projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Linux 6.10-rc3
[linux-block.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
17896406 39#include "mgmt_config.h"
e5e1e7fd 40#include "msft.h"
01ce70b0 41#include "eir.h"
258f56d1 42#include "aosp.h"
0381101f 43
2da9c55c 44#define MGMT_VERSION 1
91cb4c19 45#define MGMT_REVISION 22
02d98129 46
e70bb2e8
JH		 47static const u16 mgmt_commands[] = {
48 MGMT_OP_READ_INDEX_LIST,
49 MGMT_OP_READ_INFO,
50 MGMT_OP_SET_POWERED,
51 MGMT_OP_SET_DISCOVERABLE,
52 MGMT_OP_SET_CONNECTABLE,
53 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 54 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 55 MGMT_OP_SET_LINK_SECURITY,
56 MGMT_OP_SET_SSP,
57 MGMT_OP_SET_HS,
58 MGMT_OP_SET_LE,
59 MGMT_OP_SET_DEV_CLASS,
60 MGMT_OP_SET_LOCAL_NAME,
61 MGMT_OP_ADD_UUID,
62 MGMT_OP_REMOVE_UUID,
63 MGMT_OP_LOAD_LINK_KEYS,
64 MGMT_OP_LOAD_LONG_TERM_KEYS,
65 MGMT_OP_DISCONNECT,
66 MGMT_OP_GET_CONNECTIONS,
67 MGMT_OP_PIN_CODE_REPLY,
68 MGMT_OP_PIN_CODE_NEG_REPLY,
69 MGMT_OP_SET_IO_CAPABILITY,
70 MGMT_OP_PAIR_DEVICE,
71 MGMT_OP_CANCEL_PAIR_DEVICE,
72 MGMT_OP_UNPAIR_DEVICE,
73 MGMT_OP_USER_CONFIRM_REPLY,
74 MGMT_OP_USER_CONFIRM_NEG_REPLY,
75 MGMT_OP_USER_PASSKEY_REPLY,
76 MGMT_OP_USER_PASSKEY_NEG_REPLY,
77 MGMT_OP_READ_LOCAL_OOB_DATA,
78 MGMT_OP_ADD_REMOTE_OOB_DATA,
79 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
80 MGMT_OP_START_DISCOVERY,
81 MGMT_OP_STOP_DISCOVERY,
82 MGMT_OP_CONFIRM_NAME,
83 MGMT_OP_BLOCK_DEVICE,
84 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 85 MGMT_OP_SET_DEVICE_ID,
4375f103 86 MGMT_OP_SET_ADVERTISING,
0663ca2a 87 MGMT_OP_SET_BREDR,
d13eafce 88 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 89 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 90 MGMT_OP_SET_SECURE_CONN,
4e39ac81 91 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 92 MGMT_OP_SET_PRIVACY,
41edf160 93 MGMT_OP_LOAD_IRKS,
dd983808 94 MGMT_OP_GET_CONN_INFO,
95868426 95 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 96 MGMT_OP_ADD_DEVICE,
97 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 98 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 99 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 100 MGMT_OP_READ_CONFIG_INFO,
dbece37a 101 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 102 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 103 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 105 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 106 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 107 MGMT_OP_ADD_ADVERTISING,
da929335 108 MGMT_OP_REMOVE_ADVERTISING,
40b25fe5 109 MGMT_OP_GET_ADV_SIZE_INFO,
78b781ca 110 MGMT_OP_START_LIMITED_DISCOVERY,
321c6fee 111 MGMT_OP_READ_EXT_INFO,
c4960ecf 112 MGMT_OP_SET_APPEARANCE,
02431b6c
MH		 113 MGMT_OP_GET_PHY_CONFIGURATION,
114 MGMT_OP_SET_PHY_CONFIGURATION,
600a8749 115 MGMT_OP_SET_BLOCKED_KEYS,
00bce3fb 116 MGMT_OP_SET_WIDEBAND_SPEECH,
4d9b9528 117 MGMT_OP_READ_CONTROLLER_CAP,
a10c907c
MH		 118 MGMT_OP_READ_EXP_FEATURES_INFO,
119 MGMT_OP_SET_EXP_FEATURE,
17896406
AM		 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
121 MGMT_OP_SET_DEF_SYSTEM_CONFIG,
aececa64
MH		 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
123 MGMT_OP_SET_DEF_RUNTIME_CONFIG,
4c54bf2b
APS		 124 MGMT_OP_GET_DEVICE_FLAGS,
125 MGMT_OP_SET_DEVICE_FLAGS,
e5e1e7fd 126 MGMT_OP_READ_ADV_MONITOR_FEATURES,
b139553d 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
bd2fbc6c 128 MGMT_OP_REMOVE_ADV_MONITOR,
12410572
DW		 129 MGMT_OP_ADD_EXT_ADV_PARAMS,
130 MGMT_OP_ADD_EXT_ADV_DATA,
b4a221ea 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
b338d917
BG		 132 MGMT_OP_SET_MESH_RECEIVER,
133 MGMT_OP_MESH_READ_FEATURES,
134 MGMT_OP_MESH_SEND,
135 MGMT_OP_MESH_SEND_CANCEL,
e70bb2e8
JH		 136};
137
138static const u16 mgmt_events[] = {
139 MGMT_EV_CONTROLLER_ERROR,
140 MGMT_EV_INDEX_ADDED,
141 MGMT_EV_INDEX_REMOVED,
142 MGMT_EV_NEW_SETTINGS,
143 MGMT_EV_CLASS_OF_DEV_CHANGED,
144 MGMT_EV_LOCAL_NAME_CHANGED,
145 MGMT_EV_NEW_LINK_KEY,
146 MGMT_EV_NEW_LONG_TERM_KEY,
147 MGMT_EV_DEVICE_CONNECTED,
148 MGMT_EV_DEVICE_DISCONNECTED,
149 MGMT_EV_CONNECT_FAILED,
150 MGMT_EV_PIN_CODE_REQUEST,
151 MGMT_EV_USER_CONFIRM_REQUEST,
152 MGMT_EV_USER_PASSKEY_REQUEST,
153 MGMT_EV_AUTH_FAILED,
154 MGMT_EV_DEVICE_FOUND,
155 MGMT_EV_DISCOVERING,
156 MGMT_EV_DEVICE_BLOCKED,
157 MGMT_EV_DEVICE_UNBLOCKED,
158 MGMT_EV_DEVICE_UNPAIRED,
92a25256 159 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 160 MGMT_EV_NEW_IRK,
7ee4ea36 161 MGMT_EV_NEW_CSRK,
8afef092
MH		 162 MGMT_EV_DEVICE_ADDED,
163 MGMT_EV_DEVICE_REMOVED,
ffb5a827 164 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 165 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 166 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 167 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 168 MGMT_EV_EXT_INDEX_ADDED,
169 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 171 MGMT_EV_ADVERTISING_ADDED,
172 MGMT_EV_ADVERTISING_REMOVED,
321c6fee 173 MGMT_EV_EXT_INFO_CHANGED,
5f4b9172 174 MGMT_EV_PHY_CONFIGURATION_CHANGED,
a10c907c 175 MGMT_EV_EXP_FEATURE_CHANGED,
4c54bf2b 176 MGMT_EV_DEVICE_FLAGS_CHANGED,
3d34a71f
MH		 177 MGMT_EV_ADV_MONITOR_ADDED,
178 MGMT_EV_ADV_MONITOR_REMOVED,
346ce5b7
APS		 179 MGMT_EV_CONTROLLER_SUSPEND,
180 MGMT_EV_CONTROLLER_RESUME,
8d7f1677
MM		 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
182 MGMT_EV_ADV_MONITOR_DEVICE_LOST,
e70bb2e8
JH		 183};
184
99c679ac
MH		 185static const u16 mgmt_untrusted_commands[] = {
186 MGMT_OP_READ_INDEX_LIST,
187 MGMT_OP_READ_INFO,
188 MGMT_OP_READ_UNCONF_INDEX_LIST,
189 MGMT_OP_READ_CONFIG_INFO,
190 MGMT_OP_READ_EXT_INDEX_LIST,
321c6fee 191 MGMT_OP_READ_EXT_INFO,
4d9b9528 192 MGMT_OP_READ_CONTROLLER_CAP,
a10c907c 193 MGMT_OP_READ_EXP_FEATURES_INFO,
17896406 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
aececa64 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
99c679ac
MH		 196};
197
198static const u16 mgmt_untrusted_events[] = {
199 MGMT_EV_INDEX_ADDED,
200 MGMT_EV_INDEX_REMOVED,
201 MGMT_EV_NEW_SETTINGS,
202 MGMT_EV_CLASS_OF_DEV_CHANGED,
203 MGMT_EV_LOCAL_NAME_CHANGED,
204 MGMT_EV_UNCONF_INDEX_ADDED,
205 MGMT_EV_UNCONF_INDEX_REMOVED,
206 MGMT_EV_NEW_CONFIG_OPTIONS,
207 MGMT_EV_EXT_INDEX_ADDED,
208 MGMT_EV_EXT_INDEX_REMOVED,
321c6fee 209 MGMT_EV_EXT_INFO_CHANGED,
a10c907c 210 MGMT_EV_EXP_FEATURE_CHANGED,
99c679ac
MH		 211};
212
17b02e62 213#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 214
d25b78e2
JH		 215#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
216 "\x00\x00\x00\x00\x00\x00\x00\x00"
217
ca69b795 218/* HCI to MGMT error code conversion table */
bdf2aca7 219static const u8 mgmt_status_table[] = {
ca69b795
JH		 220 MGMT_STATUS_SUCCESS,
221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
223 MGMT_STATUS_FAILED, /* Hardware Failure */
224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
232 MGMT_STATUS_BUSY, /* Command Disallowed */
233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
234 MGMT_STATUS_REJECTED, /* Rejected Security */
235 MGMT_STATUS_REJECTED, /* Rejected Personal */
236 MGMT_STATUS_TIMEOUT, /* Host Timeout */
237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
243 MGMT_STATUS_BUSY, /* Repeated Attempts */
244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
251 MGMT_STATUS_FAILED, /* Unspecified Error */
252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
258 MGMT_STATUS_FAILED, /* Unit Link Key Used */
259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
260 MGMT_STATUS_TIMEOUT, /* Instant Passed */
261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
262 MGMT_STATUS_FAILED, /* Transaction Collision */
4ef36a52 263 MGMT_STATUS_FAILED, /* Reserved for future use */
ca69b795
JH		 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
265 MGMT_STATUS_REJECTED, /* QoS Rejected */
266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
267 MGMT_STATUS_REJECTED, /* Insufficient Security */
268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
4ef36a52 269 MGMT_STATUS_FAILED, /* Reserved for future use */
ca69b795 270 MGMT_STATUS_BUSY, /* Role Switch Pending */
4ef36a52 271 MGMT_STATUS_FAILED, /* Reserved for future use */
ca69b795
JH		 272 MGMT_STATUS_FAILED, /* Slot Violation */
273 MGMT_STATUS_FAILED, /* Role Switch Failed */
274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
276 MGMT_STATUS_BUSY, /* Host Busy Pairing */
277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
278 MGMT_STATUS_BUSY, /* Controller Busy */
279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
284};
285
161510cc 286static u8 mgmt_errno_status(int err)
ca69b795 287{
161510cc
LAD		 288 switch (err) {
289 case 0:
290 return MGMT_STATUS_SUCCESS;
291 case -EPERM:
292 return MGMT_STATUS_REJECTED;
293 case -EINVAL:
294 return MGMT_STATUS_INVALID_PARAMS;
295 case -EOPNOTSUPP:
296 return MGMT_STATUS_NOT_SUPPORTED;
297 case -EBUSY:
298 return MGMT_STATUS_BUSY;
299 case -ETIMEDOUT:
300 return MGMT_STATUS_AUTH_FAILED;
301 case -ENOMEM:
302 return MGMT_STATUS_NO_RESOURCES;
303 case -EISCONN:
304 return MGMT_STATUS_ALREADY_CONNECTED;
305 case -ENOTCONN:
306 return MGMT_STATUS_DISCONNECTED;
307 }
308
309 return MGMT_STATUS_FAILED;
310}
311
312static u8 mgmt_status(int err)
313{
314 if (err < 0)
315 return mgmt_errno_status(err);
316
317 if (err < ARRAY_SIZE(mgmt_status_table))
318 return mgmt_status_table[err];
ca69b795
JH		 319
320 return MGMT_STATUS_FAILED;
321}
322
c08b1a1d
MH		 323static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
324 u16 len, int flag)
f9207338 325{
c08b1a1d
MH		 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
327 flag, NULL);
f9207338
MH		 328}
329
72000df2
MH		 330static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
331 u16 len, int flag, struct sock *skip_sk)
332{
333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
334 flag, skip_sk);
335}
336
7a00ff44
JH		 337static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
338 struct sock *skip_sk)
339{
340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 341 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 342}
343
cf1bce1d
LAD		 344static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
345{
346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
347 skip_sk);
348}
349
85813a7e
JH		 350static u8 le_addr_type(u8 mgmt_addr_type)
351{
352 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
353 return ADDR_LE_DEV_PUBLIC;
354 else
355 return ADDR_LE_DEV_RANDOM;
356}
357
03c979c4
MH		 358void mgmt_fill_version_info(void *ver)
359{
360 struct mgmt_rp_read_version *rp = ver;
361
362 rp->version = MGMT_VERSION;
363 rp->revision = cpu_to_le16(MGMT_REVISION);
364}
365
04124681
GP		 366static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
367 u16 data_len)
a38528f1
JH		 368{
369 struct mgmt_rp_read_version rp;
370
181d6953 371 bt_dev_dbg(hdev, "sock %p", sk);
a38528f1 372
03c979c4 373 mgmt_fill_version_info(&rp);
a38528f1 374
2a1afb5a
JH		 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
376 &rp, sizeof(rp));
a38528f1
JH		 377}
378
04124681
GP		 379static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
380 u16 data_len)
e70bb2e8
JH		 381{
382 struct mgmt_rp_read_commands *rp;
99c679ac 383 u16 num_commands, num_events;
e70bb2e8
JH		 384 size_t rp_size;
385 int i, err;
386
181d6953 387 bt_dev_dbg(hdev, "sock %p", sk);
e70bb2e8 388
99c679ac
MH		 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
390 num_commands = ARRAY_SIZE(mgmt_commands);
391 num_events = ARRAY_SIZE(mgmt_events);
392 } else {
393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
394 num_events = ARRAY_SIZE(mgmt_untrusted_events);
395 }
396
e70bb2e8
JH		 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
398
399 rp = kmalloc(rp_size, GFP_KERNEL);
400 if (!rp)
401 return -ENOMEM;
402
dcf4adbf
JP		 403 rp->num_commands = cpu_to_le16(num_commands);
404 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 405
99c679ac
MH		 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
407 __le16 *opcode = rp->opcodes;
408
409 for (i = 0; i < num_commands; i++, opcode++)
410 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 411
99c679ac
MH		 412 for (i = 0; i < num_events; i++, opcode++)
413 put_unaligned_le16(mgmt_events[i], opcode);
414 } else {
415 __le16 *opcode = rp->opcodes;
416
417 for (i = 0; i < num_commands; i++, opcode++)
418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
419
420 for (i = 0; i < num_events; i++, opcode++)
421 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
422 }
e70bb2e8 423
2a1afb5a
JH		 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
425 rp, rp_size);
e70bb2e8
JH		 426 kfree(rp);
427
428 return err;
429}
430
04124681
GP		 431static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
432 u16 data_len)
faba42eb 433{
faba42eb 434 struct mgmt_rp_read_index_list *rp;
8035ded4 435 struct hci_dev *d;
a38528f1 436 size_t rp_len;
faba42eb 437 u16 count;
476e44cb 438 int err;
faba42eb 439
181d6953 440 bt_dev_dbg(hdev, "sock %p", sk);
faba42eb
JH		 441
442 read_lock(&hci_dev_list_lock);
443
444 count = 0;
bb4b2a9a 445 list_for_each_entry(d, &hci_dev_list, list) {
84a4bb65 446 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 447 count++;
faba42eb
JH		 448 }
449
a38528f1
JH		 450 rp_len = sizeof(*rp) + (2 * count);
451 rp = kmalloc(rp_len, GFP_ATOMIC);
452 if (!rp) {
b2c60d42 453 read_unlock(&hci_dev_list_lock);
faba42eb 454 return -ENOMEM;
b2c60d42 455 }
faba42eb 456
476e44cb 457 count = 0;
8035ded4 458 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 459 if (hci_dev_test_flag(d, HCI_SETUP) ||
460 hci_dev_test_flag(d, HCI_CONFIG) ||
461 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 462 continue;
463
73d1df2a
MH		 464 /* Devices marked as raw-only are neither configured
465 * nor unconfigured controllers.
466 */
467 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 468 continue;
469
84a4bb65 470 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892 471 rp->index[count++] = cpu_to_le16(d->id);
181d6953 472 bt_dev_dbg(hdev, "Added hci%u", d->id);
1514b892 473 }
faba42eb
JH		 474 }
475
476e44cb
JH		 476 rp->num_controllers = cpu_to_le16(count);
477 rp_len = sizeof(*rp) + (2 * count);
478
faba42eb
JH		 479 read_unlock(&hci_dev_list_lock);
480
2a1afb5a
JH		 481 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
482 0, rp, rp_len);
faba42eb 483
a38528f1
JH		 484 kfree(rp);
485
486 return err;
faba42eb
JH		 487}
488
73d1df2a
MH		 489static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
490 void *data, u16 data_len)
491{
492 struct mgmt_rp_read_unconf_index_list *rp;
493 struct hci_dev *d;
494 size_t rp_len;
495 u16 count;
496 int err;
497
181d6953 498 bt_dev_dbg(hdev, "sock %p", sk);
73d1df2a
MH		 499
500 read_lock(&hci_dev_list_lock);
501
502 count = 0;
503 list_for_each_entry(d, &hci_dev_list, list) {
84a4bb65 504 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 505 count++;
506 }
507
508 rp_len = sizeof(*rp) + (2 * count);
509 rp = kmalloc(rp_len, GFP_ATOMIC);
510 if (!rp) {
511 read_unlock(&hci_dev_list_lock);
512 return -ENOMEM;
513 }
514
515 count = 0;
516 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 517 if (hci_dev_test_flag(d, HCI_SETUP) ||
518 hci_dev_test_flag(d, HCI_CONFIG) ||
519 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 520 continue;
521
522 /* Devices marked as raw-only are neither configured
523 * nor unconfigured controllers.
524 */
525 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
526 continue;
527
84a4bb65 528 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a 529 rp->index[count++] = cpu_to_le16(d->id);
181d6953 530 bt_dev_dbg(hdev, "Added hci%u", d->id);
73d1df2a
MH		 531 }
532 }
533
534 rp->num_controllers = cpu_to_le16(count);
535 rp_len = sizeof(*rp) + (2 * count);
536
537 read_unlock(&hci_dev_list_lock);
538
2a1afb5a
JH		 539 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
540 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 541
542 kfree(rp);
543
544 return err;
545}
546
96f1474a
MH		 547static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
548 void *data, u16 data_len)
549{
550 struct mgmt_rp_read_ext_index_list *rp;
551 struct hci_dev *d;
96f1474a
MH		 552 u16 count;
553 int err;
554
181d6953 555 bt_dev_dbg(hdev, "sock %p", sk);
96f1474a
MH		 556
557 read_lock(&hci_dev_list_lock);
558
559 count = 0;
84a4bb65
LAD		 560 list_for_each_entry(d, &hci_dev_list, list)
561 count++;
96f1474a 562
4a67e5d4 563 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
96f1474a
MH		 564 if (!rp) {
565 read_unlock(&hci_dev_list_lock);
566 return -ENOMEM;
567 }
568
569 count = 0;
570 list_for_each_entry(d, &hci_dev_list, list) {
571 if (hci_dev_test_flag(d, HCI_SETUP) ||
572 hci_dev_test_flag(d, HCI_CONFIG) ||
573 hci_dev_test_flag(d, HCI_USER_CHANNEL))
574 continue;
575
576 /* Devices marked as raw-only are neither configured
577 * nor unconfigured controllers.
578 */
579 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
580 continue;
581
84a4bb65
LAD		 582 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
583 rp->entry[count].type = 0x01;
584 else
585 rp->entry[count].type = 0x00;
96f1474a
MH		 586
587 rp->entry[count].bus = d->bus;
588 rp->entry[count++].index = cpu_to_le16(d->id);
181d6953 589 bt_dev_dbg(hdev, "Added hci%u", d->id);
96f1474a
MH		 590 }
591
592 rp->num_controllers = cpu_to_le16(count);
96f1474a
MH		 593
594 read_unlock(&hci_dev_list_lock);
595
596 /* If this command is called at least once, then all the
597 * default index and unconfigured index events are disabled
598 * and from now on only extended index events are used.
599 */
600 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
601 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
602 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
603
604 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4a67e5d4
GS		 605 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
606 struct_size(rp, entry, count));
96f1474a
MH		 607
608 kfree(rp);
609
610 return err;
611}
612
dbece37a
MH		 613static bool is_configured(struct hci_dev *hdev)
614{
615 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 616 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 617 return false;
618
7a0e5b15
MK		 619 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
620 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
dbece37a
MH		 621 !bacmp(&hdev->public_addr, BDADDR_ANY))
622 return false;
623
624 return true;
625}
626
89bc22d2
MH		 627static __le32 get_missing_options(struct hci_dev *hdev)
628{
629 u32 options = 0;
630
dbece37a 631 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 632 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 633 options |= MGMT_OPTION_EXTERNAL_CONFIG;
634
7a0e5b15
MK		 635 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
636 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
89bc22d2
MH		 637 !bacmp(&hdev->public_addr, BDADDR_ANY))
638 options |= MGMT_OPTION_PUBLIC_ADDRESS;
639
640 return cpu_to_le32(options);
641}
642
f4537c04
MH		 643static int new_options(struct hci_dev *hdev, struct sock *skip)
644{
645 __le32 options = get_missing_options(hdev);
646
5504c3a3
MH		 647 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
648 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
f4537c04
MH		 649}
650
dbece37a
MH		 651static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
652{
653 __le32 options = get_missing_options(hdev);
654
2a1afb5a
JH		 655 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
656 sizeof(options));
dbece37a
MH		 657}
658
9fc3bfb6
MH		 659static int read_config_info(struct sock *sk, struct hci_dev *hdev,
660 void *data, u16 data_len)
661{
662 struct mgmt_rp_read_config_info rp;
89bc22d2 663 u32 options = 0;
9fc3bfb6 664
181d6953 665 bt_dev_dbg(hdev, "sock %p", sk);
9fc3bfb6
MH		 666
667 hci_dev_lock(hdev);
668
669 memset(&rp, 0, sizeof(rp));
670 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 671
eb1904f4
MH		 672 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
673 options |= MGMT_OPTION_EXTERNAL_CONFIG;
674
9fc3bfb6 675 if (hdev->set_bdaddr)
89bc22d2
MH		 676 options |= MGMT_OPTION_PUBLIC_ADDRESS;
677
678 rp.supported_options = cpu_to_le32(options);
679 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 680
681 hci_dev_unlock(hdev);
682
2a1afb5a
JH		 683 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
684 &rp, sizeof(rp));
9fc3bfb6
MH		 685}
686
6244691f
JK		 687static u32 get_supported_phys(struct hci_dev *hdev)
688{
689 u32 supported_phys = 0;
690
691 if (lmp_bredr_capable(hdev)) {
692 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
693
694 if (hdev->features[0][0] & LMP_3SLOT)
695 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
696
697 if (hdev->features[0][0] & LMP_5SLOT)
698 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
699
700 if (lmp_edr_2m_capable(hdev)) {
701 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
702
703 if (lmp_edr_3slot_capable(hdev))
704 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
705
706 if (lmp_edr_5slot_capable(hdev))
707 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
708
709 if (lmp_edr_3m_capable(hdev)) {
710 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
711
712 if (lmp_edr_3slot_capable(hdev))
713 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
714
715 if (lmp_edr_5slot_capable(hdev))
716 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
717 }
718 }
719 }
720
721 if (lmp_le_capable(hdev)) {
722 supported_phys |= MGMT_PHY_LE_1M_TX;
723 supported_phys |= MGMT_PHY_LE_1M_RX;
724
725 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
726 supported_phys |= MGMT_PHY_LE_2M_TX;
727 supported_phys |= MGMT_PHY_LE_2M_RX;
728 }
729
730 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
731 supported_phys |= MGMT_PHY_LE_CODED_TX;
732 supported_phys |= MGMT_PHY_LE_CODED_RX;
733 }
734 }
735
736 return supported_phys;
737}
738
739static u32 get_selected_phys(struct hci_dev *hdev)
740{
741 u32 selected_phys = 0;
742
743 if (lmp_bredr_capable(hdev)) {
744 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
745
746 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
747 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
748
749 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
750 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
751
752 if (lmp_edr_2m_capable(hdev)) {
753 if (!(hdev->pkt_type & HCI_2DH1))
754 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
755
756 if (lmp_edr_3slot_capable(hdev) &&
757 !(hdev->pkt_type & HCI_2DH3))
758 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
759
760 if (lmp_edr_5slot_capable(hdev) &&
761 !(hdev->pkt_type & HCI_2DH5))
762 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
763
764 if (lmp_edr_3m_capable(hdev)) {
765 if (!(hdev->pkt_type & HCI_3DH1))
766 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
767
768 if (lmp_edr_3slot_capable(hdev) &&
769 !(hdev->pkt_type & HCI_3DH3))
770 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
771
772 if (lmp_edr_5slot_capable(hdev) &&
773 !(hdev->pkt_type & HCI_3DH5))
774 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
775 }
776 }
777 }
778
779 if (lmp_le_capable(hdev)) {
780 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
781 selected_phys |= MGMT_PHY_LE_1M_TX;
782
783 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
784 selected_phys |= MGMT_PHY_LE_1M_RX;
785
786 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
787 selected_phys |= MGMT_PHY_LE_2M_TX;
788
789 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
790 selected_phys |= MGMT_PHY_LE_2M_RX;
791
792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
793 selected_phys |= MGMT_PHY_LE_CODED_TX;
794
795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
796 selected_phys |= MGMT_PHY_LE_CODED_RX;
797 }
798
799 return selected_phys;
800}
801
802static u32 get_configurable_phys(struct hci_dev *hdev)
803{
804 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
805 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
806}
807
69ab39ea
JH		 808static u32 get_supported_settings(struct hci_dev *hdev)
809{
810 u32 settings = 0;
811
812 settings |= MGMT_SETTING_POWERED;
b2939475 813 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 814 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 815 settings |= MGMT_SETTING_CONNECTABLE;
816 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 817
ed3fa31f 818 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 819 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
820 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 821 settings |= MGMT_SETTING_BREDR;
822 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 823
824 if (lmp_ssp_capable(hdev)) {
825 settings |= MGMT_SETTING_SSP;
a82974c9 826 }
e98d2ce2 827
05b3c3e7 828 if (lmp_sc_capable(hdev))
e98d2ce2 829 settings |= MGMT_SETTING_SECURE_CONN;
4b127bd5 830
00bce3fb 831 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
4b127bd5 832 &hdev->quirks))
00bce3fb 833 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
848566b3 834 }
d7b7e796 835
eeca6f89 836 if (lmp_le_capable(hdev)) {
9d42820f 837 settings |= MGMT_SETTING_LE;
a3209694 838 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 839 settings |= MGMT_SETTING_PRIVACY;
93690c22 840 settings |= MGMT_SETTING_STATIC_ADDRESS;
ad383c2c 841 settings |= MGMT_SETTING_ADVERTISING;
eeca6f89 842 }
69ab39ea 843
eb1904f4
MH		 844 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
845 hdev->set_bdaddr)
9fc3bfb6
MH		 846 settings |= MGMT_SETTING_CONFIGURATION;
847
2394186a
PV		 848 if (cis_central_capable(hdev))
849 settings |= MGMT_SETTING_CIS_CENTRAL;
850
851 if (cis_peripheral_capable(hdev))
852 settings |= MGMT_SETTING_CIS_PERIPHERAL;
853
6244691f
JK		 854 settings |= MGMT_SETTING_PHY_CONFIGURATION;
855
69ab39ea
JH		 856 return settings;
857}
858
859static u32 get_current_settings(struct hci_dev *hdev)
860{
861 u32 settings = 0;
862
f1f0eb02 863 if (hdev_is_powered(hdev))
f0d4b78a
MH		 864 settings |= MGMT_SETTING_POWERED;
865
d7a5a11d 866 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 867 settings |= MGMT_SETTING_CONNECTABLE;
868
d7a5a11d 869 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 870 settings |= MGMT_SETTING_FAST_CONNECTABLE;
871
d7a5a11d 872 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 873 settings |= MGMT_SETTING_DISCOVERABLE;
874
d7a5a11d 875 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 876 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 877
d7a5a11d 878 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 879 settings |= MGMT_SETTING_BREDR;
880
d7a5a11d 881 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 882 settings |= MGMT_SETTING_LE;
883
d7a5a11d 884 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 885 settings |= MGMT_SETTING_LINK_SECURITY;
886
d7a5a11d 887 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 888 settings |= MGMT_SETTING_SSP;
889
d7a5a11d 890 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 891 settings |= MGMT_SETTING_ADVERTISING;
892
d7a5a11d 893 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 894 settings |= MGMT_SETTING_SECURE_CONN;
895
d7a5a11d 896 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 897 settings |= MGMT_SETTING_DEBUG_KEYS;
898
d7a5a11d 899 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 900 settings |= MGMT_SETTING_PRIVACY;
901
93690c22
MH		 902 /* The current setting for static address has two purposes. The
903 * first is to indicate if the static address will be used and
904 * the second is to indicate if it is actually set.
905 *
906 * This means if the static address is not configured, this flag
08dc0e98 907 * will never be set. If the address is configured, then if the
93690c22
MH		 908 * address is actually used decides if the flag is set or not.
909 *
910 * For single mode LE only controllers and dual-mode controllers
911 * with BR/EDR disabled, the existence of the static address will
912 * be evaluated.
913 */
b7cb93e5 914 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 915 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 916 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
917 if (bacmp(&hdev->static_addr, BDADDR_ANY))
918 settings |= MGMT_SETTING_STATIC_ADDRESS;
919 }
920
00bce3fb
AM		 921 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
922 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
923
2394186a
PV		 924 if (cis_central_capable(hdev))
925 settings |= MGMT_SETTING_CIS_CENTRAL;
926
927 if (cis_peripheral_capable(hdev))
928 settings |= MGMT_SETTING_CIS_PERIPHERAL;
929
ae753361
CD		 930 if (bis_capable(hdev))
931 settings |= MGMT_SETTING_ISO_BROADCASTER;
932
933 if (sync_recv_capable(hdev))
934 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
935
69ab39ea
JH		 936 return settings;
937}
938
333ae95d
JH		 939static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
940{
941 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
942}
943
f2252570 944u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
9a43e25f 945{
3b0602cd 946 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 947
948 /* If there's a pending mgmt command the flags will not yet have
949 * their final values, so check for this first.
950 */
333ae95d 951 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 952 if (cmd) {
953 struct mgmt_mode *cp = cmd->param;
954 if (cp->val == 0x01)
955 return LE_AD_GENERAL;
956 else if (cp->val == 0x02)
957 return LE_AD_LIMITED;
958 } else {
d7a5a11d 959 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 960 return LE_AD_LIMITED;
d7a5a11d 961 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 962 return LE_AD_GENERAL;
963 }
964
965 return 0;
966}
967
f2252570 968bool mgmt_get_connectable(struct hci_dev *hdev)
fdf51784
AU		 969{
970 struct mgmt_pending_cmd *cmd;
441ad2d0 971
fdf51784
AU		 972 /* If there's a pending mgmt command the flag will not yet have
973 * it's final value, so check for this first.
974 */
975 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
976 if (cmd) {
977 struct mgmt_mode *cp = cmd->param;
441ad2d0 978
fdf51784 979 return cp->val;
441ad2d0
MH		 980 }
981
fdf51784
AU		 982 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
983}
441ad2d0 984
161510cc
LAD		 985static int service_cache_sync(struct hci_dev *hdev, void *data)
986{
987 hci_update_eir_sync(hdev);
988 hci_update_class_sync(hdev);
989
990 return 0;
991}
992
7d78525d
JH		 993static void service_cache_off(struct work_struct *work)
994{
995 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 996 service_cache.work);
7d78525d 997
a69d8927 998 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 999 return;
1000
161510cc 1001 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
7d78525d
JH		 1002}
1003
cba6b758
LAD		 1004static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1005{
1006 /* The generation of a new RPA and programming it into the
1007 * controller happens in the hci_req_enable_advertising()
1008 * function.
1009 */
1010 if (ext_adv_capable(hdev))
1011 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1012 else
1013 return hci_enable_advertising_sync(hdev);
1014}
1015
d6bfd59c
JH		 1016static void rpa_expired(struct work_struct *work)
1017{
1018 struct hci_dev *hdev = container_of(work, struct hci_dev,
1019 rpa_expired.work);
d6bfd59c 1020
181d6953 1021 bt_dev_dbg(hdev, "");
d6bfd59c 1022
a1536da2 1023 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1024
d7a5a11d 1025 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1026 return;
1027
cba6b758 1028 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
d6bfd59c
JH		 1029}
1030
0bd1fb58
FD		 1031static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1032
0ef08313
BG		 1033static void discov_off(struct work_struct *work)
1034{
1035 struct hci_dev *hdev = container_of(work, struct hci_dev,
1036 discov_off.work);
1037
1038 bt_dev_dbg(hdev, "");
1039
1040 hci_dev_lock(hdev);
1041
1042 /* When discoverable timeout triggers, then just make sure
1043 * the limited discoverable flag is cleared. Even in the case
1044 * of a timeout triggered from general discoverable, it is
1045 * safe to unconditionally clear the flag.
1046 */
1047 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1048 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1049 hdev->discov_timeout = 0;
1050
0bd1fb58 1051 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
0ef08313
BG		 1052
1053 mgmt_new_settings(hdev);
1054
1055 hci_dev_unlock(hdev);
1056}
1057
b338d917
BG		 1058static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1059
1060static void mesh_send_complete(struct hci_dev *hdev,
1061 struct mgmt_mesh_tx *mesh_tx, bool silent)
1062{
1063 u8 handle = mesh_tx->handle;
1064
1065 if (!silent)
1066 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1067 sizeof(handle), NULL);
1068
1069 mgmt_mesh_remove(mesh_tx);
1070}
1071
1072static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1073{
1074 struct mgmt_mesh_tx *mesh_tx;
1075
1076 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1077 hci_disable_advertising_sync(hdev);
1078 mesh_tx = mgmt_mesh_next(hdev, NULL);
1079
1080 if (mesh_tx)
1081 mesh_send_complete(hdev, mesh_tx, false);
1082
1083 return 0;
1084}
1085
1086static int mesh_send_sync(struct hci_dev *hdev, void *data);
1087static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1088static void mesh_next(struct hci_dev *hdev, void *data, int err)
1089{
1090 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092 if (!mesh_tx)
1093 return;
1094
1095 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1096 mesh_send_start_complete);
1097
1098 if (err < 0)
1099 mesh_send_complete(hdev, mesh_tx, false);
1100 else
1101 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1102}
1103
1104static void mesh_send_done(struct work_struct *work)
1105{
1106 struct hci_dev *hdev = container_of(work, struct hci_dev,
1107 mesh_send_done.work);
1108
1109 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1110 return;
1111
1112 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1113}
1114
6a919082 1115static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1116{
f74ca25d 1117 if (hci_dev_test_flag(hdev, HCI_MGMT))
6a919082
JH		 1118 return;
1119
0ef08313
BG		 1120 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1121
1122 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
4f87da80 1123 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1124 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
b338d917 1125 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
7d78525d 1126
4f87da80
JH		 1127 /* Non-mgmt controlled devices get this bit set
1128 * implicitly so that pairing works for them, however
1129 * for mgmt we require user-space to explicitly enable
1130 * it
1131 */
a358dc11 1132 hci_dev_clear_flag(hdev, HCI_BONDABLE);
f74ca25d
TH		 1133
1134 hci_dev_set_flag(hdev, HCI_MGMT);
7d78525d
JH		 1135}
1136
0f4e68cf 1137static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1138 void *data, u16 data_len)
0381101f 1139{
a38528f1 1140 struct mgmt_rp_read_info rp;
f7b64e69 1141
181d6953 1142 bt_dev_dbg(hdev, "sock %p", sk);
f7b64e69 1143
09fd0de5 1144 hci_dev_lock(hdev);
f7b64e69 1145
dc4fe30b
JH		 1146 memset(&rp, 0, sizeof(rp));
1147
69ab39ea 1148 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1149
69ab39ea 1150 rp.version = hdev->hci_ver;
eb55ef07 1151 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1152
1153 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1154 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1155
a38528f1 1156 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1157
dc4fe30b 1158 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1159 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1160
09fd0de5 1161 hci_dev_unlock(hdev);
0381101f 1162
2a1afb5a
JH		 1163 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1164 sizeof(rp));
0381101f
JH		 1165}
1166
cde7a863
MN		 1167static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1168{
1169 u16 eir_len = 0;
1170 size_t name_len;
1171
1172 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1173 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1174 hdev->dev_class, 3);
1175
6a9e90bf
SJ		 1176 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1177 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1178 hdev->appearance);
1179
dd7b8cdd 1180 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
cde7a863
MN		 1181 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1182 hdev->dev_name, name_len);
1183
dd7b8cdd 1184 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
cde7a863
MN		 1185 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1186 hdev->short_name, name_len);
1187
1188 return eir_len;
1189}
1190
321c6fee
MH		 1191static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1192 void *data, u16 data_len)
1193{
7d5c11da
SJ		 1194 char buf[512];
1195 struct mgmt_rp_read_ext_info *rp = (void *)buf;
cde7a863 1196 u16 eir_len;
321c6fee 1197
181d6953 1198 bt_dev_dbg(hdev, "sock %p", sk);
321c6fee 1199
7d5c11da
SJ		 1200 memset(&buf, 0, sizeof(buf));
1201
321c6fee
MH		 1202 hci_dev_lock(hdev);
1203
7d5c11da
SJ		 1204 bacpy(&rp->bdaddr, &hdev->bdaddr);
1205
1206 rp->version = hdev->hci_ver;
1207 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1208
1209 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1210 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1211
321c6fee 1212
cde7a863 1213 eir_len = append_eir_data_to_buf(hdev, rp->eir);
8a0c9f49 1214 rp->eir_len = cpu_to_le16(eir_len);
321c6fee
MH		 1215
1216 hci_dev_unlock(hdev);
1217
1218 /* If this command is called at least once, then the events
1219 * for class of device and local name changes are disabled
1220 * and only the new extended controller information event
1221 * is used.
1222 */
1223 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1224 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1225 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1226
8a0c9f49
MN		 1227 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1228 sizeof(*rp) + eir_len);
321c6fee
MH		 1229}
1230
1231static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1232{
5e9fae48
MN		 1233 char buf[512];
1234 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1235 u16 eir_len;
1236
1237 memset(buf, 0, sizeof(buf));
321c6fee 1238
5e9fae48
MN		 1239 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1240 ev->eir_len = cpu_to_le16(eir_len);
321c6fee 1241
5e9fae48
MN		 1242 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1243 sizeof(*ev) + eir_len,
1244 HCI_MGMT_EXT_INFO_EVENTS, skip);
321c6fee
MH		 1245}
1246
69ab39ea 1247static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1248{
69ab39ea 1249 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1250
2a1afb5a
JH		 1251 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1252 sizeof(settings));
8680570b
JH		 1253}
1254
f2252570 1255void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
912098a6
AU		 1256{
1257 struct mgmt_ev_advertising_added ev;
1258
1259 ev.instance = instance;
1260
1261 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1262}
1263
f2252570
JH		 1264void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1265 u8 instance)
912098a6
AU		 1266{
1267 struct mgmt_ev_advertising_removed ev;
1268
1269 ev.instance = instance;
1270
1271 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1272}
1273
7816b820
FG		 1274static void cancel_adv_timeout(struct hci_dev *hdev)
1275{
1276 if (hdev->adv_instance_timeout) {
1277 hdev->adv_instance_timeout = 0;
1278 cancel_delayed_work(&hdev->adv_instance_expire);
1279 }
1280}
1281
cf75ad8b
LAD		 1282/* This function requires the caller holds hdev->lock */
1283static void restart_le_actions(struct hci_dev *hdev)
8b064a3a 1284{
cf75ad8b 1285 struct hci_conn_params *p;
8b064a3a 1286
cf75ad8b
LAD		 1287 list_for_each_entry(p, &hdev->le_conn_params, list) {
1288 /* Needed for AUTO_OFF case where might not "really"
1289 * have been powered off.
