 (no command) */
b9a245fb 7352 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 7353 HCI_MGMT_NO_HDEV |
7354 HCI_MGMT_UNTRUSTED },
b9a245fb 7355 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 7356 HCI_MGMT_NO_HDEV |
7357 HCI_MGMT_UNTRUSTED },
b9a245fb 7358 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 7359 HCI_MGMT_NO_HDEV |
7360 HCI_MGMT_UNTRUSTED },
7361 { read_controller_info, MGMT_READ_INFO_SIZE,
7362 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 7363 { set_powered, MGMT_SETTING_SIZE },
7364 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
7365 { set_connectable, MGMT_SETTING_SIZE },
7366 { set_fast_connectable, MGMT_SETTING_SIZE },
7367 { set_bondable, MGMT_SETTING_SIZE },
7368 { set_link_security, MGMT_SETTING_SIZE },
7369 { set_ssp, MGMT_SETTING_SIZE },
7370 { set_hs, MGMT_SETTING_SIZE },
7371 { set_le, MGMT_SETTING_SIZE },
7372 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
7373 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
7374 { add_uuid, MGMT_ADD_UUID_SIZE },
7375 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 7376 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
7377 HCI_MGMT_VAR_LEN },
7378 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7379 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7380 { disconnect, MGMT_DISCONNECT_SIZE },
7381 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
7382 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
7383 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7384 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
7385 { pair_device, MGMT_PAIR_DEVICE_SIZE },
7386 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7387 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
7388 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
7389 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7390 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
7391 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 7392 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7393 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7394 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7395 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7396 { start_discovery, MGMT_START_DISCOVERY_SIZE },
7397 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
7398 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
7399 { block_device, MGMT_BLOCK_DEVICE_SIZE },
7400 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
7401 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
7402 { set_advertising, MGMT_SETTING_SIZE },
7403 { set_bredr, MGMT_SETTING_SIZE },
7404 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
7405 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
7406 { set_secure_conn, MGMT_SETTING_SIZE },
7407 { set_debug_keys, MGMT_SETTING_SIZE },
7408 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 7409 { load_irks, MGMT_LOAD_IRKS_SIZE,
7410 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7411 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
7412 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
7413 { add_device, MGMT_ADD_DEVICE_SIZE },
7414 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 7415 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
7416 HCI_MGMT_VAR_LEN },
7417 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 7418 HCI_MGMT_NO_HDEV |
7419 HCI_MGMT_UNTRUSTED },
b9a245fb 7420 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 7421 HCI_MGMT_UNCONFIGURED |
7422 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 7423 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7424 HCI_MGMT_UNCONFIGURED },
7425 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7426 HCI_MGMT_UNCONFIGURED },
7427 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7428 HCI_MGMT_VAR_LEN },
4f0f155c 7429 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7430 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7431 HCI_MGMT_NO_HDEV |
7432 HCI_MGMT_UNTRUSTED },
d3d5305b 7433 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7434 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7435 HCI_MGMT_VAR_LEN },
da929335 7436 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7437};
7438
bf6b56db 7439void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7440{
ced85549 7441 struct mgmt_ev_ext_index ev;
bb4b2a9a 7442
0602a8ad
MH		 7443 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7444 return;
7445
f9207338
MH		 7446 switch (hdev->dev_type) {
7447 case HCI_BREDR:
7448 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7449 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7450 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7451 ev.type = 0x01;
f9207338
MH		 7452 } else {
7453 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7454 HCI_MGMT_INDEX_EVENTS);
ced85549 7455 ev.type = 0x00;
f9207338
MH		 7456 }
7457 break;
ced85549
MH		 7458 case HCI_AMP:
7459 ev.type = 0x02;
7460 break;
7461 default:
7462 return;
f9207338 7463 }
ced85549
MH		 7464
7465 ev.bus = hdev->bus;
7466
7467 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7468 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7469}
7470
bf6b56db 7471void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7472{
ced85549 7473 struct mgmt_ev_ext_index ev;
5f159032 7474 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7475
0602a8ad
MH		 7476 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7477 return;
7478
f9207338
MH		 7479 switch (hdev->dev_type) {
7480 case HCI_BREDR:
7481 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7482
f9207338
MH		 7483 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7484 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7485 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7486 ev.type = 0x01;
f9207338
MH		 7487 } else {
7488 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7489 HCI_MGMT_INDEX_EVENTS);
ced85549 7490 ev.type = 0x00;
f9207338
MH		 7491 }
7492 break;
ced85549
MH		 7493 case HCI_AMP:
7494 ev.type = 0x02;
7495 break;
7496 default:
7497 return;
f9207338 7498 }
ced85549
MH		 7499
7500 ev.bus = hdev->bus;
7501
7502 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7503 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7504}
7505
6046dc3e 7506/* This function requires the caller holds hdev->lock */
2cf22218 7507static void restart_le_actions(struct hci_request *req)
6046dc3e 7508{
2cf22218 7509 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7510 struct hci_conn_params *p;
7511
7512 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7513 /* Needed for AUTO_OFF case where might not "really"
7514 * have been powered off.
