net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = cpu_to_le16(MGMT_REVISION);
 280
 281         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 282                                  &rp, sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         u16 num_commands, num_events;
 290         size_t rp_size;
 291         int i, err;
 292
 293         BT_DBG("sock %p", sk);
 294
 295         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 296                 num_commands = ARRAY_SIZE(mgmt_commands);
 297                 num_events = ARRAY_SIZE(mgmt_events);
 298         } else {
 299                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 300                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 301         }
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 313                 __le16 *opcode = rp->opcodes;
 314
 315                 for (i = 0; i < num_commands; i++, opcode++)
 316                         put_unaligned_le16(mgmt_commands[i], opcode);
 317
 318                 for (i = 0; i < num_events; i++, opcode++)
 319                         put_unaligned_le16(mgmt_events[i], opcode);
 320         } else {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 328         }
 329
 330         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 331                                 rp, rp_size);
 332         kfree(rp);
 333
 334         return err;
 335 }
 336
 337 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 338                            u16 data_len)
 339 {
 340         struct mgmt_rp_read_index_list *rp;
 341         struct hci_dev *d;
 342         size_t rp_len;
 343         u16 count;
 344         int err;
 345
 346         BT_DBG("sock %p", sk);
 347
 348         read_lock(&hci_dev_list_lock);
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (d->dev_type == HCI_BREDR &&
 353                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 354                         count++;
 355         }
 356
 357         rp_len = sizeof(*rp) + (2 * count);
 358         rp = kmalloc(rp_len, GFP_ATOMIC);
 359         if (!rp) {
 360                 read_unlock(&hci_dev_list_lock);
 361                 return -ENOMEM;
 362         }
 363
 364         count = 0;
 365         list_for_each_entry(d, &hci_dev_list, list) {
 366                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 367                     hci_dev_test_flag(d, HCI_CONFIG) ||
 368                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 369                         continue;
 370
 371                 /* Devices marked as raw-only are neither configured
 372                  * nor unconfigured controllers.
 373                  */
 374                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 375                         continue;
 376
 377                 if (d->dev_type == HCI_BREDR &&
 378                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 379                         rp->index[count++] = cpu_to_le16(d->id);
 380                         BT_DBG("Added hci%u", d->id);
 381                 }
 382         }
 383
 384         rp->num_controllers = cpu_to_le16(count);
 385         rp_len = sizeof(*rp) + (2 * count);
 386
 387         read_unlock(&hci_dev_list_lock);
 388
 389         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 390                                 0, rp, rp_len);
 391
 392         kfree(rp);
 393
 394         return err;
 395 }
 396
 397 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 398                                   void *data, u16 data_len)
 399 {
 400         struct mgmt_rp_read_unconf_index_list *rp;
 401         struct hci_dev *d;
 402         size_t rp_len;
 403         u16 count;
 404         int err;
 405
 406         BT_DBG("sock %p", sk);
 407
 408         read_lock(&hci_dev_list_lock);
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (d->dev_type == HCI_BREDR &&
 413                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 414                         count++;
 415         }
 416
 417         rp_len = sizeof(*rp) + (2 * count);
 418         rp = kmalloc(rp_len, GFP_ATOMIC);
 419         if (!rp) {
 420                 read_unlock(&hci_dev_list_lock);
 421                 return -ENOMEM;
 422         }
 423
 424         count = 0;
 425         list_for_each_entry(d, &hci_dev_list, list) {
 426                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 427                     hci_dev_test_flag(d, HCI_CONFIG) ||
 428                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 429                         continue;
 430
 431                 /* Devices marked as raw-only are neither configured
 432                  * nor unconfigured controllers.
 433                  */
 434                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 435                         continue;
 436
 437                 if (d->dev_type == HCI_BREDR &&
 438                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 439                         rp->index[count++] = cpu_to_le16(d->id);
 440                         BT_DBG("Added hci%u", d->id);
 441                 }
 442         }
 443
 444         rp->num_controllers = cpu_to_le16(count);
 445         rp_len = sizeof(*rp) + (2 * count);
 446
 447         read_unlock(&hci_dev_list_lock);
 448
 449         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 450                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 451
 452         kfree(rp);
 453
 454         return err;
 455 }
 456
 457 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 458                                void *data, u16 data_len)
 459 {
 460         struct mgmt_rp_read_ext_index_list *rp;
 461         struct hci_dev *d;
 462         size_t rp_len;
 463         u16 count;
 464         int err;
 465
 466         BT_DBG("sock %p", sk);
 467
 468         read_lock(&hci_dev_list_lock);
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 473                         count++;
 474         }
 475
 476         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 477         rp = kmalloc(rp_len, GFP_ATOMIC);
 478         if (!rp) {
 479                 read_unlock(&hci_dev_list_lock);
 480                 return -ENOMEM;
 481         }
 482
 483         count = 0;
 484         list_for_each_entry(d, &hci_dev_list, list) {
 485                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 486                     hci_dev_test_flag(d, HCI_CONFIG) ||
 487                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 488                         continue;
 489
 490                 /* Devices marked as raw-only are neither configured
 491                  * nor unconfigured controllers.
 492                  */
 493                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 494                         continue;
 495
 496                 if (d->dev_type == HCI_BREDR) {
 497                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 498                                 rp->entry[count].type = 0x01;
 499                         else
 500                                 rp->entry[count].type = 0x00;
 501                 } else if (d->dev_type == HCI_AMP) {
 502                         rp->entry[count].type = 0x02;
 503                 } else {
 504                         continue;
 505                 }
 506
 507                 rp->entry[count].bus = d->bus;
 508                 rp->entry[count++].index = cpu_to_le16(d->id);
 509                 BT_DBG("Added hci%u", d->id);
 510         }
 511
 512         rp->num_controllers = cpu_to_le16(count);
 513         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 514
 515         read_unlock(&hci_dev_list_lock);
 516
 517         /* If this command is called at least once, then all the
 518          * default index and unconfigured index events are disabled
 519          * and from now on only extended index events are used.