1290 */
195ef75e 1291 hci_pend_le_list_del_init(p);
8b064a3a 1292
cf75ad8b
LAD		 1293 switch (p->auto_connect) {
1294 case HCI_AUTO_CONN_DIRECT:
1295 case HCI_AUTO_CONN_ALWAYS:
195ef75e 1296 hci_pend_le_list_add(p, &hdev->pend_le_conns);
cf75ad8b
LAD		 1297 break;
1298 case HCI_AUTO_CONN_REPORT:
195ef75e 1299 hci_pend_le_list_add(p, &hdev->pend_le_reports);
cf75ad8b
LAD		 1300 break;
1301 default:
1302 break;
1303 }
8b064a3a 1304 }
cf75ad8b 1305}
8b064a3a 1306
cf75ad8b
LAD		 1307static int new_settings(struct hci_dev *hdev, struct sock *skip)
1308{
1309 __le32 ev = cpu_to_le32(get_current_settings(hdev));
912098a6 1310
cf75ad8b
LAD		 1311 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1312 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1313}
8b064a3a 1314
cf75ad8b
LAD		 1315static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1316{
1317 struct mgmt_pending_cmd *cmd = data;
275f3f64
BG		 1318 struct mgmt_mode *cp;
1319
1320 /* Make sure cmd still outstanding. */
1321 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1322 return;
1323
1324 cp = cmd->param;
cf75ad8b
LAD		 1325
1326 bt_dev_dbg(hdev, "err %d", err);
1327
1328 if (!err) {
1329 if (cp->val) {
1330 hci_dev_lock(hdev);
1331 restart_le_actions(hdev);
1332 hci_update_passive_scan(hdev);
1333 hci_dev_unlock(hdev);
1334 }
8b064a3a 1335
cf75ad8b
LAD		 1336 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1337
1338 /* Only call new_setting for power on as power off is deferred
1339 * to hdev->power_off work which does call hci_dev_do_close.
1340 */
1341 if (cp->val)
1342 new_settings(hdev, cmd->sk);
1343 } else {
1344 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1345 mgmt_status(err));
8b064a3a
JH		 1346 }
1347
275f3f64 1348 mgmt_pending_remove(cmd);
cf75ad8b 1349}
23a48093 1350
cf75ad8b
LAD		 1351static int set_powered_sync(struct hci_dev *hdev, void *data)
1352{
1353 struct mgmt_pending_cmd *cmd = data;
1354 struct mgmt_mode *cp = cmd->param;
1355
1356 BT_DBG("%s", hdev->name);
1357
1358 return hci_set_powered_sync(hdev, cp->val);
8b064a3a
JH		 1359}
1360
bdb6d971 1361static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1362 u16 len)
eec8d2bc 1363{
650f726d 1364 struct mgmt_mode *cp = data;
3b0602cd 1365 struct mgmt_pending_cmd *cmd;
4b34ee78 1366 int err;
eec8d2bc 1367
181d6953 1368 bt_dev_dbg(hdev, "sock %p", sk);
eec8d2bc 1369
a7e80f25 1370 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1371 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1372 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1373
09fd0de5 1374 hci_dev_lock(hdev);
eec8d2bc 1375
b14202af
JD		 1376 if (!cp->val) {
1377 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
1378 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1379 MGMT_STATUS_BUSY);
1380 goto failed;
1381 }
1382 }
1383
333ae95d 1384 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1385 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1386 MGMT_STATUS_BUSY);
87b95ba6
JH		 1387 goto failed;
1388 }
1389
4b34ee78 1390 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1391 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1392 goto failed;
1393 }
1394
275f3f64 1395 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1396 if (!cmd) {
1397 err = -ENOMEM;
eec8d2bc 1398 goto failed;
366a0336 1399 }
eec8d2bc 1400
f4198635 1401 /* Cancel potentially blocking sync operation before power off */
d883a466 1402 if (cp->val == 0x00) {
63298d6e 1403 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
d883a466
LAD		 1404 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1405 mgmt_set_powered_complete);
1406 } else {
1407 /* Use hci_cmd_sync_submit since hdev might not be running */
1408 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1409 mgmt_set_powered_complete);
1410 }
eec8d2bc 1411
275f3f64
BG		 1412 if (err < 0)
1413 mgmt_pending_remove(cmd);
1414
eec8d2bc 1415failed:
09fd0de5 1416 hci_dev_unlock(hdev);
366a0336 1417 return err;
eec8d2bc
JH		 1418}
1419
91a668b0
JH		 1420int mgmt_new_settings(struct hci_dev *hdev)
1421{
1422 return new_settings(hdev, NULL);
1423}
1424
bd99abdd
JH		 1425struct cmd_lookup {
1426 struct sock *sk;
1427 struct hci_dev *hdev;
1428 u8 mgmt_status;
1429};
1430
3b0602cd 1431static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1432{
1433 struct cmd_lookup *match = data;
1434
1435 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1436
1437 list_del(&cmd->list);
1438
1439 if (match->sk == NULL) {
1440 match->sk = cmd->sk;
1441 sock_hold(match->sk);
1442 }
1443
1444 mgmt_pending_free(cmd);
1445}
1446
3b0602cd 1447static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1448{
1449 u8 *status = data;
1450
a69e8375 1451 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1452 mgmt_pending_remove(cmd);
1453}
1454
3b0602cd 1455static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1456{
1457 if (cmd->cmd_complete) {
1458 u8 *status = data;
1459
1460 cmd->cmd_complete(cmd, *status);
1461 mgmt_pending_remove(cmd);
1462
1463 return;
1464 }
1465
1466 cmd_status_rsp(cmd, data);
1467}
1468
3b0602cd 1469static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1470{
2a1afb5a
JH		 1471 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1472 cmd->param, cmd->param_len);
f5818c22
JH		 1473}
1474
3b0602cd 1475static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1476{
2a1afb5a
JH		 1477 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1478 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1479}
1480
e6fe7986
JH		 1481static u8 mgmt_bredr_support(struct hci_dev *hdev)
1482{
1483 if (!lmp_bredr_capable(hdev))
1484 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1485 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1486 return MGMT_STATUS_REJECTED;
1487 else
1488 return MGMT_STATUS_SUCCESS;
1489}
1490
1491static u8 mgmt_le_support(struct hci_dev *hdev)
1492{
1493 if (!lmp_le_capable(hdev))
1494 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1495 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1496 return MGMT_STATUS_REJECTED;
1497 else
1498 return MGMT_STATUS_SUCCESS;
1499}
1500
2bd1b237
LAD		 1501static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1502 int err)
bfaf8c9f 1503{
2bd1b237 1504 struct mgmt_pending_cmd *cmd = data;
bfaf8c9f 1505
2bd1b237 1506 bt_dev_dbg(hdev, "err %d", err);
bfaf8c9f 1507
275f3f64
BG		 1508 /* Make sure cmd still outstanding. */
1509 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1510 return;
1511
bfaf8c9f
JH		 1512 hci_dev_lock(hdev);
1513
2bd1b237
LAD		 1514 if (err) {
1515 u8 mgmt_err = mgmt_status(err);
a69e8375 1516 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1517 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2bd1b237 1518 goto done;
bfaf8c9f
JH		 1519 }
1520
aed1a885
JH		 1521 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1522 hdev->discov_timeout > 0) {
1523 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1524 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
d4462a07 1525 }
bfaf8c9f
JH		 1526
1527 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
aed1a885 1528 new_settings(hdev, cmd->sk);
970ba524 1529
2bd1b237 1530done:
275f3f64 1531 mgmt_pending_remove(cmd);
bfaf8c9f
JH		 1532 hci_dev_unlock(hdev);
1533}
1534
2bd1b237
LAD		 1535static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1536{
1537 BT_DBG("%s", hdev->name);
1538
1539 return hci_update_discoverable_sync(hdev);
1540}
1541
bdb6d971 1542static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1543 u16 len)
73f22f62 1544{
650f726d 1545 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1546 struct mgmt_pending_cmd *cmd;
5e5282bb 1547 u16 timeout;
73f22f62
JH		 1548 int err;
1549
181d6953 1550 bt_dev_dbg(hdev, "sock %p", sk);
73f22f62 1551
d7a5a11d
MH		 1552 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1553 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1554 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1555 MGMT_STATUS_REJECTED);
33c525c0 1556
310a3d48 1557 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1558 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1559 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1560
1f350c87 1561 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1562
1563 /* Disabling discoverable requires that no timeout is set,
1564 * and enabling limited discoverable requires a timeout.
1565 */
1566 if ((cp->val == 0x00 && timeout > 0) ||
1567 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1568 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1569 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1570
09fd0de5 1571 hci_dev_lock(hdev);
73f22f62 1572
5e5282bb 1573 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1574 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1575 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1576 goto failed;
1577 }
1578
333ae95d
JH		 1579 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1580 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1581 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1582 MGMT_STATUS_BUSY);
73f22f62
JH		 1583 goto failed;
1584 }
1585
d7a5a11d 1586 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1587 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1588 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1589 goto failed;
1590 }
1591
4867bd00
APS		 1592 if (hdev->advertising_paused) {
1593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594 MGMT_STATUS_BUSY);
1595 goto failed;
1596 }
1597
5e5282bb 1598 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1599 bool changed = false;
1600
310a3d48
MH		 1601 /* Setting limited discoverable when powered off is
1602 * not a valid operation since it requires a timeout
1603 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1604 */
d7a5a11d 1605 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1606 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1607 changed = true;
1608 }
1609
5e5282bb 1610 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1611 if (err < 0)
1612 goto failed;
1613
1614 if (changed)
1615 err = new_settings(hdev, sk);
1616
5e5282bb
JH		 1617 goto failed;
1618 }
1619
310a3d48
MH		 1620 /* If the current mode is the same, then just update the timeout
1621 * value with the new value. And if only the timeout gets updated,
1622 * then no need for any HCI transactions.
1623 */
d7a5a11d
MH		 1624 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1625 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1626 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1627 cancel_delayed_work(&hdev->discov_off);
1628 hdev->discov_timeout = timeout;
955638ec 1629
36261547
MH		 1630 if (cp->val && hdev->discov_timeout > 0) {
1631 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
c366f555
JH		 1632 queue_delayed_work(hdev->req_workqueue,
1633 &hdev->discov_off, to);
955638ec
MH		 1634 }
1635
69ab39ea 1636 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1637 goto failed;
1638 }
1639
275f3f64 1640 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1641 if (!cmd) {
1642 err = -ENOMEM;
73f22f62 1643 goto failed;
366a0336 1644 }
73f22f62 1645
310a3d48
MH		 1646 /* Cancel any potential discoverable timeout that might be
1647 * still active and store new timeout value. The arming of
1648 * the timeout happens in the complete handler.
1649 */
1650 cancel_delayed_work(&hdev->discov_off);
1651 hdev->discov_timeout = timeout;
1652
aed1a885
JH		 1653 if (cp->val)
1654 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1655 else
1656 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1657
b456f87c
JH		 1658 /* Limited discoverable mode */
1659 if (cp->val == 0x02)
a1536da2 1660 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1661 else
a358dc11 1662 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1663
2bd1b237
LAD		 1664 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1665 mgmt_set_discoverable_complete);
73f22f62 1666
275f3f64
BG		 1667 if (err < 0)
1668 mgmt_pending_remove(cmd);
1669
73f22f62 1670failed:
09fd0de5 1671 hci_dev_unlock(hdev);
73f22f62
JH		 1672 return err;
1673}
1674
f056a657
LAD		 1675static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1676 int err)
2b76f453 1677{
f056a657 1678 struct mgmt_pending_cmd *cmd = data;
2b76f453 1679
f056a657 1680 bt_dev_dbg(hdev, "err %d", err);
2b76f453 1681
275f3f64
BG		 1682 /* Make sure cmd still outstanding. */
1683 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1684 return;
1685
2b76f453
JH		 1686 hci_dev_lock(hdev);
1687
f056a657
LAD		 1688 if (err) {
1689 u8 mgmt_err = mgmt_status(err);
a69e8375 1690 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
f056a657 1691 goto done;
37438c1f
JH		 1692 }
1693
2b76f453 1694 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
53c0ba74 1695 new_settings(hdev, cmd->sk);
d7b856f9 1696
f056a657 1697done:
3237da12 1698 mgmt_pending_remove(cmd);
275f3f64 1699
2b76f453
JH		 1700 hci_dev_unlock(hdev);
1701}
1702
e8ba3a1f
JH		 1703static int set_connectable_update_settings(struct hci_dev *hdev,
1704 struct sock *sk, u8 val)
1705{
1706 bool changed = false;
1707 int err;
1708
d7a5a11d 1709 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 1710 changed = true;
1711
1712 if (val) {
a1536da2 1713 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 1714 } else {
a358dc11
MH		 1715 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1716 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 1717 }
1718
1719 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1720 if (err < 0)
1721 return err;
1722
562064e6 1723 if (changed) {
bb876725 1724 hci_update_scan(hdev);
5bee2fd6 1725 hci_update_passive_scan(hdev);
e8ba3a1f 1726 return new_settings(hdev, sk);
562064e6 1727 }
e8ba3a1f
JH		 1728
1729 return 0;
1730}
1731
f056a657
LAD		 1732static int set_connectable_sync(struct hci_dev *hdev, void *data)
1733{
1734 BT_DBG("%s", hdev->name);
1735
1736 return hci_update_connectable_sync(hdev);
1737}
1738
bdb6d971 1739static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1740 u16 len)
9fbcbb45 1741{
650f726d 1742 struct mgmt_mode *cp = data;
3b0602cd 1743 struct mgmt_pending_cmd *cmd;
9fbcbb45
JH		 1744 int err;
1745
181d6953 1746 bt_dev_dbg(hdev, "sock %p", sk);
9fbcbb45 1747
d7a5a11d
MH		 1748 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1749 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1751 MGMT_STATUS_REJECTED);
33c525c0 1752
a7e80f25 1753 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1755 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1756
09fd0de5 1757 hci_dev_lock(hdev);
9fbcbb45 1758
4b34ee78 1759 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1760 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1761 goto failed;
1762 }
1763
333ae95d
JH		 1764 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1765 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1766 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1767 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1768 goto failed;
1769 }
1770
275f3f64 1771 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1772 if (!cmd) {
1773 err = -ENOMEM;
9fbcbb45 1774 goto failed;
366a0336 1775 }
9fbcbb45 1776
53c0ba74
JH		 1777 if (cp->val) {
1778 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1779 } else {
1780 if (hdev->discov_timeout > 0)
1781 cancel_delayed_work(&hdev->discov_off);
2b76f453 1782
53c0ba74
JH		 1783 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1784 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1785 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
9b74246f 1786 }
2b76f453 1787
f056a657
LAD		 1788 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1789 mgmt_set_connectable_complete);
9fbcbb45 1790
275f3f64
BG		 1791 if (err < 0)
1792 mgmt_pending_remove(cmd);
1793
9fbcbb45 1794failed:
09fd0de5 1795 hci_dev_unlock(hdev);
9fbcbb45
JH		 1796 return err;
1797}
1798
b2939475 1799static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1800 u16 len)
c542a06c 1801{
650f726d 1802 struct mgmt_mode *cp = data;
55594356 1803 bool changed;
c542a06c
JH		 1804 int err;
1805
181d6953 1806 bt_dev_dbg(hdev, "sock %p", sk);
c542a06c 1807
a7e80f25 1808 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1809 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1810 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1811
09fd0de5 1812 hci_dev_lock(hdev);
c542a06c
JH		 1813
1814 if (cp->val)
238be788 1815 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 1816 else
a69d8927 1817 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 1818
b2939475 1819 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 1820 if (err < 0)
55594356 1821 goto unlock;
c542a06c 1822
82a37ade
JH		 1823 if (changed) {
1824 /* In limited privacy mode the change of bondable mode
1825 * may affect the local advertising address.
1826 */
2bd1b237 1827 hci_update_discoverable(hdev);
82a37ade 1828
55594356 1829 err = new_settings(hdev, sk);
82a37ade 1830 }
c542a06c 1831
55594356 1832unlock:
09fd0de5 1833 hci_dev_unlock(hdev);
c542a06c
JH		 1834 return err;
1835}
1836
04124681
GP		 1837static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1838 u16 len)
33ef95ed
JH		 1839{
1840 struct mgmt_mode *cp = data;
3b0602cd 1841 struct mgmt_pending_cmd *cmd;
e6fe7986 1842 u8 val, status;
33ef95ed
JH		 1843 int err;
1844
181d6953 1845 bt_dev_dbg(hdev, "sock %p", sk);
33ef95ed 1846
e6fe7986
JH		 1847 status = mgmt_bredr_support(hdev);
1848 if (status)
a69e8375
JH		 1849 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1850 status);
33c525c0 1851
a7e80f25 1852 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1853 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1854 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1855
33ef95ed
JH		 1856 hci_dev_lock(hdev);
1857
4b34ee78 1858 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 1859 bool changed = false;
1860
d7a5a11d 1861 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 1862 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 1863 changed = true;
1864 }
1865
1866 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1867 if (err < 0)
1868 goto failed;
1869
1870 if (changed)
1871 err = new_settings(hdev, sk);
1872
33ef95ed
JH		 1873 goto failed;
1874 }
1875
333ae95d 1876 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 1877 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1878 MGMT_STATUS_BUSY);
33ef95ed
JH		 1879 goto failed;
1880 }
1881
1882 val = !!cp->val;
1883
1884 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1885 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1886 goto failed;
1887 }
1888
1889 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1890 if (!cmd) {
1891 err = -ENOMEM;
1892 goto failed;
1893 }
1894
1895 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1896 if (err < 0) {
1897 mgmt_pending_remove(cmd);
1898 goto failed;
1899 }
1900
1901failed:
1902 hci_dev_unlock(hdev);
33ef95ed
JH		 1903 return err;
1904}
1905
3244845c
BG		 1906static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1907{
1908 struct cmd_lookup match = { NULL, hdev };
1909 struct mgmt_pending_cmd *cmd = data;
1910 struct mgmt_mode *cp = cmd->param;
1911 u8 enable = cp->val;
1912 bool changed;
1913
275f3f64
BG		 1914 /* Make sure cmd still outstanding. */
1915 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1916 return;
1917
3244845c
BG		 1918 if (err) {
1919 u8 mgmt_err = mgmt_status(err);
1920
1921 if (enable && hci_dev_test_and_clear_flag(hdev,
1922 HCI_SSP_ENABLED)) {
3244845c
BG		 1923 new_settings(hdev, NULL);
1924 }
1925
1926 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1927 &mgmt_err);
1928 return;
1929 }
1930
1931 if (enable) {
1932 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1933 } else {
1934 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
3244845c
BG		 1935 }
1936
1937 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1938
1939 if (changed)
1940 new_settings(hdev, match.sk);
1941
1942 if (match.sk)
1943 sock_put(match.sk);
1944
1945 hci_update_eir_sync(hdev);
1946}
1947
1948static int set_ssp_sync(struct hci_dev *hdev, void *data)
1949{
1950 struct mgmt_pending_cmd *cmd = data;
1951 struct mgmt_mode *cp = cmd->param;
1952 bool changed = false;
1953 int err;
1954
1955 if (cp->val)
1956 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1957
1958 err = hci_write_ssp_mode_sync(hdev, cp->val);
1959
1960 if (!err && changed)
1961 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1962
1963 return err;
1964}
1965
bdb6d971 1966static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 1967{
1968 struct mgmt_mode *cp = data;
3b0602cd 1969 struct mgmt_pending_cmd *cmd;
72ef0c1a 1970 u8 status;
ed2c4ee3
JH		 1971 int err;
1972
181d6953 1973 bt_dev_dbg(hdev, "sock %p", sk);
ed2c4ee3 1974
cdba5281
MH		 1975 status = mgmt_bredr_support(hdev);
1976 if (status)
a69e8375 1977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 1978
13ecd8b6 1979 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 1980 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1981 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 1982
a7e80f25 1983 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1984 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1985 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1986
13ecd8b6 1987 hci_dev_lock(hdev);
6c8f12c1 1988
4b34ee78 1989 if (!hdev_is_powered(hdev)) {
9ecb3e24 1990 bool changed;
c0ecddc2 1991
9ecb3e24 1992 if (cp->val) {
238be788
MH		 1993 changed = !hci_dev_test_and_set_flag(hdev,
1994 HCI_SSP_ENABLED);
9ecb3e24 1995 } else {
a69d8927
MH		 1996 changed = hci_dev_test_and_clear_flag(hdev,
1997 HCI_SSP_ENABLED);
c0ecddc2
JH		 1998 }
1999
2000 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2001 if (err < 0)
2002 goto failed;
2003
2004 if (changed)
2005 err = new_settings(hdev, sk);
2006
ed2c4ee3
JH		 2007 goto failed;
2008 }
2009
333ae95d 2010 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2011 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2012 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2013 goto failed;
2014 }
2015
d7a5a11d 2016 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2017 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2018 goto failed;
2019 }
2020
2021 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
3244845c 2022 if (!cmd)
ed2c4ee3 2023 err = -ENOMEM;
3244845c
BG		 2024 else
2025 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2026 set_ssp_complete);
3769972b 2027
ed2c4ee3 2028 if (err < 0) {
3244845c
BG		 2029 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2030 MGMT_STATUS_FAILED);
2031
2032 if (cmd)
2033 mgmt_pending_remove(cmd);
ed2c4ee3
JH		 2034 }
2035
2036failed:
2037 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2038 return err;
2039}
2040
bdb6d971 2041static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0 2042{
181d6953 2043 bt_dev_dbg(hdev, "sock %p", sk);
6d80dfd0 2044
e7b02296 2045 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
b560a208 2046 MGMT_STATUS_NOT_SUPPORTED);
6d80dfd0
JH		 2047}
2048
d81a494c 2049static void set_le_complete(struct hci_dev *hdev, void *data, int err)
416a4ae5
JH		 2050{
2051 struct cmd_lookup match = { NULL, hdev };
d81a494c 2052 u8 status = mgmt_status(err);
416a4ae5 2053
d81a494c 2054 bt_dev_dbg(hdev, "err %d", err);
3ad67582 2055
416a4ae5 2056 if (status) {
416a4ae5 2057 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
d81a494c
BG		 2058 &status);
2059 return;
416a4ae5
JH		 2060 }
2061
2062 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2063
2064 new_settings(hdev, match.sk);
2065
2066 if (match.sk)
2067 sock_put(match.sk);
d81a494c
BG		 2068}
2069
2070static int set_le_sync(struct hci_dev *hdev, void *data)
2071{
2072 struct mgmt_pending_cmd *cmd = data;
2073 struct mgmt_mode *cp = cmd->param;
2074 u8 val = !!cp->val;
2075 int err;
2076
2077 if (!val) {
c249ea9b
BG		 2078 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2079
d81a494c
BG		 2080 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2081 hci_disable_advertising_sync(hdev);
2082
2083 if (ext_adv_capable(hdev))
2084 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2085 } else {
2086 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2087 }
2088
2089 err = hci_write_le_host_supported_sync(hdev, val, 0);
441ad2d0
MH		 2090
2091 /* Make sure the controller has a good default for
2092 * advertising data. Restrict the update to when LE
2093 * has actually been enabled. During power on, the
2094 * update in powered_update_hci will take care of it.
2095 */
d81a494c 2096 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
a0fb3726 2097 if (ext_adv_capable(hdev)) {
d81a494c 2098 int status;
a0fb3726 2099
d81a494c
BG		 2100 status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2101 if (!status)
2102 hci_update_scan_rsp_data_sync(hdev, 0x00);
a0fb3726 2103 } else {
d81a494c
BG		 2104 hci_update_adv_data_sync(hdev, 0x00);
2105 hci_update_scan_rsp_data_sync(hdev, 0x00);
a0fb3726 2106 }
d81a494c 2107
5bee2fd6 2108 hci_update_passive_scan(hdev);
441ad2d0 2109 }
3ad67582 2110
d81a494c 2111 return err;
416a4ae5
JH		 2112}
2113
b338d917
BG		 2114static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2115{
2116 struct mgmt_pending_cmd *cmd = data;
2117 u8 status = mgmt_status(err);
2118 struct sock *sk = cmd->sk;
2119
2120 if (status) {
2121 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2122 cmd_status_rsp, &status);
2123 return;
2124 }
2125
2126 mgmt_pending_remove(cmd);
2127 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2128}
2129
2130static int set_mesh_sync(struct hci_dev *hdev, void *data)
2131{
2132 struct mgmt_pending_cmd *cmd = data;
2133 struct mgmt_cp_set_mesh *cp = cmd->param;
2134 size_t len = cmd->param_len;
2135
2136 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2137
2138 if (cp->enable)
2139 hci_dev_set_flag(hdev, HCI_MESH);
2140 else
2141 hci_dev_clear_flag(hdev, HCI_MESH);
2142
2143 len -= sizeof(*cp);
2144
2145 /* If filters don't fit, forward all adv pkts */
2146 if (len <= sizeof(hdev->mesh_ad_types))
2147 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2148
2149 hci_update_passive_scan_sync(hdev);
2150 return 0;
2151}
2152
2153static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2154{
2155 struct mgmt_cp_set_mesh *cp = data;
2156 struct mgmt_pending_cmd *cmd;
2157 int err = 0;
2158
2159 bt_dev_dbg(hdev, "sock %p", sk);
2160
af6bcc19
BG		 2161 if (!lmp_le_capable(hdev) ||
2162 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
b338d917
BG		 2163 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2164 MGMT_STATUS_NOT_SUPPORTED);
2165
2166 if (cp->enable != 0x00 && cp->enable != 0x01)
2167 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2168 MGMT_STATUS_INVALID_PARAMS);
2169
2170 hci_dev_lock(hdev);
2171
2172 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2173 if (!cmd)
2174 err = -ENOMEM;
2175 else
2176 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2177 set_mesh_complete);
2178
2179 if (err < 0) {
2180 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2181 MGMT_STATUS_FAILED);
2182
2183 if (cmd)
2184 mgmt_pending_remove(cmd);
2185 }
2186
2187 hci_dev_unlock(hdev);
2188 return err;
2189}
2190
2191static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2192{
2193 struct mgmt_mesh_tx *mesh_tx = data;
2194 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2195 unsigned long mesh_send_interval;
2196 u8 mgmt_err = mgmt_status(err);
2197
2198 /* Report any errors here, but don't report completion */
2199
2200 if (mgmt_err) {
2201 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2202 /* Send Complete Error Code for handle */
2203 mesh_send_complete(hdev, mesh_tx, false);
2204 return;
2205 }
2206
2207 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2208 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2209 mesh_send_interval);
2210}
2211
2212static int mesh_send_sync(struct hci_dev *hdev, void *data)
2213{
2214 struct mgmt_mesh_tx *mesh_tx = data;
2215 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2216 struct adv_info *adv, *next_instance;
2217 u8 instance = hdev->le_num_of_adv_sets + 1;
2218 u16 timeout, duration;
2219 int err = 0;
2220
2221 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2222 return MGMT_STATUS_BUSY;
2223
2224 timeout = 1000;
2225 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2226 adv = hci_add_adv_instance(hdev, instance, 0,
2227 send->adv_data_len, send->adv_data,
2228 0, NULL,
2229 timeout, duration,
2230 HCI_ADV_TX_POWER_NO_PREFERENCE,
2231 hdev->le_adv_min_interval,
2232 hdev->le_adv_max_interval,
2233 mesh_tx->handle);
2234
2235 if (!IS_ERR(adv))
2236 mesh_tx->instance = instance;
2237 else
2238 err = PTR_ERR(adv);
2239
2240 if (hdev->cur_adv_instance == instance) {
2241 /* If the currently advertised instance is being changed then
2242 * cancel the current advertising and schedule the next
2243 * instance. If there is only one instance then the overridden
2244 * advertising data will be visible right away.
2245 */
2246 cancel_adv_timeout(hdev);
2247
2248 next_instance = hci_get_next_instance(hdev, instance);
2249 if (next_instance)
2250 instance = next_instance->instance;
2251 else
2252 instance = 0;
2253 } else if (hdev->adv_instance_timeout) {
2254 /* Immediately advertise the new instance if no other, or
2255 * let it go naturally from queue if ADV is already happening
2256 */
2257 instance = 0;
2258 }
2259
2260 if (instance)
2261 return hci_schedule_adv_instance_sync(hdev, instance, true);
2262
2263 return err;
2264}
2265
2266static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2267{
2268 struct mgmt_rp_mesh_read_features *rp = data;
2269
2270 if (rp->used_handles >= rp->max_handles)
2271 return;
2272
2273 rp->handles[rp->used_handles++] = mesh_tx->handle;
2274}
2275
2276static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2277 void *data, u16 len)
2278{
2279 struct mgmt_rp_mesh_read_features rp;
2280
af6bcc19
BG		 2281 if (!lmp_le_capable(hdev) ||
2282 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
b338d917
BG		 2283 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2284 MGMT_STATUS_NOT_SUPPORTED);
2285
2286 memset(&rp, 0, sizeof(rp));
2287 rp.index = cpu_to_le16(hdev->id);
2288 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2289 rp.max_handles = MESH_HANDLES_MAX;
2290
2291 hci_dev_lock(hdev);
2292
2293 if (rp.max_handles)
2294 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2295
2296 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2297 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2298
2299 hci_dev_unlock(hdev);
2300 return 0;
2301}
2302
2303static int send_cancel(struct hci_dev *hdev, void *data)
2304{
2305 struct mgmt_pending_cmd *cmd = data;
2306 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2307 struct mgmt_mesh_tx *mesh_tx;
2308
2309 if (!cancel->handle) {
2310 do {
2311 mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2312
2313 if (mesh_tx)
2314 mesh_send_complete(hdev, mesh_tx, false);
2315 } while (mesh_tx);
2316 } else {
2317 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2318
2319 if (mesh_tx && mesh_tx->sk == cmd->sk)
2320 mesh_send_complete(hdev, mesh_tx, false);
2321 }
2322
2323 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2324 0, NULL, 0);
2325 mgmt_pending_free(cmd);
2326
2327 return 0;
2328}
2329
2330static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2331 void *data, u16 len)
2332{
2333 struct mgmt_pending_cmd *cmd;
2334 int err;
2335
af6bcc19
BG		 2336 if (!lmp_le_capable(hdev) ||
2337 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2339 MGMT_STATUS_NOT_SUPPORTED);
2340
b338d917
BG		 2341 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2342 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2343 MGMT_STATUS_REJECTED);
2344
2345 hci_dev_lock(hdev);
2346 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2347 if (!cmd)
2348 err = -ENOMEM;
2349 else
2350 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2351
2352 if (err < 0) {
2353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2354 MGMT_STATUS_FAILED);
2355
2356 if (cmd)
2357 mgmt_pending_free(cmd);
2358 }
2359
2360 hci_dev_unlock(hdev);
2361 return err;
2362}
2363
2364static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2365{
2366 struct mgmt_mesh_tx *mesh_tx;
2367 struct mgmt_cp_mesh_send *send = data;
2368 struct mgmt_rp_mesh_read_features rp;
2369 bool sending;
2370 int err = 0;
2371
af6bcc19
BG		 2372 if (!lmp_le_capable(hdev) ||
2373 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2374 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2375 MGMT_STATUS_NOT_SUPPORTED);
b338d917
BG		 2376 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2377 len <= MGMT_MESH_SEND_SIZE ||
2378 len > (MGMT_MESH_SEND_SIZE + 31))
2379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2380 MGMT_STATUS_REJECTED);
2381
2382 hci_dev_lock(hdev);
2383
2384 memset(&rp, 0, sizeof(rp));
2385 rp.max_handles = MESH_HANDLES_MAX;
2386
2387 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2388
2389 if (rp.max_handles <= rp.used_handles) {
2390 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2391 MGMT_STATUS_BUSY);
2392 goto done;
2393 }
2394
2395 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2396 mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2397
2398 if (!mesh_tx)
2399 err = -ENOMEM;
2400 else if (!sending)
2401 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2402 mesh_send_start_complete);
2403
2404 if (err < 0) {
2405 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2406 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2407 MGMT_STATUS_FAILED);
2408
2409 if (mesh_tx) {
2410 if (sending)
2411 mgmt_mesh_remove(mesh_tx);
2412 }
2413 } else {
2414 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2415
2416 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2417 &mesh_tx->handle, 1);
2418 }
2419
2420done:
2421 hci_dev_unlock(hdev);
2422 return err;
2423}
2424
bdb6d971 2425static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2426{
2427 struct mgmt_mode *cp = data;
3b0602cd 2428 struct mgmt_pending_cmd *cmd;
06199cf8 2429 int err;
0b60eba1 2430 u8 val, enabled;
06199cf8 2431
181d6953 2432 bt_dev_dbg(hdev, "sock %p", sk);
06199cf8 2433
13ecd8b6 2434 if (!lmp_le_capable(hdev))
a69e8375
JH		 2435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2436 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2437
a7e80f25 2438 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2439 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2440 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2441
e7844ee5
MH		 2442 /* Bluetooth single mode LE only controllers or dual-mode
2443 * controllers configured as LE only devices, do not allow
2444 * switching LE off. These have either LE enabled explicitly
2445 * or BR/EDR has been previously switched off.
2446 *
2447 * When trying to enable an already enabled LE, then gracefully
2448 * send a positive response. Trying to disable it however will
2449 * result into rejection.
2450 */
2451 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2452 if (cp->val == 0x01)
2453 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2454
a69e8375
JH		 2455 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2456 MGMT_STATUS_REJECTED);
e7844ee5 2457 }
c73eee91 2458
13ecd8b6 2459 hci_dev_lock(hdev);
06199cf8
JH		 2460
2461 val = !!cp->val;
ffa88e02 2462 enabled = lmp_host_le_capable(hdev);
06199cf8 2463
0b60eba1 2464 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2465 bool changed = false;
2466
d7a5a11d 2467 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2468 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2469 changed = true;
2470 }
2471
d7a5a11d 2472 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2473 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2474 changed = true;
2475 }
2476
06199cf8
JH		 2477 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2478 if (err < 0)
1de028ce 2479 goto unlock;
06199cf8
JH		 2480
2481 if (changed)
2482 err = new_settings(hdev, sk);
2483
1de028ce 2484 goto unlock;
06199cf8
JH		 2485 }
2486
333ae95d
JH		 2487 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2488 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2489 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2490 MGMT_STATUS_BUSY);
1de028ce 2491 goto unlock;
06199cf8
JH		 2492 }
2493
2494 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
d81a494c 2495 if (!cmd)
06199cf8 2496 err = -ENOMEM;
d81a494c
BG		 2497 else
2498 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2499 set_le_complete);
06199cf8 2500
d81a494c
BG		 2501 if (err < 0) {
2502 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2503 MGMT_STATUS_FAILED);
45b7749f 2504
d81a494c
BG		 2505 if (cmd)
2506 mgmt_pending_remove(cmd);
06199cf8
JH		 2507 }
2508
1de028ce
JH		 2509unlock:
2510 hci_dev_unlock(hdev);
06199cf8
JH		 2511 return err;
2512}
2513
0cab9c80
JH		 2514/* This is a helper function to test for pending mgmt commands that can
2515 * cause CoD or EIR HCI commands. We can only allow one such pending
2516 * mgmt command at a time since otherwise we cannot easily track what
2517 * the current values are, will be, and based on that calculate if a new
2518 * HCI command needs to be sent and if yes with what value.
2519 */
2520static bool pending_eir_or_class(struct hci_dev *hdev)
2521{
3b0602cd 2522 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2523
2524 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2525 switch (cmd->opcode) {
2526 case MGMT_OP_ADD_UUID:
2527 case MGMT_OP_REMOVE_UUID:
2528 case MGMT_OP_SET_DEV_CLASS:
2529 case MGMT_OP_SET_POWERED:
2530 return true;
2531 }
2532 }
2533
2534 return false;
2535}
2536
83be8eca
JH		 2537static const u8 bluetooth_base_uuid[] = {
2538 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2539 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2540};
2541
2542static u8 get_uuid_size(const u8 *uuid)
2543{
2544 u32 val;
2545
2546 if (memcmp(uuid, bluetooth_base_uuid, 12))
2547 return 128;
2548
2549 val = get_unaligned_le32(&uuid[12]);
2550 if (val > 0xffff)
2551 return 32;
2552
2553 return 16;
2554}
2555
161510cc 2556static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
92da6097 2557{
161510cc 2558 struct mgmt_pending_cmd *cmd = data;
92da6097 2559
161510cc 2560 bt_dev_dbg(hdev, "err %d", err);
92da6097 2561
2a1afb5a 2562 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
161510cc 2563 mgmt_status(err), hdev->dev_class, 3);
92da6097 2564
161510cc 2565 mgmt_pending_free(cmd);
92da6097
JH		 2566}
2567
161510cc 2568static int add_uuid_sync(struct hci_dev *hdev, void *data)
92da6097 2569{
161510cc 2570 int err;
92da6097 2571
161510cc
LAD		 2572 err = hci_update_class_sync(hdev);
2573 if (err)
2574 return err;
2575
2576 return hci_update_eir_sync(hdev);
92da6097
JH		 2577}
2578
bdb6d971 2579static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2580{
650f726d 2581 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2582 struct mgmt_pending_cmd *cmd;
2aeb9a1a 2583 struct bt_uuid *uuid;
2aeb9a1a
JH		 2584 int err;
2585
181d6953 2586 bt_dev_dbg(hdev, "sock %p", sk);
2aeb9a1a 2587
09fd0de5 2588 hci_dev_lock(hdev);
2aeb9a1a 2589
0cab9c80 2590 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2591 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2592 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2593 goto failed;
2594 }
2595
92c4c204 2596 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2597 if (!uuid) {
2598 err = -ENOMEM;
2599 goto failed;
2600 }
2601
2602 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2603 uuid->svc_hint = cp->svc_hint;
83be8eca 2604 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2605
de66aa63 2606 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2607
161510cc 2608 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2609 if (!cmd) {
90e70454 2610 err = -ENOMEM;
890ea898
JH		 2611 goto failed;
2612 }
2613
6eb5fcc4
LAD		 2614 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
2615 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2616 */
2617 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
2618 mgmt_class_complete);
161510cc
LAD		 2619 if (err < 0) {
2620 mgmt_pending_free(cmd);
2621 goto failed;
2622 }
2aeb9a1a
JH		 2623
2624failed:
09fd0de5 2625 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2626 return err;
2627}
2628
24b78d0f
JH		 2629static bool enable_service_cache(struct hci_dev *hdev)
2630{
2631 if (!hdev_is_powered(hdev))
2632 return false;
2633
238be788 2634 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2635 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2636 CACHE_TIMEOUT);
24b78d0f
JH		 2637 return true;
2638 }
2639
2640 return false;
2641}
2642
161510cc 2643static int remove_uuid_sync(struct hci_dev *hdev, void *data)
92da6097 2644{
161510cc 2645 int err;
92da6097 2646
161510cc
LAD		 2647 err = hci_update_class_sync(hdev);
2648 if (err)
2649 return err;
2650
2651 return hci_update_eir_sync(hdev);
92da6097
JH		 2652}
2653
bdb6d971 2654static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2655 u16 len)
2aeb9a1a 2656{
650f726d 2657 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2658 struct mgmt_pending_cmd *cmd;
056341c8 2659 struct bt_uuid *match, *tmp;
e616fec6
CIK		 2660 static const u8 bt_uuid_any[] = {
2661 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2662 };
2aeb9a1a
JH		 2663 int err, found;
2664
181d6953 2665 bt_dev_dbg(hdev, "sock %p", sk);
2aeb9a1a 2666
09fd0de5 2667 hci_dev_lock(hdev);
2aeb9a1a 2668
0cab9c80 2669 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2670 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2671 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2672 goto unlock;
2673 }
2674
2aeb9a1a 2675 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2676 hci_uuids_clear(hdev);
4004b6d9 2677
24b78d0f 2678 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2679 err = mgmt_cmd_complete(sk, hdev->id,
2680 MGMT_OP_REMOVE_UUID,
2681 0, hdev->dev_class, 3);
24b78d0f
JH		 2682 goto unlock;
2683 }
4004b6d9 2684
9246a869 2685 goto update_class;
2aeb9a1a
JH		 2686 }
2687
2688 found = 0;
2689
056341c8 2690 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2691 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2692 continue;
2693
2694 list_del(&match->list);
482049f7 2695 kfree(match);
2aeb9a1a
JH		 2696 found++;
2697 }
2698
2699 if (found == 0) {
a69e8375
JH		 2700 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2701 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2702 goto unlock;
2703 }
2704
9246a869 2705update_class:
161510cc 2706 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2707 if (!cmd) {
90e70454 2708 err = -ENOMEM;
890ea898
JH		 2709 goto unlock;
2710 }
2711
6eb5fcc4
LAD		 2712 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
2713 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2714 */
2715 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
2716 mgmt_class_complete);
161510cc
LAD		 2717 if (err < 0)
2718 mgmt_pending_free(cmd);
2aeb9a1a
JH		 2719
2720unlock:
09fd0de5 2721 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2722 return err;
2723}
2724
161510cc 2725static int set_class_sync(struct hci_dev *hdev, void *data)
92da6097 2726{
161510cc
LAD		 2727 int err = 0;
2728
2729 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2730 cancel_delayed_work_sync(&hdev->service_cache);
2731 err = hci_update_eir_sync(hdev);
2732 }
2733
2734 if (err)
2735 return err;
92da6097 2736
161510cc 2737 return hci_update_class_sync(hdev);
92da6097
JH		 2738}
2739
bdb6d971 2740static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2741 u16 len)
1aff6f09 2742{
650f726d 2743 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2744 struct mgmt_pending_cmd *cmd;
1aff6f09
JH		 2745 int err;
2746
181d6953 2747 bt_dev_dbg(hdev, "sock %p", sk);
1aff6f09 2748
6203fc98 2749 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2751 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2752
0cab9c80 2753 hci_dev_lock(hdev);
ee98f473 2754
0cab9c80 2755 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2756 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2757 MGMT_STATUS_BUSY);
0cab9c80
JH		 2758 goto unlock;
2759 }
c95f0ba7 2760
0cab9c80 2761 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2762 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2763 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2764 goto unlock;
2765 }
575b3a02 2766
932f5ff5
JH		 2767 hdev->major_class = cp->major;
2768 hdev->minor_class = cp->minor;
2769
b5235a65 2770 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2771 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2772 hdev->dev_class, 3);
b5235a65
JH		 2773 goto unlock;
2774 }
2775
161510cc 2776 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2777 if (!cmd) {
90e70454 2778 err = -ENOMEM;
890ea898
JH		 2779 goto unlock;
2780 }
2781
6eb5fcc4
LAD		 2782 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
2783 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2784 */
2785 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
2786 mgmt_class_complete);
161510cc
LAD		 2787 if (err < 0)
2788 mgmt_pending_free(cmd);
1aff6f09 2789
b5235a65 2790unlock:
09fd0de5 2791 hci_dev_unlock(hdev);
1aff6f09
JH		 2792 return err;
2793}
2794
bdb6d971 2795static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2796 u16 len)
55ed8ca1 2797{
650f726d 2798 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2799 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2800 sizeof(struct mgmt_link_key_info));
4e51eae9 2801 u16 key_count, expected_len;
b1de97d8 2802 bool changed;
a492cd52 2803 int i;
55ed8ca1 2804
181d6953 2805 bt_dev_dbg(hdev, "sock %p", sk);
9060d5cf
MH		 2806
2807 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2808 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2809 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2810
1f350c87 2811 key_count = __le16_to_cpu(cp->key_count);
ba1d6936 2812 if (key_count > max_key_count) {
2064ee33
MH		 2813 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2814 key_count);
a69e8375
JH		 2815 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2816 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2817 }
55ed8ca1 2818
5bec1fb8 2819 expected_len = struct_size(cp, keys, key_count);
a492cd52 2820 if (expected_len != len) {
2064ee33
MH		 2821 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2822 expected_len, len);
a69e8375
JH		 2823 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2824 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2825 }
2826
4ae14301 2827 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2829 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2830
181d6953
MH		 2831 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2832 key_count);
55ed8ca1 2833
4ee71b20
JH		 2834 for (i = 0; i < key_count; i++) {
2835 struct mgmt_link_key_info *key = &cp->keys[i];
2836
59b047bc
XY		 2837 /* Considering SMP over BREDR/LE, there is no need to check addr_type */
2838 if (key->type > 0x08)
a69e8375
JH		 2839 return mgmt_cmd_status(sk, hdev->id,
2840 MGMT_OP_LOAD_LINK_KEYS,
2841 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2842 }
2843
09fd0de5 2844 hci_dev_lock(hdev);
55ed8ca1
JH		 2845
2846 hci_link_keys_clear(hdev);
2847
55ed8ca1 2848 if (cp->debug_keys)
238be788 2849 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 2850 else
a69d8927
MH		 2851 changed = hci_dev_test_and_clear_flag(hdev,
2852 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 2853
2854 if (changed)
2855 new_settings(hdev, NULL);
55ed8ca1 2856
a492cd52 2857 for (i = 0; i < key_count; i++) {
86742e1e 2858 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2859
600a8749
AM		 2860 if (hci_is_blocked_key(hdev,
2861 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2862 key->val)) {
2863 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2864 &key->addr.bdaddr);
2865 continue;
2866 }
2867
58e9293c
JH		 2868 /* Always ignore debug keys and require a new pairing if
2869 * the user wants to use them.