7515 */
7516 list_del_init(&p->action);
7517
7518 switch (p->auto_connect) {
4b9e7e75 7519 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7520 case HCI_AUTO_CONN_ALWAYS:
7521 list_add(&p->action, &hdev->pend_le_conns);
7522 break;
7523 case HCI_AUTO_CONN_REPORT:
7524 list_add(&p->action, &hdev->pend_le_reports);
7525 break;
7526 default:
7527 break;
c83ed19d 7528 }
6046dc3e 7529 }
c83ed19d 7530
2cf22218 7531 __hci_update_background_scan(req);
6046dc3e
AG		 7532}
7533
1904a853 7534static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7535{
7536 struct cmd_lookup match = { NULL, hdev };
7537
7538 BT_DBG("status 0x%02x", status);
7539
162a3bac
MH		 7540 if (!status) {
7541 /* Register the available SMP channels (BR/EDR and LE) only
7542 * when successfully powering on the controller. This late
7543 * registration is required so that LE SMP can clearly
7544 * decide if the public address or static address is used.
7545 */
7546 smp_register(hdev);
7547 }
7548
229ab39c
JH		 7549 hci_dev_lock(hdev);
7550
7551 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7552
7553 new_settings(hdev, match.sk);
7554
7555 hci_dev_unlock(hdev);
7556
7557 if (match.sk)
7558 sock_put(match.sk);
7559}
7560
70da6243 7561static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7562{
890ea898 7563 struct hci_request req;
320b3bf7 7564 struct adv_info *adv_instance;
70da6243 7565 u8 link_sec;
5add6af8 7566
890ea898
JH		 7567 hci_req_init(&req, hdev);
7568
d7a5a11d 7569 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7570 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7571 u8 mode = 0x01;
5e5282bb 7572
574ea3c7
MH		 7573 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7574
7575 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7576 u8 support = 0x01;
5add6af8 7577
574ea3c7
MH		 7578 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7579 sizeof(support), &support);
7580 }
ec6f99b8
JH		 7581 }
7582
d7a5a11d 7583 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7584 lmp_bredr_capable(hdev)) {
70da6243 7585 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7586
32226e4f
MH		 7587 cp.le = 0x01;
7588 cp.simul = 0x00;
3d1cbdd6 7589
70da6243
JH		 7590 /* Check first if we already have the right
7591 * host state (host features set)
7592 */
7593 if (cp.le != lmp_host_le_capable(hdev) ||
7594 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7595 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7596 sizeof(cp), &cp);
70da6243 7597 }
3d1cbdd6 7598
d13eafce 7599 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7600 /* Make sure the controller has a good default for
7601 * advertising data. This also applies to the case
7602 * where BR/EDR was toggled during the AUTO_OFF phase.
7603 */
320b3bf7
FG		 7604 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7605 (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7606 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))) {
5947f4bc 7607 update_adv_data(&req);
f14d8f64
MH		 7608 update_scan_rsp_data(&req);
7609 }
441ad2d0 7610
320b3bf7
FG		 7611 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7612 hdev->cur_adv_instance == 0x00 &&
7613 !list_empty(&hdev->adv_instances)) {
7614 adv_instance = list_first_entry(&hdev->adv_instances,
7615 struct adv_info, list);
7616 hdev->cur_adv_instance = adv_instance->instance;
7617 }
7618
7619 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
bba3aa55 7620 enable_advertising(&req);
320b3bf7
FG		 7621 else if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7622 hdev->cur_adv_instance)
7623 schedule_adv_instance(&req, hdev->cur_adv_instance,
7624 true);
2cf22218
JH		 7625
7626 restart_le_actions(&req);
eeca6f89
JH		 7627 }
7628
d7a5a11d 7629 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7630 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7631 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7632 sizeof(link_sec), &link_sec);
562fcc24 7633
70da6243 7634 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7635 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7636 write_fast_connectable(&req, true);
7637 else
7638 write_fast_connectable(&req, false);
1d2dc5b7 7639 __hci_update_page_scan(&req);
890ea898 7640 update_class(&req);
13928971 7641 update_name(&req);
890ea898 7642 update_eir(&req);
70da6243 7643 }
562fcc24 7644
229ab39c 7645 return hci_req_run(&req, powered_complete);
70da6243 7646}
562fcc24 7647
70da6243
JH		 7648int mgmt_powered(struct hci_dev *hdev, u8 powered)
7649{
7650 struct cmd_lookup match = { NULL, hdev };
9845904f 7651 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7652 int err;
f0ff92fb 7653
d7a5a11d 7654 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7655 return 0;
7656
70da6243 7657 if (powered) {
229ab39c
JH		 7658 if (powered_update_hci(hdev) == 0)
7659 return 0;
fe038884 7660
229ab39c
JH		 7661 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7662 &match);
7663 goto new_settings;
b24752fe
JH		 7664 }
7665
229ab39c 7666 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7667
7668 /* If the power off is because of hdev unregistration let
7669 * use the appropriate INVALID_INDEX status. Otherwise use
7670 * NOT_POWERED. We cover both scenarios here since later in
7671 * mgmt_index_removed() any hci_conn callbacks will have already
7672 * been triggered, potentially causing misleading DISCONNECTED
7673 * status responses.