 520          */
 521         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 522         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 523         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 524
 525         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 526                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 527
 528         kfree(rp);
 529
 530         return err;
 531 }
 532
 533 static bool is_configured(struct hci_dev *hdev)
 534 {
 535         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 536             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 537                 return false;
 538
 539         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 540             !bacmp(&hdev->public_addr, BDADDR_ANY))
 541                 return false;
 542
 543         return true;
 544 }
 545
 546 static __le32 get_missing_options(struct hci_dev *hdev)
 547 {
 548         u32 options = 0;
 549
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 557
 558         return cpu_to_le32(options);
 559 }
 560
 561 static int new_options(struct hci_dev *hdev, struct sock *skip)
 562 {
 563         __le32 options = get_missing_options(hdev);
 564
 565         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 566                                   sizeof(options), skip);
 567 }
 568
 569 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 574                                  sizeof(options));
 575 }
 576
 577 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 578                             void *data, u16 data_len)
 579 {
 580         struct mgmt_rp_read_config_info rp;
 581         u32 options = 0;
 582
 583         BT_DBG("sock %p %s", sk, hdev->name);
 584
 585         hci_dev_lock(hdev);
 586
 587         memset(&rp, 0, sizeof(rp));
 588         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 589
 590         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 591                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 592
 593         if (hdev->set_bdaddr)
 594                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 595
 596         rp.supported_options = cpu_to_le32(options);
 597         rp.missing_options = get_missing_options(hdev);
 598
 599         hci_dev_unlock(hdev);
 600
 601         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 602                                  &rp, sizeof(rp));
 603 }
 604
 605 static u32 get_supported_settings(struct hci_dev *hdev)
 606 {
 607         u32 settings = 0;
 608
 609         settings |= MGMT_SETTING_POWERED;
 610         settings |= MGMT_SETTING_BONDABLE;
 611         settings |= MGMT_SETTING_DEBUG_KEYS;
 612         settings |= MGMT_SETTING_CONNECTABLE;
 613         settings |= MGMT_SETTING_DISCOVERABLE;
 614
 615         if (lmp_bredr_capable(hdev)) {
 616                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 617                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 618                 settings |= MGMT_SETTING_BREDR;
 619                 settings |= MGMT_SETTING_LINK_SECURITY;
 620
 621                 if (lmp_ssp_capable(hdev)) {
 622                         settings |= MGMT_SETTING_SSP;
 623                         settings |= MGMT_SETTING_HS;
 624                 }
 625
 626                 if (lmp_sc_capable(hdev))
 627                         settings |= MGMT_SETTING_SECURE_CONN;
 628         }
 629
 630         if (lmp_le_capable(hdev)) {
 631                 settings |= MGMT_SETTING_LE;
 632                 settings |= MGMT_SETTING_ADVERTISING;
 633                 settings |= MGMT_SETTING_SECURE_CONN;
 634                 settings |= MGMT_SETTING_PRIVACY;
 635                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 636         }
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 639             hdev->set_bdaddr)
 640                 settings |= MGMT_SETTING_CONFIGURATION;
 641
 642         return settings;
 643 }
 644
 645 static u32 get_current_settings(struct hci_dev *hdev)
 646 {
 647         u32 settings = 0;
 648
 649         if (hdev_is_powered(hdev))
 650                 settings |= MGMT_SETTING_POWERED;
 651
 652         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 653                 settings |= MGMT_SETTING_CONNECTABLE;
 654
 655         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 656                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 657
 658         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 659                 settings |= MGMT_SETTING_DISCOVERABLE;
 660
 661         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 662                 settings |= MGMT_SETTING_BONDABLE;
 663
 664         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 665                 settings |= MGMT_SETTING_BREDR;
 666
 667         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 668                 settings |= MGMT_SETTING_LE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 671                 settings |= MGMT_SETTING_LINK_SECURITY;
 672
 673         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 674                 settings |= MGMT_SETTING_SSP;
 675
 676         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 677                 settings |= MGMT_SETTING_HS;
 678
 679         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 680                 settings |= MGMT_SETTING_ADVERTISING;
 681
 682         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 683                 settings |= MGMT_SETTING_SECURE_CONN;
 684
 685         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 686                 settings |= MGMT_SETTING_DEBUG_KEYS;
 687
 688         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 689                 settings |= MGMT_SETTING_PRIVACY;
 690
 691         /* The current setting for static address has two purposes. The
 692          * first is to indicate if the static address will be used and
 693          * the second is to indicate if it is actually set.
 694          *
 695          * This means if the static address is not configured, this flag
 696          * will never be set. If the address is configured, then if the
 697          * address is actually used decides if the flag is set or not.
 698          *
 699          * For single mode LE only controllers and dual-mode controllers
 700          * with BR/EDR disabled, the existence of the static address will
 701          * be evaluated.