2870 */
2871 if (key->type == HCI_LK_DEBUG_COMBINATION)
2872 continue;
2873
7652ff6a
JH		 2874 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2875 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2876 }
2877
2a1afb5a 2878 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2879
09fd0de5 2880 hci_dev_unlock(hdev);
55ed8ca1 2881
a492cd52 2882 return 0;
55ed8ca1
JH		 2883}
2884
b1078ad0 2885static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2886 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2887{
2888 struct mgmt_ev_device_unpaired ev;
2889
2890 bacpy(&ev.addr.bdaddr, bdaddr);
2891 ev.addr.type = addr_type;
2892
2893 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2894 skip_sk);
b1078ad0
JH		 2895}
2896
1f7435c8
LAD		 2897static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2898{
2899 struct mgmt_pending_cmd *cmd = data;
2900 struct mgmt_cp_unpair_device *cp = cmd->param;
2901
2902 if (!err)
2903 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2904
2905 cmd->cmd_complete(cmd, err);
2906 mgmt_pending_free(cmd);
2907}
2908
2909static int unpair_device_sync(struct hci_dev *hdev, void *data)
2910{
2911 struct mgmt_pending_cmd *cmd = data;
2912 struct mgmt_cp_unpair_device *cp = cmd->param;
2913 struct hci_conn *conn;
2914
2915 if (cp->addr.type == BDADDR_BREDR)
2916 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2917 &cp->addr.bdaddr);
2918 else
2919 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2920 le_addr_type(cp->addr.type));
2921
2922 if (!conn)
2923 return 0;
2924
2925 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2926}
2927
bdb6d971 2928static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2929 u16 len)
55ed8ca1 2930{
124f6e35
JH		 2931 struct mgmt_cp_unpair_device *cp = data;
2932 struct mgmt_rp_unpair_device rp;
fc64361a 2933 struct hci_conn_params *params;
3b0602cd 2934 struct mgmt_pending_cmd *cmd;
55ed8ca1 2935 struct hci_conn *conn;
ec182f03 2936 u8 addr_type;
55ed8ca1
JH		 2937 int err;
2938
a8a1d19e 2939 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2940 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2941 rp.addr.type = cp->addr.type;
a8a1d19e 2942
4ee71b20 2943 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 2944 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2945 MGMT_STATUS_INVALID_PARAMS,
2946 &rp, sizeof(rp));
4ee71b20 2947
118da70b 2948 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 2949 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2950 MGMT_STATUS_INVALID_PARAMS,
2951 &rp, sizeof(rp));
118da70b 2952
4ee71b20
JH		 2953 hci_dev_lock(hdev);
2954
86a8cfc6 2955 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2956 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2957 MGMT_STATUS_NOT_POWERED, &rp,
2958 sizeof(rp));
86a8cfc6
JH		 2959 goto unlock;
2960 }
2961
e0b2b27e 2962 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2963 /* If disconnection is requested, then look up the
2964 * connection. If the remote device is connected, it
2965 * will be later used to terminate the link.
2966 *
2967 * Setting it to NULL explicitly will cause no
2968 * termination of the link.
2969 */
2970 if (cp->disconnect)
2971 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2972 &cp->addr.bdaddr);
2973 else
2974 conn = NULL;
2975
124f6e35 2976 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
ec182f03
JH		 2977 if (err < 0) {
2978 err = mgmt_cmd_complete(sk, hdev->id,
2979 MGMT_OP_UNPAIR_DEVICE,
2980 MGMT_STATUS_NOT_PAIRED, &rp,
2981 sizeof(rp));
2982 goto unlock;
89cbb063
AA		 2983 }
2984
ec182f03 2985 goto done;
e0b2b27e 2986 }
b0dbfb46 2987
ec182f03
JH		 2988 /* LE address type */
2989 addr_type = le_addr_type(cp->addr.type);
2990
cb28c306
MK		 2991 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2992 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
55ed8ca1 2993 if (err < 0) {
2a1afb5a
JH		 2994 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2995 MGMT_STATUS_NOT_PAIRED, &rp,
2996 sizeof(rp));
55ed8ca1
JH		 2997 goto unlock;
2998 }
2999
ec182f03
JH		 3000 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3001 if (!conn) {
3002 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3003 goto done;
3004 }
3005
c81d555a 3006
ec182f03
JH		 3007 /* Defer clearing up the connection parameters until closing to
3008 * give a chance of keeping them if a repairing happens.
3009 */
3010 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3011
fc64361a
JH		 3012 /* Disable auto-connection parameters if present */
3013 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3014 if (params) {
3015 if (params->explicit_connect)
3016 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3017 else
3018 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3019 }
3020
ec182f03
JH		 3021 /* If disconnection is not requested, then clear the connection
3022 * variable so that the link is not terminated.
3023 */
3024 if (!cp->disconnect)
3025 conn = NULL;
3026
3027done:
89cbb063
AA		 3028 /* If the connection variable is set, then termination of the
3029 * link is requested.
3030 */
a8a1d19e 3031 if (!conn) {
2a1afb5a
JH		 3032 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3033 &rp, sizeof(rp));
b1078ad0 3034 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3035 goto unlock;
3036 }
55ed8ca1 3037
1f7435c8 3038 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3039 sizeof(*cp));
a8a1d19e
JH		 3040 if (!cmd) {
3041 err = -ENOMEM;
3042 goto unlock;
55ed8ca1
JH		 3043 }
3044
d8b7b1e4
JH		 3045 cmd->cmd_complete = addr_cmd_complete;
3046
1f7435c8
LAD		 3047 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3048 unpair_device_complete);
a8a1d19e 3049 if (err < 0)
1f7435c8 3050 mgmt_pending_free(cmd);
a8a1d19e 3051
55ed8ca1 3052unlock:
09fd0de5 3053 hci_dev_unlock(hdev);
55ed8ca1
JH		 3054 return err;
3055}
3056
bdb6d971 3057static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3058 u16 len)
8962ee74 3059{
650f726d 3060 struct mgmt_cp_disconnect *cp = data;
06a63b19 3061 struct mgmt_rp_disconnect rp;
3b0602cd 3062 struct mgmt_pending_cmd *cmd;
8962ee74 3063 struct hci_conn *conn;
8962ee74
JH		 3064 int err;
3065
181d6953 3066 bt_dev_dbg(hdev, "sock %p", sk);
8962ee74 3067
06a63b19
JH		 3068 memset(&rp, 0, sizeof(rp));
3069 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3070 rp.addr.type = cp->addr.type;
3071
4ee71b20 3072 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3073 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3074 MGMT_STATUS_INVALID_PARAMS,
3075 &rp, sizeof(rp));
4ee71b20 3076
09fd0de5 3077 hci_dev_lock(hdev);
8962ee74
JH		 3078
3079 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3080 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3081 MGMT_STATUS_NOT_POWERED, &rp,
3082 sizeof(rp));
8962ee74
JH		 3083 goto failed;
3084 }
3085
333ae95d 3086 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3087 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3088 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3089 goto failed;
3090 }
3091
591f47f3 3092 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3093 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3094 &cp->addr.bdaddr);
88c3df13 3095 else
9d4c1cc1
JH		 3096 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3097 le_addr_type(cp->addr.type));
365227e5 3098
f960727e 3099 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3100 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3101 MGMT_STATUS_NOT_CONNECTED, &rp,
3102 sizeof(rp));
8962ee74
JH		 3103 goto failed;
3104 }
3105
2e58ef3e 3106 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3107 if (!cmd) {
3108 err = -ENOMEM;
8962ee74 3109 goto failed;
366a0336 3110 }
8962ee74 3111
f5818c22
JH		 3112 cmd->cmd_complete = generic_cmd_complete;
3113
e3f2f92a 3114 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3115 if (err < 0)
a664b5bc 3116 mgmt_pending_remove(cmd);
8962ee74
JH		 3117
3118failed:
09fd0de5 3119 hci_dev_unlock(hdev);
8962ee74
JH		 3120 return err;
3121}
3122
57c1477c 3123static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3124{
3125 switch (link_type) {
eeda1bf9 3126 case ISO_LINK:
4c659c39 3127 case LE_LINK:
48264f06
JH		 3128 switch (addr_type) {
3129 case ADDR_LE_DEV_PUBLIC:
591f47f3 3130 return BDADDR_LE_PUBLIC;
0ed09148 3131
48264f06 3132 default:
0ed09148 3133 /* Fallback to LE Random address type */
591f47f3 3134 return BDADDR_LE_RANDOM;
48264f06 3135 }
0ed09148 3136
4c659c39 3137 default:
0ed09148 3138 /* Fallback to BR/EDR type */
591f47f3 3139 return BDADDR_BREDR;
4c659c39
JH		 3140 }
3141}
3142
04124681
GP		 3143static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3144 u16 data_len)
2784eb41 3145{
2784eb41 3146 struct mgmt_rp_get_connections *rp;
8035ded4 3147 struct hci_conn *c;
60fc5fb6
JH		 3148 int err;
3149 u16 i;
2784eb41 3150
181d6953 3151 bt_dev_dbg(hdev, "sock %p", sk);
2784eb41 3152
09fd0de5 3153 hci_dev_lock(hdev);
2784eb41 3154
5f97c1df 3155 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3156 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3157 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3158 goto unlock;
3159 }
3160
60fc5fb6 3161 i = 0;
b644ba33
JH		 3162 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3163 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3164 i++;
2784eb41
JH		 3165 }
3166
72bb169e 3167 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
a38528f1 3168 if (!rp) {
2784eb41
JH		 3169 err = -ENOMEM;
3170 goto unlock;
3171 }
3172
2784eb41 3173 i = 0;
4c659c39 3174 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3175 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3176 continue;
4c659c39 3177 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3178 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3179 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3180 continue;
3181 i++;
3182 }
3183
eb55ef07 3184 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3185
4c659c39 3186 /* Recalculate length in case of filtered SCO connections, etc */
2a1afb5a 3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
72bb169e 3188 struct_size(rp, addr, i));
2784eb41 3189
a38528f1 3190 kfree(rp);
5f97c1df
JH		 3191
3192unlock:
09fd0de5 3193 hci_dev_unlock(hdev);
2784eb41
JH		 3194 return err;
3195}
3196
bdb6d971 3197static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3198 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3199{
3b0602cd 3200 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3201 int err;
3202
2e58ef3e 3203 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3204 sizeof(*cp));
96d97a67
WR		 3205 if (!cmd)
3206 return -ENOMEM;
3207
dd7e39bb
AL		 3208 cmd->cmd_complete = addr_cmd_complete;
3209
d8457698 3210 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3211 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3212 if (err < 0)
3213 mgmt_pending_remove(cmd);
3214
3215 return err;
3216}
3217
bdb6d971 3218static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3219 u16 len)
980e1a53 3220{
96d97a67 3221 struct hci_conn *conn;
650f726d 3222 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3223 struct hci_cp_pin_code_reply reply;
3b0602cd 3224 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3225 int err;
3226
181d6953 3227 bt_dev_dbg(hdev, "sock %p", sk);
980e1a53 3228
09fd0de5 3229 hci_dev_lock(hdev);
980e1a53 3230
4b34ee78 3231 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3232 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3233 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3234 goto failed;
3235 }
3236
d8457698 3237 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3238 if (!conn) {
a69e8375
JH		 3239 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3240 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3241 goto failed;
3242 }
3243
3244 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3245 struct mgmt_cp_pin_code_neg_reply ncp;
3246
3247 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67 3248
2064ee33 3249 bt_dev_err(hdev, "PIN code is not 16 bytes long");
96d97a67 3250
bdb6d971 3251 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3252 if (err >= 0)
a69e8375
JH		 3253 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3254 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3255
3256 goto failed;
3257 }
3258
00abfe44 3259 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3260 if (!cmd) {
3261 err = -ENOMEM;
980e1a53 3262 goto failed;
366a0336 3263 }
980e1a53 3264
7776d1d8
JH		 3265 cmd->cmd_complete = addr_cmd_complete;
3266
d8457698 3267 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3268 reply.pin_len = cp->pin_len;
24718ca5 3269 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3270
3271 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3272 if (err < 0)
a664b5bc 3273 mgmt_pending_remove(cmd);
980e1a53
JH		 3274
3275failed:
09fd0de5 3276 hci_dev_unlock(hdev);
980e1a53
JH		 3277 return err;
3278}
3279
04124681
GP		 3280static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3281 u16 len)
17fa4b9d 3282{
650f726d 3283 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d 3284
181d6953 3285 bt_dev_dbg(hdev, "sock %p", sk);
17fa4b9d 3286
4ec86d4c 3287 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
9db5c629
MH		 3288 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3289 MGMT_STATUS_INVALID_PARAMS);
4ec86d4c 3290
09fd0de5 3291 hci_dev_lock(hdev);
17fa4b9d
JH		 3292
3293 hdev->io_capability = cp->io_capability;
3294
181d6953 3295 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
17fa4b9d 3296
09fd0de5 3297 hci_dev_unlock(hdev);
17fa4b9d 3298
2a1afb5a
JH		 3299 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3300 NULL, 0);
17fa4b9d
JH		 3301}
3302
3b0602cd 3303static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3304{
3305 struct hci_dev *hdev = conn->hdev;
3b0602cd 3306 struct mgmt_pending_cmd *cmd;
e9a416b5 3307
2e58ef3e 3308 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3309 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3310 continue;
3311
e9a416b5
JH		 3312 if (cmd->user_data != conn)
3313 continue;
3314
3315 return cmd;
3316 }
3317
3318 return NULL;
3319}
3320
3b0602cd 3321static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3322{
3323 struct mgmt_rp_pair_device rp;
3324 struct hci_conn *conn = cmd->user_data;
9df74653 3325 int err;
e9a416b5 3326
61b1a7fb
JH		 3327 bacpy(&rp.addr.bdaddr, &conn->dst);
3328 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3329
2a1afb5a
JH		 3330 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3331 status, &rp, sizeof(rp));
e9a416b5
JH		 3332
3333 /* So we don't get further callbacks for this connection */
3334 conn->connect_cfm_cb = NULL;
3335 conn->security_cfm_cb = NULL;
3336 conn->disconn_cfm_cb = NULL;
3337
76a68ba0 3338 hci_conn_drop(conn);
89cbb063
AA		 3339
3340 /* The device is paired so there is no need to remove
3341 * its connection parameters anymore.
3342 */
3343 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3344
3345 hci_conn_put(conn);
9df74653
JH		 3346
3347 return err;
e9a416b5
JH		 3348}
3349
f4a407be
JH		 3350void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3351{
3352 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3353 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3354
3355 cmd = find_pairing(conn);
a511b35b 3356 if (cmd) {
04ab2749 3357 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3358 mgmt_pending_remove(cmd);
3359 }
f4a407be
JH		 3360}
3361
e9a416b5
JH		 3362static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3363{
3b0602cd 3364 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3365
3366 BT_DBG("status %u", status);
3367
3368 cmd = find_pairing(conn);
a511b35b 3369 if (!cmd) {
e9a416b5 3370 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3371 return;
3372 }
3373
3374 cmd->cmd_complete(cmd, mgmt_status(status));
3375 mgmt_pending_remove(cmd);
e9a416b5
JH		 3376}
3377
f4a407be 3378static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3379{
3b0602cd 3380 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3381
3382 BT_DBG("status %u", status);
3383
3384 if (!status)
3385 return;
3386
3387 cmd = find_pairing(conn);
a511b35b 3388 if (!cmd) {
4c47d739 3389 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3390 return;
3391 }
3392
3393 cmd->cmd_complete(cmd, mgmt_status(status));
3394 mgmt_pending_remove(cmd);
4c47d739
VA		 3395}
3396
bdb6d971 3397static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3398 u16 len)
e9a416b5 3399{
650f726d 3400 struct mgmt_cp_pair_device *cp = data;
1425acb7 3401 struct mgmt_rp_pair_device rp;
3b0602cd 3402 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3403 u8 sec_level, auth_type;
3404 struct hci_conn *conn;
e9a416b5
JH		 3405 int err;
3406
181d6953 3407 bt_dev_dbg(hdev, "sock %p", sk);
e9a416b5 3408
f950a30e
SJ		 3409 memset(&rp, 0, sizeof(rp));
3410 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3411 rp.addr.type = cp->addr.type;
3412
4ee71b20 3413 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3414 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3415 MGMT_STATUS_INVALID_PARAMS,
3416 &rp, sizeof(rp));
4ee71b20 3417
4ec86d4c 3418 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3419 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3420 MGMT_STATUS_INVALID_PARAMS,
3421 &rp, sizeof(rp));
4ec86d4c 3422
09fd0de5 3423 hci_dev_lock(hdev);
e9a416b5 3424
5f97c1df 3425 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3426 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3427 MGMT_STATUS_NOT_POWERED, &rp,
3428 sizeof(rp));
5f97c1df
JH		 3429 goto unlock;
3430 }
3431
55e76b38
JH		 3432 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3434 MGMT_STATUS_ALREADY_PAIRED, &rp,
3435 sizeof(rp));
3436 goto unlock;
3437 }
3438
c908df36 3439 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3440 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3441
6f77d8c7 3442 if (cp->addr.type == BDADDR_BREDR) {
04a6c589 3443 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
bf98feea
LAD		 3444 auth_type, CONN_REASON_PAIR_DEVICE,
3445 HCI_ACL_CONN_TIMEOUT);
6f77d8c7 3446 } else {
85813a7e 3447 u8 addr_type = le_addr_type(cp->addr.type);
5157b8a5 3448 struct hci_conn_params *p;
6f77d8c7 3449
7c264b10
MH		 3450 /* When pairing a new device, it is expected to remember
3451 * this device for future connections. Adding the connection
3452 * parameter information ahead of time allows tracking
67ffb185 3453 * of the peripheral preferred values and will speed up any
7c264b10
MH		 3454 * further connection establishment.
3455 *
3456 * If connection parameters already exist, then they
3457 * will be kept and this function does nothing.
3458 */
5157b8a5
JP		 3459 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3460
3461 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3462 p->auto_connect = HCI_AUTO_CONN_DISABLED;
7c264b10 3463
76b13996
MM		 3464 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3465 sec_level, HCI_LE_CONN_TIMEOUT,
3466 CONN_REASON_PAIR_DEVICE);
6f77d8c7 3467 }
7a512d01 3468
30e76272 3469 if (IS_ERR(conn)) {
489dc48e
AK		 3470 int status;
3471
3472 if (PTR_ERR(conn) == -EBUSY)
3473 status = MGMT_STATUS_BUSY;
faa81030
LR		 3474 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3475 status = MGMT_STATUS_NOT_SUPPORTED;
3476 else if (PTR_ERR(conn) == -ECONNREFUSED)
3477 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3478 else
3479 status = MGMT_STATUS_CONNECT_FAILED;
3480
2a1afb5a
JH		 3481 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3482 status, &rp, sizeof(rp));
e9a416b5
JH		 3483 goto unlock;
3484 }
3485
3486 if (conn->connect_cfm_cb) {
76a68ba0 3487 hci_conn_drop(conn);
2a1afb5a
JH		 3488 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3489 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3490 goto unlock;
3491 }
3492
2e58ef3e 3493 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3494 if (!cmd) {
3495 err = -ENOMEM;
76a68ba0 3496 hci_conn_drop(conn);
e9a416b5
JH		 3497 goto unlock;
3498 }
3499
04ab2749
JH		 3500 cmd->cmd_complete = pairing_complete;
3501
7a512d01 3502 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3503 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3504 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3505 conn->security_cfm_cb = pairing_complete_cb;
3506 conn->disconn_cfm_cb = pairing_complete_cb;
3507 } else {
3508 conn->connect_cfm_cb = le_pairing_complete_cb;
3509 conn->security_cfm_cb = le_pairing_complete_cb;
3510 conn->disconn_cfm_cb = le_pairing_complete_cb;
3511 }
7a512d01 3512
e9a416b5 3513 conn->io_capability = cp->io_cap;
f8aaf9b6 3514 cmd->user_data = hci_conn_get(conn);
e9a416b5 3515
6f78fd4b 3516 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3517 hci_conn_security(conn, sec_level, auth_type, true)) {
3518 cmd->cmd_complete(cmd, 0);
3519 mgmt_pending_remove(cmd);
3520 }
e9a416b5
JH		 3521
3522 err = 0;
3523
3524unlock:
09fd0de5 3525 hci_dev_unlock(hdev);
e9a416b5
JH		 3526 return err;
3527}
3528
04124681
GP		 3529static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3530 u16 len)
28424707 3531{
0f4e68cf 3532 struct mgmt_addr_info *addr = data;
3b0602cd 3533 struct mgmt_pending_cmd *cmd;
28424707
JH		 3534 struct hci_conn *conn;
3535 int err;
3536
181d6953 3537 bt_dev_dbg(hdev, "sock %p", sk);
28424707 3538
28424707
JH		 3539 hci_dev_lock(hdev);
3540
5f97c1df 3541 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3543 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3544 goto unlock;
3545 }
3546
333ae95d 3547 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3548 if (!cmd) {
a69e8375
JH		 3549 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3550 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3551 goto unlock;
3552 }
3553
3554 conn = cmd->user_data;
3555
3556 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3557 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3558 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3559 goto unlock;
3560 }
3561
a511b35b
JH		 3562 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3563 mgmt_pending_remove(cmd);
28424707 3564
2a1afb5a
JH		 3565 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3566 addr, sizeof(*addr));
76b13996
MM		 3567
3568 /* Since user doesn't want to proceed with the connection, abort any
3569 * ongoing pairing and then terminate the link if it was created
3570 * because of the pair device action.
3571 */
3572 if (addr->type == BDADDR_BREDR)
3573 hci_remove_link_key(hdev, &addr->bdaddr);
3574 else
3575 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3576 le_addr_type(addr->type));
3577
3578 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
a13f316e 3579 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
76b13996 3580
28424707
JH		 3581unlock:
3582 hci_dev_unlock(hdev);
28424707
JH		 3583 return err;
3584}
3585
bdb6d971 3586static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3587 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3588 u16 hci_op, __le32 passkey)
a5c29683 3589{
3b0602cd 3590 struct mgmt_pending_cmd *cmd;
0df4c185 3591 struct hci_conn *conn;
a5c29683
JH		 3592 int err;
3593
09fd0de5 3594 hci_dev_lock(hdev);
08ba5382 3595
4b34ee78 3596 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3597 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3598 MGMT_STATUS_NOT_POWERED, addr,
3599 sizeof(*addr));
0df4c185 3600 goto done;
a5c29683
JH		 3601 }
3602
1707c60e
JH		 3603 if (addr->type == BDADDR_BREDR)
3604 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3605 else
9d4c1cc1
JH		 3606 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3607 le_addr_type(addr->type));
272d90df
JH		 3608
3609 if (!conn) {
2a1afb5a
JH		 3610 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3611 MGMT_STATUS_NOT_CONNECTED, addr,
3612 sizeof(*addr));
272d90df
JH		 3613 goto done;
3614 }
47c15e2b 3615
1707c60e 3616 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3617 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3618 if (!err)
2a1afb5a
JH		 3619 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3620 MGMT_STATUS_SUCCESS, addr,
3621 sizeof(*addr));
5fe57d9e 3622 else
2a1afb5a
JH		 3623 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3624 MGMT_STATUS_FAILED, addr,
3625 sizeof(*addr));
47c15e2b 3626
47c15e2b
BG		 3627 goto done;
3628 }
3629
1707c60e 3630 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3631 if (!cmd) {
3632 err = -ENOMEM;
0df4c185 3633 goto done;
a5c29683
JH		 3634 }
3635
7776d1d8
JH		 3636 cmd->cmd_complete = addr_cmd_complete;
3637
0df4c185 3638 /* Continue with pairing via HCI */
604086b7
BG		 3639 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3640 struct hci_cp_user_passkey_reply cp;
3641
1707c60e 3642 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3643 cp.passkey = passkey;
3644 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3645 } else
1707c60e
JH		 3646 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3647 &addr->bdaddr);
604086b7 3648
a664b5bc
JH		 3649 if (err < 0)
3650 mgmt_pending_remove(cmd);
a5c29683 3651
0df4c185 3652done:
09fd0de5 3653 hci_dev_unlock(hdev);
a5c29683
JH		 3654 return err;
3655}
3656
afeb019d
JK		 3657static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3658 void *data, u16 len)
3659{
3660 struct mgmt_cp_pin_code_neg_reply *cp = data;
3661
181d6953 3662 bt_dev_dbg(hdev, "sock %p", sk);
afeb019d 3663
1707c60e 3664 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3665 MGMT_OP_PIN_CODE_NEG_REPLY,
3666 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3667}
3668
04124681
GP		 3669static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3670 u16 len)
0df4c185 3671{
650f726d 3672 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185 3673
181d6953 3674 bt_dev_dbg(hdev, "sock %p", sk);
0df4c185
BG		 3675
3676 if (len != sizeof(*cp))
a69e8375
JH		 3677 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3678 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3679
1707c60e 3680 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3681 MGMT_OP_USER_CONFIRM_REPLY,
3682 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3683}
3684
bdb6d971 3685static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3686 void *data, u16 len)
0df4c185 3687{
c9c2659f 3688 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185 3689
181d6953 3690 bt_dev_dbg(hdev, "sock %p", sk);
0df4c185 3691
1707c60e 3692 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3693 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3694 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3695}
3696
04124681
GP		 3697static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3698 u16 len)
604086b7 3699{
650f726d 3700 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7 3701
181d6953 3702 bt_dev_dbg(hdev, "sock %p", sk);
604086b7 3703
1707c60e 3704 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3705 MGMT_OP_USER_PASSKEY_REPLY,
3706 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3707}
3708
bdb6d971 3709static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3710 void *data, u16 len)
604086b7 3711{
650f726d 3712 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7 3713
181d6953 3714 bt_dev_dbg(hdev, "sock %p", sk);
604086b7 3715
1707c60e 3716 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3717 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3718 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3719}
3720
5e233ed5 3721static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
7c295c48
MN		 3722{
3723 struct adv_info *adv_instance;
7c295c48
MN		 3724
3725 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3726 if (!adv_instance)
5e233ed5 3727 return 0;
7c295c48
MN		 3728
3729 /* stop if current instance doesn't need to be changed */
3730 if (!(adv_instance->flags & flags))
5e233ed5 3731 return 0;
7c295c48
MN		 3732
3733 cancel_adv_timeout(hdev);
3734
3735 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3736 if (!adv_instance)
5e233ed5 3737 return 0;
7c295c48 3738
5e233ed5 3739 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
7c295c48 3740
5e233ed5
BG		 3741 return 0;
3742}
3743
3744static int name_changed_sync(struct hci_dev *hdev, void *data)
3745{
3746 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
7c295c48
MN		 3747}
3748
6f6ff38a 3749static void set_name_complete(struct hci_dev *hdev, void *data, int err)
13928971 3750{
6f6ff38a
BG		 3751 struct mgmt_pending_cmd *cmd = data;
3752 struct mgmt_cp_set_local_name *cp = cmd->param;
3753 u8 status = mgmt_status(err);
13928971 3754
6f6ff38a 3755 bt_dev_dbg(hdev, "err %d", err);
13928971 3756
275f3f64
BG		 3757 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3758 return;
3759
7c295c48 3760 if (status) {
a69e8375 3761 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
6f6ff38a 3762 status);
7c295c48 3763 } else {
2a1afb5a
JH		 3764 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3765 cp, sizeof(*cp));
13928971 3766
7c295c48 3767 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5e233ed5 3768 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
7c295c48
MN		 3769 }
3770
13928971 3771 mgmt_pending_remove(cmd);
6f6ff38a 3772}
13928971 3773
6f6ff38a
BG		 3774static int set_name_sync(struct hci_dev *hdev, void *data)
3775{
3776 if (lmp_bredr_capable(hdev)) {
3777 hci_update_name_sync(hdev);
3778 hci_update_eir_sync(hdev);
3779 }
3780
3781 /* The name is stored in the scan response data and so
3782 * no need to update the advertising data here.
3783 */
3784 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3785 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3786
3787 return 0;
13928971
JH		 3788}
3789
bdb6d971 3790static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3791 u16 len)
b312b161 3792{
2b4bf397 3793 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3794 struct mgmt_pending_cmd *cmd;
b312b161
JH		 3795 int err;
3796
181d6953 3797 bt_dev_dbg(hdev, "sock %p", sk);
b312b161 3798
09fd0de5 3799 hci_dev_lock(hdev);
b312b161 3800
b3f2ca94
JH		 3801 /* If the old values are the same as the new ones just return a
3802 * direct command complete event.
3803 */
3804 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3805 !memcmp(hdev->short_name, cp->short_name,
3806 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3807 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3808 data, len);
b3f2ca94
JH		 3809 goto failed;
3810 }
3811
2b4bf397 3812 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3813
b5235a65 3814 if (!hdev_is_powered(hdev)) {
2b4bf397 3815 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3816
2a1afb5a
JH		 3817 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3818 data, len);
28cc7bde
JH		 3819 if (err < 0)
3820 goto failed;
3821
5504c3a3
MH		 3822 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3823 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
321c6fee 3824 ext_info_changed(hdev, sk);
28cc7bde 3825
b5235a65
JH		 3826 goto failed;
3827 }
3828
28cc7bde 3829 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
6f6ff38a 3830 if (!cmd)
b312b161 3831 err = -ENOMEM;
6f6ff38a
BG		 3832 else
3833 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3834 set_name_complete);
b312b161 3835
6f6ff38a
BG		 3836 if (err < 0) {
3837 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3838 MGMT_STATUS_FAILED);
13928971 3839
6f6ff38a
BG		 3840 if (cmd)
3841 mgmt_pending_remove(cmd);
3f985050 3842
6f6ff38a 3843 goto failed;
3f985050
JH		 3844 }
3845
6f6ff38a 3846 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
b312b161
JH		 3847
3848failed:
09fd0de5 3849 hci_dev_unlock(hdev);
b312b161
JH		 3850 return err;
3851}
3852
5e233ed5
BG		 3853static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3854{
3855 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3856}
3857
c4960ecf
MN		 3858static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3859 u16 len)
3860{
3861 struct mgmt_cp_set_appearance *cp = data;
6613baba 3862 u16 appearance;
c4960ecf
MN		 3863 int err;
3864
181d6953 3865 bt_dev_dbg(hdev, "sock %p", sk);
c4960ecf 3866
af4168c5
MN		 3867 if (!lmp_le_capable(hdev))
3868 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3869 MGMT_STATUS_NOT_SUPPORTED);
3870
6613baba 3871 appearance = le16_to_cpu(cp->appearance);
c4960ecf
MN		 3872
3873 hci_dev_lock(hdev);
3874
6613baba
AM		 3875 if (hdev->appearance != appearance) {
3876 hdev->appearance = appearance;
c4960ecf
MN		 3877
3878 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5e233ed5
BG		 3879 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3880 NULL);
e74317f4
MN		 3881
3882 ext_info_changed(hdev, sk);
c4960ecf
MN		 3883 }
3884
3885 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3886 0);
3887
3888 hci_dev_unlock(hdev);
3889
3890 return err;
3891}
3892
6244691f
JK		 3893static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3894 void *data, u16 len)
3895{
35302158 3896 struct mgmt_rp_get_phy_configuration rp;
6244691f 3897
181d6953 3898 bt_dev_dbg(hdev, "sock %p", sk);
6244691f
JK		 3899
3900 hci_dev_lock(hdev);
3901
3902 memset(&rp, 0, sizeof(rp));
3903
3904 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3905 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3906 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3907
3908 hci_dev_unlock(hdev);
3909
3910 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3911 &rp, sizeof(rp));
3912}
3913
b7c23df8
JK		 3914int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3915{
3916 struct mgmt_ev_phy_configuration_changed ev;
3917
3918 memset(&ev, 0, sizeof(ev));
3919
3920 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3921
3922 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3923 sizeof(ev), skip);
3924}
3925
71efbb08 3926static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
0314f286 3927{
71efbb08
BG		 3928 struct mgmt_pending_cmd *cmd = data;
3929 struct sk_buff *skb = cmd->skb;
3930 u8 status = mgmt_status(err);
0314f286 3931
275f3f64
BG		 3932 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3933 return;
3934
71efbb08
BG		 3935 if (!status) {
3936 if (!skb)
3937 status = MGMT_STATUS_FAILED;
3938 else if (IS_ERR(skb))
3939 status = mgmt_status(PTR_ERR(skb));
3940 else
3941 status = mgmt_status(skb->data[0]);
3942 }
0314f286 3943
71efbb08 3944 bt_dev_dbg(hdev, "status %d", status);
0314f286 3945
0314f286
JK		 3946 if (status) {
3947 mgmt_cmd_status(cmd->sk, hdev->id,
71efbb08 3948 MGMT_OP_SET_PHY_CONFIGURATION, status);
0314f286
JK		 3949 } else {
3950 mgmt_cmd_complete(cmd->sk, hdev->id,
3951 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3952 NULL, 0);
b7c23df8
JK		 3953
3954 mgmt_phy_configuration_changed(hdev, cmd->sk);
0314f286
JK		 3955 }
3956
71efbb08
BG		 3957 if (skb && !IS_ERR(skb))
3958 kfree_skb(skb);
3959
0314f286 3960 mgmt_pending_remove(cmd);
71efbb08 3961}
0314f286 3962
71efbb08
BG		 3963static int set_default_phy_sync(struct hci_dev *hdev, void *data)
3964{
3965 struct mgmt_pending_cmd *cmd = data;
3966 struct mgmt_cp_set_phy_configuration *cp = cmd->param;
3967 struct hci_cp_le_set_default_phy cp_phy;
3968 u32 selected_phys = __le32_to_cpu(cp->selected_phys);
3969
3970 memset(&cp_phy, 0, sizeof(cp_phy));
3971
3972 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3973 cp_phy.all_phys |= 0x01;
3974
3975 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3976 cp_phy.all_phys |= 0x02;
3977
3978 if (selected_phys & MGMT_PHY_LE_1M_TX)
3979 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3980
3981 if (selected_phys & MGMT_PHY_LE_2M_TX)
3982 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3983
3984 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3985 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3986
3987 if (selected_phys & MGMT_PHY_LE_1M_RX)
3988 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3989
3990 if (selected_phys & MGMT_PHY_LE_2M_RX)
3991 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3992
3993 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3994 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3995
3996 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
3997 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
3998
3999 return 0;
0314f286
JK		 4000}
4001
4002static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4003 void *data, u16 len)
4004{
35302158 4005 struct mgmt_cp_set_phy_configuration *cp = data;
0314f286 4006 struct mgmt_pending_cmd *cmd;
0314f286
JK		 4007 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4008 u16 pkt_type = (HCI_DH1 | HCI_DM1);
b7c23df8 4009 bool changed = false;
0314f286
JK		 4010 int err;
4011
181d6953 4012 bt_dev_dbg(hdev, "sock %p", sk);
0314f286
JK		 4013
4014 configurable_phys = get_configurable_phys(hdev);
4015 supported_phys = get_supported_phys(hdev);
4016 selected_phys = __le32_to_cpu(cp->selected_phys);
4017
4018 if (selected_phys & ~supported_phys)
4019 return mgmt_cmd_status(sk, hdev->id,
4020 MGMT_OP_SET_PHY_CONFIGURATION,
4021 MGMT_STATUS_INVALID_PARAMS);
4022
4023 unconfigure_phys = supported_phys & ~configurable_phys;
4024
4025 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4026 return mgmt_cmd_status(sk, hdev->id,
4027 MGMT_OP_SET_PHY_CONFIGURATION,
4028 MGMT_STATUS_INVALID_PARAMS);
4029
4030 if (selected_phys == get_selected_phys(hdev))
4031 return mgmt_cmd_complete(sk, hdev->id,
4032 MGMT_OP_SET_PHY_CONFIGURATION,
4033 0, NULL, 0);
4034
4035 hci_dev_lock(hdev);
4036
4037 if (!hdev_is_powered(hdev)) {
4038 err = mgmt_cmd_status(sk, hdev->id,
4039 MGMT_OP_SET_PHY_CONFIGURATION,
4040 MGMT_STATUS_REJECTED);
4041 goto unlock;
4042 }
4043
4044 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4045 err = mgmt_cmd_status(sk, hdev->id,
4046 MGMT_OP_SET_PHY_CONFIGURATION,
4047 MGMT_STATUS_BUSY);
4048 goto unlock;
4049 }
4050
4051 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4052 pkt_type |= (HCI_DH3 | HCI_DM3);
4053 else
4054 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4055
4056 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4057 pkt_type |= (HCI_DH5 | HCI_DM5);
4058 else
4059 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4060
4061 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4062 pkt_type &= ~HCI_2DH1;
4063 else
4064 pkt_type |= HCI_2DH1;
4065
4066 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4067 pkt_type &= ~HCI_2DH3;
4068 else
4069 pkt_type |= HCI_2DH3;
4070
4071 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4072 pkt_type &= ~HCI_2DH5;
4073 else
4074 pkt_type |= HCI_2DH5;
4075
4076 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4077 pkt_type &= ~HCI_3DH1;
4078 else
4079 pkt_type |= HCI_3DH1;
4080
4081 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4082 pkt_type &= ~HCI_3DH3;
4083 else
4084 pkt_type |= HCI_3DH3;
4085
4086 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4087 pkt_type &= ~HCI_3DH5;
4088 else
4089 pkt_type |= HCI_3DH5;
4090
b7c23df8 4091 if (pkt_type != hdev->pkt_type) {
0314f286 4092 hdev->pkt_type = pkt_type;
b7c23df8
JK		 4093 changed = true;
4094 }
0314f286
JK		 4095
4096 if ((selected_phys & MGMT_PHY_LE_MASK) ==
4097 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
b7c23df8
JK		 4098 if (changed)
4099 mgmt_phy_configuration_changed(hdev, sk);
4100
0314f286
JK		 4101 err = mgmt_cmd_complete(sk, hdev->id,
4102 MGMT_OP_SET_PHY_CONFIGURATION,
4103 0, NULL, 0);
4104
4105 goto unlock;
4106 }
4107
4108 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4109 len);
71efbb08 4110 if (!cmd)
0314f286 4111 err = -ENOMEM;
71efbb08
BG		 4112 else
4113 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4114 set_default_phy_complete);
0314f286 4115
71efbb08
BG		 4116 if (err < 0) {
4117 err = mgmt_cmd_status(sk, hdev->id,
4118 MGMT_OP_SET_PHY_CONFIGURATION,
4119 MGMT_STATUS_FAILED);
0314f286 4120
71efbb08
BG		 4121 if (cmd)
4122 mgmt_pending_remove(cmd);
4123 }
0314f286
JK		 4124
4125unlock:
4126 hci_dev_unlock(hdev);
4127
4128 return err;
4129}
4130
600a8749
AM		 4131static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4132 u16 len)
4133{
4134 int err = MGMT_STATUS_SUCCESS;
4135 struct mgmt_cp_set_blocked_keys *keys = data;
4136 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4137 sizeof(struct mgmt_blocked_key_info));
4138 u16 key_count, expected_len;
4139 int i;
4140
181d6953 4141 bt_dev_dbg(hdev, "sock %p", sk);
600a8749
AM		 4142
4143 key_count = __le16_to_cpu(keys->key_count);
4144 if (key_count > max_key_count) {
4145 bt_dev_err(hdev, "too big key_count value %u", key_count);
4146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4147 MGMT_STATUS_INVALID_PARAMS);
4148 }
4149
4150 expected_len = struct_size(keys, keys, key_count);
4151 if (expected_len != len) {
4152 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4153 expected_len, len);
4154 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4155 MGMT_STATUS_INVALID_PARAMS);
4156 }
4157
4158 hci_dev_lock(hdev);
4159
4160 hci_blocked_keys_clear(hdev);
4161
0c793758 4162 for (i = 0; i < key_count; ++i) {
600a8749
AM		 4163 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4164
4165 if (!b) {
4166 err = MGMT_STATUS_NO_RESOURCES;
4167 break;
4168 }
4169
4170 b->type = keys->keys[i].type;
4171 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4172 list_add_rcu(&b->list, &hdev->blocked_keys);
4173 }
4174 hci_dev_unlock(hdev);
4175
4176 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4177 err, NULL, 0);
4178}
4179
00bce3fb
AM		 4180static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4181 void *data, u16 len)
4182{
4183 struct mgmt_mode *cp = data;
4184 int err;
4185 bool changed = false;
4186
181d6953 4187 bt_dev_dbg(hdev, "sock %p", sk);
00bce3fb
AM		 4188
4189 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4190 return mgmt_cmd_status(sk, hdev->id,
4191 MGMT_OP_SET_WIDEBAND_SPEECH,
4192 MGMT_STATUS_NOT_SUPPORTED);
4193
4194 if (cp->val != 0x00 && cp->val != 0x01)
4195 return mgmt_cmd_status(sk, hdev->id,
4196 MGMT_OP_SET_WIDEBAND_SPEECH,
4197 MGMT_STATUS_INVALID_PARAMS);
4198
4199 hci_dev_lock(hdev);
4200
00bce3fb
AM		 4201 if (hdev_is_powered(hdev) &&
4202 !!cp->val != hci_dev_test_flag(hdev,
4203 HCI_WIDEBAND_SPEECH_ENABLED)) {
4204 err = mgmt_cmd_status(sk, hdev->id,
4205 MGMT_OP_SET_WIDEBAND_SPEECH,
4206 MGMT_STATUS_REJECTED);
4207 goto unlock;
4208 }
4209
4210 if (cp->val)
4211 changed = !hci_dev_test_and_set_flag(hdev,
4212 HCI_WIDEBAND_SPEECH_ENABLED);
4213 else
4214 changed = hci_dev_test_and_clear_flag(hdev,
4215 HCI_WIDEBAND_SPEECH_ENABLED);
4216
4217 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4218 if (err < 0)
4219 goto unlock;
4220
4221 if (changed)
4222 err = new_settings(hdev, sk);
4223
4224unlock:
4225 hci_dev_unlock(hdev);
4226 return err;
4227}
4228
4d9b9528
DW		 4229static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4230 void *data, u16 data_len)
bc292258 4231{
4d9b9528
DW		 4232 char buf[20];
4233 struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4234 u16 cap_len = 0;
bc292258 4235 u8 flags = 0;
4d9b9528 4236 u8 tx_power_range[2];
bc292258
MH		 4237
4238 bt_dev_dbg(hdev, "sock %p", sk);
4239
4240 memset(&buf, 0, sizeof(buf));
4241
4242 hci_dev_lock(hdev);
4243
4244 /* When the Read Simple Pairing Options command is supported, then
4245 * the remote public key validation is supported.
a61d6718
MH		 4246 *
4247 * Alternatively, when Microsoft extensions are available, they can
4248 * indicate support for public key validation as well.
bc292258 4249 */
a61d6718 4250 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
bc292258
MH		 4251 flags |= 0x01; /* Remote public key validation (BR/EDR) */
4252
4253 flags |= 0x02; /* Remote public key validation (LE) */
4254
4255 /* When the Read Encryption Key Size command is supported, then the
4256 * encryption key size is enforced.