7674 */
d7a5a11d 7675 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7676 status = MGMT_STATUS_INVALID_INDEX;
7677 else
7678 status = MGMT_STATUS_NOT_POWERED;
7679
7680 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7681
7682 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7683 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7684 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7685
7686new_settings:
beadb2bd 7687 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7688
7689 if (match.sk)
7690 sock_put(match.sk);
7691
7bb895d6 7692 return err;
5add6af8 7693}
73f22f62 7694
3eec705e 7695void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7696{
3b0602cd 7697 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7698 u8 status;
7699
333ae95d 7700 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7701 if (!cmd)
3eec705e 7702 return;
96570ffc
JH		 7703
7704 if (err == -ERFKILL)
7705 status = MGMT_STATUS_RFKILLED;
7706 else
7707 status = MGMT_STATUS_FAILED;
7708
a69e8375 7709 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7710
7711 mgmt_pending_remove(cmd);
96570ffc
JH		 7712}
7713
d1967ff8
MH		 7714void mgmt_discoverable_timeout(struct hci_dev *hdev)
7715{
7716 struct hci_request req;
d1967ff8
MH		 7717
7718 hci_dev_lock(hdev);
7719
7720 /* When discoverable timeout triggers, then just make sure
7721 * the limited discoverable flag is cleared. Even in the case
7722 * of a timeout triggered from general discoverable, it is
7723 * safe to unconditionally clear the flag.
7724 */
a358dc11
MH		 7725 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7726 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7727
7728 hci_req_init(&req, hdev);
d7a5a11d 7729 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7730 u8 scan = SCAN_PAGE;
7731 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7732 sizeof(scan), &scan);
7733 }
d1967ff8 7734 update_class(&req);
24b4f38f
AU		 7735
7736 /* Advertising instances don't use the global discoverable setting, so
7737 * only update AD if advertising was enabled using Set Advertising.
7738 */
7739 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7740 update_adv_data(&req);
7741
d1967ff8
MH		 7742 hci_req_run(&req, NULL);
7743
7744 hdev->discov_timeout = 0;
7745
9a43e25f
JH		 7746 new_settings(hdev, NULL);
7747
d1967ff8
MH		 7748 hci_dev_unlock(hdev);
7749}
7750
dc4a5ee2
MH		 7751void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7752 bool persistent)
55ed8ca1 7753{
86742e1e 7754 struct mgmt_ev_new_link_key ev;
55ed8ca1 7755
a492cd52 7756 memset(&ev, 0, sizeof(ev));
55ed8ca1 7757
a492cd52 7758 ev.store_hint = persistent;
d753fdc4 7759 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7760 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7761 ev.key.type = key->type;
9b3b4460 7762 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7763 ev.key.pin_len = key->pin_len;
55ed8ca1 7764
dc4a5ee2 7765 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7766}
f7520543 7767
d7b25450
JH		 7768static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7769{
23fb8de3
JH		 7770 switch (ltk->type) {
7771 case SMP_LTK:
7772 case SMP_LTK_SLAVE:
7773 if (ltk->authenticated)
7774 return MGMT_LTK_AUTHENTICATED;
7775 return MGMT_LTK_UNAUTHENTICATED;
7776 case SMP_LTK_P256:
7777 if (ltk->authenticated)
7778 return MGMT_LTK_P256_AUTH;
7779 return MGMT_LTK_P256_UNAUTH;
7780 case SMP_LTK_P256_DEBUG:
7781 return MGMT_LTK_P256_DEBUG;
7782 }
d7b25450
JH		 7783
7784 return MGMT_LTK_UNAUTHENTICATED;
7785}
7786
53ac6ab6 7787void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7788{
7789 struct mgmt_ev_new_long_term_key ev;
7790
7791 memset(&ev, 0, sizeof(ev));
7792
5192d301 7793 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7794 * without providing an identity resolving key don't require
5192d301
MH		 7795 * to store long term keys. Their addresses will change the
7796 * next time around.
7797 *
7798 * Only when a remote device provides an identity address
7799 * make sure the long term key is stored. If the remote
7800 * identity is known, the long term keys are internally
7801 * mapped to the identity address. So allow static random
7802 * and public addresses here.
7803 */
ba74b666
JH		 7804 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7805 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7806 ev.store_hint = 0x00;
7807 else
53ac6ab6 7808 ev.store_hint = persistent;
ba74b666 7809
346af67b 7810 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7811 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7812 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7813 ev.key.enc_size = key->enc_size;
7814 ev.key.ediv = key->ediv;
fe39c7b2 7815 ev.key.rand = key->rand;
346af67b 7816
2ceba539 7817 if (key->type == SMP_LTK)
346af67b
VCG		 7818 ev.key.master = 1;
7819
1fc62c52
JH		 7820 /* Make sure we copy only the significant bytes based on the
7821 * encryption key size, and set the rest of the value to zeroes.