 702          */
 703         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 704             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 705             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 706                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 707                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 708         }
 709
 710         return settings;
 711 }
 712
 713 #define PNP_INFO_SVCLASS_ID             0x1200
 714
 715 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 716 {
 717         u8 *ptr = data, *uuids_start = NULL;
 718         struct bt_uuid *uuid;
 719
 720         if (len < 4)
 721                 return ptr;
 722
 723         list_for_each_entry(uuid, &hdev->uuids, list) {
 724                 u16 uuid16;
 725
 726                 if (uuid->size != 16)
 727                         continue;
 728
 729                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 730                 if (uuid16 < 0x1100)
 731                         continue;
 732
 733                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 734                         continue;
 735
 736                 if (!uuids_start) {
 737                         uuids_start = ptr;
 738                         uuids_start[0] = 1;
 739                         uuids_start[1] = EIR_UUID16_ALL;
 740                         ptr += 2;
 741                 }
 742
 743                 /* Stop if not enough space to put next UUID */
 744                 if ((ptr - data) + sizeof(u16) > len) {
 745                         uuids_start[1] = EIR_UUID16_SOME;
 746                         break;
 747                 }
 748
 749                 *ptr++ = (uuid16 & 0x00ff);
 750                 *ptr++ = (uuid16 & 0xff00) >> 8;
 751                 uuids_start[0] += sizeof(uuid16);
 752         }
 753
 754         return ptr;
 755 }
 756
 757 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 758 {
 759         u8 *ptr = data, *uuids_start = NULL;
 760         struct bt_uuid *uuid;
 761
 762         if (len < 6)
 763                 return ptr;
 764
 765         list_for_each_entry(uuid, &hdev->uuids, list) {
 766                 if (uuid->size != 32)
 767                         continue;
 768
 769                 if (!uuids_start) {
 770                         uuids_start = ptr;
 771                         uuids_start[0] = 1;
 772                         uuids_start[1] = EIR_UUID32_ALL;
 773                         ptr += 2;
 774                 }
 775
 776                 /* Stop if not enough space to put next UUID */
 777                 if ((ptr - data) + sizeof(u32) > len) {
 778                         uuids_start[1] = EIR_UUID32_SOME;
 779                         break;
 780                 }
 781
 782                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 783                 ptr += sizeof(u32);
 784                 uuids_start[0] += sizeof(u32);
 785         }
 786
 787         return ptr;
 788 }
 789
 790 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 791 {
 792         u8 *ptr = data, *uuids_start = NULL;
 793         struct bt_uuid *uuid;
 794
 795         if (len < 18)
 796                 return ptr;
 797
 798         list_for_each_entry(uuid, &hdev->uuids, list) {
 799                 if (uuid->size != 128)
 800                         continue;
 801
 802                 if (!uuids_start) {
 803                         uuids_start = ptr;
 804                         uuids_start[0] = 1;
 805                         uuids_start[1] = EIR_UUID128_ALL;
 806                         ptr += 2;
 807                 }
 808
 809                 /* Stop if not enough space to put next UUID */
 810                 if ((ptr - data) + 16 > len) {
 811                         uuids_start[1] = EIR_UUID128_SOME;
 812                         break;
 813                 }
 814
 815                 memcpy(ptr, uuid->uuid, 16);
 816                 ptr += 16;
 817                 uuids_start[0] += 16;
 818         }
 819
 820         return ptr;
 821 }
 822
 823 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 824 {
 825         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 826 }
 827
 828 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 829                                                   struct hci_dev *hdev,
 830                                                   const void *data)
 831 {
 832         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 833 }
 834
 835 static u8 get_current_adv_instance(struct hci_dev *hdev)
 836 {
 837         /* The "Set Advertising" setting supersedes the "Add Advertising"
 838          * setting. Here we set the advertising data based on which
 839          * setting was set. When neither apply, default to the global settings,
 840          * represented by instance "0".
 841          */
 842         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 843             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 844                 return hdev->cur_adv_instance;
 845
 846         return 0x00;
 847 }
 848
 849 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 850 {
 851         u8 ad_len = 0;
 852         size_t name_len;
 853
 854         name_len = strlen(hdev->dev_name);
 855         if (name_len > 0) {
 856                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 857
 858                 if (name_len > max_len) {
 859                         name_len = max_len;
 860                         ptr[1] = EIR_NAME_SHORT;
 861                 } else
 862                         ptr[1] = EIR_NAME_COMPLETE;
 863
 864                 ptr[0] = name_len + 1;
 865
 866                 memcpy(ptr + 2, hdev->dev_name, name_len);
 867
 868                 ad_len += (name_len + 2);
 869                 ptr += (name_len + 2);
 870         }
 871
 872         return ad_len;
 873 }
 874
 875 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 876 {
 877         /* TODO: Set the appropriate entries based on advertising instance flags
 878          * here once flags other than 0 are supported.
 879          */
 880         memcpy(ptr, hdev->adv_instance.scan_rsp_data,
 881                hdev->adv_instance.scan_rsp_len);
 882
 883         return hdev->adv_instance.scan_rsp_len;
 884 }
 885
 886 static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
 887 {
 888         struct hci_dev *hdev = req->hdev;
 889         struct hci_cp_le_set_scan_rsp_data cp;
 890         u8 len;
 891
 892         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 893                 return;
 894
 895         memset(&cp, 0, sizeof(cp));
 896
 897         if (instance)
 898                 len = create_instance_scan_rsp_data(hdev, cp.data);
 899         else
 900                 len = create_default_scan_rsp_data(hdev, cp.data);
 901
 902         if (hdev->scan_rsp_data_len == len &&
 903             !memcmp(cp.data, hdev->scan_rsp_data, len))
 904                 return;
 905
 906         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 907         hdev->scan_rsp_data_len = len;
 908
 909         cp.length = len;
 910
 911         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 912 }
 913
 914 static void update_scan_rsp_data(struct hci_request *req)
 915 {
 916         update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
 917 }
 918
 919 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 920 {
 921         struct mgmt_pending_cmd *cmd;
 922
 923         /* If there's a pending mgmt command the flags will not yet have
 924          * their final values, so check for this first.
 925          */
 926         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 927         if (cmd) {
 928                 struct mgmt_mode *cp = cmd->param;
 929                 if (cp->val == 0x01)
 930                         return LE_AD_GENERAL;
 931                 else if (cp->val == 0x02)
 932                         return LE_AD_LIMITED;
 933         } else {
 934                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 935                         return LE_AD_LIMITED;
 936                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 937                         return LE_AD_GENERAL;
 938         }
 939
 940         return 0;
 941 }
 942
 943 static bool get_connectable(struct hci_dev *hdev)
 944 {
 945         struct mgmt_pending_cmd *cmd;
 946
 947         /* If there's a pending mgmt command the flag will not yet have
 948          * it's final value, so check for this first.
 949          */
 950         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 951         if (cmd) {
 952                 struct mgmt_mode *cp = cmd->param;
 953
 954                 return cp->val;
 955         }
 956
 957         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 958 }
 959
 960 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
 961 {
 962         u32 flags;
 963         struct adv_info *adv_instance;
 964
 965         if (instance == 0x00) {
 966                 /* Instance 0 always manages the "Tx Power" and "Flags"
 967                  * fields
 968                  */
 969                 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
 970
 971                 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
 972                  * corresponds to the "connectable" instance flag.