4257 */
4258 if (hdev->commands[20] & 0x10)
4259 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */
4260
4261 flags |= 0x08; /* Encryption key size enforcement (LE) */
4262
4d9b9528
DW		 4263 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4264 &flags, 1);
bc292258
MH		 4265
4266 /* When the Read Simple Pairing Options command is supported, then
4267 * also max encryption key size information is provided.
4268 */
4269 if (hdev->commands[41] & 0x08)
4d9b9528
DW		 4270 cap_len = eir_append_le16(rp->cap, cap_len,
4271 MGMT_CAP_MAX_ENC_KEY_SIZE,
bc292258
MH		 4272 hdev->max_enc_key_size);
4273
4d9b9528
DW		 4274 cap_len = eir_append_le16(rp->cap, cap_len,
4275 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4276 SMP_MAX_ENC_KEY_SIZE);
4277
4278 /* Append the min/max LE tx power parameters if we were able to fetch
4279 * it from the controller
4280 */
4281 if (hdev->commands[38] & 0x80) {
4282 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4283 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4284 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4285 tx_power_range, 2);
4286 }
bc292258 4287
4d9b9528 4288 rp->cap_len = cpu_to_le16(cap_len);
bc292258
MH		 4289
4290 hci_dev_unlock(hdev);
4291
4d9b9528
DW		 4292 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4293 rp, sizeof(*rp) + cap_len);
bc292258
MH		 4294}
4295
e625e50c
MH		 4296#ifdef CONFIG_BT_FEATURE_DEBUG
4297/* d4992530-b9ec-469f-ab01-6c481c47da1c */
4298static const u8 debug_uuid[16] = {
4299 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4300 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4301};
4302#endif
4303
ae7d925b
JH		 4304/* 330859bc-7506-492d-9370-9a6f0614037f */
4305static const u8 quality_report_uuid[16] = {
4306 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4307 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4308};
4309
ad933151
K		 4310/* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4311static const u8 offload_codecs_uuid[16] = {
4312 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4313 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4314};
4315
15d8ce05 4316/* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
76d0685b 4317static const u8 le_simultaneous_roles_uuid[16] = {
15d8ce05
AM		 4318 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4319 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4320};
4321
cbbdfa6f
SN		 4322/* 15c0a148-c273-11ea-b3de-0242ac130004 */
4323static const u8 rpa_resolution_uuid[16] = {
4324 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4325 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4326};
4327
ccf74f23
LAD		 4328/* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4329static const u8 iso_socket_uuid[16] = {
4330 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4331 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4332};
4333
af6bcc19
BG		 4334/* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4335static const u8 mgmt_mesh_uuid[16] = {
4336 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4337 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4338};
4339
a10c907c
MH		 4340static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4341 void *data, u16 data_len)
4342{
af6bcc19
BG		 4343 struct mgmt_rp_read_exp_features_info *rp;
4344 size_t len;
a10c907c 4345 u16 idx = 0;
15d8ce05 4346 u32 flags;
af6bcc19 4347 int status;
a10c907c
MH		 4348
4349 bt_dev_dbg(hdev, "sock %p", sk);
4350
af6bcc19
BG		 4351 /* Enough space for 7 features */
4352 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
bb20da18 4353 rp = kzalloc(len, GFP_KERNEL);
af6bcc19
BG		 4354 if (!rp)
4355 return -ENOMEM;
4356
e625e50c
MH		 4357#ifdef CONFIG_BT_FEATURE_DEBUG
4358 if (!hdev) {
15d8ce05 4359 flags = bt_dbg_get() ? BIT(0) : 0;
e625e50c
MH		 4360
4361 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4362 rp->features[idx].flags = cpu_to_le32(flags);
4363 idx++;
4364 }
4365#endif
4366
76d0685b
LAD		 4367 if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4368 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
15d8ce05
AM		 4369 flags = BIT(0);
4370 else
4371 flags = 0;
4372
76d0685b 4373 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
15d8ce05
AM		 4374 rp->features[idx].flags = cpu_to_le32(flags);
4375 idx++;
4376 }
4377
ad383c2c 4378 if (hdev && ll_privacy_capable(hdev)) {
cbbdfa6f
SN		 4379 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4380 flags = BIT(0) | BIT(1);
4381 else
4382 flags = BIT(1);
4383
4384 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4385 rp->features[idx].flags = cpu_to_le32(flags);
4386 idx++;
4387 }
4388
258f56d1
JH		 4389 if (hdev && (aosp_has_quality_report(hdev) ||
4390 hdev->set_quality_report)) {
823f3bc4 4391 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
ae7d925b 4392 flags = BIT(0);
823f3bc4 4393 else
ae7d925b 4394 flags = 0;
823f3bc4 4395
ae7d925b
JH		 4396 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4397 rp->features[idx].flags = cpu_to_le32(flags);
4398 idx++;
4399 }
4400
7f7fd17e
MH		 4401 if (hdev && hdev->get_data_path_id) {
4402 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
ad933151 4403 flags = BIT(0);
7f7fd17e 4404 else
ad933151 4405 flags = 0;
7f7fd17e 4406
ad933151
K		 4407 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4408 rp->features[idx].flags = cpu_to_le32(flags);
4409 idx++;
4410 }
4411
ccf74f23
LAD		 4412 if (IS_ENABLED(CONFIG_BT_LE)) {
4413 flags = iso_enabled() ? BIT(0) : 0;
4414 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4415 rp->features[idx].flags = cpu_to_le32(flags);
4416 idx++;
4417 }
4418
af6bcc19
BG		 4419 if (hdev && lmp_le_capable(hdev)) {
4420 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4421 flags = BIT(0);
4422 else
4423 flags = 0;
4424
4425 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4426 rp->features[idx].flags = cpu_to_le32(flags);
4427 idx++;
4428 }
4429
a10c907c
MH		 4430 rp->feature_count = cpu_to_le16(idx);
4431
4432 /* After reading the experimental features information, enable
4433 * the events to update client on any future change.
4434 */
4435 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4436
af6bcc19
BG		 4437 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4438 MGMT_OP_READ_EXP_FEATURES_INFO,
4439 0, rp, sizeof(*rp) + (20 * idx));
4440
4441 kfree(rp);
4442 return status;
a10c907c
MH		 4443}
4444
cbbdfa6f
SN		 4445static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4446 struct sock *skip)
4447{
4448 struct mgmt_ev_exp_feature_changed ev;
4449
4450 memset(&ev, 0, sizeof(ev));
4451 memcpy(ev.uuid, rpa_resolution_uuid, 16);
4452 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4453
e1cff700 4454 // Do we need to be atomic with the conn_flags?
6126ffab 4455 if (enabled && privacy_mode_capable(hdev))
e1cff700 4456 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
6126ffab 4457 else
e1cff700 4458 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
6126ffab 4459
cbbdfa6f
SN		 4460 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4461 &ev, sizeof(ev),
4462 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4463
4464}
4465
76d0685b
LAD		 4466static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4467 bool enabled, struct sock *skip)
ae7d925b
JH		 4468{
4469 struct mgmt_ev_exp_feature_changed ev;
4470
4471 memset(&ev, 0, sizeof(ev));
76d0685b 4472 memcpy(ev.uuid, uuid, 16);
ae7d925b
JH		 4473 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4474
b15bfa4d 4475 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
ae7d925b
JH		 4476 &ev, sizeof(ev),
4477 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4478}
4479
93fb70bc
JH		 4480#define EXP_FEAT(_uuid, _set_func) \
4481{ \
4482 .uuid = _uuid, \
4483 .set_func = _set_func, \
4484}
4485
4486/* The zero key uuid is special. Multiple exp features are set through it. */
4487static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4488 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
a10c907c 4489{
a10c907c
MH		 4490 struct mgmt_rp_set_exp_feature rp;
4491
93fb70bc
JH		 4492 memset(rp.uuid, 0, 16);
4493 rp.flags = cpu_to_le32(0);
a10c907c 4494
e625e50c 4495#ifdef CONFIG_BT_FEATURE_DEBUG
93fb70bc
JH		 4496 if (!hdev) {
4497 bool changed = bt_dbg_get();
e625e50c 4498
93fb70bc 4499 bt_dbg_set(false);
e625e50c 4500
93fb70bc 4501 if (changed)
76d0685b 4502 exp_feature_changed(NULL, ZERO_KEY, false, sk);
93fb70bc 4503 }
e625e50c
MH		 4504#endif
4505
93fb70bc 4506 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
6f59f991 4507 bool changed;
cbbdfa6f 4508
6f59f991
LAD		 4509 changed = hci_dev_test_and_clear_flag(hdev,
4510 HCI_ENABLE_LL_PRIVACY);
93fb70bc 4511 if (changed)
76d0685b
LAD		 4512 exp_feature_changed(hdev, rpa_resolution_uuid, false,
4513 sk);
93fb70bc 4514 }
cbbdfa6f 4515
93fb70bc 4516 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
a10c907c 4517
93fb70bc
JH		 4518 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4519 MGMT_OP_SET_EXP_FEATURE, 0,
4520 &rp, sizeof(rp));
4521}
a10c907c 4522
e625e50c 4523#ifdef CONFIG_BT_FEATURE_DEBUG
93fb70bc
JH		 4524static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4525 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4526{
4527 struct mgmt_rp_set_exp_feature rp;
e625e50c 4528
93fb70bc
JH		 4529 bool val, changed;
4530 int err;
e625e50c 4531
93fb70bc
JH		 4532 /* Command requires to use the non-controller index */
4533 if (hdev)
4534 return mgmt_cmd_status(sk, hdev->id,
4535 MGMT_OP_SET_EXP_FEATURE,
4536 MGMT_STATUS_INVALID_INDEX);
e625e50c 4537
93fb70bc
JH		 4538 /* Parameters are limited to a single octet */
4539 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4540 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4541 MGMT_OP_SET_EXP_FEATURE,
4542 MGMT_STATUS_INVALID_PARAMS);
e625e50c 4543
93fb70bc
JH		 4544 /* Only boolean on/off is supported */
4545 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4546 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4547 MGMT_OP_SET_EXP_FEATURE,
4548 MGMT_STATUS_INVALID_PARAMS);
e625e50c 4549
93fb70bc
JH		 4550 val = !!cp->param[0];
4551 changed = val ? !bt_dbg_get() : bt_dbg_get();
4552 bt_dbg_set(val);
e625e50c 4553
93fb70bc
JH		 4554 memcpy(rp.uuid, debug_uuid, 16);
4555 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
e625e50c 4556
93fb70bc 4557 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
e625e50c 4558
93fb70bc
JH		 4559 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4560 MGMT_OP_SET_EXP_FEATURE, 0,
4561 &rp, sizeof(rp));
e625e50c 4562
93fb70bc 4563 if (changed)
76d0685b 4564 exp_feature_changed(hdev, debug_uuid, val, sk);
93fb70bc
JH		 4565
4566 return err;
4567}
e625e50c
MH		 4568#endif
4569
af6bcc19
BG		 4570static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4571 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4572{
4573 struct mgmt_rp_set_exp_feature rp;
4574 bool val, changed;
4575 int err;
4576
4577 /* Command requires to use the controller index */
4578 if (!hdev)
4579 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4580 MGMT_OP_SET_EXP_FEATURE,
4581 MGMT_STATUS_INVALID_INDEX);
4582
af6bcc19
BG		 4583 /* Parameters are limited to a single octet */
4584 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4585 return mgmt_cmd_status(sk, hdev->id,
4586 MGMT_OP_SET_EXP_FEATURE,
4587 MGMT_STATUS_INVALID_PARAMS);
4588
4589 /* Only boolean on/off is supported */
4590 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4591 return mgmt_cmd_status(sk, hdev->id,
4592 MGMT_OP_SET_EXP_FEATURE,
4593 MGMT_STATUS_INVALID_PARAMS);
4594
4595 val = !!cp->param[0];
4596
4597 if (val) {
4598 changed = !hci_dev_test_and_set_flag(hdev,
4599 HCI_MESH_EXPERIMENTAL);
4600 } else {
4601 hci_dev_clear_flag(hdev, HCI_MESH);
4602 changed = hci_dev_test_and_clear_flag(hdev,
4603 HCI_MESH_EXPERIMENTAL);
4604 }
4605
4606 memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4607 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4608
4609 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4610
4611 err = mgmt_cmd_complete(sk, hdev->id,
4612 MGMT_OP_SET_EXP_FEATURE, 0,
4613 &rp, sizeof(rp));
4614
4615 if (changed)
4616 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4617
4618 return err;
4619}
4620
93fb70bc
JH		 4621static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4622 struct mgmt_cp_set_exp_feature *cp,
4623 u16 data_len)
4624{
4625 struct mgmt_rp_set_exp_feature rp;
4626 bool val, changed;
4627 int err;
4628 u32 flags;
4629
4630 /* Command requires to use the controller index */
4631 if (!hdev)
4632 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4633 MGMT_OP_SET_EXP_FEATURE,
4634 MGMT_STATUS_INVALID_INDEX);
cbbdfa6f 4635
93fb70bc
JH		 4636 /* Changes can only be made when controller is powered down */
4637 if (hdev_is_powered(hdev))
4638 return mgmt_cmd_status(sk, hdev->id,
4639 MGMT_OP_SET_EXP_FEATURE,
4640 MGMT_STATUS_REJECTED);
cbbdfa6f 4641
93fb70bc
JH		 4642 /* Parameters are limited to a single octet */
4643 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4644 return mgmt_cmd_status(sk, hdev->id,
4645 MGMT_OP_SET_EXP_FEATURE,
4646 MGMT_STATUS_INVALID_PARAMS);
cbbdfa6f 4647
93fb70bc
JH		 4648 /* Only boolean on/off is supported */
4649 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4650 return mgmt_cmd_status(sk, hdev->id,
4651 MGMT_OP_SET_EXP_FEATURE,
4652 MGMT_STATUS_INVALID_PARAMS);
cbbdfa6f 4653
93fb70bc 4654 val = !!cp->param[0];
cbbdfa6f 4655
93fb70bc 4656 if (val) {
6f59f991
LAD		 4657 changed = !hci_dev_test_and_set_flag(hdev,
4658 HCI_ENABLE_LL_PRIVACY);
93fb70bc 4659 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
cbbdfa6f 4660
93fb70bc
JH		 4661 /* Enable LL privacy + supported settings changed */
4662 flags = BIT(0) | BIT(1);
4663 } else {
6f59f991
LAD		 4664 changed = hci_dev_test_and_clear_flag(hdev,
4665 HCI_ENABLE_LL_PRIVACY);
cbbdfa6f 4666
93fb70bc
JH		 4667 /* Disable LL privacy + supported settings changed */
4668 flags = BIT(1);
4669 }
cbbdfa6f 4670
93fb70bc
JH		 4671 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4672 rp.flags = cpu_to_le32(flags);
cbbdfa6f 4673
93fb70bc 4674 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
cbbdfa6f 4675
93fb70bc
JH		 4676 err = mgmt_cmd_complete(sk, hdev->id,
4677 MGMT_OP_SET_EXP_FEATURE, 0,
4678 &rp, sizeof(rp));
cbbdfa6f 4679
93fb70bc
JH		 4680 if (changed)
4681 exp_ll_privacy_feature_changed(val, hdev, sk);
cbbdfa6f 4682
93fb70bc
JH		 4683 return err;
4684}
cbbdfa6f 4685
ae7d925b
JH		 4686static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4687 struct mgmt_cp_set_exp_feature *cp,
4688 u16 data_len)
4689{
4690 struct mgmt_rp_set_exp_feature rp;
4691 bool val, changed;
4692 int err;
4693
4694 /* Command requires to use a valid controller index */
4695 if (!hdev)
4696 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4697 MGMT_OP_SET_EXP_FEATURE,
4698 MGMT_STATUS_INVALID_INDEX);
4699
4700 /* Parameters are limited to a single octet */
4701 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4702 return mgmt_cmd_status(sk, hdev->id,
4703 MGMT_OP_SET_EXP_FEATURE,
4704 MGMT_STATUS_INVALID_PARAMS);
4705
4706 /* Only boolean on/off is supported */
4707 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4708 return mgmt_cmd_status(sk, hdev->id,
4709 MGMT_OP_SET_EXP_FEATURE,
4710 MGMT_STATUS_INVALID_PARAMS);
4711
4712 hci_req_sync_lock(hdev);
4713
4714 val = !!cp->param[0];
4715 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4716
258f56d1 4717 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
ae7d925b
JH		 4718 err = mgmt_cmd_status(sk, hdev->id,
4719 MGMT_OP_SET_EXP_FEATURE,
4720 MGMT_STATUS_NOT_SUPPORTED);
4721 goto unlock_quality_report;
4722 }
4723
4724 if (changed) {
258f56d1
JH		 4725 if (hdev->set_quality_report)
4726 err = hdev->set_quality_report(hdev, val);
4727 else
4728 err = aosp_set_quality_report(hdev, val);
4729
ae7d925b
JH		 4730 if (err) {
4731 err = mgmt_cmd_status(sk, hdev->id,
4732 MGMT_OP_SET_EXP_FEATURE,
4733 MGMT_STATUS_FAILED);
4734 goto unlock_quality_report;
4735 }
258f56d1 4736
ae7d925b
JH		 4737 if (val)
4738 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4739 else
4740 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4741 }
4742
4743 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4744
4745 memcpy(rp.uuid, quality_report_uuid, 16);
4746 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4747 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
258f56d1
JH		 4748
4749 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
ae7d925b
JH		 4750 &rp, sizeof(rp));
4751
4752 if (changed)
76d0685b 4753 exp_feature_changed(hdev, quality_report_uuid, val, sk);
ae7d925b
JH		 4754
4755unlock_quality_report:
4756 hci_req_sync_unlock(hdev);
4757 return err;
4758}
4759
ad933151
K		 4760static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4761 struct mgmt_cp_set_exp_feature *cp,
4762 u16 data_len)
4763{
4764 bool val, changed;
4765 int err;
4766 struct mgmt_rp_set_exp_feature rp;
4767
4768 /* Command requires to use a valid controller index */
4769 if (!hdev)
4770 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4771 MGMT_OP_SET_EXP_FEATURE,
4772 MGMT_STATUS_INVALID_INDEX);
4773
4774 /* Parameters are limited to a single octet */
4775 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4776 return mgmt_cmd_status(sk, hdev->id,
4777 MGMT_OP_SET_EXP_FEATURE,
4778 MGMT_STATUS_INVALID_PARAMS);
4779
4780 /* Only boolean on/off is supported */
4781 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4782 return mgmt_cmd_status(sk, hdev->id,
4783 MGMT_OP_SET_EXP_FEATURE,
4784 MGMT_STATUS_INVALID_PARAMS);
4785
4786 val = !!cp->param[0];
4787 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4788
4789 if (!hdev->get_data_path_id) {
4790 return mgmt_cmd_status(sk, hdev->id,
4791 MGMT_OP_SET_EXP_FEATURE,
4792 MGMT_STATUS_NOT_SUPPORTED);
4793 }
4794
4795 if (changed) {
4796 if (val)
4797 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4798 else
4799 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4800 }
4801
4802 bt_dev_info(hdev, "offload codecs enable %d changed %d",
4803 val, changed);
4804
4805 memcpy(rp.uuid, offload_codecs_uuid, 16);
4806 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4807 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4808 err = mgmt_cmd_complete(sk, hdev->id,
4809 MGMT_OP_SET_EXP_FEATURE, 0,
4810 &rp, sizeof(rp));
4811
4812 if (changed)
76d0685b
LAD		 4813 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4814
4815 return err;
4816}
4817
4818static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4819 struct mgmt_cp_set_exp_feature *cp,
4820 u16 data_len)
4821{
4822 bool val, changed;
4823 int err;
4824 struct mgmt_rp_set_exp_feature rp;
4825
4826 /* Command requires to use a valid controller index */
4827 if (!hdev)
4828 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4829 MGMT_OP_SET_EXP_FEATURE,
4830 MGMT_STATUS_INVALID_INDEX);
4831
4832 /* Parameters are limited to a single octet */
4833 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4834 return mgmt_cmd_status(sk, hdev->id,
4835 MGMT_OP_SET_EXP_FEATURE,
4836 MGMT_STATUS_INVALID_PARAMS);
4837
4838 /* Only boolean on/off is supported */
4839 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4840 return mgmt_cmd_status(sk, hdev->id,
4841 MGMT_OP_SET_EXP_FEATURE,
4842 MGMT_STATUS_INVALID_PARAMS);
4843
4844 val = !!cp->param[0];
4845 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4846
4847 if (!hci_dev_le_state_simultaneous(hdev)) {
4848 return mgmt_cmd_status(sk, hdev->id,
4849 MGMT_OP_SET_EXP_FEATURE,
4850 MGMT_STATUS_NOT_SUPPORTED);
4851 }
4852
4853 if (changed) {
4854 if (val)
4855 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4856 else
4857 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4858 }
4859
5d1dd2e5 4860 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
76d0685b
LAD		 4861 val, changed);
4862
4863 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4864 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4865 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4866 err = mgmt_cmd_complete(sk, hdev->id,
4867 MGMT_OP_SET_EXP_FEATURE, 0,
4868 &rp, sizeof(rp));
4869
4870 if (changed)
4871 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
ad933151
K		 4872
4873 return err;
4874}
4875
ccf74f23
LAD		 4876#ifdef CONFIG_BT_LE
4877static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4878 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4879{
4880 struct mgmt_rp_set_exp_feature rp;
4881 bool val, changed = false;
4882 int err;
4883
4884 /* Command requires to use the non-controller index */
4885 if (hdev)
4886 return mgmt_cmd_status(sk, hdev->id,
4887 MGMT_OP_SET_EXP_FEATURE,
4888 MGMT_STATUS_INVALID_INDEX);
4889
4890 /* Parameters are limited to a single octet */
4891 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4892 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4893 MGMT_OP_SET_EXP_FEATURE,
4894 MGMT_STATUS_INVALID_PARAMS);
4895
4896 /* Only boolean on/off is supported */
4897 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4898 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4899 MGMT_OP_SET_EXP_FEATURE,
4900 MGMT_STATUS_INVALID_PARAMS);
4901
4902 val = cp->param[0] ? true : false;
4903 if (val)
4904 err = iso_init();
4905 else
4906 err = iso_exit();
4907
4908 if (!err)
4909 changed = true;
4910
4911 memcpy(rp.uuid, iso_socket_uuid, 16);
4912 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4913
4914 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4915
4916 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4917 MGMT_OP_SET_EXP_FEATURE, 0,
4918 &rp, sizeof(rp));
4919
4920 if (changed)
4921 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4922
4923 return err;
4924}
4925#endif
4926
93fb70bc
JH		 4927static const struct mgmt_exp_feature {
4928 const u8 *uuid;
4929 int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4930 struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4931} exp_features[] = {
4932 EXP_FEAT(ZERO_KEY, set_zero_key_func),
4933#ifdef CONFIG_BT_FEATURE_DEBUG
4934 EXP_FEAT(debug_uuid, set_debug_func),
4935#endif
af6bcc19 4936 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
93fb70bc 4937 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
ae7d925b 4938 EXP_FEAT(quality_report_uuid, set_quality_report_func),
ad933151 4939 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
76d0685b 4940 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
ccf74f23
LAD		 4941#ifdef CONFIG_BT_LE
4942 EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4943#endif
93fb70bc
JH		 4944
4945 /* end with a null feature */
4946 EXP_FEAT(NULL, NULL)
4947};
4948
4949static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4950 void *data, u16 data_len)
4951{
4952 struct mgmt_cp_set_exp_feature *cp = data;
4953 size_t i = 0;
4954
4955 bt_dev_dbg(hdev, "sock %p", sk);
4956
4957 for (i = 0; exp_features[i].uuid; i++) {
4958 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4959 return exp_features[i].set_func(sk, hdev, cp, data_len);
cbbdfa6f
SN		 4960 }
4961
a10c907c
MH		 4962 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4963 MGMT_OP_SET_EXP_FEATURE,
4964 MGMT_STATUS_NOT_SUPPORTED);
4965}
4966
529d4492
LAD		 4967static u32 get_params_flags(struct hci_dev *hdev,
4968 struct hci_conn_params *params)
4969{
4970 u32 flags = hdev->conn_flags;
4971
4972 /* Devices using RPAs can only be programmed in the acceptlist if
4973 * LL Privacy has been enable otherwise they cannot mark
4974 * HCI_CONN_FLAG_REMOTE_WAKEUP.
4975 */
4976 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
4977 hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
4978 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
4979
4980 return flags;
4981}
4982
4c54bf2b
APS		 4983static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4984 u16 data_len)
4985{
4986 struct mgmt_cp_get_device_flags *cp = data;
4987 struct mgmt_rp_get_device_flags rp;
4988 struct bdaddr_list_with_flags *br_params;
4989 struct hci_conn_params *params;
fe92ee64 4990 u32 supported_flags;
4c54bf2b
APS		 4991 u32 current_flags = 0;
4992 u8 status = MGMT_STATUS_INVALID_PARAMS;
4993
4994 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4995 &cp->addr.bdaddr, cp->addr.type);
4996
3ca33e3f
APS		 4997 hci_dev_lock(hdev);
4998
e1cff700 4999 supported_flags = hdev->conn_flags;
fe92ee64 5000
02ce2c2c
THJA		 5001 memset(&rp, 0, sizeof(rp));
5002
4c54bf2b 5003 if (cp->addr.type == BDADDR_BREDR) {
3d4f9c00 5004 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4c54bf2b
APS		 5005 &cp->addr.bdaddr,
5006 cp->addr.type);
5007 if (!br_params)
5008 goto done;
5009
e1cff700 5010 current_flags = br_params->flags;
4c54bf2b
APS		 5011 } else {
5012 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5013 le_addr_type(cp->addr.type));
4c54bf2b
APS		 5014 if (!params)
5015 goto done;
5016
529d4492 5017 supported_flags = get_params_flags(hdev, params);
e1cff700 5018 current_flags = params->flags;
4c54bf2b
APS		 5019 }
5020
5021 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5022 rp.addr.type = cp->addr.type;
5023 rp.supported_flags = cpu_to_le32(supported_flags);
5024 rp.current_flags = cpu_to_le32(current_flags);
5025
5026 status = MGMT_STATUS_SUCCESS;
5027
5028done:
3ca33e3f
APS		 5029 hci_dev_unlock(hdev);
5030
4c54bf2b
APS		 5031 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5032 &rp, sizeof(rp));
5033}
5034
5035static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5036 bdaddr_t *bdaddr, u8 bdaddr_type,
5037 u32 supported_flags, u32 current_flags)
5038{
5039 struct mgmt_ev_device_flags_changed ev;
5040
5041 bacpy(&ev.addr.bdaddr, bdaddr);
5042 ev.addr.type = bdaddr_type;
5043 ev.supported_flags = cpu_to_le32(supported_flags);
5044 ev.current_flags = cpu_to_le32(current_flags);
5045
5046 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5047}
5048
5049static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5050 u16 len)
5051{
5052 struct mgmt_cp_set_device_flags *cp = data;
5053 struct bdaddr_list_with_flags *br_params;
5054 struct hci_conn_params *params;
5055 u8 status = MGMT_STATUS_INVALID_PARAMS;
fe92ee64 5056 u32 supported_flags;
4c54bf2b
APS		 5057 u32 current_flags = __le32_to_cpu(cp->current_flags);
5058
5059 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
0c793758 5060 &cp->addr.bdaddr, cp->addr.type, current_flags);
4c54bf2b 5061
e1cff700
LT		 5062 // We should take hci_dev_lock() early, I think.. conn_flags can change
5063 supported_flags = hdev->conn_flags;
fe92ee64 5064
4c54bf2b
APS		 5065 if ((supported_flags | current_flags) != supported_flags) {
5066 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5067 current_flags, supported_flags);
5068 goto done;
5069 }
5070
3ca33e3f
APS		 5071 hci_dev_lock(hdev);
5072
4c54bf2b 5073 if (cp->addr.type == BDADDR_BREDR) {
3d4f9c00 5074 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4c54bf2b
APS		 5075 &cp->addr.bdaddr,
5076 cp->addr.type);
5077
5078 if (br_params) {
e1cff700 5079 br_params->flags = current_flags;
4c54bf2b
APS		 5080 status = MGMT_STATUS_SUCCESS;
5081 } else {
5082 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5083 &cp->addr.bdaddr, cp->addr.type);
5084 }
a9a34765 5085
529d4492
LAD		 5086 goto unlock;
5087 }
6126ffab 5088
529d4492
LAD		 5089 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5090 le_addr_type(cp->addr.type));
5091 if (!params) {
5092 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5093 &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5094 goto unlock;
5095 }
5096
5097 supported_flags = get_params_flags(hdev, params);
5098
5099 if ((supported_flags | current_flags) != supported_flags) {
5100 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5101 current_flags, supported_flags);
5102 goto unlock;
4c54bf2b
APS		 5103 }
5104
195ef75e 5105 WRITE_ONCE(params->flags, current_flags);
529d4492
LAD		 5106 status = MGMT_STATUS_SUCCESS;
5107
5108 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5109 * has been set.
5110 */
5111 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5112 hci_update_passive_scan(hdev);
5113
a9a34765 5114unlock:
3ca33e3f
APS		 5115 hci_dev_unlock(hdev);
5116
815d5121 5117done:
4c54bf2b
APS		 5118 if (status == MGMT_STATUS_SUCCESS)
5119 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5120 supported_flags, current_flags);
5121
5122 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5123 &cp->addr, sizeof(cp->addr));
5124}
5125
b52729f2
MC		 5126static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5127 u16 handle)
5128{
5129 struct mgmt_ev_adv_monitor_added ev;
5130
5131 ev.monitor_handle = cpu_to_le16(handle);
5132
5133 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5134}
5135
66bd095a 5136void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
cdde92e2 5137{
66bd095a
AP		 5138 struct mgmt_ev_adv_monitor_removed ev;
5139 struct mgmt_pending_cmd *cmd;
5140 struct sock *sk_skip = NULL;
5141 struct mgmt_cp_remove_adv_monitor *cp;
5142
5143 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5144 if (cmd) {
5145 cp = cmd->param;
5146
5147 if (cp->monitor_handle)
5148 sk_skip = cmd->sk;
5149 }
cdde92e2
MC		 5150
5151 ev.monitor_handle = cpu_to_le16(handle);
5152
66bd095a 5153 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
cdde92e2
MC		 5154}
5155
e5e1e7fd
MC		 5156static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5157 void *data, u16 len)
5158{
5159 struct adv_monitor *monitor = NULL;
5160 struct mgmt_rp_read_adv_monitor_features *rp = NULL;
cafd472a 5161 int handle, err;
e5e1e7fd
MC		 5162 size_t rp_size = 0;
5163 __u32 supported = 0;
a2a4dedf 5164 __u32 enabled = 0;
e5e1e7fd
MC		 5165 __u16 num_handles = 0;
5166 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5167
5168 BT_DBG("request for %s", hdev->name);
5169
5170 hci_dev_lock(hdev);
5171
a2a4dedf 5172 if (msft_monitor_supported(hdev))
e5e1e7fd
MC		 5173 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5174
a2a4dedf 5175 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
e5e1e7fd 5176 handles[num_handles++] = monitor->handle;
e5e1e7fd
MC		 5177
5178 hci_dev_unlock(hdev);
5179
5180 rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5181 rp = kmalloc(rp_size, GFP_KERNEL);
5182 if (!rp)
5183 return -ENOMEM;
5184
a2a4dedf
AP		 5185 /* All supported features are currently enabled */
5186 enabled = supported;
5187
e5e1e7fd 5188 rp->supported_features = cpu_to_le32(supported);
a2a4dedf 5189 rp->enabled_features = cpu_to_le32(enabled);
e5e1e7fd
MC		 5190 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5191 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5192 rp->num_handles = cpu_to_le16(num_handles);
5193 if (num_handles)
5194 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5195
cafd472a
PY		 5196 err = mgmt_cmd_complete(sk, hdev->id,
5197 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5198 MGMT_STATUS_SUCCESS, rp, rp_size);
5199
5200 kfree(rp);
5201
5202 return err;
e5e1e7fd
MC		 5203}
5204
b747a836
MM		 5205static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5206 void *data, int status)
a2a4dedf
AP		 5207{
5208 struct mgmt_rp_add_adv_patterns_monitor rp;
b747a836
MM		 5209 struct mgmt_pending_cmd *cmd = data;
5210 struct adv_monitor *monitor = cmd->user_data;
a2a4dedf
AP		 5211
5212 hci_dev_lock(hdev);
5213
a2a4dedf
AP		 5214 rp.monitor_handle = cpu_to_le16(monitor->handle);
5215
5216 if (!status) {
5217 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5218 hdev->adv_monitors_cnt++;
5219 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5220 monitor->state = ADV_MONITOR_STATE_REGISTERED;
5bee2fd6 5221 hci_update_passive_scan(hdev);
a2a4dedf
AP		 5222 }
5223
b747a836
MM		 5224 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5225 mgmt_status(status), &rp, sizeof(rp));
a2a4dedf
AP		 5226 mgmt_pending_remove(cmd);
5227
a2a4dedf 5228 hci_dev_unlock(hdev);
b747a836 5229 bt_dev_dbg(hdev, "add monitor %d complete, status %d",
a2a4dedf 5230 rp.monitor_handle, status);
b747a836 5231}
a2a4dedf 5232
b747a836
MM		 5233static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5234{
5235 struct mgmt_pending_cmd *cmd = data;
5236 struct adv_monitor *monitor = cmd->user_data;
5237
5238 return hci_add_adv_monitor(hdev, monitor);
a2a4dedf
AP		 5239}
5240
b4a221ea 5241static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
a2a4dedf
AP		 5242 struct adv_monitor *m, u8 status,
5243 void *data, u16 len, u16 op)
b139553d 5244{
a2a4dedf 5245 struct mgmt_pending_cmd *cmd;
b4a221ea 5246 int err;
a2a4dedf
AP		 5247
5248 hci_dev_lock(hdev);
b139553d 5249
b4a221ea 5250 if (status)
a2a4dedf 5251 goto unlock;
b139553d 5252
a2a4dedf
AP		 5253 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5254 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5255 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5256 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5257 status = MGMT_STATUS_BUSY;
5258 goto unlock;
5259 }
b139553d 5260
a2a4dedf
AP		 5261 cmd = mgmt_pending_add(sk, op, hdev, data, len);
5262 if (!cmd) {
5263 status = MGMT_STATUS_NO_RESOURCES;
5264 goto unlock;
5265 }
b52729f2 5266
b1810feb 5267 cmd->user_data = m;
b747a836
MM		 5268 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5269 mgmt_add_adv_patterns_monitor_complete);
b139553d 5270 if (err) {
b747a836 5271 if (err == -ENOMEM)
b4a221ea
AP		 5272 status = MGMT_STATUS_NO_RESOURCES;
5273 else
5274 status = MGMT_STATUS_FAILED;
5275
b139553d
MC		 5276 goto unlock;
5277 }
5278
a2a4dedf 5279 hci_dev_unlock(hdev);
b139553d 5280
a2a4dedf 5281 return 0;
b139553d
MC		 5282
5283unlock:
66bd095a 5284 hci_free_adv_monitor(hdev, m);
b139553d 5285 hci_dev_unlock(hdev);
b4a221ea
AP		 5286 return mgmt_cmd_status(sk, hdev->id, op, status);
5287}
5288
5289static void parse_adv_monitor_rssi(struct adv_monitor *m,
5290 struct mgmt_adv_rssi_thresholds *rssi)
5291{
5292 if (rssi) {
5293 m->rssi.low_threshold = rssi->low_threshold;
5294 m->rssi.low_threshold_timeout =
5295 __le16_to_cpu(rssi->low_threshold_timeout);
5296 m->rssi.high_threshold = rssi->high_threshold;
5297 m->rssi.high_threshold_timeout =
5298 __le16_to_cpu(rssi->high_threshold_timeout);
5299 m->rssi.sampling_period = rssi->sampling_period;
5300 } else {
5301 /* Default values. These numbers are the least constricting
5302 * parameters for MSFT API to work, so it behaves as if there
5303 * are no rssi parameter to consider. May need to be changed
5304 * if other API are to be supported.