7822 */
cb92205b 7823 memcpy(ev.key.val, key->val, key->enc_size);
1fc62c52
JH		 7824 memset(ev.key.val + key->enc_size, 0,
7825 sizeof(ev.key.val) - key->enc_size);
346af67b 7826
083368f7 7827 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7828}
7829
95fbac8a
JH		 7830void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7831{
7832 struct mgmt_ev_new_irk ev;
7833
7834 memset(&ev, 0, sizeof(ev));
7835
bab6d1e5
MH		 7836 /* For identity resolving keys from devices that are already
7837 * using a public address or static random address, do not
7838 * ask for storing this key. The identity resolving key really
f72186d2 7839 * is only mandatory for devices using resolvable random
bab6d1e5
MH		 7840 * addresses.
7841 *
7842 * Storing all identity resolving keys has the downside that
7843 * they will be also loaded on next boot of they system. More
7844 * identity resolving keys, means more time during scanning is
7845 * needed to actually resolve these addresses.
7846 */
7847 if (bacmp(&irk->rpa, BDADDR_ANY))
7848 ev.store_hint = 0x01;
7849 else
7850 ev.store_hint = 0x00;
7851
95fbac8a
JH		 7852 bacpy(&ev.rpa, &irk->rpa);
7853 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7854 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7855 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7856
7857 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7858}
7859
53ac6ab6
MH		 7860void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7861 bool persistent)
7ee4ea36
MH		 7862{
7863 struct mgmt_ev_new_csrk ev;
7864
7865 memset(&ev, 0, sizeof(ev));
7866
7867 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7868 * without providing an identity resolving key don't require
7ee4ea36
MH		 7869 * to store signature resolving keys. Their addresses will change
7870 * the next time around.
7871 *
7872 * Only when a remote device provides an identity address
7873 * make sure the signature resolving key is stored. So allow
7874 * static random and public addresses here.
7875 */
7876 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7877 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7878 ev.store_hint = 0x00;
7879 else
53ac6ab6 7880 ev.store_hint = persistent;
7ee4ea36
MH		 7881
7882 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7883 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7884 ev.key.type = csrk->type;
7ee4ea36
MH		 7885 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7886
7887 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7888}
7889
ffb5a827 7890void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7891 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7892 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7893{
7894 struct mgmt_ev_new_conn_param ev;
7895
c103aea6
JH		 7896 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7897 return;
7898
ffb5a827
AG		 7899 memset(&ev, 0, sizeof(ev));
7900 bacpy(&ev.addr.bdaddr, bdaddr);
7901 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7902 ev.store_hint = store_hint;
ffb5a827
AG		 7903 ev.min_interval = cpu_to_le16(min_interval);
7904 ev.max_interval = cpu_to_le16(max_interval);
7905 ev.latency = cpu_to_le16(latency);
7906 ev.timeout = cpu_to_le16(timeout);
7907
7908 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7909}
7910
48ec92fa
AA		 7911void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7912 u32 flags, u8 *name, u8 name_len)
f7520543 7913{
b644ba33
JH		 7914 char buf[512];
7915 struct mgmt_ev_device_connected *ev = (void *) buf;
7916 u16 eir_len = 0;
f7520543 7917
48ec92fa
AA		 7918 bacpy(&ev->addr.bdaddr, &conn->dst);
7919 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7920
c95f0ba7 7921 ev->flags = __cpu_to_le32(flags);
08c79b61 7922
fd45ada9
AA		 7923 /* We must ensure that the EIR Data fields are ordered and
7924 * unique. Keep it simple for now and avoid the problem by not
7925 * adding any BR/EDR data to the LE adv.
7926 */
7927 if (conn->le_adv_data_len > 0) {
7928 memcpy(&ev->eir[eir_len],
7929 conn->le_adv_data, conn->le_adv_data_len);
7930 eir_len = conn->le_adv_data_len;
7931 } else {
7932 if (name_len > 0)
7933 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7934 name, name_len);
b644ba33 7935
ddbea5cf 7936 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7937 eir_len = eir_append_data(ev->eir, eir_len,
7938 EIR_CLASS_OF_DEV,
7939 conn->dev_class, 3);
7940 }
b644ba33 7941
eb55ef07 7942 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7943
ecd90ae7
MH		 7944 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7945 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7946}
7947
3b0602cd 7948static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7949{
8962ee74 7950 struct sock **sk = data;
8962ee74 7951
f5818c22 7952 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7953
7954 *sk = cmd->sk;
7955 sock_hold(*sk);
7956
a664b5bc 7957 mgmt_pending_remove(cmd);
8962ee74
JH		 7958}
7959
3b0602cd 7960static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7961{
b1078ad0 7962 struct hci_dev *hdev = data;
124f6e35 7963 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7964
b1078ad0
JH		 7965 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7966
d8b7b1e4 7967 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7968 mgmt_pending_remove(cmd);
7969}
7970
84c61d92
JH		 7971bool mgmt_powering_down(struct hci_dev *hdev)
7972{
3b0602cd 7973 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7974 struct mgmt_mode *cp;
7975
333ae95d 7976 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7977 if (!cmd)
7978 return false;
7979
7980 cp = cmd->param;
7981 if (!cp->val)
7982 return true;
7983
7984 return false;
7985}
7986
9b80ec5e 7987void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 7988 u8 link_type, u8 addr_type, u8 reason,
7989 bool mgmt_connected)
f7520543 7990{
f0d6a0ea 7991 struct mgmt_ev_device_disconnected ev;
8962ee74 7992 struct sock *sk = NULL;
8962ee74 7993
84c61d92
JH		 7994 /* The connection is still in hci_conn_hash so test for 1
7995 * instead of 0 to know if this is the last one.