 973                  */
 974                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
 975                         flags |= MGMT_ADV_FLAG_CONNECTABLE;
 976
 977                 return flags;
 978         }
 979
 980         adv_instance = hci_find_adv_instance(hdev, instance);
 981
 982         /* Return 0 when we got an invalid instance identifier. */
 983         if (!adv_instance)
 984                 return 0;
 985
 986         return adv_instance->flags;
 987 }
 988
 989 static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
 990 {
 991         /* Ignore instance 0 and other unsupported instances */
 992         if (instance != 0x01)
 993                 return 0;
 994
 995         /* TODO: Take into account the "appearance" and "local-name" flags here.
 996          * These are currently being ignored as they are not supported.
 997          */
 998         return hdev->adv_instance.scan_rsp_len;
 999 }
1000
1001 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1002 {
1003         u8 ad_len = 0, flags = 0;
1004         u32 instance_flags = get_adv_instance_flags(hdev, instance);
1005
1006         /* The Add Advertising command allows userspace to set both the general
1007          * and limited discoverable flags.
1008          */
1009         if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1010                 flags |= LE_AD_GENERAL;
1011
1012         if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1013                 flags |= LE_AD_LIMITED;
1014
1015         if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1016                 /* If a discovery flag wasn't provided, simply use the global
1017                  * settings.
1018                  */
1019                 if (!flags)
1020                         flags |= get_adv_discov_flags(hdev);
1021
1022                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1023                         flags |= LE_AD_NO_BREDR;
1024
1025                 /* If flags would still be empty, then there is no need to
1026                  * include the "Flags" AD field".
1027                  */
1028                 if (flags) {
1029                         ptr[0] = 0x02;
1030                         ptr[1] = EIR_FLAGS;
1031                         ptr[2] = flags;
1032
1033                         ad_len += 3;
1034                         ptr += 3;
1035                 }
1036         }
1037
1038         if (instance) {
1039                 memcpy(ptr, hdev->adv_instance.adv_data,
1040                        hdev->adv_instance.adv_data_len);
1041
1042                 ad_len += hdev->adv_instance.adv_data_len;
1043                 ptr += hdev->adv_instance.adv_data_len;
1044         }
1045
1046         /* Provide Tx Power only if we can provide a valid value for it */
1047         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1048             (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1049                 ptr[0] = 0x02;
1050                 ptr[1] = EIR_TX_POWER;
1051                 ptr[2] = (u8)hdev->adv_tx_power;
1052
1053                 ad_len += 3;
1054                 ptr += 3;
1055         }
1056
1057         return ad_len;
1058 }
1059
1060 static void update_inst_adv_data(struct hci_request *req, u8 instance)
1061 {
1062         struct hci_dev *hdev = req->hdev;
1063         struct hci_cp_le_set_adv_data cp;
1064         u8 len;
1065
1066         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1067                 return;
1068
1069         memset(&cp, 0, sizeof(cp));
1070
1071         len = create_instance_adv_data(hdev, instance, cp.data);
1072
1073         /* There's nothing to do if the data hasn't changed */
1074         if (hdev->adv_data_len == len &&
1075             memcmp(cp.data, hdev->adv_data, len) == 0)
1076                 return;
1077
1078         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1079         hdev->adv_data_len = len;
1080
1081         cp.length = len;
1082
1083         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1084 }
1085
1086 static void update_adv_data(struct hci_request *req)
1087 {
1088         update_inst_adv_data(req, get_current_adv_instance(req->hdev));
1089 }
1090
1091 int mgmt_update_adv_data(struct hci_dev *hdev)
1092 {
1093         struct hci_request req;
1094
1095         hci_req_init(&req, hdev);
1096         update_adv_data(&req);
1097
1098         return hci_req_run(&req, NULL);
1099 }
1100
1101 static void create_eir(struct hci_dev *hdev, u8 *data)
1102 {
1103         u8 *ptr = data;
1104         size_t name_len;
1105
1106         name_len = strlen(hdev->dev_name);
1107
1108         if (name_len > 0) {
1109                 /* EIR Data type */
1110                 if (name_len > 48) {
1111                         name_len = 48;
1112                         ptr[1] = EIR_NAME_SHORT;
1113                 } else
1114                         ptr[1] = EIR_NAME_COMPLETE;
1115
1116                 /* EIR Data length */
1117                 ptr[0] = name_len + 1;
1118
1119                 memcpy(ptr + 2, hdev->dev_name, name_len);
1120
1121                 ptr += (name_len + 2);
1122         }
1123
1124         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1125                 ptr[0] = 2;
1126                 ptr[1] = EIR_TX_POWER;
1127                 ptr[2] = (u8) hdev->inq_tx_power;
1128
1129                 ptr += 3;
1130         }
1131
1132         if (hdev->devid_source > 0) {
1133                 ptr[0] = 9;
1134                 ptr[1] = EIR_DEVICE_ID;
1135
1136                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1137                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1138                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1139                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1140
1141                 ptr += 10;
1142         }
1143
1144         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1145         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1146         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1147 }
1148
1149 static void update_eir(struct hci_request *req)
1150 {
1151         struct hci_dev *hdev = req->hdev;
1152         struct hci_cp_write_eir cp;
1153
1154         if (!hdev_is_powered(hdev))
1155                 return;
1156
1157         if (!lmp_ext_inq_capable(hdev))
1158                 return;
1159
1160         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1161                 return;
1162
1163         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1164                 return;
1165
1166         memset(&cp, 0, sizeof(cp));
1167
1168         create_eir(hdev, cp.data);
1169
1170         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1171                 return;
1172
1173         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1174
1175         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1176 }
1177
1178 static u8 get_service_classes(struct hci_dev *hdev)
1179 {
1180         struct bt_uuid *uuid;
1181         u8 val = 0;
1182
1183         list_for_each_entry(uuid, &hdev->uuids, list)
1184                 val |= uuid->svc_hint;
1185
1186         return val;
1187 }
1188
1189 static void update_class(struct hci_request *req)
1190 {
1191         struct hci_dev *hdev = req->hdev;
1192         u8 cod[3];
1193
1194         BT_DBG("%s", hdev->name);
1195
1196         if (!hdev_is_powered(hdev))
1197                 return;
1198
1199         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1200                 return;
1201
1202         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1203                 return;
1204
1205         cod[0] = hdev->minor_class;
1206         cod[1] = hdev->major_class;
1207         cod[2] = get_service_classes(hdev);
1208
1209         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1210                 cod[1] |= 0x20;
1211
1212         if (memcmp(cod, hdev->dev_class, 3) == 0)
1213                 return;
1214
1215         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1216 }
1217
1218 static void disable_advertising(struct hci_request *req)
1219 {
1220         u8 enable = 0x00;
1221
1222         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1223 }
1224
1225 static void enable_advertising(struct hci_request *req)
1226 {
1227         struct hci_dev *hdev = req->hdev;
1228         struct hci_cp_le_set_adv_param cp;
1229         u8 own_addr_type, enable = 0x01;
1230         bool connectable;
1231         u8 instance;
1232         u32 flags;
1233
1234         if (hci_conn_num(hdev, LE_LINK) > 0)
1235                 return;
1236
1237         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1238                 disable_advertising(req);
1239
1240         /* Clear the HCI_LE_ADV bit temporarily so that the
1241          * hci_update_random_address knows that it's safe to go ahead
1242          * and write a new random address. The flag will be set back on
1243          * as soon as the SET_ADV_ENABLE HCI command completes.