5305 */
5306 m->rssi.low_threshold = -127;
5307 m->rssi.low_threshold_timeout = 60;
5308 m->rssi.high_threshold = -127;
5309 m->rssi.high_threshold_timeout = 0;
5310 m->rssi.sampling_period = 0;
5311 }
5312}
5313
5314static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5315 struct mgmt_adv_pattern *patterns)
5316{
5317 u8 offset = 0, length = 0;
5318 struct adv_pattern *p = NULL;
b4a221ea
AP		 5319 int i;
5320
5321 for (i = 0; i < pattern_count; i++) {
b4a221ea
AP		 5322 offset = patterns[i].offset;
5323 length = patterns[i].length;
db08722f
LAD		 5324 if (offset >= HCI_MAX_EXT_AD_LENGTH ||
5325 length > HCI_MAX_EXT_AD_LENGTH ||
5326 (offset + length) > HCI_MAX_EXT_AD_LENGTH)
b4a221ea
AP		 5327 return MGMT_STATUS_INVALID_PARAMS;
5328
5329 p = kmalloc(sizeof(*p), GFP_KERNEL);
5330 if (!p)
5331 return MGMT_STATUS_NO_RESOURCES;
5332
5333 p->ad_type = patterns[i].ad_type;
5334 p->offset = patterns[i].offset;
5335 p->length = patterns[i].length;
5336 memcpy(p->value, patterns[i].value, p->length);
5337
5338 INIT_LIST_HEAD(&p->list);
5339 list_add(&p->list, &m->patterns);
5340 }
5341
b4a221ea
AP		 5342 return MGMT_STATUS_SUCCESS;
5343}
5344
5345static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5346 void *data, u16 len)
5347{
5348 struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5349 struct adv_monitor *m = NULL;
5350 u8 status = MGMT_STATUS_SUCCESS;
5351 size_t expected_size = sizeof(*cp);
5352
5353 BT_DBG("request for %s", hdev->name);
5354
5355 if (len <= sizeof(*cp)) {
5356 status = MGMT_STATUS_INVALID_PARAMS;
5357 goto done;
5358 }
5359
5360 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5361 if (len != expected_size) {
5362 status = MGMT_STATUS_INVALID_PARAMS;
5363 goto done;
5364 }
5365
5366 m = kzalloc(sizeof(*m), GFP_KERNEL);
5367 if (!m) {
5368 status = MGMT_STATUS_NO_RESOURCES;
5369 goto done;
5370 }
5371
5372 INIT_LIST_HEAD(&m->patterns);
5373
5374 parse_adv_monitor_rssi(m, NULL);
5375 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5376
5377done:
a2a4dedf 5378 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
b4a221ea
AP		 5379 MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5380}
5381
5382static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5383 void *data, u16 len)
5384{
5385 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5386 struct adv_monitor *m = NULL;
5387 u8 status = MGMT_STATUS_SUCCESS;
5388 size_t expected_size = sizeof(*cp);
5389
5390 BT_DBG("request for %s", hdev->name);
5391
5392 if (len <= sizeof(*cp)) {
5393 status = MGMT_STATUS_INVALID_PARAMS;
5394 goto done;
5395 }
5396
5397 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5398 if (len != expected_size) {
5399 status = MGMT_STATUS_INVALID_PARAMS;
5400 goto done;
5401 }
5402
5403 m = kzalloc(sizeof(*m), GFP_KERNEL);
5404 if (!m) {
5405 status = MGMT_STATUS_NO_RESOURCES;
5406 goto done;
5407 }
5408
5409 INIT_LIST_HEAD(&m->patterns);
5410
5411 parse_adv_monitor_rssi(m, &cp->rssi);
5412 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5413
5414done:
a2a4dedf 5415 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
b4a221ea 5416 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
b139553d
MC		 5417}
5418
7cf5c297
MM		 5419static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5420 void *data, int status)
66bd095a
AP		 5421{
5422 struct mgmt_rp_remove_adv_monitor rp;
7cf5c297
MM		 5423 struct mgmt_pending_cmd *cmd = data;
5424 struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
66bd095a
AP		 5425
5426 hci_dev_lock(hdev);
5427
66bd095a
AP		 5428 rp.monitor_handle = cp->monitor_handle;
5429
5430 if (!status)
5bee2fd6 5431 hci_update_passive_scan(hdev);
66bd095a 5432
7cf5c297
MM		 5433 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5434 mgmt_status(status), &rp, sizeof(rp));
66bd095a
AP		 5435 mgmt_pending_remove(cmd);
5436
66bd095a 5437 hci_dev_unlock(hdev);
7cf5c297 5438 bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
66bd095a 5439 rp.monitor_handle, status);
7cf5c297 5440}
66bd095a 5441
7cf5c297
MM		 5442static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5443{
5444 struct mgmt_pending_cmd *cmd = data;
5445 struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5446 u16 handle = __le16_to_cpu(cp->monitor_handle);
5447
5448 if (!handle)
5449 return hci_remove_all_adv_monitor(hdev);
5450
5451 return hci_remove_single_adv_monitor(hdev, handle);
66bd095a
AP		 5452}
5453
bd2fbc6c
MC		 5454static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5455 void *data, u16 len)
5456{
66bd095a 5457 struct mgmt_pending_cmd *cmd;
66bd095a 5458 int err, status;
bd2fbc6c
MC		 5459
5460 hci_dev_lock(hdev);
5461
66bd095a
AP		 5462 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5463 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5464 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5465 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5466 status = MGMT_STATUS_BUSY;
5467 goto unlock;
5468 }
bd2fbc6c 5469
66bd095a
AP		 5470 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5471 if (!cmd) {
5472 status = MGMT_STATUS_NO_RESOURCES;
bd2fbc6c
MC		 5473 goto unlock;
5474 }
5475
88cd6e6b
CYL		 5476 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
5477 mgmt_remove_adv_monitor_complete);
cdde92e2 5478
66bd095a
AP		 5479 if (err) {
5480 mgmt_pending_remove(cmd);
bd2fbc6c 5481
7cf5c297
MM		 5482 if (err == -ENOMEM)
5483 status = MGMT_STATUS_NO_RESOURCES;
66bd095a
AP		 5484 else
5485 status = MGMT_STATUS_FAILED;
5486
7cf5c297 5487 goto unlock;
66bd095a 5488 }
bd2fbc6c 5489
66bd095a 5490 hci_dev_unlock(hdev);
7cf5c297 5491
66bd095a 5492 return 0;
bd2fbc6c
MC		 5493
5494unlock:
5495 hci_dev_unlock(hdev);
66bd095a
AP		 5496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5497 status);
bd2fbc6c
MC		 5498}
5499
f892244b 5500static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
1b9441f8
JH		 5501{
5502 struct mgmt_rp_read_local_oob_data mgmt_rp;
5503 size_t rp_size = sizeof(mgmt_rp);
f892244b
BG		 5504 struct mgmt_pending_cmd *cmd = data;
5505 struct sk_buff *skb = cmd->skb;
5506 u8 status = mgmt_status(err);
1b9441f8 5507
f892244b
BG		 5508 if (!status) {
5509 if (!skb)
5510 status = MGMT_STATUS_FAILED;
5511 else if (IS_ERR(skb))
5512 status = mgmt_status(PTR_ERR(skb));
5513 else
5514 status = mgmt_status(skb->data[0]);
5515 }
1b9441f8 5516
f892244b 5517 bt_dev_dbg(hdev, "status %d", status);
1b9441f8 5518
f892244b
BG		 5519 if (status) {
5520 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
1b9441f8
JH		 5521 goto remove;
5522 }
5523
5524 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5525
f892244b 5526 if (!bredr_sc_enabled(hdev)) {
1b9441f8
JH		 5527 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5528
5529 if (skb->len < sizeof(*rp)) {
5530 mgmt_cmd_status(cmd->sk, hdev->id,
5531 MGMT_OP_READ_LOCAL_OOB_DATA,
5532 MGMT_STATUS_FAILED);
5533 goto remove;
5534 }
5535
5536 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5537 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5538
5539 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5540 } else {
5541 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5542
5543 if (skb->len < sizeof(*rp)) {
5544 mgmt_cmd_status(cmd->sk, hdev->id,
5545 MGMT_OP_READ_LOCAL_OOB_DATA,
5546 MGMT_STATUS_FAILED);
5547 goto remove;
5548 }
5549
5550 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5551 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5552
5553 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5554 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5555 }
5556
5557 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5558 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5559
5560remove:
f892244b
BG		 5561 if (skb && !IS_ERR(skb))
5562 kfree_skb(skb);
5563
5564 mgmt_pending_free(cmd);
5565}
5566
5567static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5568{
5569 struct mgmt_pending_cmd *cmd = data;
5570
5571 if (bredr_sc_enabled(hdev))
5572 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5573 else
5574 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5575
5576 if (IS_ERR(cmd->skb))
5577 return PTR_ERR(cmd->skb);
5578 else
5579 return 0;
1b9441f8
JH		 5580}
5581
0f4e68cf 5582static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 5583 void *data, u16 data_len)
c35938b2 5584{
3b0602cd 5585 struct mgmt_pending_cmd *cmd;
c35938b2
SJ		 5586 int err;
5587
181d6953 5588 bt_dev_dbg(hdev, "sock %p", sk);
c35938b2 5589
09fd0de5 5590 hci_dev_lock(hdev);
c35938b2 5591
4b34ee78 5592 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 5593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5594 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 5595 goto unlock;
5596 }
5597
9a1a1996 5598 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 5599 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5600 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 5601 goto unlock;
5602 }
5603
f892244b
BG		 5604 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5605 if (!cmd)
c35938b2 5606 err = -ENOMEM;
4d2d2796 5607 else
f892244b
BG		 5608 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5609 read_local_oob_data_complete);
4d2d2796 5610
f892244b
BG		 5611 if (err < 0) {
5612 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5613 MGMT_STATUS_FAILED);
5614
5615 if (cmd)
5616 mgmt_pending_free(cmd);
5617 }
c35938b2
SJ		 5618
5619unlock:
09fd0de5 5620 hci_dev_unlock(hdev);
c35938b2
SJ		 5621 return err;
5622}
5623
bdb6d971 5624static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 5625 void *data, u16 len)
2763eda6 5626{
5d57e796 5627 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 5628 int err;
5629
181d6953 5630 bt_dev_dbg(hdev, "sock %p", sk);
2763eda6 5631
5d57e796 5632 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 5633 return mgmt_cmd_complete(sk, hdev->id,
5634 MGMT_OP_ADD_REMOTE_OOB_DATA,
5635 MGMT_STATUS_INVALID_PARAMS,
5636 addr, sizeof(*addr));
5d57e796 5637
09fd0de5 5638 hci_dev_lock(hdev);
2763eda6 5639
ec109113
MH		 5640 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5641 struct mgmt_cp_add_remote_oob_data *cp = data;
5642 u8 status;
bf1e3541 5643
c19a495c 5644 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 5645 err = mgmt_cmd_complete(sk, hdev->id,
5646 MGMT_OP_ADD_REMOTE_OOB_DATA,
5647 MGMT_STATUS_INVALID_PARAMS,
5648 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 5649 goto unlock;
5650 }
5651
ec109113 5652 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 5653 cp->addr.type, cp->hash,
5654 cp->rand, NULL, NULL);
ec109113
MH		 5655 if (err < 0)
5656 status = MGMT_STATUS_FAILED;
5657 else
5658 status = MGMT_STATUS_SUCCESS;
5659
2a1afb5a
JH		 5660 err = mgmt_cmd_complete(sk, hdev->id,
5661 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5662 &cp->addr, sizeof(cp->addr));
ec109113
MH		 5663 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5664 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 5665 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 5666 u8 status;
5667
86df9200 5668 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 5669 /* Enforce zero-valued 192-bit parameters as
5670 * long as legacy SMP OOB isn't implemented.
5671 */
5672 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5673 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 5674 err = mgmt_cmd_complete(sk, hdev->id,
5675 MGMT_OP_ADD_REMOTE_OOB_DATA,
5676 MGMT_STATUS_INVALID_PARAMS,
5677 addr, sizeof(*addr));
d25b78e2
JH		 5678 goto unlock;
5679 }
5680
86df9200
JH		 5681 rand192 = NULL;
5682 hash192 = NULL;
5683 } else {
41bcfd50
MH		 5684 /* In case one of the P-192 values is set to zero,
5685 * then just disable OOB data for P-192.
5686 */
5687 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5688 !memcmp(cp->hash192, ZERO_KEY, 16)) {
5689 rand192 = NULL;
5690 hash192 = NULL;
5691 } else {
5692 rand192 = cp->rand192;
5693 hash192 = cp->hash192;
5694 }
5695 }
5696
5697 /* In case one of the P-256 values is set to zero, then just
5698 * disable OOB data for P-256.
5699 */
5700 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5701 !memcmp(cp->hash256, ZERO_KEY, 16)) {
5702 rand256 = NULL;
5703 hash256 = NULL;
5704 } else {
5705 rand256 = cp->rand256;
5706 hash256 = cp->hash256;
86df9200
JH		 5707 }
5708
81328d5c 5709 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 5710 cp->addr.type, hash192, rand192,
41bcfd50 5711 hash256, rand256);
ec109113
MH		 5712 if (err < 0)
5713 status = MGMT_STATUS_FAILED;
5714 else
5715 status = MGMT_STATUS_SUCCESS;
5716
2a1afb5a
JH		 5717 err = mgmt_cmd_complete(sk, hdev->id,
5718 MGMT_OP_ADD_REMOTE_OOB_DATA,
5719 status, &cp->addr, sizeof(cp->addr));
ec109113 5720 } else {
2064ee33
MH		 5721 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5722 len);
a69e8375
JH		 5723 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5724 MGMT_STATUS_INVALID_PARAMS);
ec109113 5725 }
2763eda6 5726
c19a495c 5727unlock:
09fd0de5 5728 hci_dev_unlock(hdev);
2763eda6
SJ		 5729 return err;
5730}
5731
bdb6d971 5732static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 5733 void *data, u16 len)
2763eda6 5734{
650f726d 5735 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 5736 u8 status;
2763eda6
SJ		 5737 int err;
5738
181d6953 5739 bt_dev_dbg(hdev, "sock %p", sk);
2763eda6 5740
c19a495c 5741 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 5742 return mgmt_cmd_complete(sk, hdev->id,
5743 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5744 MGMT_STATUS_INVALID_PARAMS,
5745 &cp->addr, sizeof(cp->addr));
c19a495c 5746
09fd0de5 5747 hci_dev_lock(hdev);
2763eda6 5748
eedbd581
JH		 5749 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5750 hci_remote_oob_data_clear(hdev);
5751 status = MGMT_STATUS_SUCCESS;
5752 goto done;
5753 }
5754
6928a924 5755 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 5756 if (err < 0)
bf1e3541 5757 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 5758 else
a6785be2 5759 status = MGMT_STATUS_SUCCESS;
bf1e3541 5760
eedbd581 5761done:
2a1afb5a
JH		 5762 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5763 status, &cp->addr, sizeof(cp->addr));
2763eda6 5764
09fd0de5 5765 hci_dev_unlock(hdev);
2763eda6
SJ		 5766 return err;
5767}
5768
e68f072b 5769void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
7c307720 5770{
3b0602cd 5771 struct mgmt_pending_cmd *cmd;
ae55f598 5772
85d67284 5773 bt_dev_dbg(hdev, "status %u", status);
7c307720 5774
11e6e25d 5775 hci_dev_lock(hdev);
41dc2bd6 5776
333ae95d 5777 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 5778 if (!cmd)
333ae95d 5779 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 5780
78b781ca
JH		 5781 if (!cmd)
5782 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5783
11e6e25d 5784 if (cmd) {
2922a94f 5785 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 5786 mgmt_pending_remove(cmd);
5787 }
7c307720 5788
11e6e25d 5789 hci_dev_unlock(hdev);
7c307720
AG		 5790}
5791
591752af
JH		 5792static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5793 uint8_t *mgmt_status)
5794{
5795 switch (type) {
5796 case DISCOV_TYPE_LE:
5797 *mgmt_status = mgmt_le_support(hdev);
5798 if (*mgmt_status)
5799 return false;
5800 break;
5801 case DISCOV_TYPE_INTERLEAVED:
5802 *mgmt_status = mgmt_le_support(hdev);
5803 if (*mgmt_status)
5804 return false;
19186c7b 5805 fallthrough;
591752af
JH		 5806 case DISCOV_TYPE_BREDR:
5807 *mgmt_status = mgmt_bredr_support(hdev);
5808 if (*mgmt_status)
5809 return false;
5810 break;
5811 default:
5812 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5813 return false;
5814 }
5815
5816 return true;
5817}
5818
abfeea47
LAD		 5819static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5820{
5821 struct mgmt_pending_cmd *cmd = data;
5822
275f3f64
BG		 5823 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5824 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5825 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5826 return;
5827
abfeea47
LAD		 5828 bt_dev_dbg(hdev, "err %d", err);
5829
5830 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5831 cmd->param, 1);
275f3f64 5832 mgmt_pending_remove(cmd);
abfeea47 5833
182ee45d 5834 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
abfeea47
LAD		 5835 DISCOVERY_FINDING);
5836}
5837
5838static int start_discovery_sync(struct hci_dev *hdev, void *data)
5839{
5840 return hci_start_discovery_sync(hdev);
5841}
5842
78b781ca
JH		 5843static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5844 u16 op, void *data, u16 len)
14a53664 5845{
650f726d 5846 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 5847 struct mgmt_pending_cmd *cmd;
8019044d 5848 u8 status;
14a53664
JH		 5849 int err;
5850
181d6953 5851 bt_dev_dbg(hdev, "sock %p", sk);
14a53664 5852
09fd0de5 5853 hci_dev_lock(hdev);
14a53664 5854
4b34ee78 5855 if (!hdev_is_powered(hdev)) {
78b781ca 5856 err = mgmt_cmd_complete(sk, hdev->id, op,
2a1afb5a
JH		 5857 MGMT_STATUS_NOT_POWERED,
5858 &cp->type, sizeof(cp->type));
bd2d1334
JH		 5859 goto failed;
5860 }
5861
f5a969f2 5862 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 5863 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
78b781ca
JH		 5864 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5865 &cp->type, sizeof(cp->type));
642be6c7
AG		 5866 goto failed;
5867 }
5868
591752af 5869 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
78b781ca
JH		 5870 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5871 &cp->type, sizeof(cp->type));
591752af
JH		 5872 goto failed;
5873 }
5874
4867bd00
APS		 5875 /* Can't start discovery when it is paused */
5876 if (hdev->discovery_paused) {
5877 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5878 &cp->type, sizeof(cp->type));
5879 goto failed;
5880 }
5881
22078800
MH		 5882 /* Clear the discovery filter first to free any previously
5883 * allocated memory for the UUID list.
5884 */
5885 hci_discovery_filter_clear(hdev);
5886
4aab14e5 5887 hdev->discovery.type = cp->type;
da25cf6a 5888 hdev->discovery.report_invalid_rssi = false;
78b781ca
JH		 5889 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5890 hdev->discovery.limited = true;
5891 else
5892 hdev->discovery.limited = false;
4aab14e5 5893
275f3f64 5894 cmd = mgmt_pending_add(sk, op, hdev, data, len);
e68f072b
JH		 5895 if (!cmd) {
5896 err = -ENOMEM;
04106755 5897 goto failed;
f39799f5 5898 }
04106755 5899
abfeea47
LAD		 5900 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5901 start_discovery_complete);
5902 if (err < 0) {
275f3f64 5903 mgmt_pending_remove(cmd);
abfeea47
LAD		 5904 goto failed;
5905 }
7c307720 5906
f5a969f2 5907 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 5908
14a53664 5909failed:
09fd0de5 5910 hci_dev_unlock(hdev);
14a53664
JH		 5911 return err;
5912}
f39799f5 5913
78b781ca
JH		 5914static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5915 void *data, u16 len)
5916{
5917 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5918 data, len);
5919}
5920
5921static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5922 void *data, u16 len)
5923{
5924 return start_discovery_internal(sk, hdev,
5925 MGMT_OP_START_LIMITED_DISCOVERY,
5926 data, len);
5927}
5928
66ea9427
JP		 5929static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5930 void *data, u16 len)
5931{
5932 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 5933 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 5934 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5935 u16 uuid_count, expected_len;
5936 u8 status;
5937 int err;
04106755 5938
181d6953 5939 bt_dev_dbg(hdev, "sock %p", sk);
e8bb6b97 5940
66ea9427 5941 hci_dev_lock(hdev);
7c307720 5942
66ea9427 5943 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5944 err = mgmt_cmd_complete(sk, hdev->id,
5945 MGMT_OP_START_SERVICE_DISCOVERY,
5946 MGMT_STATUS_NOT_POWERED,
5947 &cp->type, sizeof(cp->type));
66ea9427
JP		 5948 goto failed;
5949 }
7c307720 5950
66ea9427 5951 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 5952 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
36211f7f
APS		 5953 err = mgmt_cmd_complete(sk, hdev->id,
5954 MGMT_OP_START_SERVICE_DISCOVERY,
5955 MGMT_STATUS_BUSY, &cp->type,
5956 sizeof(cp->type));
5957 goto failed;
5958 }
5959
5960 if (hdev->discovery_paused) {
2a1afb5a
JH		 5961 err = mgmt_cmd_complete(sk, hdev->id,
5962 MGMT_OP_START_SERVICE_DISCOVERY,
5963 MGMT_STATUS_BUSY, &cp->type,
5964 sizeof(cp->type));
66ea9427
JP		 5965 goto failed;
5966 }
d9483943 5967
66ea9427
JP		 5968 uuid_count = __le16_to_cpu(cp->uuid_count);
5969 if (uuid_count > max_uuid_count) {
2064ee33
MH		 5970 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5971 uuid_count);
2a1afb5a
JH		 5972 err = mgmt_cmd_complete(sk, hdev->id,
5973 MGMT_OP_START_SERVICE_DISCOVERY,
5974 MGMT_STATUS_INVALID_PARAMS, &cp->type,
5975 sizeof(cp->type));
66ea9427
JP		 5976 goto failed;
5977 }
5978
5979 expected_len = sizeof(*cp) + uuid_count * 16;
5980 if (expected_len != len) {
2064ee33
MH		 5981 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5982 expected_len, len);
2a1afb5a
JH		 5983 err = mgmt_cmd_complete(sk, hdev->id,
5984 MGMT_OP_START_SERVICE_DISCOVERY,
5985 MGMT_STATUS_INVALID_PARAMS, &cp->type,
5986 sizeof(cp->type));
66ea9427
JP		 5987 goto failed;
5988 }
5989
591752af
JH		 5990 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5991 err = mgmt_cmd_complete(sk, hdev->id,
5992 MGMT_OP_START_SERVICE_DISCOVERY,
5993 status, &cp->type, sizeof(cp->type));
5994 goto failed;
5995 }
5996
275f3f64 5997 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 5998 hdev, data, len);
66ea9427
JP		 5999 if (!cmd) {
6000 err = -ENOMEM;
6001 goto failed;
6002 }
6003
22078800
MH		 6004 /* Clear the discovery filter first to free any previously
6005 * allocated memory for the UUID list.
6006 */
6007 hci_discovery_filter_clear(hdev);
6008
82f8b651 6009 hdev->discovery.result_filtering = true;
66ea9427
JP		 6010 hdev->discovery.type = cp->type;
6011 hdev->discovery.rssi = cp->rssi;
6012 hdev->discovery.uuid_count = uuid_count;
6013
6014 if (uuid_count > 0) {
6015 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6016 GFP_KERNEL);
6017 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 6018 err = mgmt_cmd_complete(sk, hdev->id,
6019 MGMT_OP_START_SERVICE_DISCOVERY,
6020 MGMT_STATUS_FAILED,
6021 &cp->type, sizeof(cp->type));
d9483943
JH		 6022 mgmt_pending_remove(cmd);
6023 goto failed;
6024 }
66ea9427 6025 }
d9483943 6026
abfeea47
LAD		 6027 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6028 start_discovery_complete);
6029 if (err < 0) {
275f3f64 6030 mgmt_pending_remove(cmd);
abfeea47
LAD		 6031 goto failed;
6032 }
6033
66ea9427 6034 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 6035
6036failed:
09fd0de5 6037 hci_dev_unlock(hdev);
14a53664
JH		 6038 return err;
6039}
6040
2154d3f4 6041void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
1183fdca 6042{
3b0602cd 6043 struct mgmt_pending_cmd *cmd;
1183fdca 6044
85d67284 6045 bt_dev_dbg(hdev, "status %u", status);
0e05bba6
AG		 6046
6047 hci_dev_lock(hdev);
6048
333ae95d 6049 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 6050 if (cmd) {
2922a94f 6051 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 6052 mgmt_pending_remove(cmd);
0e05bba6
AG		 6053 }
6054
0e05bba6
AG		 6055 hci_dev_unlock(hdev);
6056}
6057
abfeea47
LAD		 6058static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6059{
6060 struct mgmt_pending_cmd *cmd = data;
6061
275f3f64
BG		 6062 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6063 return;
6064
abfeea47
LAD		 6065 bt_dev_dbg(hdev, "err %d", err);
6066
6067 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6068 cmd->param, 1);
275f3f64 6069 mgmt_pending_remove(cmd);
abfeea47 6070
abfeea47
LAD		 6071 if (!err)
6072 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6073}
6074
6075static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6076{
6077 return hci_stop_discovery_sync(hdev);
6078}
6079
bdb6d971 6080static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 6081 u16 len)
14a53664 6082{
d930650b 6083 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 6084 struct mgmt_pending_cmd *cmd;
14a53664
JH		 6085 int err;
6086
181d6953 6087 bt_dev_dbg(hdev, "sock %p", sk);
14a53664 6088
09fd0de5 6089 hci_dev_lock(hdev);
14a53664 6090
30dc78e1 6091 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 6092 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6093 MGMT_STATUS_REJECTED, &mgmt_cp->type,
6094 sizeof(mgmt_cp->type));
d930650b
JH		 6095 goto unlock;
6096 }
6097
6098 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 6099 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6100 MGMT_STATUS_INVALID_PARAMS,
6101 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 6102 goto unlock;
ff9ef578
JH		 6103 }
6104
275f3f64 6105 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 6106 if (!cmd) {
6107 err = -ENOMEM;
30dc78e1
JH		 6108 goto unlock;
6109 }
6110
abfeea47
LAD		 6111 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6112 stop_discovery_complete);
6113 if (err < 0) {
275f3f64 6114 mgmt_pending_remove(cmd);
abfeea47
LAD		 6115 goto unlock;
6116 }
2922a94f 6117
2154d3f4 6118 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
14a53664 6119
30dc78e1 6120unlock:
09fd0de5 6121 hci_dev_unlock(hdev);
14a53664
JH		 6122 return err;
6123}
6124
bdb6d971 6125static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 6126 u16 len)
561aafbc 6127{
650f726d 6128 struct mgmt_cp_confirm_name *cp = data;
561aafbc 6129 struct inquiry_entry *e;
561aafbc
JH		 6130 int err;
6131
181d6953 6132 bt_dev_dbg(hdev, "sock %p", sk);
561aafbc 6133
561aafbc
JH		 6134 hci_dev_lock(hdev);
6135
30dc78e1 6136 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 6137 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6138 MGMT_STATUS_FAILED, &cp->addr,
6139 sizeof(cp->addr));
30dc78e1
JH		 6140 goto failed;
6141 }
6142
a198e7b1 6143 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 6144 if (!e) {
2a1afb5a
JH		 6145 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6146 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6147 sizeof(cp->addr));
561aafbc
JH		 6148 goto failed;
6149 }
6150
6151 if (cp->name_known) {
6152 e->name_state = NAME_KNOWN;
6153 list_del(&e->list);
6154 } else {
6155 e->name_state = NAME_NEEDED;
a3d4e20a 6156 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 6157 }
6158
2a1afb5a
JH		 6159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6160 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 6161
6162failed:
6163 hci_dev_unlock(hdev);
561aafbc
JH		 6164 return err;
6165}
6166
bdb6d971 6167static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 6168 u16 len)
7fbec224 6169{
650f726d 6170 struct mgmt_cp_block_device *cp = data;
f0eeea8b 6171 u8 status;
7fbec224
AJ		 6172 int err;
6173
181d6953 6174 bt_dev_dbg(hdev, "sock %p", sk);
7fbec224 6175
4ee71b20 6176 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 6177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6178 MGMT_STATUS_INVALID_PARAMS,
6179 &cp->addr, sizeof(cp->addr));
4ee71b20 6180
09fd0de5 6181 hci_dev_lock(hdev);
5e762444 6182
3d4f9c00 6183 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
dcc36c16 6184 cp->addr.type);
2a8357f2 6185 if (err < 0) {
f0eeea8b 6186 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 6187 goto done;
6188 }
6189
6190 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6191 sk);
6192 status = MGMT_STATUS_SUCCESS;
f0eeea8b 6193
2a8357f2 6194done:
2a1afb5a
JH		 6195 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6196 &cp->addr, sizeof(cp->addr));
5e762444 6197
09fd0de5 6198 hci_dev_unlock(hdev);
7fbec224
AJ		 6199
6200 return err;
6201}
6202
bdb6d971 6203static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 6204 u16 len)
7fbec224 6205{
650f726d 6206 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 6207 u8 status;
7fbec224
AJ		 6208 int err;
6209
181d6953 6210 bt_dev_dbg(hdev, "sock %p", sk);
7fbec224 6211
4ee71b20 6212 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 6213 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6214 MGMT_STATUS_INVALID_PARAMS,
6215 &cp->addr, sizeof(cp->addr));
4ee71b20 6216
09fd0de5 6217 hci_dev_lock(hdev);
5e762444 6218
3d4f9c00 6219 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
dcc36c16 6220 cp->addr.type);
2a8357f2 6221 if (err < 0) {
f0eeea8b 6222 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 6223 goto done;
6224 }
6225
6226 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6227 sk);
6228 status = MGMT_STATUS_SUCCESS;
f0eeea8b 6229
2a8357f2 6230done:
2a1afb5a
JH		 6231 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6232 &cp->addr, sizeof(cp->addr));
5e762444 6233
09fd0de5 6234 hci_dev_unlock(hdev);
7fbec224
AJ		 6235
6236 return err;
6237}
6238
161510cc
LAD		 6239static int set_device_id_sync(struct hci_dev *hdev, void *data)
6240{
6241 return hci_update_eir_sync(hdev);
6242}
6243
cdbaccca
MH		 6244static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6245 u16 len)
6246{
6247 struct mgmt_cp_set_device_id *cp = data;
6248 int err;
c72d4b8a 6249 __u16 source;
cdbaccca 6250
181d6953 6251 bt_dev_dbg(hdev, "sock %p", sk);
cdbaccca 6252
c72d4b8a
SJ		 6253 source = __le16_to_cpu(cp->source);
6254
6255 if (source > 0x0002)
a69e8375
JH		 6256 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6257 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 6258
cdbaccca
MH		 6259 hci_dev_lock(hdev);
6260
c72d4b8a 6261 hdev->devid_source = source;
cdbaccca
MH		 6262 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6263 hdev->devid_product = __le16_to_cpu(cp->product);
6264 hdev->devid_version = __le16_to_cpu(cp->version);
6265
2a1afb5a
JH		 6266 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6267 NULL, 0);
cdbaccca 6268
161510cc 6269 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
cdbaccca
MH		 6270
6271 hci_dev_unlock(hdev);
6272
6273 return err;
6274}
6275
26ac4c56 6276static void enable_advertising_instance(struct hci_dev *hdev, int err)
24b4f38f 6277{
26ac4c56
BG		 6278 if (err)
6279 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6280 else
6281 bt_dev_dbg(hdev, "status %d", err);
24b4f38f
AU		 6282}
6283
26ac4c56 6284static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
4375f103
JH		 6285{
6286 struct cmd_lookup match = { NULL, hdev };
7816b820
FG		 6287 u8 instance;
6288 struct adv_info *adv_instance;
26ac4c56 6289 u8 status = mgmt_status(err);
3ad67582 6290
4375f103 6291 if (status) {
4375f103 6292 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
26ac4c56
BG		 6293 cmd_status_rsp, &status);
6294 return;
4375f103
JH		 6295 }
6296
d7a5a11d 6297 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 6298 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 6299 else
a358dc11 6300 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 6301
4375f103
JH		 6302 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6303 &match);
6304
6305 new_settings(hdev, match.sk);
6306
6307 if (match.sk)
6308 sock_put(match.sk);
3ad67582 6309
24b4f38f 6310 /* If "Set Advertising" was just disabled and instance advertising was
7816b820 6311 * set up earlier, then re-enable multi-instance advertising.
24b4f38f
AU		 6312 */
6313 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7816b820 6314 list_empty(&hdev->adv_instances))
26ac4c56 6315 return;
24b4f38f 6316
7816b820
FG		 6317 instance = hdev->cur_adv_instance;
6318 if (!instance) {
6319 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6320 struct adv_info, list);
6321 if (!adv_instance)
26ac4c56 6322 return;
7816b820
FG		 6323
6324 instance = adv_instance->instance;
6325 }
6326
26ac4c56 6327 err = hci_schedule_adv_instance_sync(hdev, instance, true);
24b4f38f 6328
26ac4c56
BG		 6329 enable_advertising_instance(hdev, err);
6330}
7816b820 6331
26ac4c56
BG		 6332static int set_adv_sync(struct hci_dev *hdev, void *data)
6333{
6334 struct mgmt_pending_cmd *cmd = data;
6335 struct mgmt_mode *cp = cmd->param;
6336 u8 val = !!cp->val;
24b4f38f 6337
26ac4c56
BG		 6338 if (cp->val == 0x02)
6339 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6340 else
6341 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
24b4f38f 6342
26ac4c56
BG		 6343 cancel_adv_timeout(hdev);
6344
6345 if (val) {
6346 /* Switch to instance "0" for the Set Advertising setting.
6347 * We cannot use update_[adv|scan_rsp]_data() here as the
6348 * HCI_ADVERTISING flag is not yet set.
6349 */
6350 hdev->cur_adv_instance = 0x00;
6351
6352 if (ext_adv_capable(hdev)) {
6353 hci_start_ext_adv_sync(hdev, 0x00);
6354 } else {
6355 hci_update_adv_data_sync(hdev, 0x00);
6356 hci_update_scan_rsp_data_sync(hdev, 0x00);
6357 hci_enable_advertising_sync(hdev);
6358 }
6359 } else {
6360 hci_disable_advertising_sync(hdev);
6361 }
6362
6363 return 0;
4375f103
JH		 6364}
6365
21b5187f
MH		 6366static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6367 u16 len)
4375f103
JH		 6368{
6369 struct mgmt_mode *cp = data;
3b0602cd 6370 struct mgmt_pending_cmd *cmd;
cc91cb04 6371 u8 val, status;
4375f103
JH		 6372 int err;
6373
181d6953 6374 bt_dev_dbg(hdev, "sock %p", sk);
4375f103 6375
e6fe7986
JH		 6376 status = mgmt_le_support(hdev);
6377 if (status)
a69e8375
JH		 6378 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6379 status);
4375f103 6380
cc91cb04 6381 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 6382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6383 MGMT_STATUS_INVALID_PARAMS);
4375f103 6384
4867bd00
APS		 6385 if (hdev->advertising_paused)
6386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6387 MGMT_STATUS_BUSY);
6388
4375f103
JH		 6389 hci_dev_lock(hdev);
6390
6391 val = !!cp->val;
4375f103 6392
f74ca9b8
JH		 6393 /* The following conditions are ones which mean that we should
6394 * not do any HCI communication but directly send a mgmt
6395 * response to user space (after toggling the flag if
6396 * necessary).
6397 */
cc91cb04 6398 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 6399 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6400 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
b338d917 6401 hci_dev_test_flag(hdev, HCI_MESH) ||
e8bb6b97 6402 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 6403 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 6404 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 6405 bool changed;
4375f103 6406
cc91cb04 6407 if (cp->val) {
cab054ab 6408 hdev->cur_adv_instance = 0x00;
238be788 6409 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 6410 if (cp->val == 0x02)
a1536da2 6411 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 6412 else
a358dc11 6413 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 6414 } else {
a69d8927 6415 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 6416 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 6417 }
6418
6419 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6420 if (err < 0)
6421 goto unlock;
6422
6423 if (changed)
6424 err = new_settings(hdev, sk);
6425
6426 goto unlock;
6427 }
6428
333ae95d
JH		 6429 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6430 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 6431 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6432 MGMT_STATUS_BUSY);
4375f103
JH		 6433 goto unlock;
6434 }
6435
6436 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
26ac4c56 6437 if (!cmd)
4375f103 6438 err = -ENOMEM;
cc91cb04 6439 else
26ac4c56
BG		 6440 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6441 set_advertising_complete);
de181e88 6442
26ac4c56 6443 if (err < 0 && cmd)
4375f103
JH		 6444 mgmt_pending_remove(cmd);
6445
6446unlock:
6447 hci_dev_unlock(hdev);
6448 return err;
6449}
6450
d13eafce
MH		 6451static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6452 void *data, u16 len)
6453{
6454 struct mgmt_cp_set_static_address *cp = data;
6455 int err;
6456
181d6953 6457 bt_dev_dbg(hdev, "sock %p", sk);
d13eafce 6458
62af4443 6459 if (!lmp_le_capable(hdev))
a69e8375
JH		 6460 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6461 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 6462
6463 if (hdev_is_powered(hdev))
a69e8375
JH		 6464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6465 MGMT_STATUS_REJECTED);
d13eafce
MH		 6466
6467 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6468 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 6469 return mgmt_cmd_status(sk, hdev->id,
6470 MGMT_OP_SET_STATIC_ADDRESS,
6471 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 6472
6473 /* Two most significant bits shall be set */
6474 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 6475 return mgmt_cmd_status(sk, hdev->id,
6476 MGMT_OP_SET_STATIC_ADDRESS,
6477 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 6478 }
6479
6480 hci_dev_lock(hdev);
6481
6482 bacpy(&hdev->static_addr, &cp->bdaddr);
6483
93690c22
MH		 6484 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6485 if (err < 0)
6486 goto unlock;
6487
6488 err = new_settings(hdev, sk);
d13eafce 6489
93690c22 6490unlock:
d13eafce 6491 hci_dev_unlock(hdev);
d13eafce
MH		 6492 return err;
6493}
6494
14b49b9a
MH		 6495static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6496 void *data, u16 len)
6497{
6498 struct mgmt_cp_set_scan_params *cp = data;
6499 __u16 interval, window;
6500 int err;
6501
181d6953 6502 bt_dev_dbg(hdev, "sock %p", sk);
14b49b9a
MH		 6503
6504 if (!lmp_le_capable(hdev))
a69e8375
JH		 6505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6506 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 6507
6508 interval = __le16_to_cpu(cp->interval);
6509
6510 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 6511 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6512 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 6513
6514 window = __le16_to_cpu(cp->window);
6515
6516 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 6517 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6518 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 6519
899e1075 6520 if (window > interval)
a69e8375
JH		 6521 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6522 MGMT_STATUS_INVALID_PARAMS);
899e1075 6523
14b49b9a
MH		 6524 hci_dev_lock(hdev);
6525
6526 hdev->le_scan_interval = interval;
6527 hdev->le_scan_window = window;
6528
2a1afb5a
JH		 6529 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6530 NULL, 0);
14b49b9a 6531
dd2ef8e2
AG		 6532 /* If background scan is running, restart it so new parameters are
6533 * loaded.
6534 */
d7a5a11d 6535 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
abfeea47
LAD		 6536 hdev->discovery.state == DISCOVERY_STOPPED)
6537 hci_update_passive_scan(hdev);
dd2ef8e2 6538
14b49b9a
MH		 6539 hci_dev_unlock(hdev);
6540
6541 return err;
6542}
6543
353a0249 6544static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
33e38b3e 6545{
353a0249 6546 struct mgmt_pending_cmd *cmd = data;
33e38b3e 6547
353a0249 6548 bt_dev_dbg(hdev, "err %d", err);
33e38b3e 6549
353a0249 6550 if (err) {
a69e8375 6551 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
353a0249 6552 mgmt_status(err));
33e38b3e 6553 } else {
1a4d3c4b
JH		 6554 struct mgmt_mode *cp = cmd->param;
6555
6556 if (cp->val)
a1536da2 6557 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 6558 else
a358dc11 6559 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 6560
33e38b3e
JH		 6561 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6562 new_settings(hdev, cmd->sk);
6563 }
6564
353a0249
BG		 6565 mgmt_pending_free(cmd);
6566}
33e38b3e 6567
353a0249
BG		 6568static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6569{
6570 struct mgmt_pending_cmd *cmd = data;
6571 struct mgmt_mode *cp = cmd->param;
6572
6573 return hci_write_fast_connectable_sync(hdev, cp->val);
33e38b3e
JH		 6574}
6575
bdb6d971 6576static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 6577 void *data, u16 len)
f6422ec6 6578{
650f726d 6579 struct mgmt_mode *cp = data;
3b0602cd 6580 struct mgmt_pending_cmd *cmd;
f6422ec6
AJ		 6581 int err;
6582
181d6953 6583 bt_dev_dbg(hdev, "sock %p", sk);
f6422ec6 6584
d7a5a11d 6585 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 6586 hdev->hci_ver < BLUETOOTH_VER_1_2)
353a0249
BG		 6587 return mgmt_cmd_status(sk, hdev->id,
6588 MGMT_OP_SET_FAST_CONNECTABLE,
a69e8375 6589 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 6590
a7e80f25 6591 if (cp->val != 0x00 && cp->val != 0x01)
353a0249
BG		 6592 return mgmt_cmd_status(sk, hdev->id,
6593 MGMT_OP_SET_FAST_CONNECTABLE,
a69e8375 6594 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 6595
f6422ec6
AJ		 6596 hci_dev_lock(hdev);
6597
d7a5a11d 6598 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
353a0249 6599 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
1a4d3c4b
JH		 6600 goto unlock;
6601 }
6602
406ef2a6 6603 if (!hdev_is_powered(hdev)) {
ce05d603 6604 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
353a0249 6605 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
406ef2a6
JH		 6606 new_settings(hdev, sk);
6607 goto unlock;
6608 }
6609
353a0249
BG		 6610 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6611 len);
6612 if (!cmd)
33e38b3e 6613 err = -ENOMEM;
353a0249
BG		 6614 else
6615 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6616 fast_connectable_complete);
f6422ec6 6617
353a0249
BG		 6618 if (err < 0) {
6619 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6620 MGMT_STATUS_FAILED);
33e38b3e 6621
353a0249
BG		 6622 if (cmd)
6623 mgmt_pending_free(cmd);
f6422ec6
AJ		 6624 }
6625
33e38b3e 6626unlock:
f6422ec6 6627 hci_dev_unlock(hdev);
33e38b3e 6628
f6422ec6
AJ		 6629 return err;
6630}
6631
451d95a9 6632static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
0663ca2a 6633{
451d95a9 6634 struct mgmt_pending_cmd *cmd = data;
0663ca2a 6635
451d95a9 6636 bt_dev_dbg(hdev, "err %d", err);
0663ca2a 6637
451d95a9
BG		 6638 if (err) {
6639 u8 mgmt_err = mgmt_status(err);
0663ca2a
JH		 6640
6641 /* We need to restore the flag if related HCI commands
6642 * failed.