7996 */
7997 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7998 cancel_delayed_work(&hdev->power_off);
7999 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 8000 }
8001
12d4a3b2
JH		 8002 if (!mgmt_connected)
8003 return;
8004
57eb776f
AG		 8005 if (link_type != ACL_LINK && link_type != LE_LINK)
8006 return;
8007
744cf19e 8008 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 8009
f0d6a0ea
MA		 8010 bacpy(&ev.addr.bdaddr, bdaddr);
8011 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8012 ev.reason = reason;
f7520543 8013
9b80ec5e 8014 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 8015
8016 if (sk)
d97dcb66 8017 sock_put(sk);
8962ee74 8018
124f6e35 8019 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 8020 hdev);
8962ee74
JH		 8021}
8022
7892924c
MH		 8023void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8024 u8 link_type, u8 addr_type, u8 status)
8962ee74 8025{
3655bba8
AG		 8026 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8027 struct mgmt_cp_disconnect *cp;
3b0602cd 8028 struct mgmt_pending_cmd *cmd;
8962ee74 8029
36a75f1b
JD		 8030 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8031 hdev);
8032
333ae95d 8033 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 8034 if (!cmd)
7892924c 8035 return;
8962ee74 8036
3655bba8
AG		 8037 cp = cmd->param;
8038
8039 if (bacmp(bdaddr, &cp->addr.bdaddr))
8040 return;
8041
8042 if (cp->addr.type != bdaddr_type)
8043 return;
8044
f5818c22 8045 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8046 mgmt_pending_remove(cmd);
f7520543 8047}
17d5c04c 8048
445608d0
MH		 8049void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8050 u8 addr_type, u8 status)
17d5c04c
JH		 8051{
8052 struct mgmt_ev_connect_failed ev;
c9910d0f 8053
84c61d92
JH		 8054 /* The connection is still in hci_conn_hash so test for 1
8055 * instead of 0 to know if this is the last one.
8056 */
8057 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8058 cancel_delayed_work(&hdev->power_off);
8059 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 8060 }
17d5c04c 8061
4c659c39 8062 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8063 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 8064 ev.status = mgmt_status(status);
17d5c04c 8065
445608d0 8066 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 8067}
980e1a53 8068
ce0e4a0d 8069void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 8070{
8071 struct mgmt_ev_pin_code_request ev;
8072
d8457698 8073 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 8074 ev.addr.type = BDADDR_BREDR;
a770bb5a 8075 ev.secure = secure;
980e1a53 8076
ce0e4a0d 8077 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 8078}
8079
e669cf80
MH		 8080void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8081 u8 status)
980e1a53 8082{
3b0602cd 8083 struct mgmt_pending_cmd *cmd;
980e1a53 8084
333ae95d 8085 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 8086 if (!cmd)
e669cf80 8087 return;
980e1a53 8088
7776d1d8 8089 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8090 mgmt_pending_remove(cmd);
980e1a53
JH		 8091}
8092
3eb38528
MH		 8093void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8094 u8 status)
980e1a53 8095{
3b0602cd 8096 struct mgmt_pending_cmd *cmd;
980e1a53 8097
333ae95d 8098 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 8099 if (!cmd)
3eb38528 8100 return;
980e1a53 8101
7776d1d8 8102 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8103 mgmt_pending_remove(cmd);
980e1a53 8104}
a5c29683 8105
744cf19e 8106int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 8107 u8 link_type, u8 addr_type, u32 value,
04124681 8108 u8 confirm_hint)
a5c29683
JH		 8109{
8110 struct mgmt_ev_user_confirm_request ev;
8111
744cf19e 8112 BT_DBG("%s", hdev->name);
a5c29683 8113
272d90df 8114 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8115 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 8116 ev.confirm_hint = confirm_hint;
39adbffe 8117 ev.value = cpu_to_le32(value);
a5c29683 8118
744cf19e 8119 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 8120 NULL);
a5c29683
JH		 8121}
8122
272d90df 8123int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 8124 u8 link_type, u8 addr_type)
604086b7
BG		 8125{
8126 struct mgmt_ev_user_passkey_request ev;
8127
8128 BT_DBG("%s", hdev->name);
8129
272d90df 8130 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8131 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 8132
8133 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 8134 NULL);
604086b7
BG		 8135}
8136
0df4c185 8137static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 8138 u8 link_type, u8 addr_type, u8 status,
8139 u8 opcode)
a5c29683 8140{
3b0602cd 8141 struct mgmt_pending_cmd *cmd;
a5c29683 8142
333ae95d 8143 cmd = pending_find(opcode, hdev);
a5c29683
JH		 8144 if (!cmd)
8145 return -ENOENT;
8146
7776d1d8 8147 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8148 mgmt_pending_remove(cmd);
a5c29683 8149
7776d1d8 8150 return 0;