1244          */
1245         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1246
1247         instance = get_current_adv_instance(hdev);
1248         flags = get_adv_instance_flags(hdev, instance);
1249
1250         /* If the "connectable" instance flag was not set, then choose between
1251          * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1252          */
1253         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1254                       get_connectable(hdev);
1255
1256         /* Set require_privacy to true only when non-connectable
1257          * advertising is used. In that case it is fine to use a
1258          * non-resolvable private address.
1259          */
1260         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1261                 return;
1262
1263         memset(&cp, 0, sizeof(cp));
1264         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1265         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1266
1267         if (connectable)
1268                 cp.type = LE_ADV_IND;
1269         else if (get_adv_instance_scan_rsp_len(hdev, instance))
1270                 cp.type = LE_ADV_SCAN_IND;
1271         else
1272                 cp.type = LE_ADV_NONCONN_IND;
1273
1274         cp.own_address_type = own_addr_type;
1275         cp.channel_map = hdev->le_adv_channel_map;
1276
1277         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1278
1279         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1280 }
1281
1282 static void service_cache_off(struct work_struct *work)
1283 {
1284         struct hci_dev *hdev = container_of(work, struct hci_dev,
1285                                             service_cache.work);
1286         struct hci_request req;
1287
1288         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1289                 return;
1290
1291         hci_req_init(&req, hdev);
1292
1293         hci_dev_lock(hdev);
1294
1295         update_eir(&req);
1296         update_class(&req);
1297
1298         hci_dev_unlock(hdev);
1299
1300         hci_req_run(&req, NULL);
1301 }
1302
1303 static void rpa_expired(struct work_struct *work)
1304 {
1305         struct hci_dev *hdev = container_of(work, struct hci_dev,
1306                                             rpa_expired.work);
1307         struct hci_request req;
1308
1309         BT_DBG("");
1310
1311         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1312
1313         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1314                 return;
1315
1316         /* The generation of a new RPA and programming it into the
1317          * controller happens in the enable_advertising() function.
1318          */
1319         hci_req_init(&req, hdev);
1320         enable_advertising(&req);
1321         hci_req_run(&req, NULL);
1322 }
1323
1324 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1325 {
1326         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1327                 return;
1328
1329         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1330         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1331
1332         /* Non-mgmt controlled devices get this bit set
1333          * implicitly so that pairing works for them, however
1334          * for mgmt we require user-space to explicitly enable
1335          * it
1336          */
1337         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1338 }
1339
1340 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1341                                 void *data, u16 data_len)
1342 {
1343         struct mgmt_rp_read_info rp;
1344
1345         BT_DBG("sock %p %s", sk, hdev->name);
1346
1347         hci_dev_lock(hdev);
1348
1349         memset(&rp, 0, sizeof(rp));
1350
1351         bacpy(&rp.bdaddr, &hdev->bdaddr);
1352
1353         rp.version = hdev->hci_ver;
1354         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1355
1356         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1357         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1358
1359         memcpy(rp.dev_class, hdev->dev_class, 3);
1360
1361         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1362         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1363
1364         hci_dev_unlock(hdev);
1365
1366         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1367                                  sizeof(rp));
1368 }
1369
1370 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1371 {
1372         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1373
1374         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1375                                  sizeof(settings));
1376 }
1377
1378 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1379 {
1380         BT_DBG("%s status 0x%02x", hdev->name, status);
1381
1382         if (hci_conn_count(hdev) == 0) {
1383                 cancel_delayed_work(&hdev->power_off);
1384                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1385         }
1386 }
1387
1388 static bool hci_stop_discovery(struct hci_request *req)
1389 {
1390         struct hci_dev *hdev = req->hdev;
1391         struct hci_cp_remote_name_req_cancel cp;
1392         struct inquiry_entry *e;
1393
1394         switch (hdev->discovery.state) {
1395         case DISCOVERY_FINDING:
1396                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1397                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1398
1399                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1400                         cancel_delayed_work(&hdev->le_scan_disable);
1401                         hci_req_add_le_scan_disable(req);
1402                 }
1403
1404                 return true;
1405
1406         case DISCOVERY_RESOLVING:
1407                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1408                                                      NAME_PENDING);
1409                 if (!e)
1410                         break;
1411
1412                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1413                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1414                             &cp);
1415
1416                 return true;
1417
1418         default:
1419                 /* Passive scanning */
1420                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1421                         hci_req_add_le_scan_disable(req);
1422                         return true;
1423                 }
1424
1425                 break;
1426         }
1427
1428         return false;
1429 }
1430
1431 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1432                               u8 instance)
1433 {
1434         struct mgmt_ev_advertising_added ev;
1435
1436         ev.instance = instance;
1437
1438         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1439 }
1440
1441 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1442                                 u8 instance)
1443 {
1444         struct mgmt_ev_advertising_removed ev;
1445
1446         ev.instance = instance;
1447
1448         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1449 }
1450
1451 static void clear_adv_instance(struct hci_dev *hdev)
1452 {
1453         struct hci_request req;
1454
1455         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1456                 return;
1457
1458         if (hdev->adv_instance_timeout)
1459                 cancel_delayed_work(&hdev->adv_instance_expire);
1460
1461         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1462         advertising_removed(NULL, hdev, 1);
1463         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1464
1465         if (!hdev_is_powered(hdev) ||
1466             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1467                 return;
1468
1469         hci_req_init(&req, hdev);
1470         disable_advertising(&req);
1471         hci_req_run(&req, NULL);
1472 }
1473
1474 static int clean_up_hci_state(struct hci_dev *hdev)
1475 {
1476         struct hci_request req;
1477         struct hci_conn *conn;
1478         bool discov_stopped;
1479         int err;
1480
1481         hci_req_init(&req, hdev);
1482
1483         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1484             test_bit(HCI_PSCAN, &hdev->flags)) {
1485                 u8 scan = 0x00;
1486                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1487         }
1488
1489         if (hdev->adv_instance_timeout)
1490                 clear_adv_instance(hdev);
1491
1492         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1493                 disable_advertising(&req);
1494
1495         discov_stopped = hci_stop_discovery(&req);