6643 */
a358dc11 6644 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 6645
a69e8375 6646 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 6647 } else {
6648 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6649 new_settings(hdev, cmd->sk);
6650 }
6651
451d95a9
BG		 6652 mgmt_pending_free(cmd);
6653}
0663ca2a 6654
451d95a9
BG		 6655static int set_bredr_sync(struct hci_dev *hdev, void *data)
6656{
6657 int status;
6658
6659 status = hci_write_fast_connectable_sync(hdev, false);
6660
6661 if (!status)
6662 status = hci_update_scan_sync(hdev);
6663
6664 /* Since only the advertising data flags will change, there
6665 * is no need to update the scan response data.
6666 */
6667 if (!status)
6668 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6669
6670 return status;
0663ca2a
JH		 6671}
6672
6673static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6674{
6675 struct mgmt_mode *cp = data;
3b0602cd 6676 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 6677 int err;
6678
181d6953 6679 bt_dev_dbg(hdev, "sock %p", sk);
0663ca2a
JH		 6680
6681 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 6682 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6683 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 6684
d7a5a11d 6685 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 6686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6687 MGMT_STATUS_REJECTED);
0663ca2a
JH		 6688
6689 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 6690 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6691 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 6692
6693 hci_dev_lock(hdev);
6694
d7a5a11d 6695 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 6696 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6697 goto unlock;
6698 }
6699
6700 if (!hdev_is_powered(hdev)) {
6701 if (!cp->val) {
a358dc11
MH		 6702 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6703 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6704 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6705 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
0663ca2a
JH		 6706 }
6707
ce05d603 6708 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 6709
6710 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6711 if (err < 0)
6712 goto unlock;
6713
6714 err = new_settings(hdev, sk);
6715 goto unlock;
6716 }
6717
6718 /* Reject disabling when powered on */
6719 if (!cp->val) {
a69e8375
JH		 6720 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6721 MGMT_STATUS_REJECTED);
0663ca2a 6722 goto unlock;
111e4bcc
MH		 6723 } else {
6724 /* When configuring a dual-mode controller to operate
6725 * with LE only and using a static address, then switching
6726 * BR/EDR back on is not allowed.
6727 *
6728 * Dual-mode controllers shall operate with the public
6729 * address as its identity address for BR/EDR and LE. So
6730 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 6731 *
6732 * The same restrictions applies when secure connections
6733 * has been enabled. For BR/EDR this is a controller feature
6734 * while for LE it is a host stack feature. This means that
6735 * switching BR/EDR back on when secure connections has been
6736 * enabled is not a supported transaction.
111e4bcc 6737 */
d7a5a11d 6738 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 6739 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 6740 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6742 MGMT_STATUS_REJECTED);
111e4bcc
MH		 6743 goto unlock;
6744 }
0663ca2a
JH		 6745 }
6746
451d95a9
BG		 6747 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6748 if (!cmd)
0663ca2a 6749 err = -ENOMEM;
451d95a9
BG		 6750 else
6751 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6752 set_bredr_complete);
6753
6754 if (err < 0) {
6755 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6756 MGMT_STATUS_FAILED);
6757 if (cmd)
6758 mgmt_pending_free(cmd);
6759
0663ca2a
JH		 6760 goto unlock;
6761 }
6762
f2252570
JH		 6763 /* We need to flip the bit already here so that
6764 * hci_req_update_adv_data generates the correct flags.
0663ca2a 6765 */
a1536da2 6766 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 6767
0663ca2a
JH		 6768unlock:
6769 hci_dev_unlock(hdev);
6770 return err;
6771}
6772
2f2eb0c9 6773static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
a1443f5a 6774{
2f2eb0c9 6775 struct mgmt_pending_cmd *cmd = data;
a1443f5a
JH		 6776 struct mgmt_mode *cp;
6777
2f2eb0c9 6778 bt_dev_dbg(hdev, "err %d", err);
a1443f5a 6779
2f2eb0c9
BG		 6780 if (err) {
6781 u8 mgmt_err = mgmt_status(err);
a1443f5a 6782
2f2eb0c9
BG		 6783 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6784 goto done;
a1443f5a
JH		 6785 }
6786
6787 cp = cmd->param;
6788
6789 switch (cp->val) {
6790 case 0x00:
a358dc11
MH		 6791 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6792 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 6793 break;
6794 case 0x01:
a1536da2 6795 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 6796 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 6797 break;
6798 case 0x02:
a1536da2
MH		 6799 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6800 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 6801 break;
6802 }
6803
2f2eb0c9 6804 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
a1443f5a
JH		 6805 new_settings(hdev, cmd->sk);
6806
2f2eb0c9
BG		 6807done:
6808 mgmt_pending_free(cmd);
6809}
6810
6811static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6812{
6813 struct mgmt_pending_cmd *cmd = data;
6814 struct mgmt_mode *cp = cmd->param;
6815 u8 val = !!cp->val;
6816
6817 /* Force write of val */
6818 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6819
6820 return hci_write_sc_support_sync(hdev, val);
a1443f5a
JH		 6821}
6822
eac83dc6
MH		 6823static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6824 void *data, u16 len)
6825{
6826 struct mgmt_mode *cp = data;
3b0602cd 6827 struct mgmt_pending_cmd *cmd;
a3209694 6828 u8 val;
eac83dc6
MH		 6829 int err;
6830
181d6953 6831 bt_dev_dbg(hdev, "sock %p", sk);
eac83dc6 6832
05b3c3e7 6833 if (!lmp_sc_capable(hdev) &&
d7a5a11d 6834 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 6835 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6836 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 6837
d7a5a11d 6838 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 6839 lmp_sc_capable(hdev) &&
d7a5a11d 6840 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 6841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6842 MGMT_STATUS_REJECTED);
ed93ec69 6843
0ab04a9c 6844 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 6845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
2f2eb0c9 6846 MGMT_STATUS_INVALID_PARAMS);
eac83dc6
MH		 6847
6848 hci_dev_lock(hdev);
6849
05b3c3e7 6850 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 6851 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 6852 bool changed;
6853
0ab04a9c 6854 if (cp->val) {
238be788
MH		 6855 changed = !hci_dev_test_and_set_flag(hdev,
6856 HCI_SC_ENABLED);
0ab04a9c 6857 if (cp->val == 0x02)
a1536da2 6858 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 6859 else
a358dc11 6860 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 6861 } else {
a69d8927
MH		 6862 changed = hci_dev_test_and_clear_flag(hdev,
6863 HCI_SC_ENABLED);
a358dc11 6864 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 6865 }
eac83dc6
MH		 6866
6867 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6868 if (err < 0)
6869 goto failed;
6870
6871 if (changed)
6872 err = new_settings(hdev, sk);
6873
6874 goto failed;
6875 }
6876
0ab04a9c
MH		 6877 val = !!cp->val;
6878
d7a5a11d
MH		 6879 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6880 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 6881 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6882 goto failed;
6883 }
6884
2f2eb0c9
BG		 6885 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6886 if (!cmd)
eac83dc6 6887 err = -ENOMEM;
2f2eb0c9
BG		 6888 else
6889 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6890 set_secure_conn_complete);
eac83dc6 6891
eac83dc6 6892 if (err < 0) {
2f2eb0c9
BG		 6893 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6894 MGMT_STATUS_FAILED);
6895 if (cmd)
6896 mgmt_pending_free(cmd);
eac83dc6
MH		 6897 }
6898
6899failed:
6900 hci_dev_unlock(hdev);
6901 return err;
6902}
6903
4e39ac81
MH		 6904static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6905 void *data, u16 len)
6906{
6907 struct mgmt_mode *cp = data;
b9710979 6908 bool changed, use_changed;
4e39ac81
MH		 6909 int err;
6910
181d6953 6911 bt_dev_dbg(hdev, "sock %p", sk);
4e39ac81 6912
b9710979 6913 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 6914 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6915 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 6916
6917 hci_dev_lock(hdev);
6918
6919 if (cp->val)
238be788 6920 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 6921 else
a69d8927
MH		 6922 changed = hci_dev_test_and_clear_flag(hdev,
6923 HCI_KEEP_DEBUG_KEYS);
4e39ac81 6924
b9710979 6925 if (cp->val == 0x02)
238be788
MH		 6926 use_changed = !hci_dev_test_and_set_flag(hdev,
6927 HCI_USE_DEBUG_KEYS);
b9710979 6928 else
a69d8927
MH		 6929 use_changed = hci_dev_test_and_clear_flag(hdev,
6930 HCI_USE_DEBUG_KEYS);
b9710979
JH		 6931
6932 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 6933 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 6934 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6935 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6936 sizeof(mode), &mode);
6937 }
6938
4e39ac81
MH		 6939 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6940 if (err < 0)
6941 goto unlock;
6942
6943 if (changed)
6944 err = new_settings(hdev, sk);
6945
6946unlock:
6947 hci_dev_unlock(hdev);
6948 return err;
6949}
6950
62b04cd1
JH		 6951static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6952 u16 len)
6953{
6954 struct mgmt_cp_set_privacy *cp = cp_data;
6955 bool changed;
6956 int err;
6957
181d6953 6958 bt_dev_dbg(hdev, "sock %p", sk);
62b04cd1
JH		 6959
6960 if (!lmp_le_capable(hdev))
a69e8375
JH		 6961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6962 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1 6963
82a37ade 6964 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
a69e8375
JH		 6965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6966 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 6967
6968 if (hdev_is_powered(hdev))
a69e8375
JH		 6969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6970 MGMT_STATUS_REJECTED);
62b04cd1
JH		 6971
6972 hci_dev_lock(hdev);
6973
c21c0ea0
JH		 6974 /* If user space supports this command it is also expected to
6975 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6976 */
a1536da2 6977 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 6978
62b04cd1 6979 if (cp->privacy) {
238be788 6980 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 6981 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 6982 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
a73c046a 6983 hci_adv_instances_set_rpa_expired(hdev, true);
82a37ade
JH		 6984 if (cp->privacy == 0x02)
6985 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6986 else
6987 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
62b04cd1 6988 } else {
a69d8927 6989 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 6990 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 6991 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
a73c046a 6992 hci_adv_instances_set_rpa_expired(hdev, false);
82a37ade 6993 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
62b04cd1
JH		 6994 }
6995
6996 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6997 if (err < 0)
6998 goto unlock;
6999
7000 if (changed)
7001 err = new_settings(hdev, sk);
7002
7003unlock:
7004 hci_dev_unlock(hdev);
7005 return err;
7006}
7007
41edf160
JH		 7008static bool irk_is_valid(struct mgmt_irk_info *irk)
7009{
7010 switch (irk->addr.type) {
7011 case BDADDR_LE_PUBLIC:
7012 return true;
7013
7014 case BDADDR_LE_RANDOM:
7015 /* Two most significant bits shall be set */
7016 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7017 return false;
7018 return true;
7019 }
7020
7021 return false;
7022}
7023
7024static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7025 u16 len)
7026{
7027 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 7028 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7029 sizeof(struct mgmt_irk_info));
41edf160
JH		 7030 u16 irk_count, expected_len;
7031 int i, err;
7032
181d6953 7033 bt_dev_dbg(hdev, "sock %p", sk);
41edf160
JH		 7034
7035 if (!lmp_le_capable(hdev))
a69e8375
JH		 7036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7037 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 7038
7039 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936 7040 if (irk_count > max_irk_count) {
2064ee33
MH		 7041 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7042 irk_count);
a69e8375
JH		 7043 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7044 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 7045 }
41edf160 7046
5bec1fb8 7047 expected_len = struct_size(cp, irks, irk_count);
41edf160 7048 if (expected_len != len) {
2064ee33
MH		 7049 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7050 expected_len, len);
a69e8375
JH		 7051 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7052 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 7053 }
7054
181d6953 7055 bt_dev_dbg(hdev, "irk_count %u", irk_count);
41edf160
JH		 7056
7057 for (i = 0; i < irk_count; i++) {
7058 struct mgmt_irk_info *key = &cp->irks[i];
7059
7060 if (!irk_is_valid(key))
a69e8375
JH		 7061 return mgmt_cmd_status(sk, hdev->id,
7062 MGMT_OP_LOAD_IRKS,
7063 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 7064 }
7065
7066 hci_dev_lock(hdev);
7067
7068 hci_smp_irks_clear(hdev);
7069
7070 for (i = 0; i < irk_count; i++) {
7071 struct mgmt_irk_info *irk = &cp->irks[i];
59b047bc 7072 u8 addr_type = le_addr_type(irk->addr.type);
41edf160 7073
600a8749
AM		 7074 if (hci_is_blocked_key(hdev,
7075 HCI_BLOCKED_KEY_TYPE_IRK,
7076 irk->val)) {
7077 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7078 &irk->addr.bdaddr);
7079 continue;
7080 }
7081
59b047bc
XY		 7082 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7083 if (irk->addr.type == BDADDR_BREDR)
7084 addr_type = BDADDR_BREDR;
7085
85813a7e 7086 hci_add_irk(hdev, &irk->addr.bdaddr,
59b047bc 7087 addr_type, irk->val,
41edf160
JH		 7088 BDADDR_ANY);
7089 }
7090
a1536da2 7091 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 7092
2a1afb5a 7093 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 7094
7095 hci_dev_unlock(hdev);
7096
7097 return err;
7098}
7099
3f706b72
JH		 7100static bool ltk_is_valid(struct mgmt_ltk_info *key)
7101{
fad646e1 7102 if (key->initiator != 0x00 && key->initiator != 0x01)
3f706b72 7103 return false;
490cb0b3
MH		 7104
7105 switch (key->addr.type) {
7106 case BDADDR_LE_PUBLIC:
7107 return true;
7108
7109 case BDADDR_LE_RANDOM:
7110 /* Two most significant bits shall be set */
7111 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7112 return false;
7113 return true;
7114 }
7115
7116 return false;
3f706b72
JH		 7117}
7118
bdb6d971 7119static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 7120 void *cp_data, u16 len)
346af67b 7121{
346af67b 7122 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 7123 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7124 sizeof(struct mgmt_ltk_info));
346af67b 7125 u16 key_count, expected_len;
715a5bf2 7126 int i, err;
346af67b 7127
181d6953 7128 bt_dev_dbg(hdev, "sock %p", sk);
cf99ba13
MH		 7129
7130 if (!lmp_le_capable(hdev))
a69e8375
JH		 7131 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7132 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 7133
1f350c87 7134 key_count = __le16_to_cpu(cp->key_count);
ba1d6936 7135 if (key_count > max_key_count) {
2064ee33
MH		 7136 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7137 key_count);
a69e8375
JH		 7138 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7139 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 7140 }
346af67b 7141
5bec1fb8 7142 expected_len = struct_size(cp, keys, key_count);
346af67b 7143 if (expected_len != len) {
2064ee33
MH		 7144 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7145 expected_len, len);
a69e8375
JH		 7146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7147 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 7148 }
7149
181d6953 7150 bt_dev_dbg(hdev, "key_count %u", key_count);
346af67b 7151
54ad6d8a
JH		 7152 for (i = 0; i < key_count; i++) {
7153 struct mgmt_ltk_info *key = &cp->keys[i];
7154
3f706b72 7155 if (!ltk_is_valid(key))
a69e8375
JH		 7156 return mgmt_cmd_status(sk, hdev->id,
7157 MGMT_OP_LOAD_LONG_TERM_KEYS,
7158 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 7159 }
7160
346af67b
VCG		 7161 hci_dev_lock(hdev);
7162
7163 hci_smp_ltks_clear(hdev);
7164
7165 for (i = 0; i < key_count; i++) {
7166 struct mgmt_ltk_info *key = &cp->keys[i];
85813a7e 7167 u8 type, authenticated;
59b047bc 7168 u8 addr_type = le_addr_type(key->addr.type);
346af67b 7169
600a8749
AM		 7170 if (hci_is_blocked_key(hdev,
7171 HCI_BLOCKED_KEY_TYPE_LTK,
7172 key->val)) {
7173 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7174 &key->addr.bdaddr);
7175 continue;
7176 }
7177
61b43357
JH		 7178 switch (key->type) {
7179 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 7180 authenticated = 0x00;
fad646e1 7181 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
61b43357
JH		 7182 break;
7183 case MGMT_LTK_AUTHENTICATED:
d7b25450 7184 authenticated = 0x01;
fad646e1 7185 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
23fb8de3
JH		 7186 break;
7187 case MGMT_LTK_P256_UNAUTH:
7188 authenticated = 0x00;
7189 type = SMP_LTK_P256;
61b43357 7190 break;
23fb8de3
JH		 7191 case MGMT_LTK_P256_AUTH:
7192 authenticated = 0x01;
7193 type = SMP_LTK_P256;
61b43357 7194 break;
23fb8de3
JH		 7195 case MGMT_LTK_P256_DEBUG:
7196 authenticated = 0x00;
7197 type = SMP_LTK_P256_DEBUG;
19186c7b 7198 fallthrough;
61b43357
JH		 7199 default:
7200 continue;
7201 }
d7b25450 7202
59b047bc
XY		 7203 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7204 if (key->addr.type == BDADDR_BREDR)
7205 addr_type = BDADDR_BREDR;
7206
85813a7e 7207 hci_add_ltk(hdev, &key->addr.bdaddr,
59b047bc 7208 addr_type, type, authenticated,
85813a7e 7209 key->val, key->enc_size, key->ediv, key->rand);
346af67b
VCG		 7210 }
7211
2a1afb5a 7212 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 7213 NULL, 0);
7214
346af67b 7215 hci_dev_unlock(hdev);
346af67b 7216
715a5bf2 7217 return err;
346af67b
VCG		 7218}
7219
47db6b42 7220static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
dd983808 7221{
47db6b42 7222 struct mgmt_pending_cmd *cmd = data;
dd983808 7223 struct hci_conn *conn = cmd->user_data;
47db6b42 7224 struct mgmt_cp_get_conn_info *cp = cmd->param;
9981bdb0 7225 struct mgmt_rp_get_conn_info rp;
47db6b42 7226 u8 status;
dd983808 7227
47db6b42
BG		 7228 bt_dev_dbg(hdev, "err %d", err);
7229
d1f0a981 7230 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
dd983808 7231
47db6b42 7232 status = mgmt_status(err);
9981bdb0 7233 if (status == MGMT_STATUS_SUCCESS) {
dd983808 7234 rp.rssi = conn->rssi;
9981bdb0
JH		 7235 rp.tx_power = conn->tx_power;
7236 rp.max_tx_power = conn->max_tx_power;
7237 } else {
7238 rp.rssi = HCI_RSSI_INVALID;
7239 rp.tx_power = HCI_TX_POWER_INVALID;
7240 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 7241 }
7242
47db6b42
BG		 7243 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7244 &rp, sizeof(rp));
dd983808 7245
47db6b42 7246 mgmt_pending_free(cmd);
dd983808
AK		 7247}
7248
47db6b42 7249static int get_conn_info_sync(struct hci_dev *hdev, void *data)
dd983808 7250{
47db6b42
BG		 7251 struct mgmt_pending_cmd *cmd = data;
7252 struct mgmt_cp_get_conn_info *cp = cmd->param;
dd983808 7253 struct hci_conn *conn;
47db6b42
BG		 7254 int err;
7255 __le16 handle;
dd983808 7256
47db6b42
BG		 7257 /* Make sure we are still connected */
7258 if (cp->addr.type == BDADDR_BREDR)
7259 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7260 &cp->addr.bdaddr);
7261 else
7262 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
dd983808 7263
7b445e22 7264 if (!conn || conn->state != BT_CONNECTED)
47db6b42 7265 return MGMT_STATUS_NOT_CONNECTED;
dd983808 7266
7b445e22 7267 cmd->user_data = conn;
47db6b42 7268 handle = cpu_to_le16(conn->handle);
dd983808 7269
47db6b42
BG		 7270 /* Refresh RSSI each time */
7271 err = hci_read_rssi_sync(hdev, handle);
dd983808 7272
47db6b42
BG		 7273 /* For LE links TX power does not change thus we don't need to
7274 * query for it once value is known.
7275 */
7276 if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7277 conn->tx_power == HCI_TX_POWER_INVALID))
7278 err = hci_read_tx_power_sync(hdev, handle, 0x00);
dd983808 7279
47db6b42
BG		 7280 /* Max TX power needs to be read only once per connection */
7281 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7282 err = hci_read_tx_power_sync(hdev, handle, 0x01);
dd983808 7283
47db6b42 7284 return err;
dd983808
AK		 7285}
7286
7287static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7288 u16 len)
7289{
7290 struct mgmt_cp_get_conn_info *cp = data;
7291 struct mgmt_rp_get_conn_info rp;
7292 struct hci_conn *conn;
7293 unsigned long conn_info_age;
7294 int err = 0;
7295
181d6953 7296 bt_dev_dbg(hdev, "sock %p", sk);
dd983808
AK		 7297
7298 memset(&rp, 0, sizeof(rp));
7299 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7300 rp.addr.type = cp->addr.type;
7301
7302 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 7303 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7304 MGMT_STATUS_INVALID_PARAMS,
7305 &rp, sizeof(rp));
dd983808
AK		 7306
7307 hci_dev_lock(hdev);
7308
7309 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 7310 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7311 MGMT_STATUS_NOT_POWERED, &rp,
7312 sizeof(rp));
dd983808
AK		 7313 goto unlock;
7314 }
7315
7316 if (cp->addr.type == BDADDR_BREDR)
7317 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7318 &cp->addr.bdaddr);
7319 else
7320 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7321
7322 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 7323 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7324 MGMT_STATUS_NOT_CONNECTED, &rp,
7325 sizeof(rp));
dd983808
AK		 7326 goto unlock;
7327 }
7328
7329 /* To avoid client trying to guess when to poll again for information we
7330 * calculate conn info age as random value between min/max set in hdev.
7331 */
e8a533cb
JD		 7332 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7333 hdev->conn_info_max_age - 1);
dd983808
AK		 7334
7335 /* Query controller to refresh cached values if they are too old or were
7336 * never read.
7337 */
f4e2dd53
AK		 7338 if (time_after(jiffies, conn->conn_info_timestamp +
7339 msecs_to_jiffies(conn_info_age)) ||
dd983808 7340 !conn->conn_info_timestamp) {
3b0602cd 7341 struct mgmt_pending_cmd *cmd;
dd983808 7342
47db6b42
BG		 7343 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7344 len);
d7b2fdfb 7345 if (!cmd) {
47db6b42 7346 err = -ENOMEM;
d7b2fdfb 7347 } else {
47db6b42
BG		 7348 err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7349 cmd, get_conn_info_complete);
d7b2fdfb 7350 }
dd983808 7351
47db6b42
BG		 7352 if (err < 0) {
7353 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7354 MGMT_STATUS_FAILED, &rp, sizeof(rp));
eed5daf3 7355
47db6b42
BG		 7356 if (cmd)
7357 mgmt_pending_free(cmd);
dd983808 7358
dd983808
AK		 7359 goto unlock;
7360 }
7361
dd983808
AK		 7362 conn->conn_info_timestamp = jiffies;
7363 } else {
7364 /* Cache is valid, just reply with values cached in hci_conn */
7365 rp.rssi = conn->rssi;
7366 rp.tx_power = conn->tx_power;
eed5daf3 7367 rp.max_tx_power = conn->max_tx_power;
dd983808 7368
2a1afb5a
JH		 7369 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7370 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 7371 }
7372
7373unlock:
7374 hci_dev_unlock(hdev);
7375 return err;
7376}
7377
5a750137 7378static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
95868426 7379{
5a750137
BG		 7380 struct mgmt_pending_cmd *cmd = data;
7381 struct mgmt_cp_get_clock_info *cp = cmd->param;
95868426 7382 struct mgmt_rp_get_clock_info rp;
5a750137
BG		 7383 struct hci_conn *conn = cmd->user_data;
7384 u8 status = mgmt_status(err);
7385
7386 bt_dev_dbg(hdev, "err %d", err);
69487371
JH		 7387
7388 memset(&rp, 0, sizeof(rp));
5a750137
BG		 7389 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7390 rp.addr.type = cp->addr.type;
69487371 7391
5a750137 7392 if (err)
69487371
JH		 7393 goto complete;
7394
5a750137 7395 rp.local_clock = cpu_to_le32(hdev->clock);
69487371
JH		 7396
7397 if (conn) {
7398 rp.piconet_clock = cpu_to_le32(conn->clock);
7399 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
69487371 7400 }
9df74653 7401
5a750137
BG		 7402complete:
7403 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7404 sizeof(rp));
7405
7406 mgmt_pending_free(cmd);
69487371
JH		 7407}
7408
5a750137 7409static int get_clock_info_sync(struct hci_dev *hdev, void *data)
69487371 7410{
5a750137
BG		 7411 struct mgmt_pending_cmd *cmd = data;
7412 struct mgmt_cp_get_clock_info *cp = cmd->param;
7413 struct hci_cp_read_clock hci_cp;
7b445e22 7414 struct hci_conn *conn;
95868426 7415
5a750137 7416 memset(&hci_cp, 0, sizeof(hci_cp));
7b445e22 7417 hci_read_clock_sync(hdev, &hci_cp);
95868426 7418
7b445e22
LAD		 7419 /* Make sure connection still exists */
7420 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7421 if (!conn || conn->state != BT_CONNECTED)
7422 return MGMT_STATUS_NOT_CONNECTED;
95868426 7423
7b445e22
LAD		 7424 cmd->user_data = conn;
7425 hci_cp.handle = cpu_to_le16(conn->handle);
7426 hci_cp.which = 0x01; /* Piconet clock */
95868426 7427
7b445e22 7428 return hci_read_clock_sync(hdev, &hci_cp);
95868426
JH		 7429}
7430
7431static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5a750137 7432 u16 len)
95868426
JH		 7433{
7434 struct mgmt_cp_get_clock_info *cp = data;
7435 struct mgmt_rp_get_clock_info rp;
3b0602cd 7436 struct mgmt_pending_cmd *cmd;
95868426
JH		 7437 struct hci_conn *conn;
7438 int err;
7439
181d6953 7440 bt_dev_dbg(hdev, "sock %p", sk);
95868426
JH		 7441
7442 memset(&rp, 0, sizeof(rp));
7443 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7444 rp.addr.type = cp->addr.type;
7445
7446 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 7447 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7448 MGMT_STATUS_INVALID_PARAMS,
7449 &rp, sizeof(rp));
95868426
JH		 7450
7451 hci_dev_lock(hdev);
7452
7453 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 7454 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7455 MGMT_STATUS_NOT_POWERED, &rp,
7456 sizeof(rp));
95868426
JH		 7457 goto unlock;
7458 }
7459
7460 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7461 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7462 &cp->addr.bdaddr);
7463 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 7464 err = mgmt_cmd_complete(sk, hdev->id,
7465 MGMT_OP_GET_CLOCK_INFO,
7466 MGMT_STATUS_NOT_CONNECTED,
7467 &rp, sizeof(rp));
95868426
JH		 7468 goto unlock;
7469 }
7470 } else {
7471 conn = NULL;
7472 }
7473
5a750137
BG		 7474 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7475 if (!cmd)
95868426 7476 err = -ENOMEM;
5a750137
BG		 7477 else
7478 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7479 get_clock_info_complete);
69487371 7480
5a750137
BG		 7481 if (err < 0) {
7482 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7483 MGMT_STATUS_FAILED, &rp, sizeof(rp));
95868426 7484
5a750137
BG		 7485 if (cmd)
7486 mgmt_pending_free(cmd);
95868426
JH		 7487 }
7488
95868426
JH		 7489
7490unlock:
7491 hci_dev_unlock(hdev);
7492 return err;
7493}
7494
5a154e6f
JH		 7495static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7496{
7497 struct hci_conn *conn;
7498
7499 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7500 if (!conn)
7501 return false;
7502
7503 if (conn->dst_type != type)
7504 return false;
7505
7506 if (conn->state != BT_CONNECTED)
7507 return false;
7508
7509 return true;
7510}
7511
7512/* This function requires the caller holds hdev->lock */
51d7a94d 7513static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5a154e6f
JH		 7514 u8 addr_type, u8 auto_connect)
7515{
5a154e6f
JH		 7516 struct hci_conn_params *params;
7517
7518 params = hci_conn_params_add(hdev, addr, addr_type);
7519 if (!params)
7520 return -EIO;
7521
7522 if (params->auto_connect == auto_connect)
7523 return 0;
7524
195ef75e 7525 hci_pend_le_list_del_init(params);
5a154e6f
JH		 7526
7527 switch (auto_connect) {
7528 case HCI_AUTO_CONN_DISABLED:
7529 case HCI_AUTO_CONN_LINK_LOSS:
28a667c9
JP		 7530 /* If auto connect is being disabled when we're trying to
7531 * connect to device, keep connecting.
7532 */
7533 if (params->explicit_connect)
195ef75e 7534 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5a154e6f
JH		 7535 break;
7536 case HCI_AUTO_CONN_REPORT:
49c50922 7537 if (params->explicit_connect)
195ef75e 7538 hci_pend_le_list_add(params, &hdev->pend_le_conns);
49c50922 7539 else
195ef75e 7540 hci_pend_le_list_add(params, &hdev->pend_le_reports);
5a154e6f
JH		 7541 break;
7542 case HCI_AUTO_CONN_DIRECT:
7543 case HCI_AUTO_CONN_ALWAYS:
51d7a94d 7544 if (!is_connected(hdev, addr, addr_type))
195ef75e 7545 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5a154e6f
JH		 7546 break;
7547 }
7548
7549 params->auto_connect = auto_connect;
7550
181d6953
MH		 7551 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7552 addr, addr_type, auto_connect);
5a154e6f
JH		 7553
7554 return 0;
7555}
7556
8afef092
MH		 7557static void device_added(struct sock *sk, struct hci_dev *hdev,
7558 bdaddr_t *bdaddr, u8 type, u8 action)
7559{
7560 struct mgmt_ev_device_added ev;
7561
7562 bacpy(&ev.addr.bdaddr, bdaddr);
7563 ev.addr.type = type;
7564 ev.action = action;
7565
7566 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7567}
7568
e8907f76
LAD		 7569static int add_device_sync(struct hci_dev *hdev, void *data)
7570{
7571 return hci_update_passive_scan_sync(hdev);
7572}
7573
2faade53
MH		 7574static int add_device(struct sock *sk, struct hci_dev *hdev,
7575 void *data, u16 len)
7576{
7577 struct mgmt_cp_add_device *cp = data;
7578 u8 auto_conn, addr_type;
4c54bf2b 7579 struct hci_conn_params *params;
2faade53 7580 int err;
4c54bf2b 7581 u32 current_flags = 0;
fe92ee64 7582 u32 supported_flags;
2faade53 7583
181d6953 7584 bt_dev_dbg(hdev, "sock %p", sk);
2faade53 7585
6659358e 7586 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 7587 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 7588 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7589 MGMT_STATUS_INVALID_PARAMS,
7590 &cp->addr, sizeof(cp->addr));
2faade53 7591
4b9e7e75 7592 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 7593 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7594 MGMT_STATUS_INVALID_PARAMS,
7595 &cp->addr, sizeof(cp->addr));
2faade53
MH		 7596
7597 hci_dev_lock(hdev);
7598
6659358e 7599 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 7600 /* Only incoming connections action is supported for now */
6659358e 7601 if (cp->action != 0x01) {
51d7a94d
JH		 7602 err = mgmt_cmd_complete(sk, hdev->id,
7603 MGMT_OP_ADD_DEVICE,
7604 MGMT_STATUS_INVALID_PARAMS,
7605 &cp->addr, sizeof(cp->addr));
6659358e
JH		 7606 goto unlock;
7607 }
7608
3d4f9c00 7609 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8baaa403
APS		 7610 &cp->addr.bdaddr,
7611 cp->addr.type, 0);
6659358e
JH		 7612 if (err)
7613 goto unlock;
a397407f 7614
bb876725 7615 hci_update_scan(hdev);
a397407f 7616
6659358e
JH		 7617 goto added;
7618 }
7619
85813a7e 7620 addr_type = le_addr_type(cp->addr.type);
2faade53 7621
4b9e7e75 7622 if (cp->action == 0x02)
2faade53 7623 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 7624 else if (cp->action == 0x01)
7625 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 7626 else
a3451d27 7627 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 7628
9a0a8a8e
JP		 7629 /* Kernel internally uses conn_params with resolvable private
7630 * address, but Add Device allows only identity addresses.
7631 * Make sure it is enforced before calling
7632 * hci_conn_params_lookup.
7633 */
7634 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
51d7a94d
JH		 7635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7636 MGMT_STATUS_INVALID_PARAMS,
7637 &cp->addr, sizeof(cp->addr));
9a0a8a8e
JP		 7638 goto unlock;
7639 }
7640
bf5b3c8b
MH		 7641 /* If the connection parameters don't exist for this device,
7642 * they will be created and configured with defaults.
7643 */
51d7a94d 7644 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
d06b50ce 7645 auto_conn) < 0) {
51d7a94d
JH		 7646 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7647 MGMT_STATUS_FAILED, &cp->addr,
7648 sizeof(cp->addr));
2faade53 7649 goto unlock;
4c54bf2b
APS		 7650 } else {
7651 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7652 addr_type);
7653 if (params)
e1cff700 7654 current_flags = params->flags;
2faade53
MH		 7655 }
7656
e8907f76
LAD		 7657 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7658 if (err < 0)
7659 goto unlock;
51d7a94d 7660
6659358e 7661added:
8afef092 7662 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
e1cff700 7663 supported_flags = hdev->conn_flags;
4c54bf2b 7664 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
fe92ee64 7665 supported_flags, current_flags);
8afef092 7666
51d7a94d
JH		 7667 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7668 MGMT_STATUS_SUCCESS, &cp->addr,
7669 sizeof(cp->addr));
2faade53
MH		 7670
7671unlock:
7672 hci_dev_unlock(hdev);
7673 return err;
7674}
7675
8afef092
MH		 7676static void device_removed(struct sock *sk, struct hci_dev *hdev,
7677 bdaddr_t *bdaddr, u8 type)
7678{
7679 struct mgmt_ev_device_removed ev;
7680
7681 bacpy(&ev.addr.bdaddr, bdaddr);
7682 ev.addr.type = type;
7683
7684 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7685}
7686
e8907f76
LAD		 7687static int remove_device_sync(struct hci_dev *hdev, void *data)
7688{
7689 return hci_update_passive_scan_sync(hdev);
7690}
7691
2faade53
MH		 7692static int remove_device(struct sock *sk, struct hci_dev *hdev,
7693 void *data, u16 len)
7694{
7695 struct mgmt_cp_remove_device *cp = data;
7696 int err;
7697
181d6953 7698 bt_dev_dbg(hdev, "sock %p", sk);
2faade53
MH		 7699
7700 hci_dev_lock(hdev);
7701
7702 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 7703 struct hci_conn_params *params;
2faade53
MH		 7704 u8 addr_type;
7705
6659358e 7706 if (!bdaddr_type_is_valid(cp->addr.type)) {
51d7a94d
JH		 7707 err = mgmt_cmd_complete(sk, hdev->id,
7708 MGMT_OP_REMOVE_DEVICE,
7709 MGMT_STATUS_INVALID_PARAMS,
7710 &cp->addr, sizeof(cp->addr));
2faade53
MH		 7711 goto unlock;
7712 }
7713
6659358e 7714 if (cp->addr.type == BDADDR_BREDR) {
3d4f9c00 7715 err = hci_bdaddr_list_del(&hdev->accept_list,
6659358e
JH		 7716 &cp->addr.bdaddr,
7717 cp->addr.type);
7718 if (err) {
51d7a94d
JH		 7719 err = mgmt_cmd_complete(sk, hdev->id,
7720 MGMT_OP_REMOVE_DEVICE,
7721 MGMT_STATUS_INVALID_PARAMS,
7722 &cp->addr,
7723 sizeof(cp->addr));
6659358e
JH		 7724 goto unlock;
7725 }
7726
bb876725 7727 hci_update_scan(hdev);
a397407f 7728
6659358e
JH		 7729 device_removed(sk, hdev, &cp->addr.bdaddr,
7730 cp->addr.type);
7731 goto complete;
7732 }
7733
85813a7e 7734 addr_type = le_addr_type(cp->addr.type);
2faade53 7735
9a0a8a8e
JP		 7736 /* Kernel internally uses conn_params with resolvable private
7737 * address, but Remove Device allows only identity addresses.
7738 * Make sure it is enforced before calling
7739 * hci_conn_params_lookup.