a5c29683
JH		 8151}
8152
744cf19e 8153int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8154 u8 link_type, u8 addr_type, u8 status)
a5c29683 8155{
272d90df 8156 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8157 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 8158}
8159
272d90df 8160int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8161 u8 link_type, u8 addr_type, u8 status)
a5c29683 8162{
272d90df 8163 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8164 status,
8165 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 8166}
2a611692 8167
604086b7 8168int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8169 u8 link_type, u8 addr_type, u8 status)
604086b7 8170{
272d90df 8171 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8172 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 8173}
8174
272d90df 8175int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8176 u8 link_type, u8 addr_type, u8 status)
604086b7 8177{
272d90df 8178 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8179 status,
8180 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 8181}
8182
92a25256
JH		 8183int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8184 u8 link_type, u8 addr_type, u32 passkey,
8185 u8 entered)
8186{
8187 struct mgmt_ev_passkey_notify ev;
8188
8189 BT_DBG("%s", hdev->name);
8190
8191 bacpy(&ev.addr.bdaddr, bdaddr);
8192 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8193 ev.passkey = __cpu_to_le32(passkey);
8194 ev.entered = entered;
8195
8196 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8197}
8198
e1e930f5 8199void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 8200{
8201 struct mgmt_ev_auth_failed ev;
3b0602cd 8202 struct mgmt_pending_cmd *cmd;
e1e930f5 8203 u8 status = mgmt_status(hci_status);
2a611692 8204
e1e930f5
JH		 8205 bacpy(&ev.addr.bdaddr, &conn->dst);
8206 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8207 ev.status = status;
2a611692 8208
e1e930f5
JH		 8209 cmd = find_pairing(conn);
8210
8211 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8212 cmd ? cmd->sk : NULL);
8213
a511b35b
JH		 8214 if (cmd) {
8215 cmd->cmd_complete(cmd, status);
8216 mgmt_pending_remove(cmd);
8217 }
2a611692 8218}
b312b161 8219
464996ae 8220void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 8221{
8222 struct cmd_lookup match = { NULL, hdev };
464996ae 8223 bool changed;
33ef95ed
JH		 8224
8225 if (status) {
8226 u8 mgmt_err = mgmt_status(status);
8227 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 8228 cmd_status_rsp, &mgmt_err);
464996ae 8229 return;
33ef95ed
JH		 8230 }
8231
464996ae 8232 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 8233 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 8234 else
a69d8927 8235 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 8236
33ef95ed 8237 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 8238 &match);
33ef95ed 8239
47990ea0 8240 if (changed)
464996ae 8241 new_settings(hdev, match.sk);
33ef95ed
JH		 8242
8243 if (match.sk)
8244 sock_put(match.sk);
33ef95ed
JH		 8245}
8246
890ea898 8247static void clear_eir(struct hci_request *req)
cacaf52f 8248{
890ea898 8249 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 8250 struct hci_cp_write_eir cp;
8251
976eb20e 8252 if (!lmp_ext_inq_capable(hdev))
890ea898 8253 return;
cacaf52f 8254
c80da27e
JH		 8255 memset(hdev->eir, 0, sizeof(hdev->eir));
8256
cacaf52f
JH		 8257 memset(&cp, 0, sizeof(cp));
8258
890ea898 8259 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 8260}
8261
3e248560 8262void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 8263{
8264 struct cmd_lookup match = { NULL, hdev };
890ea898 8265 struct hci_request req;
c0ecddc2 8266 bool changed = false;
ed2c4ee3
JH		 8267
8268 if (status) {
8269 u8 mgmt_err = mgmt_status(status);
c0ecddc2 8270
a69d8927
MH		 8271 if (enable && hci_dev_test_and_clear_flag(hdev,
8272 HCI_SSP_ENABLED)) {
a358dc11 8273 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 8274 new_settings(hdev, NULL);
9ecb3e24 8275 }
c0ecddc2 8276
04124681
GP		 8277 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8278 &mgmt_err);
3e248560 8279 return;
c0ecddc2
JH		 8280 }
8281
8282 if (enable) {
238be788 8283 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 8284 } else {
a69d8927 8285 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 8286 if (!changed)
a69d8927
MH		 8287 changed = hci_dev_test_and_clear_flag(hdev,
8288 HCI_HS_ENABLED);
9ecb3e24 8289 else
a358dc11 8290 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 8291 }
8292
8293 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8294
c0ecddc2 8295 if (changed)
3e248560 8296 new_settings(hdev, match.sk);
ed2c4ee3 8297
5fc6ebb1 8298 if (match.sk)
ed2c4ee3
JH		 8299 sock_put(match.sk);
8300
890ea898
JH		 8301 hci_req_init(&req, hdev);
8302
d7a5a11d
MH		 8303 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8304 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 8305 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8306 sizeof(enable), &enable);