1496
1497         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1498                 struct hci_cp_disconnect dc;
1499                 struct hci_cp_reject_conn_req rej;
1500
1501                 switch (conn->state) {
1502                 case BT_CONNECTED:
1503                 case BT_CONFIG:
1504                         dc.handle = cpu_to_le16(conn->handle);
1505                         dc.reason = 0x15; /* Terminated due to Power Off */
1506                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1507                         break;
1508                 case BT_CONNECT:
1509                         if (conn->type == LE_LINK)
1510                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1511                                             0, NULL);
1512                         else if (conn->type == ACL_LINK)
1513                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1514                                             6, &conn->dst);
1515                         break;
1516                 case BT_CONNECT2:
1517                         bacpy(&rej.bdaddr, &conn->dst);
1518                         rej.reason = 0x15; /* Terminated due to Power Off */
1519                         if (conn->type == ACL_LINK)
1520                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1521                                             sizeof(rej), &rej);
1522                         else if (conn->type == SCO_LINK)
1523                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1524                                             sizeof(rej), &rej);
1525                         break;
1526                 }
1527         }
1528
1529         err = hci_req_run(&req, clean_up_hci_complete);
1530         if (!err && discov_stopped)
1531                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1532
1533         return err;
1534 }
1535
1536 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1537                        u16 len)
1538 {
1539         struct mgmt_mode *cp = data;
1540         struct mgmt_pending_cmd *cmd;
1541         int err;
1542
1543         BT_DBG("request for %s", hdev->name);
1544
1545         if (cp->val != 0x00 && cp->val != 0x01)
1546                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1547                                        MGMT_STATUS_INVALID_PARAMS);
1548
1549         hci_dev_lock(hdev);
1550
1551         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1552                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1553                                       MGMT_STATUS_BUSY);
1554                 goto failed;
1555         }
1556
1557         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1558                 cancel_delayed_work(&hdev->power_off);
1559
1560                 if (cp->val) {
1561                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1562                                          data, len);
1563                         err = mgmt_powered(hdev, 1);
1564                         goto failed;
1565                 }
1566         }
1567
1568         if (!!cp->val == hdev_is_powered(hdev)) {
1569                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1570                 goto failed;
1571         }
1572
1573         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1574         if (!cmd) {
1575                 err = -ENOMEM;
1576                 goto failed;
1577         }
1578
1579         if (cp->val) {
1580                 queue_work(hdev->req_workqueue, &hdev->power_on);
1581                 err = 0;
1582         } else {
1583                 /* Disconnect connections, stop scans, etc */
1584                 err = clean_up_hci_state(hdev);
1585                 if (!err)
1586                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1587                                            HCI_POWER_OFF_TIMEOUT);
1588
1589                 /* ENODATA means there were no HCI commands queued */
1590                 if (err == -ENODATA) {
1591                         cancel_delayed_work(&hdev->power_off);
1592                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1593                         err = 0;
1594                 }
1595         }
1596
1597 failed:
1598         hci_dev_unlock(hdev);
1599         return err;
1600 }
1601
1602 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1603 {
1604         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1605
1606         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1607                                   sizeof(ev), skip);
1608 }
1609
1610 int mgmt_new_settings(struct hci_dev *hdev)
1611 {
1612         return new_settings(hdev, NULL);
1613 }
1614
1615 struct cmd_lookup {
1616         struct sock *sk;
1617         struct hci_dev *hdev;
1618         u8 mgmt_status;
1619 };
1620
1621 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1622 {
1623         struct cmd_lookup *match = data;
1624
1625         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1626
1627         list_del(&cmd->list);
1628
1629         if (match->sk == NULL) {
1630                 match->sk = cmd->sk;
1631                 sock_hold(match->sk);
1632         }
1633
1634         mgmt_pending_free(cmd);
1635 }
1636
1637 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1638 {
1639         u8 *status = data;
1640
1641         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1642         mgmt_pending_remove(cmd);
1643 }
1644
1645 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1646 {
1647         if (cmd->cmd_complete) {
1648                 u8 *status = data;
1649
1650                 cmd->cmd_complete(cmd, *status);
1651                 mgmt_pending_remove(cmd);
1652
1653                 return;
1654         }
1655
1656         cmd_status_rsp(cmd, data);
1657 }
1658
1659 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1660 {
1661         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1662                                  cmd->param, cmd->param_len);
1663 }
1664
1665 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1666 {
1667         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1668                                  cmd->param, sizeof(struct mgmt_addr_info));
1669 }
1670
1671 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1672 {
1673         if (!lmp_bredr_capable(hdev))
1674                 return MGMT_STATUS_NOT_SUPPORTED;
1675         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1676                 return MGMT_STATUS_REJECTED;
1677         else
1678                 return MGMT_STATUS_SUCCESS;
1679 }
1680
1681 static u8 mgmt_le_support(struct hci_dev *hdev)
1682 {
1683         if (!lmp_le_capable(hdev))
1684                 return MGMT_STATUS_NOT_SUPPORTED;
1685         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1686                 return MGMT_STATUS_REJECTED;
1687         else
1688                 return MGMT_STATUS_SUCCESS;
1689 }
1690
1691 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1692                                       u16 opcode)
1693 {
1694         struct mgmt_pending_cmd *cmd;
1695         struct mgmt_mode *cp;
1696         struct hci_request req;
1697         bool changed;
1698
1699         BT_DBG("status 0x%02x", status);
1700
1701         hci_dev_lock(hdev);
1702
1703         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1704         if (!cmd)
1705                 goto unlock;
1706
1707         if (status) {
1708                 u8 mgmt_err = mgmt_status(status);
1709                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1710                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1711                 goto remove_cmd;
1712         }
1713
1714         cp = cmd->param;
1715         if (cp->val) {
1716                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1717
1718                 if (hdev->discov_timeout > 0) {
1719                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1720                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1721                                            to);
1722                 }
1723         } else {
1724                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1725         }
1726
1727         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1728
1729         if (changed)
1730                 new_settings(hdev, cmd->sk);
1731
1732         /* When the discoverable mode gets changed, make sure
1733          * that class of device has the limited discoverable
1734          * bit correctly set. Also update page scan based on whitelist
1735          * entries.