7740 */
7741 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
51d7a94d
JH		 7742 err = mgmt_cmd_complete(sk, hdev->id,
7743 MGMT_OP_REMOVE_DEVICE,
7744 MGMT_STATUS_INVALID_PARAMS,
7745 &cp->addr, sizeof(cp->addr));
9a0a8a8e
JP		 7746 goto unlock;
7747 }
7748
c71593dd
JH		 7749 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7750 addr_type);
7751 if (!params) {
51d7a94d
JH		 7752 err = mgmt_cmd_complete(sk, hdev->id,
7753 MGMT_OP_REMOVE_DEVICE,
7754 MGMT_STATUS_INVALID_PARAMS,
7755 &cp->addr, sizeof(cp->addr));
c71593dd
JH		 7756 goto unlock;
7757 }
7758
679d2b6f
JH		 7759 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7760 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
51d7a94d
JH		 7761 err = mgmt_cmd_complete(sk, hdev->id,
7762 MGMT_OP_REMOVE_DEVICE,
7763 MGMT_STATUS_INVALID_PARAMS,
7764 &cp->addr, sizeof(cp->addr));
c71593dd
JH		 7765 goto unlock;
7766 }
7767
195ef75e 7768 hci_conn_params_free(params);
8afef092
MH		 7769
7770 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 7771 } else {
19de0825 7772 struct hci_conn_params *p, *tmp;
6659358e 7773 struct bdaddr_list *b, *btmp;
19de0825 7774
2faade53 7775 if (cp->addr.type) {
51d7a94d
JH		 7776 err = mgmt_cmd_complete(sk, hdev->id,
7777 MGMT_OP_REMOVE_DEVICE,
7778 MGMT_STATUS_INVALID_PARAMS,
7779 &cp->addr, sizeof(cp->addr));
2faade53
MH		 7780 goto unlock;
7781 }
7782
3d4f9c00 7783 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
6659358e
JH		 7784 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7785 list_del(&b->list);
7786 kfree(b);
7787 }
7788
bb876725 7789 hci_update_scan(hdev);
a397407f 7790
19de0825
JH		 7791 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7792 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7793 continue;
7794 device_removed(sk, hdev, &p->addr, p->addr_type);
679d2b6f
JH		 7795 if (p->explicit_connect) {
7796 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7797 continue;
7798 }
195ef75e 7799 hci_conn_params_free(p);
19de0825
JH		 7800 }
7801
181d6953 7802 bt_dev_dbg(hdev, "All LE connection parameters were removed");
2faade53
MH		 7803 }
7804
e8907f76
LAD		 7805 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7806
6659358e 7807complete:
51d7a94d
JH		 7808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7809 MGMT_STATUS_SUCCESS, &cp->addr,
7810 sizeof(cp->addr));
2faade53
MH		 7811unlock:
7812 hci_dev_unlock(hdev);
7813 return err;
7814}
7815
a26f3dcf
JH		 7816static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7817 u16 len)
7818{
7819 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 7820 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7821 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 7822 u16 param_count, expected_len;
7823 int i;
7824
7825 if (!lmp_le_capable(hdev))
a69e8375
JH		 7826 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7827 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 7828
7829 param_count = __le16_to_cpu(cp->param_count);
ba1d6936 7830 if (param_count > max_param_count) {
2064ee33
MH		 7831 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7832 param_count);
a69e8375
JH		 7833 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7834 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 7835 }
a26f3dcf 7836
5bec1fb8 7837 expected_len = struct_size(cp, params, param_count);
a26f3dcf 7838 if (expected_len != len) {
2064ee33
MH		 7839 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7840 expected_len, len);
a69e8375
JH		 7841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7842 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 7843 }
7844
181d6953 7845 bt_dev_dbg(hdev, "param_count %u", param_count);
a26f3dcf
JH		 7846
7847 hci_dev_lock(hdev);
7848
7849 hci_conn_params_clear_disabled(hdev);
7850
7851 for (i = 0; i < param_count; i++) {
7852 struct mgmt_conn_param *param = &cp->params[i];
7853 struct hci_conn_params *hci_param;
7854 u16 min, max, latency, timeout;
7855 u8 addr_type;
7856
181d6953
MH		 7857 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7858 param->addr.type);
a26f3dcf
JH		 7859
7860 if (param->addr.type == BDADDR_LE_PUBLIC) {
7861 addr_type = ADDR_LE_DEV_PUBLIC;
7862 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7863 addr_type = ADDR_LE_DEV_RANDOM;
7864 } else {
2064ee33 7865 bt_dev_err(hdev, "ignoring invalid connection parameters");
a26f3dcf
JH		 7866 continue;
7867 }
7868
7869 min = le16_to_cpu(param->min_interval);
7870 max = le16_to_cpu(param->max_interval);
7871 latency = le16_to_cpu(param->latency);
7872 timeout = le16_to_cpu(param->timeout);
7873
181d6953
MH		 7874 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7875 min, max, latency, timeout);
a26f3dcf
JH		 7876
7877 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
2064ee33 7878 bt_dev_err(hdev, "ignoring invalid connection parameters");
a26f3dcf
JH		 7879 continue;
7880 }
7881
7882 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7883 addr_type);
7884 if (!hci_param) {
2064ee33 7885 bt_dev_err(hdev, "failed to add connection parameters");
a26f3dcf
JH		 7886 continue;
7887 }
7888
7889 hci_param->conn_min_interval = min;
7890 hci_param->conn_max_interval = max;
7891 hci_param->conn_latency = latency;
7892 hci_param->supervision_timeout = timeout;
7893 }
7894
7895 hci_dev_unlock(hdev);
7896
2a1afb5a
JH		 7897 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7898 NULL, 0);
a26f3dcf
JH		 7899}
7900
dbece37a
MH		 7901static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7902 void *data, u16 len)
7903{
7904 struct mgmt_cp_set_external_config *cp = data;
7905 bool changed;
7906 int err;
7907
181d6953 7908 bt_dev_dbg(hdev, "sock %p", sk);
dbece37a
MH		 7909
7910 if (hdev_is_powered(hdev))
a69e8375
JH		 7911 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7912 MGMT_STATUS_REJECTED);
dbece37a
MH		 7913
7914 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 7915 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7916 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 7917
7918 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 7919 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7920 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 7921
7922 hci_dev_lock(hdev);
7923
7924 if (cp->config)
238be788 7925 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 7926 else
a69d8927 7927 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 7928
7929 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7930 if (err < 0)
7931 goto unlock;
7932
7933 if (!changed)
7934 goto unlock;
7935
f4537c04
MH		 7936 err = new_options(hdev, sk);
7937
d7a5a11d 7938 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 7939 mgmt_index_removed(hdev);
d603b76b 7940
516018a9 7941 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 7942 hci_dev_set_flag(hdev, HCI_CONFIG);
7943 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 7944
7945 queue_work(hdev->req_workqueue, &hdev->power_on);
7946 } else {
5ea234d3 7947 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 7948 mgmt_index_added(hdev);
7949 }
dbece37a
MH		 7950 }
7951
7952unlock:
7953 hci_dev_unlock(hdev);
7954 return err;
7955}
7956
9713c17b
MH		 7957static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7958 void *data, u16 len)
7959{
7960 struct mgmt_cp_set_public_address *cp = data;
7961 bool changed;
7962 int err;
7963
181d6953 7964 bt_dev_dbg(hdev, "sock %p", sk);
9713c17b
MH		 7965
7966 if (hdev_is_powered(hdev))
a69e8375
JH		 7967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7968 MGMT_STATUS_REJECTED);
9713c17b
MH		 7969
7970 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 7971 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7972 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 7973
7974 if (!hdev->set_bdaddr)
a69e8375
JH		 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7976 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 7977
7978 hci_dev_lock(hdev);
7979
7980 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7981 bacpy(&hdev->public_addr, &cp->bdaddr);
7982
7983 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7984 if (err < 0)
7985 goto unlock;
7986
7987 if (!changed)
7988 goto unlock;
7989
d7a5a11d 7990 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 7991 err = new_options(hdev, sk);
7992
7993 if (is_configured(hdev)) {
7994 mgmt_index_removed(hdev);
7995
a358dc11 7996 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 7997
a1536da2
MH		 7998 hci_dev_set_flag(hdev, HCI_CONFIG);
7999 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 8000
8001 queue_work(hdev->req_workqueue, &hdev->power_on);
8002 }
8003
8004unlock:
8005 hci_dev_unlock(hdev);
8006 return err;
8007}
8008
177e77a3
BG		 8009static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8010 int err)
40f66c05
JH		 8011{
8012 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8013 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8014 u8 *h192, *r192, *h256, *r256;
177e77a3
BG		 8015 struct mgmt_pending_cmd *cmd = data;
8016 struct sk_buff *skb = cmd->skb;
8017 u8 status = mgmt_status(err);
40f66c05 8018 u16 eir_len;
40f66c05 8019
275f3f64
BG		 8020 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
8021 return;
8022
177e77a3
BG		 8023 if (!status) {
8024 if (!skb)
8025 status = MGMT_STATUS_FAILED;
8026 else if (IS_ERR(skb))
8027 status = mgmt_status(PTR_ERR(skb));
8028 else
8029 status = mgmt_status(skb->data[0]);
8030 }
40f66c05 8031
177e77a3 8032 bt_dev_dbg(hdev, "status %u", status);
40f66c05
JH		 8033
8034 mgmt_cp = cmd->param;
8035
8036 if (status) {
8037 status = mgmt_status(status);
8038 eir_len = 0;
8039
8040 h192 = NULL;
8041 r192 = NULL;
8042 h256 = NULL;
8043 r256 = NULL;
177e77a3 8044 } else if (!bredr_sc_enabled(hdev)) {
40f66c05
JH		 8045 struct hci_rp_read_local_oob_data *rp;
8046
8047 if (skb->len != sizeof(*rp)) {
8048 status = MGMT_STATUS_FAILED;
8049 eir_len = 0;
8050 } else {
8051 status = MGMT_STATUS_SUCCESS;
8052 rp = (void *)skb->data;
8053
8054 eir_len = 5 + 18 + 18;
8055 h192 = rp->hash;
8056 r192 = rp->rand;
8057 h256 = NULL;
8058 r256 = NULL;
8059 }
8060 } else {
8061 struct hci_rp_read_local_oob_ext_data *rp;
8062
8063 if (skb->len != sizeof(*rp)) {
8064 status = MGMT_STATUS_FAILED;
8065 eir_len = 0;
8066 } else {
8067 status = MGMT_STATUS_SUCCESS;
8068 rp = (void *)skb->data;
8069
8070 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8071 eir_len = 5 + 18 + 18;
8072 h192 = NULL;
8073 r192 = NULL;
8074 } else {
8075 eir_len = 5 + 18 + 18 + 18 + 18;
8076 h192 = rp->hash192;
8077 r192 = rp->rand192;
8078 }
8079
8080 h256 = rp->hash256;
8081 r256 = rp->rand256;
8082 }
8083 }
8084
8085 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8086 if (!mgmt_rp)
8087 goto done;
8088
a31e5a41 8089 if (eir_len == 0)
40f66c05
JH		 8090 goto send_rsp;
8091
8092 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8093 hdev->dev_class, 3);
8094
8095 if (h192 && r192) {
8096 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8097 EIR_SSP_HASH_C192, h192, 16);
8098 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8099 EIR_SSP_RAND_R192, r192, 16);
8100 }
8101
8102 if (h256 && r256) {
8103 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8104 EIR_SSP_HASH_C256, h256, 16);
8105 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8106 EIR_SSP_RAND_R256, r256, 16);
8107 }
8108
8109send_rsp:
8110 mgmt_rp->type = mgmt_cp->type;
8111 mgmt_rp->eir_len = cpu_to_le16(eir_len);
8112
8113 err = mgmt_cmd_complete(cmd->sk, hdev->id,
8114 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8115 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8116 if (err < 0 || status)
8117 goto done;
8118
8119 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8120
8121 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8122 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8123 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8124done:
177e77a3
BG		 8125 if (skb && !IS_ERR(skb))
8126 kfree_skb(skb);
8127
40f66c05
JH		 8128 kfree(mgmt_rp);
8129 mgmt_pending_remove(cmd);
8130}
8131
8132static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8133 struct mgmt_cp_read_local_oob_ext_data *cp)
8134{
8135 struct mgmt_pending_cmd *cmd;
40f66c05
JH		 8136 int err;
8137
8138 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8139 cp, sizeof(*cp));
8140 if (!cmd)
8141 return -ENOMEM;
8142
177e77a3
BG		 8143 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8144 read_local_oob_ext_data_complete);
40f66c05 8145
40f66c05
JH		 8146 if (err < 0) {
8147 mgmt_pending_remove(cmd);
8148 return err;
8149 }
8150
8151 return 0;
8152}
8153
4f0f155c
MH		 8154static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8155 void *data, u16 data_len)
8156{
8157 struct mgmt_cp_read_local_oob_ext_data *cp = data;
8158 struct mgmt_rp_read_local_oob_ext_data *rp;
8159 size_t rp_len;
8160 u16 eir_len;
0821a2c5 8161 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 8162 int err;
8163
181d6953 8164 bt_dev_dbg(hdev, "sock %p", sk);
4f0f155c 8165
57b0d3e8
MH		 8166 if (hdev_is_powered(hdev)) {
8167 switch (cp->type) {
8168 case BIT(BDADDR_BREDR):
8169 status = mgmt_bredr_support(hdev);
8170 if (status)
8171 eir_len = 0;
8172 else
8173 eir_len = 5;
8174 break;
8175 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8176 status = mgmt_le_support(hdev);
8177 if (status)
8178 eir_len = 0;
8179 else
8180 eir_len = 9 + 3 + 18 + 18 + 3;
8181 break;
8182 default:
8183 status = MGMT_STATUS_INVALID_PARAMS;
8184 eir_len = 0;
8185 break;
8186 }
8187 } else {
8188 status = MGMT_STATUS_NOT_POWERED;
8189 eir_len = 0;
4f0f155c
MH		 8190 }
8191
4f0f155c
MH		 8192 rp_len = sizeof(*rp) + eir_len;
8193 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 8194 if (!rp)
4f0f155c 8195 return -ENOMEM;
efcd8c98 8196
81218cbe
BG		 8197 if (!status && !lmp_ssp_capable(hdev)) {
8198 status = MGMT_STATUS_NOT_SUPPORTED;
8199 eir_len = 0;
8200 }
8201
57b0d3e8
MH		 8202 if (status)
8203 goto complete;
8204
efcd8c98 8205 hci_dev_lock(hdev);
4f0f155c
MH		 8206
8207 eir_len = 0;
8208 switch (cp->type) {
8209 case BIT(BDADDR_BREDR):
40f66c05
JH		 8210 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8211 err = read_local_ssp_oob_req(hdev, sk, cp);
8212 hci_dev_unlock(hdev);
8213 if (!err)
8214 goto done;
8215
8216 status = MGMT_STATUS_FAILED;
8217 goto complete;
8218 } else {
8219 eir_len = eir_append_data(rp->eir, eir_len,
8220 EIR_CLASS_OF_DEV,
8221 hdev->dev_class, 3);
8222 }
4f0f155c
MH		 8223 break;
8224 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 8225 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8226 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 8227 hci_dev_unlock(hdev);
57b0d3e8
MH		 8228 status = MGMT_STATUS_FAILED;
8229 goto complete;
0821a2c5
MH		 8230 }
8231
e213568a
MH		 8232 /* This should return the active RPA, but since the RPA
8233 * is only programmed on demand, it is really hard to fill
8234 * this in at the moment. For now disallow retrieving
8235 * local out-of-band data when privacy is in use.
8236 *
8237 * Returning the identity address will not help here since
8238 * pairing happens before the identity resolving key is
8239 * known and thus the connection establishment happens
8240 * based on the RPA and not the identity address.
8241 */
4f0f155c 8242 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
e213568a
MH		 8243 hci_dev_unlock(hdev);
8244 status = MGMT_STATUS_REJECTED;
8245 goto complete;
8246 }
8247
8248 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8249 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8250 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8251 bacmp(&hdev->static_addr, BDADDR_ANY))) {
4f0f155c
MH		 8252 memcpy(addr, &hdev->static_addr, 6);
8253 addr[6] = 0x01;
8254 } else {
8255 memcpy(addr, &hdev->bdaddr, 6);
8256 addr[6] = 0x00;
8257 }
8258
8259 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8260 addr, sizeof(addr));
8261
8262 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8263 role = 0x02;
8264 else
8265 role = 0x01;
8266
8267 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8268 &role, sizeof(role));
8269
5082a599
MH		 8270 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8271 eir_len = eir_append_data(rp->eir, eir_len,
8272 EIR_LE_SC_CONFIRM,
8273 hash, sizeof(hash));
0821a2c5 8274
5082a599
MH		 8275 eir_len = eir_append_data(rp->eir, eir_len,
8276 EIR_LE_SC_RANDOM,
8277 rand, sizeof(rand));
8278 }
0821a2c5 8279
f2252570 8280 flags = mgmt_get_adv_discov_flags(hdev);
4f0f155c
MH		 8281
8282 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8283 flags |= LE_AD_NO_BREDR;
8284
8285 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8286 &flags, sizeof(flags));
8287 break;
8288 }
8289
4f0f155c
MH		 8290 hci_dev_unlock(hdev);
8291
72000df2
MH		 8292 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8293
57b0d3e8
MH		 8294 status = MGMT_STATUS_SUCCESS;
8295
8296complete:
efcd8c98
MH		 8297 rp->type = cp->type;
8298 rp->eir_len = cpu_to_le16(eir_len);
8299
4f0f155c 8300 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 8301 status, rp, sizeof(*rp) + eir_len);
8302 if (err < 0 || status)
72000df2
MH		 8303 goto done;
8304
8305 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8306 rp, sizeof(*rp) + eir_len,
8307 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 8308
0821a2c5 8309done:
4f0f155c
MH		 8310 kfree(rp);
8311
8312 return err;
8313}
8314
089fa8c0
AU		 8315static u32 get_supported_adv_flags(struct hci_dev *hdev)
8316{
8317 u32 flags = 0;
8318
8319 flags |= MGMT_ADV_FLAG_CONNECTABLE;
8320 flags |= MGMT_ADV_FLAG_DISCOV;
8321 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8322 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
c4960ecf 8323 flags |= MGMT_ADV_FLAG_APPEARANCE;
7c295c48 8324 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
12410572
DW		 8325 flags |= MGMT_ADV_PARAM_DURATION;
8326 flags |= MGMT_ADV_PARAM_TIMEOUT;
8327 flags |= MGMT_ADV_PARAM_INTERVALS;
8328 flags |= MGMT_ADV_PARAM_TX_POWER;
ff02db13 8329 flags |= MGMT_ADV_PARAM_SCAN_RSP;
089fa8c0 8330
de181e88
JK		 8331 /* In extended adv TX_POWER returned from Set Adv Param
8332 * will be always valid.
8333 */
b338d917 8334 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
089fa8c0
AU		 8335 flags |= MGMT_ADV_FLAG_TX_POWER;
8336
85a721a8
JK		 8337 if (ext_adv_capable(hdev)) {
8338 flags |= MGMT_ADV_FLAG_SEC_1M;
d5ea32da
DW		 8339 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8340 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
85a721a8 8341
288c9022 8342 if (le_2m_capable(hdev))
85a721a8
JK		 8343 flags |= MGMT_ADV_FLAG_SEC_2M;
8344
288c9022 8345 if (le_coded_capable(hdev))
85a721a8
JK		 8346 flags |= MGMT_ADV_FLAG_SEC_CODED;
8347 }
8348
089fa8c0
AU		 8349 return flags;
8350}
8351
d3d5305b
MH		 8352static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8353 void *data, u16 data_len)
8354{
8355 struct mgmt_rp_read_adv_features *rp;
8356 size_t rp_len;
02c04afe 8357 int err;
286e0c83 8358 struct adv_info *adv_instance;
089fa8c0 8359 u32 supported_flags;
02c04afe 8360 u8 *instance;
d3d5305b 8361
181d6953 8362 bt_dev_dbg(hdev, "sock %p", sk);
d3d5305b 8363
089fa8c0
AU		 8364 if (!lmp_le_capable(hdev))
8365 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8366 MGMT_STATUS_REJECTED);
8367
d3d5305b
MH		 8368 hci_dev_lock(hdev);
8369
02c04afe 8370 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
d3d5305b
MH		 8371 rp = kmalloc(rp_len, GFP_ATOMIC);
8372 if (!rp) {
8373 hci_dev_unlock(hdev);
8374 return -ENOMEM;
8375 }
8376
089fa8c0
AU		 8377 supported_flags = get_supported_adv_flags(hdev);
8378
8379 rp->supported_flags = cpu_to_le32(supported_flags);
112b5090
LAD		 8380 rp->max_adv_data_len = max_adv_len(hdev);
8381 rp->max_scan_rsp_len = max_adv_len(hdev);
87597482 8382 rp->max_instances = hdev->le_num_of_adv_sets;
02c04afe 8383 rp->num_instances = hdev->adv_instance_cnt;
24b4f38f 8384
02c04afe
JH		 8385 instance = rp->instance;
8386 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
b338d917
BG		 8387 /* Only instances 1-le_num_of_adv_sets are externally visible */
8388 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8389 *instance = adv_instance->instance;
8390 instance++;
8391 } else {
8392 rp->num_instances--;
8393 rp_len--;
8394 }
24b4f38f 8395 }
d3d5305b
MH		 8396
8397 hci_dev_unlock(hdev);
8398
8399 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8400 MGMT_STATUS_SUCCESS, rp, rp_len);
8401
8402 kfree(rp);
8403
8404 return err;
8405}
8406
f61851f6
MN		 8407static u8 calculate_name_len(struct hci_dev *hdev)
8408{
2ab3e8d6 8409 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
f61851f6 8410
01ce70b0 8411 return eir_append_local_name(hdev, buf, 0);
f61851f6
MN		 8412}
8413
8414static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8415 bool is_adv_data)
24b4f38f 8416{
112b5090 8417 u8 max_len = max_adv_len(hdev);
24b4f38f 8418
31a3248d
MH		 8419 if (is_adv_data) {
8420 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8421 MGMT_ADV_FLAG_LIMITED_DISCOV |
2bb36870 8422 MGMT_ADV_FLAG_MANAGED_FLAGS))
31a3248d 8423 max_len -= 3;
24b4f38f 8424
2bb36870 8425 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
31a3248d 8426 max_len -= 3;
7c295c48 8427 } else {
7c295c48 8428 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
f61851f6 8429 max_len -= calculate_name_len(hdev);
c4960ecf 8430
2bb36870 8431 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
c4960ecf 8432 max_len -= 4;
5507e358
AU		 8433 }
8434
2bb36870
SJ		 8435 return max_len;
8436}
8437
8438static bool flags_managed(u32 adv_flags)
8439{
8440 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8441 MGMT_ADV_FLAG_LIMITED_DISCOV |
8442 MGMT_ADV_FLAG_MANAGED_FLAGS);
8443}
8444
8445static bool tx_power_managed(u32 adv_flags)
8446{
8447 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8448}
8449
8450static bool name_managed(u32 adv_flags)
8451{
8452 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8453}
8454
8455static bool appearance_managed(u32 adv_flags)
8456{
8457 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8458}
8459
f61851f6
MN		 8460static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8461 u8 len, bool is_adv_data)
2bb36870
SJ		 8462{
8463 int i, cur_len;
8464 u8 max_len;
8465
f61851f6 8466 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
2bb36870 8467
4117ed70 8468 if (len > max_len)
24b4f38f
AU		 8469 return false;
8470
4117ed70 8471 /* Make sure that the data is correctly formatted. */
0ca8794a 8472 for (i = 0; i < len; i += (cur_len + 1)) {
4117ed70 8473 cur_len = data[i];
24b4f38f 8474
799acb93
LAD		 8475 if (!cur_len)
8476 continue;
8477
9c9db78d
SJ		 8478 if (data[i + 1] == EIR_FLAGS &&
8479 (!is_adv_data || flags_managed(adv_flags)))
2bb36870
SJ		 8480 return false;
8481
8482 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8483 return false;
8484
8485 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8486 return false;
8487
8488 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
b44133ff
AU		 8489 return false;
8490
2bb36870
SJ		 8491 if (data[i + 1] == EIR_APPEARANCE &&
8492 appearance_managed(adv_flags))
5507e358
AU		 8493 return false;
8494
24b4f38f
AU		 8495 /* If the current field length would exceed the total data
8496 * length, then it's invalid.
8497 */
4117ed70 8498 if (i + cur_len >= len)
24b4f38f
AU		 8499 return false;
8500 }
8501
8502 return true;
8503}
8504
12410572
DW		 8505static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8506{
8507 u32 supported_flags, phy_flags;
8508
8509 /* The current implementation only supports a subset of the specified
8510 * flags. Also need to check mutual exclusiveness of sec flags.
8511 */
8512 supported_flags = get_supported_adv_flags(hdev);
8513 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8514 if (adv_flags & ~supported_flags ||
8515 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8516 return false;
8517
8518 return true;
8519}
8520
8521static bool adv_busy(struct hci_dev *hdev)
8522{
275f3f64 8523 return pending_find(MGMT_OP_SET_LE, hdev);
12410572
DW		 8524}
8525
cba6b758
LAD		 8526static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8527 int err)
24b4f38f 8528{
cba6b758 8529 struct adv_info *adv, *n;
24b4f38f 8530
cba6b758 8531 bt_dev_dbg(hdev, "err %d", err);
24b4f38f
AU		 8532
8533 hci_dev_lock(hdev);
8534
cba6b758
LAD		 8535 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8536 u8 instance;
24b4f38f 8537
cba6b758 8538 if (!adv->pending)
fffd38bc
FG		 8539 continue;
8540
cba6b758
LAD		 8541 if (!err) {
8542 adv->pending = false;
fffd38bc
FG		 8543 continue;
8544 }
8545
cba6b758 8546 instance = adv->instance;
fffd38bc
FG		 8547
8548 if (hdev->cur_adv_instance == instance)
8549 cancel_adv_timeout(hdev);
8550
8551 hci_remove_adv_instance(hdev, instance);
cba6b758 8552 mgmt_advertising_removed(sk, hdev, instance);
24b4f38f
AU		 8553 }
8554
cba6b758
LAD		 8555 hci_dev_unlock(hdev);
8556}
8557
8558static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8559{
8560 struct mgmt_pending_cmd *cmd = data;
8561 struct mgmt_cp_add_advertising *cp = cmd->param;
8562 struct mgmt_rp_add_advertising rp;
8563
8564 memset(&rp, 0, sizeof(rp));
24b4f38f 8565
fffd38bc 8566 rp.instance = cp->instance;
24b4f38f 8567
cba6b758 8568 if (err)
24b4f38f 8569 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
cba6b758 8570 mgmt_status(err));
24b4f38f
AU		 8571 else
8572 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
cba6b758 8573 mgmt_status(err), &rp, sizeof(rp));
24b4f38f 8574
cba6b758 8575 add_adv_complete(hdev, cmd->sk, cp->instance, err);
24b4f38f 8576
cba6b758
LAD		 8577 mgmt_pending_free(cmd);
8578}
8579
8580static int add_advertising_sync(struct hci_dev *hdev, void *data)
8581{
8582 struct mgmt_pending_cmd *cmd = data;
8583 struct mgmt_cp_add_advertising *cp = cmd->param;
8584
8585 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
24b4f38f
AU		 8586}
8587
8588static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8589 void *data, u16 data_len)
8590{
8591 struct mgmt_cp_add_advertising *cp = data;
8592 struct mgmt_rp_add_advertising rp;
8593 u32 flags;
8594 u8 status;
fffd38bc 8595 u16 timeout, duration;
4bd80d7a 8596 unsigned int prev_instance_cnt;
fffd38bc 8597 u8 schedule_instance = 0;
eca0ae4a 8598 struct adv_info *adv, *next_instance;
24b4f38f
AU		 8599 int err;
8600 struct mgmt_pending_cmd *cmd;
24b4f38f 8601
181d6953 8602 bt_dev_dbg(hdev, "sock %p", sk);
24b4f38f
AU		 8603
8604 status = mgmt_le_support(hdev);
8605 if (status)
8606 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8607 status);
8608
87597482 8609 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
6a0e7807
JH		 8610 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8611 MGMT_STATUS_INVALID_PARAMS);
8612
8613 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
ceff86af
MH		 8614 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8615 MGMT_STATUS_INVALID_PARAMS);
8616
24b4f38f 8617 flags = __le32_to_cpu(cp->flags);
912098a6 8618 timeout = __le16_to_cpu(cp->timeout);
fffd38bc 8619 duration = __le16_to_cpu(cp->duration);
24b4f38f 8620
12410572 8621 if (!requested_adv_flags_are_valid(hdev, flags))
24b4f38f
AU		 8622 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8623 MGMT_STATUS_INVALID_PARAMS);
8624
8625 hci_dev_lock(hdev);
8626
912098a6
AU		 8627 if (timeout && !hdev_is_powered(hdev)) {
8628 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8629 MGMT_STATUS_REJECTED);
8630 goto unlock;
8631 }
8632
12410572 8633 if (adv_busy(hdev)) {
24b4f38f
AU		 8634 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8635 MGMT_STATUS_BUSY);
8636 goto unlock;
8637 }
8638
f61851f6
MN		 8639 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8640 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 8641 cp->scan_rsp_len, false)) {
24b4f38f
AU		 8642 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8643 MGMT_STATUS_INVALID_PARAMS);
8644 goto unlock;
8645 }
8646
4bd80d7a
ND		 8647 prev_instance_cnt = hdev->adv_instance_cnt;
8648
eca0ae4a 8649 adv = hci_add_adv_instance(hdev, cp->instance, flags,
fffd38bc
FG		 8650 cp->adv_data_len, cp->data,
8651 cp->scan_rsp_len,
8652 cp->data + cp->adv_data_len,
9bf9f4b6
DW		 8653 timeout, duration,
8654 HCI_ADV_TX_POWER_NO_PREFERENCE,
8655 hdev->le_adv_min_interval,
b338d917 8656 hdev->le_adv_max_interval, 0);
eca0ae4a 8657 if (IS_ERR(adv)) {
fffd38bc
FG		 8658 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8659 MGMT_STATUS_FAILED);
8660 goto unlock;
8661 }
24b4f38f 8662
fffd38bc
FG		 8663 /* Only trigger an advertising added event if a new instance was
8664 * actually added.
8665 */
8666 if (hdev->adv_instance_cnt > prev_instance_cnt)
f2252570 8667 mgmt_advertising_added(sk, hdev, cp->instance);
912098a6 8668
fffd38bc
FG		 8669 if (hdev->cur_adv_instance == cp->instance) {
8670 /* If the currently advertised instance is being changed then
8671 * cancel the current advertising and schedule the next
8672 * instance. If there is only one instance then the overridden
8673 * advertising data will be visible right away.
8674 */
8675 cancel_adv_timeout(hdev);
912098a6 8676
fffd38bc
FG		 8677 next_instance = hci_get_next_instance(hdev, cp->instance);
8678 if (next_instance)
8679 schedule_instance = next_instance->instance;
8680 } else if (!hdev->adv_instance_timeout) {
8681 /* Immediately advertise the new instance if no other
8682 * instance is currently being advertised.
8683 */
8684 schedule_instance = cp->instance;
8685 }
24b4f38f 8686
fffd38bc
FG		 8687 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8688 * there is no instance to be advertised then we have no HCI
8689 * communication to make. Simply return.
24b4f38f
AU		 8690 */
8691 if (!hdev_is_powered(hdev) ||
fffd38bc
FG		 8692 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8693 !schedule_instance) {
8694 rp.instance = cp->instance;
24b4f38f
AU		 8695 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8696 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8697 goto unlock;
8698 }
8699
8700 /* We're good to go, update advertising data, parameters, and start
8701 * advertising.
8702 */
cba6b758 8703 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
24b4f38f
AU		 8704 data_len);
8705 if (!cmd) {
8706 err = -ENOMEM;
8707 goto unlock;
8708 }
8709
cba6b758 8710 cp->instance = schedule_instance;
24b4f38f 8711
cba6b758
LAD		 8712 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8713 add_advertising_complete);
8714 if (err < 0)
8715 mgmt_pending_free(cmd);
24b4f38f
AU		 8716
8717unlock:
8718 hci_dev_unlock(hdev);
8719
8720 return err;
8721}
8722
cba6b758
LAD		 8723static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8724 int err)
12410572 8725{
cba6b758
LAD		 8726 struct mgmt_pending_cmd *cmd = data;
8727 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
12410572 8728 struct mgmt_rp_add_ext_adv_params rp;
cba6b758 8729 struct adv_info *adv;
12410572
DW		 8730 u32 flags;
8731
8732 BT_DBG("%s", hdev->name);
8733
8734 hci_dev_lock(hdev);
8735
cba6b758
LAD		 8736 adv = hci_find_adv_instance(hdev, cp->instance);
8737 if (!adv)
12410572
DW		 8738 goto unlock;
8739
8740 rp.instance = cp->instance;
cba6b758 8741 rp.tx_power = adv->tx_power;
12410572
DW		 8742
8743 /* While we're at it, inform userspace of the available space for this
8744 * advertisement, given the flags that will be used.
8745 */
8746 flags = __le32_to_cpu(cp->flags);
8747 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8748 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8749
cba6b758 8750 if (err) {
12410572
DW		 8751 /* If this advertisement was previously advertising and we
8752 * failed to update it, we signal that it has been removed and
8753 * delete its structure
8754 */
cba6b758 8755 if (!adv->pending)
12410572
DW		 8756 mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8757
8758 hci_remove_adv_instance(hdev, cp->instance);
8759
8760 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
cba6b758 8761 mgmt_status(err));
12410572
DW		 8762 } else {
8763 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
cba6b758 8764 mgmt_status(err), &rp, sizeof(rp));
12410572
DW		 8765 }
8766
8767unlock:
a310d74d 8768 mgmt_pending_free(cmd);
12410572
DW		 8769
8770 hci_dev_unlock(hdev);
8771}
8772
cba6b758
LAD		 8773static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8774{
8775 struct mgmt_pending_cmd *cmd = data;
8776 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8777
8778 return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8779}
8780
12410572
DW		 8781static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8782 void *data, u16 data_len)
8783{
8784 struct mgmt_cp_add_ext_adv_params *cp = data;
8785 struct mgmt_rp_add_ext_adv_params rp;
8786 struct mgmt_pending_cmd *cmd = NULL;
eca0ae4a 8787 struct adv_info *adv;
12410572
DW		 8788 u32 flags, min_interval, max_interval;
8789 u16 timeout, duration;
8790 u8 status;
8791 s8 tx_power;
8792 int err;
8793
8794 BT_DBG("%s", hdev->name);
8795
8796 status = mgmt_le_support(hdev);
8797 if (status)
8798 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8799 status);
8800
8801 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8803 MGMT_STATUS_INVALID_PARAMS);
8804
8805 /* The purpose of breaking add_advertising into two separate MGMT calls
8806 * for params and data is to allow more parameters to be added to this
8807 * structure in the future. For this reason, we verify that we have the
8808 * bare minimum structure we know of when the interface was defined. Any
8809 * extra parameters we don't know about will be ignored in this request.
8810 */
8811 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
3b1c7c00 8812 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
12410572
DW		 8813 MGMT_STATUS_INVALID_PARAMS);
8814
8815 flags = __le32_to_cpu(cp->flags);
8816
8817 if (!requested_adv_flags_are_valid(hdev, flags))
8818 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8819 MGMT_STATUS_INVALID_PARAMS);
8820
8821 hci_dev_lock(hdev);
8822
8823 /* In new interface, we require that we are powered to register */
8824 if (!hdev_is_powered(hdev)) {
8825 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8826 MGMT_STATUS_REJECTED);
8827 goto unlock;
8828 }
8829
8830 if (adv_busy(hdev)) {
8831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8832 MGMT_STATUS_BUSY);
8833 goto unlock;
8834 }
8835
8836 /* Parse defined parameters from request, use defaults otherwise */
8837 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8838 __le16_to_cpu(cp->timeout) : 0;
8839
8840 duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8841 __le16_to_cpu(cp->duration) :
8842 hdev->def_multi_adv_rotation_duration;
8843
8844 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8845 __le32_to_cpu(cp->min_interval) :
8846 hdev->le_adv_min_interval;
8847
8848 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8849 __le32_to_cpu(cp->max_interval) :
8850 hdev->le_adv_max_interval;
8851
8852 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8853 cp->tx_power :
8854 HCI_ADV_TX_POWER_NO_PREFERENCE;
8855
8856 /* Create advertising instance with no advertising or response data */
eca0ae4a
LAD		 8857 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8858 timeout, duration, tx_power, min_interval,
b338d917 8859 max_interval, 0);
12410572 8860
eca0ae4a 8861 if (IS_ERR(adv)) {
12410572
DW		 8862 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8863 MGMT_STATUS_FAILED);
8864 goto unlock;
8865 }
8866
12410572
DW		 8867 /* Submit request for advertising params if ext adv available */
8868 if (ext_adv_capable(hdev)) {
cba6b758
LAD		 8869 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8870 data, data_len);
12410572
DW		 8871 if (!cmd) {
8872 err = -ENOMEM;
8873 hci_remove_adv_instance(hdev, cp->instance);
8874 goto unlock;
8875 }
8876
cba6b758
LAD		 8877 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8878 add_ext_adv_params_complete);
8879 if (err < 0)
8880 mgmt_pending_free(cmd);
12410572
DW		 8881 } else {
8882 rp.instance = cp->instance;
8883 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8884 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8885 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8886 err = mgmt_cmd_complete(sk, hdev->id,
8887 MGMT_OP_ADD_EXT_ADV_PARAMS,
8888 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8889 }
8890
8891unlock:
8892 hci_dev_unlock(hdev);
8893
8894 return err;
8895}
8896
cba6b758
LAD		 8897static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8898{
8899 struct mgmt_pending_cmd *cmd = data;
8900 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8901 struct mgmt_rp_add_advertising rp;
8902
8903 add_adv_complete(hdev, cmd->sk, cp->instance, err);
8904
8905 memset(&rp, 0, sizeof(rp));
8906
8907 rp.instance = cp->instance;
8908
8909 if (err)
8910 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8911 mgmt_status(err));
8912 else
8913 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8914 mgmt_status(err), &rp, sizeof(rp));
8915
8916 mgmt_pending_free(cmd);
8917}
8918
8919static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8920{
8921 struct mgmt_pending_cmd *cmd = data;
8922 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8923 int err;
8924
8925 if (ext_adv_capable(hdev)) {
8926 err = hci_update_adv_data_sync(hdev, cp->instance);
8927 if (err)
8928 return err;
8929
8930 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8931 if (err)
8932 return err;
8933
8934 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8935 }
8936
8937 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8938}
8939
12410572
DW		 8940static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8941 u16 data_len)
8942{
8943 struct mgmt_cp_add_ext_adv_data *cp = data;
8944 struct mgmt_rp_add_ext_adv_data rp;
8945 u8 schedule_instance = 0;
8946 struct adv_info *next_instance;
8947 struct adv_info *adv_instance;
8948 int err = 0;
8949 struct mgmt_pending_cmd *cmd;
12410572
DW		 8950
8951 BT_DBG("%s", hdev->name);
8952
8953 hci_dev_lock(hdev);
8954
8955 adv_instance = hci_find_adv_instance(hdev, cp->instance);
8956
8957 if (!adv_instance) {
8958 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8959 MGMT_STATUS_INVALID_PARAMS);
8960 goto unlock;
8961 }
8962
8963 /* In new interface, we require that we are powered to register */
8964 if (!hdev_is_powered(hdev)) {
8965 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8966 MGMT_STATUS_REJECTED);
8967 goto clear_new_instance;
8968 }
8969
8970 if (adv_busy(hdev)) {
8971 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8972 MGMT_STATUS_BUSY);
8973 goto clear_new_instance;
8974 }
8975
8976 /* Validate new data */
8977 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8978 cp->adv_data_len, true) ||
8979 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8980 cp->adv_data_len, cp->scan_rsp_len, false)) {
8981 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8982 MGMT_STATUS_INVALID_PARAMS);
8983 goto clear_new_instance;
8984 }
8985
8986 /* Set the data in the advertising instance */
8987 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8988 cp->data, cp->scan_rsp_len,
8989 cp->data + cp->adv_data_len);
8990
cba6b758
LAD		 8991 /* If using software rotation, determine next instance to use */
8992 if (hdev->cur_adv_instance == cp->instance) {
8993 /* If the currently advertised instance is being changed
8994 * then cancel the current advertising and schedule the
8995 * next instance. If there is only one instance then the
8996 * overridden advertising data will be visible right
8997 * away
8998 */
8999 cancel_adv_timeout(hdev);
12410572 9000
cba6b758
LAD		 9001 next_instance = hci_get_next_instance(hdev, cp->instance);
9002 if (next_instance)
9003 schedule_instance = next_instance->instance;
9004 } else if (!hdev->adv_instance_timeout) {
9005 /* Immediately advertise the new instance if no other
9006 * instance is currently being advertised.
12410572 9007 */
cba6b758
LAD		 9008 schedule_instance = cp->instance;
9009 }
12410572 9010
cba6b758
LAD		 9011 /* If the HCI_ADVERTISING flag is set or there is no instance to
9012 * be advertised then we have no HCI communication to make.
9013 * Simply return.
9014 */
9015 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9016 if (adv_instance->pending) {
9017 mgmt_advertising_added(sk, hdev, cp->instance);
9018 adv_instance->pending = false;
9019 }
9020 rp.instance = cp->instance;
9021 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9022 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9023 goto unlock;
12410572
DW		 9024 }
9025
cba6b758 9026 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
12410572
DW		 9027 data_len);
9028 if (!cmd) {
9029 err = -ENOMEM;
9030 goto clear_new_instance;
9031 }
9032
cba6b758
LAD		 9033 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9034 add_ext_adv_data_complete);
12410572 9035 if (err < 0) {
cba6b758 9036 mgmt_pending_free(cmd);
12410572
DW		 9037 goto clear_new_instance;
9038 }
9039
9040 /* We were successful in updating data, so trigger advertising_added
9041 * event if this is an instance that wasn't previously advertising. If
9042 * a failure occurs in the requests we initiated, we will remove the
9043 * instance again in add_advertising_complete
9044 */
9045 if (adv_instance->pending)
9046 mgmt_advertising_added(sk, hdev, cp->instance);
9047
9048 goto unlock;
9049
9050clear_new_instance:
9051 hci_remove_adv_instance(hdev, cp->instance);
9052
9053unlock:
9054 hci_dev_unlock(hdev);
9055
9056 return err;
9057}
9058
cba6b758
LAD		 9059static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9060 int err)
da929335 9061{
cba6b758
LAD		 9062 struct mgmt_pending_cmd *cmd = data;
9063 struct mgmt_cp_remove_advertising *cp = cmd->param;
da929335
AU		 9064 struct mgmt_rp_remove_advertising rp;
9065
cba6b758 9066 bt_dev_dbg(hdev, "err %d", err);
da929335 9067
cba6b758
LAD		 9068 memset(&rp, 0, sizeof(rp));
9069 rp.instance = cp->instance;
da929335 9070
cba6b758
LAD		 9071 if (err)
9072 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9073 mgmt_status(err));
9074 else
9075 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9076 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
da929335 9077
cba6b758
LAD		 9078 mgmt_pending_free(cmd);
9079}
da929335 9080
cba6b758
LAD		 9081static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9082{
9083 struct mgmt_pending_cmd *cmd = data;
9084 struct mgmt_cp_remove_advertising *cp = cmd->param;
9085 int err;
da929335 9086
cba6b758
LAD		 9087 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9088 if (err)
9089 return err;
9090
9091 if (list_empty(&hdev->adv_instances))
9092 err = hci_disable_advertising_sync(hdev);
9093
9094 return err;
da929335
AU		 9095}
9096
9097static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9098 void *data, u16 data_len)
9099{
9100 struct mgmt_cp_remove_advertising *cp = data;
da929335 9101 struct mgmt_pending_cmd *cmd;
952497b1 9102 int err;
da929335 9103
181d6953 9104 bt_dev_dbg(hdev, "sock %p", sk);
da929335 9105
da929335
AU		 9106 hci_dev_lock(hdev);
9107
952497b1 9108 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
01948331
FG		 9109 err = mgmt_cmd_status(sk, hdev->id,
9110 MGMT_OP_REMOVE_ADVERTISING,
9111 MGMT_STATUS_INVALID_PARAMS);
9112 goto unlock;
9113 }
9114
275f3f64 9115 if (pending_find(MGMT_OP_SET_LE, hdev)) {
da929335
AU		 9116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9117 MGMT_STATUS_BUSY);
9118 goto unlock;
9119 }
9120
17fd08ff 9121 if (list_empty(&hdev->adv_instances)) {
da929335
AU		 9122 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9123 MGMT_STATUS_INVALID_PARAMS);
9124 goto unlock;
9125 }
9126
cba6b758 9127 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
da929335
AU		 9128 data_len);
9129 if (!cmd) {
9130 err = -ENOMEM;
9131 goto unlock;
9132 }
9133
cba6b758
LAD		 9134 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9135 remove_advertising_complete);
da929335 9136 if (err < 0)
cba6b758 9137 mgmt_pending_free(cmd);
da929335
AU		 9138
9139unlock:
9140 hci_dev_unlock(hdev);
9141
9142 return err;
9143}
9144
40b25fe5
MH		 9145static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9146 void *data, u16 data_len)
9147{
9148 struct mgmt_cp_get_adv_size_info *cp = data;
9149 struct mgmt_rp_get_adv_size_info rp;
9150 u32 flags, supported_flags;
40b25fe5 9151
181d6953 9152 bt_dev_dbg(hdev, "sock %p", sk);
40b25fe5
MH		 9153
9154 if (!lmp_le_capable(hdev))
9155 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9156 MGMT_STATUS_REJECTED);
9157
87597482 9158 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
40b25fe5
MH		 9159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9160 MGMT_STATUS_INVALID_PARAMS);
9161
9162 flags = __le32_to_cpu(cp->flags);
9163
9164 /* The current implementation only supports a subset of the specified
9165 * flags.