890ea898 8307 update_eir(&req);
3769972b 8308 } else {
890ea898 8309 clear_eir(&req);
3769972b 8310 }
890ea898
JH		 8311
8312 hci_req_run(&req, NULL);
ed2c4ee3
JH		 8313}
8314
3b0602cd 8315static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 8316{
8317 struct cmd_lookup *match = data;
8318
90e70454
JH		 8319 if (match->sk == NULL) {
8320 match->sk = cmd->sk;
8321 sock_hold(match->sk);
8322 }
90e70454
JH		 8323}
8324
4e1b0245
MH		 8325void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8326 u8 status)
7f9a903c 8327{
90e70454 8328 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 8329
92da6097
JH		 8330 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8331 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8332 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 8333
8334 if (!status)
f6b7712e
MH		 8335 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8336 dev_class, 3, NULL);
90e70454
JH		 8337
8338 if (match.sk)
8339 sock_put(match.sk);
7f9a903c
MH		 8340}
8341
7667da34 8342void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 8343{
b312b161 8344 struct mgmt_cp_set_local_name ev;
3b0602cd 8345 struct mgmt_pending_cmd *cmd;
28cc7bde 8346
13928971 8347 if (status)
7667da34 8348 return;
b312b161
JH		 8349
8350 memset(&ev, 0, sizeof(ev));
8351 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 8352 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 8353
333ae95d 8354 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 8355 if (!cmd) {
8356 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 8357
13928971
JH		 8358 /* If this is a HCI command related to powering on the
8359 * HCI dev don't send any mgmt signals.
8360 */
333ae95d 8361 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 8362 return;
890ea898 8363 }
b312b161 8364
f6b7712e
MH		 8365 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8366 cmd ? cmd->sk : NULL);
b312b161 8367}
c35938b2 8368
799ce93d
JP		 8369static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8370{
8371 int i;
8372
8373 for (i = 0; i < uuid_count; i++) {
8374 if (!memcmp(uuid, uuids[i], 16))
8375 return true;
8376 }
8377
8378 return false;
8379}
8380
b487b9ce
MH		 8381static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8382{
799ce93d
JP		 8383 u16 parsed = 0;
8384
8385 while (parsed < eir_len) {
8386 u8 field_len = eir[0];
8387 u8 uuid[16];
8388 int i;
8389
8390 if (field_len == 0)
8391 break;
8392
8393 if (eir_len - parsed < field_len + 1)
8394 break;
8395
8396 switch (eir[1]) {
8397 case EIR_UUID16_ALL:
8398 case EIR_UUID16_SOME:
8399 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 8400 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8401 uuid[13] = eir[i + 3];
8402 uuid[12] = eir[i + 2];
8403 if (has_uuid(uuid, uuid_count, uuids))
8404 return true;
8405 }
8406 break;
8407 case EIR_UUID32_ALL:
8408 case EIR_UUID32_SOME:
8409 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8410 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8411 uuid[15] = eir[i + 5];
8412 uuid[14] = eir[i + 4];
8413 uuid[13] = eir[i + 3];
8414 uuid[12] = eir[i + 2];
8415 if (has_uuid(uuid, uuid_count, uuids))
8416 return true;
8417 }
8418 break;
8419 case EIR_UUID128_ALL:
8420 case EIR_UUID128_SOME:
8421 for (i = 0; i + 17 <= field_len; i += 16) {
8422 memcpy(uuid, eir + i + 2, 16);
8423 if (has_uuid(uuid, uuid_count, uuids))
8424 return true;
8425 }
8426 break;
8427 }
8428
8429 parsed += field_len + 1;
8430 eir += field_len + 1;
8431 }
8432
b487b9ce
MH		 8433 return false;
8434}
8435
4b0e0ced
JP		 8436static void restart_le_scan(struct hci_dev *hdev)
8437{
8438 /* If controller is not scanning we are done. */
d7a5a11d 8439 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8440 return;
8441
8442 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8443 hdev->discovery.scan_start +
8444 hdev->discovery.scan_duration))
8445 return;
8446
8447 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8448 DISCOV_LE_RESTART_DELAY);
8449}
8450
48f86b7f
JP		 8451static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8452 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8453{
48f86b7f
JP		 8454 /* If a RSSI threshold has been specified, and
8455 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8456 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8457 * is set, let it through for further processing, as we might need to
8458 * restart the scan.
efb2513f
MH		 8459 *
8460 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8461 * the results are also dropped.
bda157a4
MH		 8462 */
8463 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8464 (rssi == HCI_RSSI_INVALID ||
8465 (rssi < hdev->discovery.rssi &&
8466 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8467 return false;
efb2513f 8468
2976cdeb
JP		 8469 if (hdev->discovery.uuid_count != 0) {
8470 /* If a list of UUIDs is provided in filter, results with no
8471 * matching UUID should be dropped.