1736          */
1737         hci_req_init(&req, hdev);
1738         __hci_update_page_scan(&req);
1739         update_class(&req);
1740         hci_req_run(&req, NULL);
1741
1742 remove_cmd:
1743         mgmt_pending_remove(cmd);
1744
1745 unlock:
1746         hci_dev_unlock(hdev);
1747 }
1748
1749 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1750                             u16 len)
1751 {
1752         struct mgmt_cp_set_discoverable *cp = data;
1753         struct mgmt_pending_cmd *cmd;
1754         struct hci_request req;
1755         u16 timeout;
1756         u8 scan;
1757         int err;
1758
1759         BT_DBG("request for %s", hdev->name);
1760
1761         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1762             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1763                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1764                                        MGMT_STATUS_REJECTED);
1765
1766         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1767                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1768                                        MGMT_STATUS_INVALID_PARAMS);
1769
1770         timeout = __le16_to_cpu(cp->timeout);
1771
1772         /* Disabling discoverable requires that no timeout is set,
1773          * and enabling limited discoverable requires a timeout.
1774          */
1775         if ((cp->val == 0x00 && timeout > 0) ||
1776             (cp->val == 0x02 && timeout == 0))
1777                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1778                                        MGMT_STATUS_INVALID_PARAMS);
1779
1780         hci_dev_lock(hdev);
1781
1782         if (!hdev_is_powered(hdev) && timeout > 0) {
1783                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1784                                       MGMT_STATUS_NOT_POWERED);
1785                 goto failed;
1786         }
1787
1788         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1789             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1790                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1791                                       MGMT_STATUS_BUSY);
1792                 goto failed;
1793         }
1794
1795         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1796                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1797                                       MGMT_STATUS_REJECTED);
1798                 goto failed;
1799         }
1800
1801         if (!hdev_is_powered(hdev)) {
1802                 bool changed = false;
1803
1804                 /* Setting limited discoverable when powered off is
1805                  * not a valid operation since it requires a timeout
1806                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1807                  */
1808                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1809                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1810                         changed = true;
1811                 }
1812
1813                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1814                 if (err < 0)
1815                         goto failed;
1816
1817                 if (changed)
1818                         err = new_settings(hdev, sk);
1819
1820                 goto failed;
1821         }
1822
1823         /* If the current mode is the same, then just update the timeout
1824          * value with the new value. And if only the timeout gets updated,
1825          * then no need for any HCI transactions.
1826          */
1827         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1828             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1829                                                    HCI_LIMITED_DISCOVERABLE)) {
1830                 cancel_delayed_work(&hdev->discov_off);
1831                 hdev->discov_timeout = timeout;
1832
1833                 if (cp->val && hdev->discov_timeout > 0) {
1834                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1835                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1836                                            to);
1837                 }
1838
1839                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1840                 goto failed;
1841         }
1842
1843         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1844         if (!cmd) {
1845                 err = -ENOMEM;
1846                 goto failed;
1847         }
1848
1849         /* Cancel any potential discoverable timeout that might be
1850          * still active and store new timeout value. The arming of
1851          * the timeout happens in the complete handler.
1852          */
1853         cancel_delayed_work(&hdev->discov_off);
1854         hdev->discov_timeout = timeout;
1855
1856         /* Limited discoverable mode */
1857         if (cp->val == 0x02)
1858                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1859         else
1860                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1861
1862         hci_req_init(&req, hdev);
1863
1864         /* The procedure for LE-only controllers is much simpler - just
1865          * update the advertising data.