9166 */
9167 supported_flags = get_supported_adv_flags(hdev);
9168 if (flags & ~supported_flags)
9169 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9170 MGMT_STATUS_INVALID_PARAMS);
9171
9172 rp.instance = cp->instance;
9173 rp.flags = cp->flags;
f61851f6
MN		 9174 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9175 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
40b25fe5 9176
a6fbb2bf
MC		 9177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9178 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
40b25fe5
MH		 9179}
9180
6d785aa3 9181static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 9182 { NULL }, /* 0x0000 (no command) */
b9a245fb 9183 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 9184 HCI_MGMT_NO_HDEV |
9185 HCI_MGMT_UNTRUSTED },
b9a245fb 9186 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 9187 HCI_MGMT_NO_HDEV |
9188 HCI_MGMT_UNTRUSTED },
b9a245fb 9189 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 9190 HCI_MGMT_NO_HDEV |
9191 HCI_MGMT_UNTRUSTED },
9192 { read_controller_info, MGMT_READ_INFO_SIZE,
9193 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 9194 { set_powered, MGMT_SETTING_SIZE },
9195 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
9196 { set_connectable, MGMT_SETTING_SIZE },
9197 { set_fast_connectable, MGMT_SETTING_SIZE },
9198 { set_bondable, MGMT_SETTING_SIZE },
9199 { set_link_security, MGMT_SETTING_SIZE },
9200 { set_ssp, MGMT_SETTING_SIZE },
9201 { set_hs, MGMT_SETTING_SIZE },
9202 { set_le, MGMT_SETTING_SIZE },
9203 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
9204 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
9205 { add_uuid, MGMT_ADD_UUID_SIZE },
9206 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 9207 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
9208 HCI_MGMT_VAR_LEN },
9209 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9210 HCI_MGMT_VAR_LEN },
7aea8616
MH		 9211 { disconnect, MGMT_DISCONNECT_SIZE },
9212 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
9213 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
9214 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
9215 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
9216 { pair_device, MGMT_PAIR_DEVICE_SIZE },
9217 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
9218 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
9219 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
9220 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9221 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
9222 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 9223 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
9224 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9225 HCI_MGMT_VAR_LEN },
7aea8616
MH		 9226 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9227 { start_discovery, MGMT_START_DISCOVERY_SIZE },
9228 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
9229 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
9230 { block_device, MGMT_BLOCK_DEVICE_SIZE },
9231 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
9232 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
9233 { set_advertising, MGMT_SETTING_SIZE },
9234 { set_bredr, MGMT_SETTING_SIZE },
9235 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
9236 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
9237 { set_secure_conn, MGMT_SETTING_SIZE },
9238 { set_debug_keys, MGMT_SETTING_SIZE },
9239 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 9240 { load_irks, MGMT_LOAD_IRKS_SIZE,
9241 HCI_MGMT_VAR_LEN },
7aea8616
MH		 9242 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
9243 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
9244 { add_device, MGMT_ADD_DEVICE_SIZE },
9245 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 9246 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
9247 HCI_MGMT_VAR_LEN },
9248 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 9249 HCI_MGMT_NO_HDEV |
9250 HCI_MGMT_UNTRUSTED },
b9a245fb 9251 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 9252 HCI_MGMT_UNCONFIGURED |
9253 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 9254 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
9255 HCI_MGMT_UNCONFIGURED },
9256 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
9257 HCI_MGMT_UNCONFIGURED },
9258 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9259 HCI_MGMT_VAR_LEN },
4f0f155c 9260 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 9261 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 9262 HCI_MGMT_NO_HDEV |
9263 HCI_MGMT_UNTRUSTED },
d3d5305b 9264 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 9265 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
9266 HCI_MGMT_VAR_LEN },
da929335 9267 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
40b25fe5 9268 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
78b781ca 9269 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
321c6fee
MH		 9270 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9271 HCI_MGMT_UNTRUSTED },
c4960ecf 9272 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
6244691f 9273 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
0314f286 9274 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
600a8749
AM		 9275 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9276 HCI_MGMT_VAR_LEN },
00bce3fb 9277 { set_wideband_speech, MGMT_SETTING_SIZE },
4d9b9528 9278 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE,
bc292258 9279 HCI_MGMT_UNTRUSTED },
a10c907c
MH		 9280 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE,
9281 HCI_MGMT_UNTRUSTED |
9282 HCI_MGMT_HDEV_OPTIONAL },
9283 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE,
9284 HCI_MGMT_VAR_LEN |
9285 HCI_MGMT_HDEV_OPTIONAL },
17896406
AM		 9286 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9287 HCI_MGMT_UNTRUSTED },
9288 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9289 HCI_MGMT_VAR_LEN },
aececa64
MH		 9290 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9291 HCI_MGMT_UNTRUSTED },
9292 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9293 HCI_MGMT_VAR_LEN },
4c54bf2b
APS		 9294 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE },
9295 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE },
e5e1e7fd 9296 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
b139553d
MC		 9297 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9298 HCI_MGMT_VAR_LEN },
bd2fbc6c 9299 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE },
12410572
DW		 9300 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9301 HCI_MGMT_VAR_LEN },
9302 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE,
9303 HCI_MGMT_VAR_LEN },
b4a221ea 9304 { add_adv_patterns_monitor_rssi,
1a0291f8
HC		 9305 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9306 HCI_MGMT_VAR_LEN },
b338d917 9307 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE,
b4a221ea 9308 HCI_MGMT_VAR_LEN },
b338d917
BG		 9309 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE },
9310 { mesh_send, MGMT_MESH_SEND_SIZE,
9311 HCI_MGMT_VAR_LEN },
9312 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE },
0f4e68cf
JH		 9313};
9314
bf6b56db 9315void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 9316{
ced85549 9317 struct mgmt_ev_ext_index ev;
bb4b2a9a 9318
0602a8ad
MH		 9319 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9320 return;
9321
84a4bb65
LAD		 9322 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9323 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0,
9324 HCI_MGMT_UNCONF_INDEX_EVENTS);
9325 ev.type = 0x01;
9326 } else {
9327 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9328 HCI_MGMT_INDEX_EVENTS);
9329 ev.type = 0x00;
f9207338 9330 }
ced85549
MH		 9331
9332 ev.bus = hdev->bus;
9333
9334 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9335 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 9336}
9337
bf6b56db 9338void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 9339{
ced85549 9340 struct mgmt_ev_ext_index ev;
5f159032 9341 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 9342
0602a8ad
MH		 9343 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9344 return;
9345
84a4bb65 9346 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 9347
84a4bb65
LAD		 9348 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9349 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
9350 HCI_MGMT_UNCONF_INDEX_EVENTS);
9351 ev.type = 0x01;
9352 } else {
9353 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9354 HCI_MGMT_INDEX_EVENTS);
9355 ev.type = 0x00;
f9207338 9356 }
ced85549
MH		 9357
9358 ev.bus = hdev->bus;
9359
9360 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9361 HCI_MGMT_EXT_INDEX_EVENTS);
0ef08313
BG		 9362
9363 /* Cancel any remaining timed work */
3f2893d3
TH		 9364 if (!hci_dev_test_flag(hdev, HCI_MGMT))
9365 return;
0ef08313
BG		 9366 cancel_delayed_work_sync(&hdev->discov_off);
9367 cancel_delayed_work_sync(&hdev->service_cache);
9368 cancel_delayed_work_sync(&hdev->rpa_expired);
eec8d2bc
JH		 9369}
9370
2ff13894 9371void mgmt_power_on(struct hci_dev *hdev, int err)
229ab39c
JH		 9372{
9373 struct cmd_lookup match = { NULL, hdev };
9374
181d6953 9375 bt_dev_dbg(hdev, "err %d", err);
229ab39c 9376
2ff13894
JH		 9377 hci_dev_lock(hdev);
9378
9379 if (!err) {
af02dd44 9380 restart_le_actions(hdev);
ad383c2c 9381 hci_update_passive_scan(hdev);
162a3bac
MH		 9382 }
9383
229ab39c
JH		 9384 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9385
9386 new_settings(hdev, match.sk);
9387
229ab39c
JH		 9388 if (match.sk)
9389 sock_put(match.sk);
229ab39c 9390
2ff13894 9391 hci_dev_unlock(hdev);
70da6243 9392}
562fcc24 9393
2ff13894 9394void __mgmt_power_off(struct hci_dev *hdev)
70da6243
JH		 9395{
9396 struct cmd_lookup match = { NULL, hdev };
9845904f 9397 u8 status, zero_cod[] = { 0, 0, 0 };
b24752fe 9398
229ab39c 9399 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 9400
9401 /* If the power off is because of hdev unregistration let
9402 * use the appropriate INVALID_INDEX status. Otherwise use
9403 * NOT_POWERED. We cover both scenarios here since later in
9404 * mgmt_index_removed() any hci_conn callbacks will have already
9405 * been triggered, potentially causing misleading DISCONNECTED
9406 * status responses.
9407 */
d7a5a11d 9408 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 9409 status = MGMT_STATUS_INVALID_INDEX;
9410 else
9411 status = MGMT_STATUS_NOT_POWERED;
9412
9413 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c 9414
321c6fee 9415 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
5504c3a3
MH		 9416 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9417 zero_cod, sizeof(zero_cod),
9418 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
321c6fee
MH		 9419 ext_info_changed(hdev, NULL);
9420 }
229ab39c 9421
2ff13894 9422 new_settings(hdev, match.sk);
eec8d2bc
JH		 9423
9424 if (match.sk)
9425 sock_put(match.sk);
5add6af8 9426}
73f22f62 9427
3eec705e 9428void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 9429{
3b0602cd 9430 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 9431 u8 status;
9432
333ae95d 9433 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 9434 if (!cmd)
3eec705e 9435 return;
96570ffc
JH		 9436
9437 if (err == -ERFKILL)
9438 status = MGMT_STATUS_RFKILLED;
9439 else
9440 status = MGMT_STATUS_FAILED;
9441
a69e8375 9442 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 9443
9444 mgmt_pending_remove(cmd);
96570ffc
JH		 9445}
9446
dc4a5ee2
MH		 9447void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9448 bool persistent)
55ed8ca1 9449{
86742e1e 9450 struct mgmt_ev_new_link_key ev;
55ed8ca1 9451
a492cd52 9452 memset(&ev, 0, sizeof(ev));
55ed8ca1 9453
a492cd52 9454 ev.store_hint = persistent;
d753fdc4 9455 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
59b047bc 9456 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
a492cd52 9457 ev.key.type = key->type;
9b3b4460 9458 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 9459 ev.key.pin_len = key->pin_len;
55ed8ca1 9460
dc4a5ee2 9461 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 9462}
f7520543 9463
d7b25450
JH		 9464static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9465{
23fb8de3
JH		 9466 switch (ltk->type) {
9467 case SMP_LTK:
fad646e1 9468 case SMP_LTK_RESPONDER:
23fb8de3
JH		 9469 if (ltk->authenticated)
9470 return MGMT_LTK_AUTHENTICATED;
9471 return MGMT_LTK_UNAUTHENTICATED;
9472 case SMP_LTK_P256:
9473 if (ltk->authenticated)
9474 return MGMT_LTK_P256_AUTH;
9475 return MGMT_LTK_P256_UNAUTH;
9476 case SMP_LTK_P256_DEBUG:
9477 return MGMT_LTK_P256_DEBUG;
9478 }
d7b25450
JH		 9479
9480 return MGMT_LTK_UNAUTHENTICATED;
9481}
9482
53ac6ab6 9483void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 9484{
9485 struct mgmt_ev_new_long_term_key ev;
9486
9487 memset(&ev, 0, sizeof(ev));
9488
5192d301 9489 /* Devices using resolvable or non-resolvable random addresses
f72186d2 9490 * without providing an identity resolving key don't require
5192d301
MH		 9491 * to store long term keys. Their addresses will change the
9492 * next time around.
9493 *
9494 * Only when a remote device provides an identity address
9495 * make sure the long term key is stored. If the remote
9496 * identity is known, the long term keys are internally
9497 * mapped to the identity address. So allow static random
9498 * and public addresses here.
9499 */
ba74b666
JH		 9500 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9501 (key->bdaddr.b[5] & 0xc0) != 0xc0)
9502 ev.store_hint = 0x00;
9503 else
53ac6ab6 9504 ev.store_hint = persistent;
ba74b666 9505
346af67b 9506 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
59b047bc 9507 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
d7b25450 9508 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 9509 ev.key.enc_size = key->enc_size;
9510 ev.key.ediv = key->ediv;
fe39c7b2 9511 ev.key.rand = key->rand;
346af67b 9512
2ceba539 9513 if (key->type == SMP_LTK)
fad646e1 9514 ev.key.initiator = 1;
346af67b 9515
1fc62c52
JH		 9516 /* Make sure we copy only the significant bytes based on the
9517 * encryption key size, and set the rest of the value to zeroes.
9518 */
cb92205b 9519 memcpy(ev.key.val, key->val, key->enc_size);
1fc62c52
JH		 9520 memset(ev.key.val + key->enc_size, 0,
9521 sizeof(ev.key.val) - key->enc_size);
346af67b 9522
083368f7 9523 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 9524}
9525
cad20c27 9526void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
95fbac8a
JH		 9527{
9528 struct mgmt_ev_new_irk ev;
9529
9530 memset(&ev, 0, sizeof(ev));
9531
cad20c27 9532 ev.store_hint = persistent;
bab6d1e5 9533
95fbac8a
JH		 9534 bacpy(&ev.rpa, &irk->rpa);
9535 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
59b047bc 9536 ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
95fbac8a
JH		 9537 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9538
9539 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9540}
9541
53ac6ab6
MH		 9542void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9543 bool persistent)
7ee4ea36
MH		 9544{
9545 struct mgmt_ev_new_csrk ev;
9546
9547 memset(&ev, 0, sizeof(ev));
9548
9549 /* Devices using resolvable or non-resolvable random addresses
f72186d2 9550 * without providing an identity resolving key don't require
7ee4ea36
MH		 9551 * to store signature resolving keys. Their addresses will change
9552 * the next time around.
9553 *
9554 * Only when a remote device provides an identity address
9555 * make sure the signature resolving key is stored. So allow
9556 * static random and public addresses here.
9557 */
9558 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9559 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9560 ev.store_hint = 0x00;
9561 else
53ac6ab6 9562 ev.store_hint = persistent;
7ee4ea36
MH		 9563
9564 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
59b047bc 9565 ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
4cd3928a 9566 ev.key.type = csrk->type;
7ee4ea36
MH		 9567 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9568
9569 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9570}
9571
ffb5a827 9572void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 9573 u8 bdaddr_type, u8 store_hint, u16 min_interval,
9574 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 9575{
9576 struct mgmt_ev_new_conn_param ev;
9577
c103aea6
JH		 9578 if (!hci_is_identity_address(bdaddr, bdaddr_type))
9579 return;
9580
ffb5a827
AG		 9581 memset(&ev, 0, sizeof(ev));
9582 bacpy(&ev.addr.bdaddr, bdaddr);
9583 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 9584 ev.store_hint = store_hint;
ffb5a827
AG		 9585 ev.min_interval = cpu_to_le16(min_interval);
9586 ev.max_interval = cpu_to_le16(max_interval);
9587 ev.latency = cpu_to_le16(latency);
9588 ev.timeout = cpu_to_le16(timeout);
9589
9590 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9591}
9592
48ec92fa 9593void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
1c6ed31b 9594 u8 *name, u8 name_len)
f7520543 9595{
e9674143
LAD		 9596 struct sk_buff *skb;
9597 struct mgmt_ev_device_connected *ev;
b644ba33 9598 u16 eir_len = 0;
1c6ed31b 9599 u32 flags = 0;
f7520543 9600
eeda1bf9
LAD		 9601 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
9602 return;
9603
ba17bb62 9604 /* allocate buff for LE or BR/EDR adv */
e9674143
LAD		 9605 if (conn->le_adv_data_len > 0)
9606 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
ba17bb62 9607 sizeof(*ev) + conn->le_adv_data_len);
e9674143
LAD		 9608 else
9609 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
ba17bb62
RB		 9610 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9611 eir_precalc_len(sizeof(conn->dev_class)));
e9674143
LAD		 9612
9613 ev = skb_put(skb, sizeof(*ev));
48ec92fa
AA		 9614 bacpy(&ev->addr.bdaddr, &conn->dst);
9615 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 9616
1c6ed31b
YL		 9617 if (conn->out)
9618 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9619
c95f0ba7 9620 ev->flags = __cpu_to_le32(flags);
08c79b61 9621
fd45ada9
AA		 9622 /* We must ensure that the EIR Data fields are ordered and
9623 * unique. Keep it simple for now and avoid the problem by not
9624 * adding any BR/EDR data to the LE adv.
9625 */
9626 if (conn->le_adv_data_len > 0) {
e9674143 9627 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
fd45ada9
AA		 9628 eir_len = conn->le_adv_data_len;
9629 } else {
c2b2a1a7
RB		 9630 if (name)
9631 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
b644ba33 9632
c2b2a1a7
RB		 9633 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9634 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9635 conn->dev_class, sizeof(conn->dev_class));
fd45ada9 9636 }
b644ba33 9637
eb55ef07 9638 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 9639
e9674143 9640 mgmt_event_skb(skb, NULL);
f7520543
JH		 9641}
9642
3b0602cd 9643static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 9644{
8962ee74 9645 struct sock **sk = data;
8962ee74 9646
f5818c22 9647 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 9648
9649 *sk = cmd->sk;
9650 sock_hold(*sk);
9651
a664b5bc 9652 mgmt_pending_remove(cmd);
8962ee74
JH		 9653}
9654
3b0602cd 9655static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 9656{
b1078ad0 9657 struct hci_dev *hdev = data;
124f6e35 9658 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 9659
b1078ad0
JH		 9660 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9661
d8b7b1e4 9662 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 9663 mgmt_pending_remove(cmd);
9664}
9665
84c61d92
JH		 9666bool mgmt_powering_down(struct hci_dev *hdev)
9667{
3b0602cd 9668 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 9669 struct mgmt_mode *cp;
9670
b14202af
JD		 9671 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
9672 return true;
9673
333ae95d 9674 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 9675 if (!cmd)
9676 return false;
9677
9678 cp = cmd->param;
9679 if (!cp->val)
9680 return true;
9681
9682 return false;
9683}
9684
9b80ec5e 9685void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 9686 u8 link_type, u8 addr_type, u8 reason,
9687 bool mgmt_connected)
f7520543 9688{
f0d6a0ea 9689 struct mgmt_ev_device_disconnected ev;
8962ee74 9690 struct sock *sk = NULL;
8962ee74 9691
12d4a3b2
JH		 9692 if (!mgmt_connected)
9693 return;
9694
57eb776f
AG		 9695 if (link_type != ACL_LINK && link_type != LE_LINK)
9696 return;
9697
744cf19e 9698 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 9699
f0d6a0ea
MA		 9700 bacpy(&ev.addr.bdaddr, bdaddr);
9701 ev.addr.type = link_to_bdaddr(link_type, addr_type);
9702 ev.reason = reason;
f7520543 9703
f0cfc486
APS		 9704 /* Report disconnects due to suspend */
9705 if (hdev->suspended)
9706 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9707
9b80ec5e 9708 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 9709
9710 if (sk)
d97dcb66 9711 sock_put(sk);
8962ee74 9712
124f6e35 9713 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 9714 hdev);
8962ee74
JH		 9715}
9716
7892924c
MH		 9717void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9718 u8 link_type, u8 addr_type, u8 status)
8962ee74 9719{
3655bba8
AG		 9720 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9721 struct mgmt_cp_disconnect *cp;
3b0602cd 9722 struct mgmt_pending_cmd *cmd;
8962ee74 9723
36a75f1b
JD		 9724 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9725 hdev);
9726
333ae95d 9727 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 9728 if (!cmd)
7892924c 9729 return;
8962ee74 9730
3655bba8
AG		 9731 cp = cmd->param;
9732
9733 if (bacmp(bdaddr, &cp->addr.bdaddr))
9734 return;
9735
9736 if (cp->addr.type != bdaddr_type)
9737 return;
9738
f5818c22 9739 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 9740 mgmt_pending_remove(cmd);
f7520543 9741}
17d5c04c 9742
445608d0
MH		 9743void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9744 u8 addr_type, u8 status)
17d5c04c
JH		 9745{
9746 struct mgmt_ev_connect_failed ev;
c9910d0f 9747
4c659c39 9748 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 9749 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 9750 ev.status = mgmt_status(status);
17d5c04c 9751
445608d0 9752 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 9753}
980e1a53 9754
ce0e4a0d 9755void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 9756{
9757 struct mgmt_ev_pin_code_request ev;
9758
d8457698 9759 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 9760 ev.addr.type = BDADDR_BREDR;
a770bb5a 9761 ev.secure = secure;
980e1a53 9762
ce0e4a0d 9763 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 9764}
9765
e669cf80
MH		 9766void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9767 u8 status)
980e1a53 9768{
3b0602cd 9769 struct mgmt_pending_cmd *cmd;
980e1a53 9770
333ae95d 9771 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 9772 if (!cmd)
e669cf80 9773 return;
980e1a53 9774
7776d1d8 9775 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 9776 mgmt_pending_remove(cmd);
980e1a53
JH		 9777}
9778
3eb38528
MH		 9779void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9780 u8 status)
980e1a53 9781{
3b0602cd 9782 struct mgmt_pending_cmd *cmd;
980e1a53 9783
333ae95d 9784 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 9785 if (!cmd)
3eb38528 9786 return;
980e1a53 9787
7776d1d8 9788 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 9789 mgmt_pending_remove(cmd);
980e1a53 9790}
a5c29683 9791
744cf19e 9792int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 9793 u8 link_type, u8 addr_type, u32 value,
04124681 9794 u8 confirm_hint)
a5c29683
JH		 9795{
9796 struct mgmt_ev_user_confirm_request ev;
9797
181d6953 9798 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
a5c29683 9799
272d90df 9800 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 9801 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 9802 ev.confirm_hint = confirm_hint;
39adbffe 9803 ev.value = cpu_to_le32(value);
a5c29683 9804
744cf19e 9805 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 9806 NULL);
a5c29683
JH		 9807}
9808
272d90df 9809int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 9810 u8 link_type, u8 addr_type)
604086b7
BG		 9811{
9812 struct mgmt_ev_user_passkey_request ev;
9813
181d6953 9814 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
604086b7 9815
272d90df 9816 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 9817 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 9818
9819 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 9820 NULL);
604086b7
BG		 9821}
9822
0df4c185 9823static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 9824 u8 link_type, u8 addr_type, u8 status,
9825 u8 opcode)
a5c29683 9826{
3b0602cd 9827 struct mgmt_pending_cmd *cmd;
a5c29683 9828
333ae95d 9829 cmd = pending_find(opcode, hdev);
a5c29683
JH		 9830 if (!cmd)
9831 return -ENOENT;
9832
7776d1d8 9833 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 9834 mgmt_pending_remove(cmd);
a5c29683 9835
7776d1d8 9836 return 0;
a5c29683
JH		 9837}
9838
744cf19e 9839int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 9840 u8 link_type, u8 addr_type, u8 status)
a5c29683 9841{
272d90df 9842 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 9843 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 9844}
9845
272d90df 9846int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 9847 u8 link_type, u8 addr_type, u8 status)
a5c29683 9848{
272d90df 9849 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 9850 status,
9851 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 9852}
2a611692 9853
604086b7 9854int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 9855 u8 link_type, u8 addr_type, u8 status)
604086b7 9856{
272d90df 9857 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 9858 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 9859}
9860
272d90df 9861int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 9862 u8 link_type, u8 addr_type, u8 status)
604086b7 9863{
272d90df 9864 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 9865 status,
9866 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 9867}
9868
92a25256
JH		 9869int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9870 u8 link_type, u8 addr_type, u32 passkey,
9871 u8 entered)
9872{
9873 struct mgmt_ev_passkey_notify ev;
9874
181d6953 9875 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
92a25256
JH		 9876
9877 bacpy(&ev.addr.bdaddr, bdaddr);
9878 ev.addr.type = link_to_bdaddr(link_type, addr_type);
9879 ev.passkey = __cpu_to_le32(passkey);
9880 ev.entered = entered;
9881
9882 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9883}
9884
e1e930f5 9885void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 9886{
9887 struct mgmt_ev_auth_failed ev;
3b0602cd 9888 struct mgmt_pending_cmd *cmd;
e1e930f5 9889 u8 status = mgmt_status(hci_status);
2a611692 9890
e1e930f5
JH		 9891 bacpy(&ev.addr.bdaddr, &conn->dst);
9892 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9893 ev.status = status;
2a611692 9894
e1e930f5
JH		 9895 cmd = find_pairing(conn);
9896
9897 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9898 cmd ? cmd->sk : NULL);
9899
a511b35b
JH		 9900 if (cmd) {
9901 cmd->cmd_complete(cmd, status);
9902 mgmt_pending_remove(cmd);
9903 }
2a611692 9904}
b312b161 9905
464996ae 9906void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 9907{
9908 struct cmd_lookup match = { NULL, hdev };
464996ae 9909 bool changed;
33ef95ed
JH		 9910
9911 if (status) {
9912 u8 mgmt_err = mgmt_status(status);
9913 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 9914 cmd_status_rsp, &mgmt_err);
464996ae 9915 return;
33ef95ed
JH		 9916 }
9917
464996ae 9918 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 9919 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 9920 else
a69d8927 9921 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 9922
33ef95ed 9923 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 9924 &match);
33ef95ed 9925
47990ea0 9926 if (changed)
464996ae 9927 new_settings(hdev, match.sk);
33ef95ed
JH		 9928
9929 if (match.sk)
9930 sock_put(match.sk);
33ef95ed
JH		 9931}
9932
3b0602cd 9933static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 9934{
9935 struct cmd_lookup *match = data;
9936
90e70454
JH		 9937 if (match->sk == NULL) {
9938 match->sk = cmd->sk;
9939 sock_hold(match->sk);
9940 }
90e70454
JH		 9941}
9942
4e1b0245
MH		 9943void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9944 u8 status)
7f9a903c 9945{
90e70454 9946 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 9947
92da6097
JH		 9948 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9949 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9950 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454 9951
321c6fee 9952 if (!status) {
5504c3a3
MH		 9953 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9954 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
321c6fee
MH		 9955 ext_info_changed(hdev, NULL);
9956 }
90e70454
JH		 9957
9958 if (match.sk)
9959 sock_put(match.sk);
7f9a903c
MH		 9960}
9961
7667da34 9962void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 9963{
b312b161 9964 struct mgmt_cp_set_local_name ev;
3b0602cd 9965 struct mgmt_pending_cmd *cmd;
28cc7bde 9966
13928971 9967 if (status)
7667da34 9968 return;
b312b161
JH		 9969
9970 memset(&ev, 0, sizeof(ev));
9971 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 9972 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 9973
333ae95d 9974 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 9975 if (!cmd) {
9976 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 9977
13928971
JH		 9978 /* If this is a HCI command related to powering on the
9979 * HCI dev don't send any mgmt signals.
9980 */
b14202af
JD		 9981 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
9982 return;
9983
333ae95d 9984 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 9985 return;
890ea898 9986 }
b312b161 9987
5504c3a3
MH		 9988 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9989 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
321c6fee 9990 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
b312b161 9991}
c35938b2 9992
799ce93d
JP		 9993static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9994{
9995 int i;
9996
9997 for (i = 0; i < uuid_count; i++) {
9998 if (!memcmp(uuid, uuids[i], 16))
9999 return true;
10000 }
10001
10002 return false;
10003}
10004
b487b9ce
MH		 10005static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10006{
799ce93d
JP		 10007 u16 parsed = 0;
10008
10009 while (parsed < eir_len) {
10010 u8 field_len = eir[0];
10011 u8 uuid[16];
10012 int i;
10013
10014 if (field_len == 0)
10015 break;
10016
10017 if (eir_len - parsed < field_len + 1)
10018 break;
10019
10020 switch (eir[1]) {
10021 case EIR_UUID16_ALL:
10022 case EIR_UUID16_SOME:
10023 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 10024 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 10025 uuid[13] = eir[i + 3];
10026 uuid[12] = eir[i + 2];
10027 if (has_uuid(uuid, uuid_count, uuids))
10028 return true;
10029 }
10030 break;
10031 case EIR_UUID32_ALL:
10032 case EIR_UUID32_SOME:
10033 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 10034 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 10035 uuid[15] = eir[i + 5];
10036 uuid[14] = eir[i + 4];
10037 uuid[13] = eir[i + 3];
10038 uuid[12] = eir[i + 2];
10039 if (has_uuid(uuid, uuid_count, uuids))
10040 return true;
10041 }
10042 break;
10043 case EIR_UUID128_ALL:
10044 case EIR_UUID128_SOME:
10045 for (i = 0; i + 17 <= field_len; i += 16) {
10046 memcpy(uuid, eir + i + 2, 16);
10047 if (has_uuid(uuid, uuid_count, uuids))
10048 return true;
10049 }
10050 break;
10051 }
10052
10053 parsed += field_len + 1;
10054 eir += field_len + 1;
10055 }
10056
b487b9ce
MH		 10057 return false;
10058}
10059
48f86b7f
JP		 10060static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10061 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 10062{
48f86b7f
JP		 10063 /* If a RSSI threshold has been specified, and
10064 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10065 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10066 * is set, let it through for further processing, as we might need to
10067 * restart the scan.
efb2513f
MH		 10068 *
10069 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10070 * the results are also dropped.
bda157a4
MH		 10071 */
10072 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 10073 (rssi == HCI_RSSI_INVALID ||
10074 (rssi < hdev->discovery.rssi &&
10075 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 10076 return false;
efb2513f 10077
2976cdeb
JP		 10078 if (hdev->discovery.uuid_count != 0) {
10079 /* If a list of UUIDs is provided in filter, results with no
10080 * matching UUID should be dropped.
b487b9ce 10081 */
2976cdeb
JP		 10082 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10083 hdev->discovery.uuids) &&
10084 !eir_has_uuids(scan_rsp, scan_rsp_len,
10085 hdev->discovery.uuid_count,
10086 hdev->discovery.uuids))
10087 return false;
b487b9ce 10088 }
5d2e9fad 10089
2976cdeb
JP		 10090 /* If duplicate filtering does not report RSSI changes, then restart
10091 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 10092 */
2976cdeb 10093 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
2976cdeb
JP		 10094 /* Validate RSSI value against the RSSI threshold once more. */
10095 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10096 rssi < hdev->discovery.rssi)
10097 return false;
10098 }
48f86b7f
JP		 10099
10100 return true;
10101}
10102
8d7f1677
MM		 10103void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10104 bdaddr_t *bdaddr, u8 addr_type)
10105{
10106 struct mgmt_ev_adv_monitor_device_lost ev;
10107
10108 ev.monitor_handle = cpu_to_le16(handle);
10109 bacpy(&ev.addr.bdaddr, bdaddr);
10110 ev.addr.type = addr_type;
10111
10112 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10113 NULL);
10114}
10115
ff39fc1b
MM		 10116static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10117 struct sk_buff *skb,
10118 struct sock *skip_sk,
10119 u16 handle)
10120{
10121 struct sk_buff *advmon_skb;
10122 size_t advmon_skb_len;
10123 __le16 *monitor_handle;
10124
10125 if (!skb)
10126 return;
10127
10128 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10129 sizeof(struct mgmt_ev_device_found)) + skb->len;
10130 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10131 advmon_skb_len);
10132 if (!advmon_skb)
10133 return;
10134
10135 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10136 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10137 * store monitor_handle of the matched monitor.
10138 */
10139 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10140 *monitor_handle = cpu_to_le16(handle);
10141 skb_put_data(advmon_skb, skb->data, skb->len);
10142
10143 mgmt_event_skb(advmon_skb, skip_sk);
10144}
10145
8d7f1677
MM		 10146static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10147 bdaddr_t *bdaddr, bool report_device,
10148 struct sk_buff *skb,
10149 struct sock *skip_sk)
10150{
8d7f1677
MM		 10151 struct monitored_device *dev, *tmp;
10152 bool matched = false;
ff39fc1b 10153 bool notified = false;
8d7f1677
MM		 10154
10155 /* We have received the Advertisement Report because:
10156 * 1. the kernel has initiated active discovery
10157 * 2. if not, we have pend_le_reports > 0 in which case we are doing
10158 * passive scanning
10159 * 3. if none of the above is true, we have one or more active
10160 * Advertisement Monitor
10161 *
10162 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10163 * and report ONLY one advertisement per device for the matched Monitor
10164 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10165 *
10166 * For case 3, since we are not active scanning and all advertisements
10167 * received are due to a matched Advertisement Monitor, report all
10168 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10169 */
10170 if (report_device && !hdev->advmon_pend_notify) {
10171 mgmt_event_skb(skb, skip_sk);
10172 return;
10173 }
10174
8d7f1677
MM		 10175 hdev->advmon_pend_notify = false;
10176
10177 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10178 if (!bacmp(&dev->bdaddr, bdaddr)) {
10179 matched = true;
10180
10181 if (!dev->notified) {
ff39fc1b
MM		 10182 mgmt_send_adv_monitor_device_found(hdev, skb,
10183 skip_sk,
10184 dev->handle);
10185 notified = true;
8d7f1677
MM		 10186 dev->notified = true;
10187 }
10188 }
10189
10190 if (!dev->notified)
10191 hdev->advmon_pend_notify = true;
10192 }
10193
10194 if (!report_device &&
ff39fc1b 10195 ((matched && !notified) || !msft_monitor_supported(hdev))) {
8d7f1677
MM		 10196 /* Handle 0 indicates that we are not active scanning and this
10197 * is a subsequent advertisement report for an already matched
10198 * Advertisement Monitor or the controller offloading support
10199 * is not available.
10200 */
ff39fc1b 10201 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
8d7f1677
MM		 10202 }
10203
10204 if (report_device)
10205 mgmt_event_skb(skb, skip_sk);
10206 else
10207 kfree_skb(skb);
8d7f1677
MM		 10208}
10209
b338d917
BG		 10210static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10211 u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10212 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10213 u64 instant)
10214{
10215 struct sk_buff *skb;
10216 struct mgmt_ev_mesh_device_found *ev;
10217 int i, j;
10218
10219 if (!hdev->mesh_ad_types[0])
10220 goto accepted;
10221
10222 /* Scan for requested AD types */
10223 if (eir_len > 0) {
10224 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10225 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10226 if (!hdev->mesh_ad_types[j])
10227 break;
10228
10229 if (hdev->mesh_ad_types[j] == eir[i + 1])
10230 goto accepted;
10231 }
10232 }
10233 }
10234
10235 if (scan_rsp_len > 0) {
10236 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10237 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10238 if (!hdev->mesh_ad_types[j])
10239 break;
10240
10241 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10242 goto accepted;
10243 }
10244 }
10245 }
10246
10247 return;
10248
10249accepted:
10250 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10251 sizeof(*ev) + eir_len + scan_rsp_len);
10252 if (!skb)
10253 return;
10254
10255 ev = skb_put(skb, sizeof(*ev));
10256
10257 bacpy(&ev->addr.bdaddr, bdaddr);
10258 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10259 ev->rssi = rssi;
10260 ev->flags = cpu_to_le32(flags);
10261 ev->instant = cpu_to_le64(instant);
10262
10263 if (eir_len > 0)
10264 /* Copy EIR or advertising data into event */
10265 skb_put_data(skb, eir, eir_len);
10266
10267 if (scan_rsp_len > 0)
10268 /* Append scan response data to event */
10269 skb_put_data(skb, scan_rsp, scan_rsp_len);
10270
10271 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10272
10273 mgmt_event_skb(skb, NULL);
10274}
10275
48f86b7f
JP		 10276void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10277 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
b338d917
BG		 10278 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10279 u64 instant)
48f86b7f 10280{
cf1bce1d
LAD		 10281 struct sk_buff *skb;
10282 struct mgmt_ev_device_found *ev;
8d7f1677 10283 bool report_device = hci_discovery_active(hdev);
48f86b7f 10284
b338d917
BG		 10285 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10286 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10287 eir, eir_len, scan_rsp, scan_rsp_len,
10288 instant);
10289
48f86b7f
JP		 10290 /* Don't send events for a non-kernel initiated discovery. With
10291 * LE one exception is if we have pend_le_reports > 0 in which
10292 * case we're doing passive scanning and want these events.
10293 */
10294 if (!hci_discovery_active(hdev)) {
10295 if (link_type == ACL_LINK)
10296 return;
8d7f1677
MM		 10297 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10298 report_device = true;
10299 else if (!hci_is_adv_monitoring(hdev))
48f86b7f
JP		 10300 return;
10301 }
10302
82f8b651 10303 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 10304 /* We are using service discovery */
10305 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10306 scan_rsp_len))
10307 return;
10308 }
10309
78b781ca
JH		 10310 if (hdev->discovery.limited) {
10311 /* Check for limited discoverable bit */
10312 if (dev_class) {
10313 if (!(dev_class[1] & 0x20))
10314 return;
10315 } else {
10316 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10317 if (!flags || !(flags[0] & LE_AD_LIMITED))
10318 return;
10319 }
10320 }
10321
cf1bce1d
LAD		 10322 /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10323 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10324 sizeof(*ev) + eir_len + scan_rsp_len + 5);
10325 if (!skb)
4b0e0ced
JP		 10326 return;
10327
cf1bce1d 10328 ev = skb_put(skb, sizeof(*ev));
48f86b7f
JP		 10329
10330 /* In case of device discovery with BR/EDR devices (pre 1.2), the
10331 * RSSI value was reported as 0 when not available. This behavior
10332 * is kept when using device discovery. This is required for full
10333 * backwards compatibility with the API.
10334 *
10335 * However when using service discovery, the value 127 will be
10336 * returned when the RSSI is not available.
10337 */
10338 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10339 link_type == ACL_LINK)
10340 rssi = 0;
10341
10342 bacpy(&ev->addr.bdaddr, bdaddr);
10343 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10344 ev->rssi = rssi;
10345 ev->flags = cpu_to_le32(flags);
10346
10347 if (eir_len > 0)
10348 /* Copy EIR or advertising data into event */
cf1bce1d
LAD		 10349 skb_put_data(skb, eir, eir_len);
10350
10351 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10352 u8 eir_cod[5];
48f86b7f 10353
cf1bce1d
LAD		 10354 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10355 dev_class, 3);
10356 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10357 }
48f86b7f
JP		 10358
10359 if (scan_rsp_len > 0)
10360 /* Append scan response data to event */
cf1bce1d 10361 skb_put_data(skb, scan_rsp, scan_rsp_len);
48f86b7f 10362
5d2e9fad 10363 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
f8523598 10364
8d7f1677 10365 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
e17acd40 10366}
a88a9652 10367
9cf12aee
MH		 10368void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10369 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 10370{
cf1bce1d 10371 struct sk_buff *skb;
b644ba33 10372 struct mgmt_ev_device_found *ev;
ba17bb62
RB		 10373 u16 eir_len = 0;
10374 u32 flags = 0;
a88a9652 10375
ba17bb62
RB		 10376 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10377 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
b644ba33 10378
cf1bce1d 10379 ev = skb_put(skb, sizeof(*ev));
b644ba33 10380 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 10381 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 10382 ev->rssi = rssi;
10383
c2b2a1a7
RB		 10384 if (name)
10385 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10386 else
ea13aed5 10387 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
b644ba33 10388
eb55ef07 10389 ev->eir_len = cpu_to_le16(eir_len);
ea13aed5 10390 ev->flags = cpu_to_le32(flags);
a88a9652 10391
cf1bce1d 10392 mgmt_event_skb(skb, NULL);
a88a9652 10393}
314b2381 10394
2f1e063b 10395void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 10396{
f963e8e9 10397 struct mgmt_ev_discovering ev;
164a6e78 10398
181d6953 10399 bt_dev_dbg(hdev, "discovering %u", discovering);
343fb145 10400
f963e8e9
JH		 10401 memset(&ev, 0, sizeof(ev));
10402 ev.type = hdev->discovery.type;
10403 ev.discovering = discovering;
10404
2f1e063b 10405 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 10406}
5e762444 10407
346ce5b7
APS		 10408void mgmt_suspending(struct hci_dev *hdev, u8 state)
10409{
10410 struct mgmt_ev_controller_suspend ev;
10411
10412 ev.suspend_state = state;
10413 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10414}
10415
10416void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10417 u8 addr_type)
10418{
10419 struct mgmt_ev_controller_resume ev;
10420
10421 ev.wake_reason = reason;
10422 if (bdaddr) {
10423 bacpy(&ev.addr.bdaddr, bdaddr);
10424 ev.addr.type = addr_type;
10425 } else {
10426 memset(&ev.addr, 0, sizeof(ev.addr));
10427 }
10428
10429 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10430}
10431
6d785aa3
JH		 10432static struct hci_mgmt_chan chan = {
10433 .channel = HCI_CHANNEL_CONTROL,
10434 .handler_count = ARRAY_SIZE(mgmt_handlers),
10435 .handlers = mgmt_handlers,
88b94ce9 10436 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 10437};
10438
10439int mgmt_init(void)
10440{
10441 return hci_mgmt_chan_register(&chan);
10442}
10443
10444void mgmt_exit(void)
10445{
10446 hci_mgmt_chan_unregister(&chan);
10447}
b338d917
BG		 10448
10449void mgmt_cleanup(struct sock *sk)
10450{
10451 struct mgmt_mesh_tx *mesh_tx;
10452 struct hci_dev *hdev;
10453
10454 read_lock(&hci_dev_list_lock);
10455
10456 list_for_each_entry(hdev, &hci_dev_list, list) {
10457 do {
10458 mesh_tx = mgmt_mesh_next(hdev, sk);
10459
10460 if (mesh_tx)
10461 mesh_send_complete(hdev, mesh_tx, true);
10462 } while (mesh_tx);
10463 }
10464
10465 read_unlock(&hci_dev_list_lock);
10466}
Linux 6.x block layer and io_uring tree(s)