b487b9ce 8472 */
2976cdeb
JP		 8473 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8474 hdev->discovery.uuids) &&
8475 !eir_has_uuids(scan_rsp, scan_rsp_len,
8476 hdev->discovery.uuid_count,
8477 hdev->discovery.uuids))
8478 return false;
b487b9ce 8479 }
5d2e9fad 8480
2976cdeb
JP		 8481 /* If duplicate filtering does not report RSSI changes, then restart
8482 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8483 */
2976cdeb
JP		 8484 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8485 restart_le_scan(hdev);
8486
8487 /* Validate RSSI value against the RSSI threshold once more. */
8488 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8489 rssi < hdev->discovery.rssi)
8490 return false;
8491 }
48f86b7f
JP		 8492
8493 return true;
8494}
8495
8496void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8497 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8498 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8499{
8500 char buf[512];
8501 struct mgmt_ev_device_found *ev = (void *)buf;
8502 size_t ev_size;
8503
8504 /* Don't send events for a non-kernel initiated discovery. With
8505 * LE one exception is if we have pend_le_reports > 0 in which
8506 * case we're doing passive scanning and want these events.
8507 */
8508 if (!hci_discovery_active(hdev)) {
8509 if (link_type == ACL_LINK)
8510 return;
8511 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8512 return;
8513 }
8514
82f8b651 8515 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8516 /* We are using service discovery */
8517 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8518 scan_rsp_len))
8519 return;
8520 }
8521
8522 /* Make sure that the buffer is big enough. The 5 extra bytes
8523 * are for the potential CoD field.
8524 */
8525 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8526 return;
8527
48f86b7f
JP		 8528 memset(buf, 0, sizeof(buf));
8529
8530 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8531 * RSSI value was reported as 0 when not available. This behavior
8532 * is kept when using device discovery. This is required for full
8533 * backwards compatibility with the API.
8534 *
8535 * However when using service discovery, the value 127 will be
8536 * returned when the RSSI is not available.
8537 */
8538 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8539 link_type == ACL_LINK)
8540 rssi = 0;
8541
8542 bacpy(&ev->addr.bdaddr, bdaddr);
8543 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8544 ev->rssi = rssi;
8545 ev->flags = cpu_to_le32(flags);
8546
8547 if (eir_len > 0)
8548 /* Copy EIR or advertising data into event */
8549 memcpy(ev->eir, eir, eir_len);
8550
8551 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8552 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8553 dev_class, 3);
8554
8555 if (scan_rsp_len > 0)
8556 /* Append scan response data to event */
8557 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8558
5d2e9fad
JH		 8559 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8560 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8561
901801b9 8562 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8563}
a88a9652 8564
9cf12aee
MH		 8565void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8566 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8567{
b644ba33
JH		 8568 struct mgmt_ev_device_found *ev;
8569 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8570 u16 eir_len;
a88a9652 8571
b644ba33 8572 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8573
b644ba33
JH		 8574 memset(buf, 0, sizeof(buf));
8575
8576 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8577 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8578 ev->rssi = rssi;
8579
8580 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8581 name_len);
b644ba33 8582
eb55ef07 8583 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8584
9cf12aee 8585 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8586}
314b2381 8587
2f1e063b 8588void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8589{
f963e8e9 8590 struct mgmt_ev_discovering ev;
164a6e78 8591
343fb145
AG		 8592 BT_DBG("%s discovering %u", hdev->name, discovering);
8593
f963e8e9
JH		 8594 memset(&ev, 0, sizeof(ev));
8595 ev.type = hdev->discovery.type;
8596 ev.discovering = discovering;
8597
2f1e063b 8598 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8599}
5e762444 8600
1904a853 8601static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8602{
8603 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8604}
8605
8606void mgmt_reenable_advertising(struct hci_dev *hdev)
8607{
8608 struct hci_request req;
eb6f95f9 8609 u8 instance;
5976e608 8610
24b4f38f
AU		 8611 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8612 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8613 return;
8614
eb6f95f9
FG		 8615 instance = get_current_adv_instance(hdev);
8616
5976e608 8617 hci_req_init(&req, hdev);
eb6f95f9
FG		 8618
8619 if (instance) {
8620 schedule_adv_instance(&req, instance, true);
8621 } else {
8622 update_adv_data(&req);
8623 update_scan_rsp_data(&req);
8624 enable_advertising(&req);
8625 }
8626
0ec5ae84 8627 hci_req_run(&req, adv_enable_complete);
5976e608 8628}
6d785aa3
JH		 8629
8630static struct hci_mgmt_chan chan = {
8631 .channel = HCI_CHANNEL_CONTROL,
8632 .handler_count = ARRAY_SIZE(mgmt_handlers),
8633 .handlers = mgmt_handlers,
88b94ce9 8634 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8635};
8636
8637int mgmt_init(void)
8638{
8639 return hci_mgmt_chan_register(&chan);
8640}
8641
8642void mgmt_exit(void)
8643{
8644 hci_mgmt_chan_unregister(&chan);
8645}
Linux 6.x block layer and io_uring tree(s)