1866          */
1867         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1868                 goto update_ad;
1869
1870         scan = SCAN_PAGE;
1871
1872         if (cp->val) {
1873                 struct hci_cp_write_current_iac_lap hci_cp;
1874
1875                 if (cp->val == 0x02) {
1876                         /* Limited discoverable mode */
1877                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1878                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1879                         hci_cp.iac_lap[1] = 0x8b;
1880                         hci_cp.iac_lap[2] = 0x9e;
1881                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1882                         hci_cp.iac_lap[4] = 0x8b;
1883                         hci_cp.iac_lap[5] = 0x9e;
1884                 } else {
1885                         /* General discoverable mode */
1886                         hci_cp.num_iac = 1;
1887                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1888                         hci_cp.iac_lap[1] = 0x8b;
1889                         hci_cp.iac_lap[2] = 0x9e;
1890                 }
1891
1892                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1893                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1894
1895                 scan |= SCAN_INQUIRY;
1896         } else {
1897                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1898         }
1899
1900         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1901
1902 update_ad:
1903         update_adv_data(&req);
1904
1905         err = hci_req_run(&req, set_discoverable_complete);
1906         if (err < 0)
1907                 mgmt_pending_remove(cmd);
1908
1909 failed:
1910         hci_dev_unlock(hdev);
1911         return err;
1912 }
1913
1914 static void write_fast_connectable(struct hci_request *req, bool enable)
1915 {
1916         struct hci_dev *hdev = req->hdev;
1917         struct hci_cp_write_page_scan_activity acp;
1918         u8 type;
1919
1920         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1921                 return;
1922
1923         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1924                 return;
1925
1926         if (enable) {
1927                 type = PAGE_SCAN_TYPE_INTERLACED;
1928
1929                 /* 160 msec page scan interval */
1930                 acp.interval = cpu_to_le16(0x0100);
1931         } else {
1932                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1933
1934                 /* default 1.28 sec page scan */
1935                 acp.interval = cpu_to_le16(0x0800);
1936         }
1937
1938         acp.window = cpu_to_le16(0x0012);
1939
1940         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1941             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1942                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1943                             sizeof(acp), &acp);
1944
1945         if (hdev->page_scan_type != type)
1946                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1947 }
1948
1949 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1950                                      u16 opcode)
1951 {
1952         struct mgmt_pending_cmd *cmd;
1953         struct mgmt_mode *cp;
1954         bool conn_changed, discov_changed;
1955
1956         BT_DBG("status 0x%02x", status);
1957
1958         hci_dev_lock(hdev);
1959
1960         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1961         if (!cmd)
1962                 goto unlock;
1963
1964         if (status) {
1965                 u8 mgmt_err = mgmt_status(status);
1966                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1967                 goto remove_cmd;
1968         }
1969
1970         cp = cmd->param;
1971         if (cp->val) {
1972                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1973                                                           HCI_CONNECTABLE);
1974                 discov_changed = false;
1975         } else {
1976                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1977                                                            HCI_CONNECTABLE);
1978                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1979                                                              HCI_DISCOVERABLE);
1980         }
1981
1982         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1983
1984         if (conn_changed || discov_changed) {
1985                 new_settings(hdev, cmd->sk);
1986                 hci_update_page_scan(hdev);
1987                 if (discov_changed)
1988                         mgmt_update_adv_data(hdev);
1989                 hci_update_background_scan(hdev);
1990         }
1991
1992 remove_cmd:
1993         mgmt_pending_remove(cmd);
1994
1995 unlock:
1996         hci_dev_unlock(hdev);
1997 }
1998
1999 static int set_connectable_update_settings(struct hci_dev *hdev,
2000                                            struct sock *sk, u8 val)
2001 {
2002         bool changed = false;
2003         int err;
2004
2005         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
2006                 changed = true;
2007
2008         if (val) {
2009                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
2010         } else {
2011                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2012                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2013         }
2014
2015         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2016         if (err < 0)
2017                 return err;
2018
2019         if (changed) {
2020                 hci_update_page_scan(hdev);
2021                 hci_update_background_scan(hdev);
2022                 return new_settings(hdev, sk);
2023         }
2024
2025         return 0;
2026 }
2027
2028 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2029                            u16 len)
2030 {
2031         struct mgmt_mode *cp = data;
2032         struct mgmt_pending_cmd *cmd;
2033         struct hci_request req;
2034         u8 scan;
2035         int err;
2036
2037         BT_DBG("request for %s", hdev->name);
2038
2039         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2040             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2041                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2042                                        MGMT_STATUS_REJECTED);
2043
2044         if (cp->val != 0x00 && cp->val != 0x01)
2045                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2046                                        MGMT_STATUS_INVALID_PARAMS);
2047
2048         hci_dev_lock(hdev);
2049
2050         if (!hdev_is_powered(hdev)) {
2051                 err = set_connectable_update_settings(hdev, sk, cp->val);
2052                 goto failed;
2053         }
2054
2055         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2056             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2057                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2058                                       MGMT_STATUS_BUSY);
2059                 goto failed;
2060         }
2061
2062         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2063         if (!cmd) {
2064                 err = -ENOMEM;
2065                 goto failed;
2066         }
2067
2068         hci_req_init(&req, hdev);
2069
2070         /* If BR/EDR is not enabled and we disable advertising as a
2071          * by-product of disabling connectable, we need to update the
2072          * advertising flags.
2073          */
2074         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2075                 if (!cp->val) {
2076                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2077                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2078                 }
2079                 update_adv_data(&req);
2080         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2081                 if (cp->val) {
2082                         scan = SCAN_PAGE;
2083                 } else {
2084                         /* If we don't have any whitelist entries just
2085                          * disable all scanning. If there are entries
2086                          * and we had both page and inquiry scanning
2087                          * enabled then fall back to only page scanning.
2088                          * Otherwise no changes are needed.
2089                          */
2090                         if (list_empty(&hdev->whitelist))
2091                                 scan = SCAN_DISABLED;
2092                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2093                                 scan = SCAN_PAGE;
2094                         else
2095                                 goto no_scan_update;
2096
2097                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2098                             hdev->discov_timeout > 0)
2099                                 cancel_delayed_work(&hdev->discov_off);
2100                 }
2101
2102                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2103         }
2104
2105 no_scan_update:
2106         /* Update the advertising parameters if necessary */
2107         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2108             hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
2109                 enable_advertising(&req);
2110
2111         err = hci_req_run(&req, set_connectable_complete);
2112         if (err < 0) {
2113                 mgmt_pending_remove(cmd);
2114                 if (err == -ENODATA)
2115                         err = set_connectable_update_settings(hdev, sk,
2116                                                               cp->val);
2117                 goto failed;
2118         }
2119
2120 failed:
2121         hci_dev_unlock(hdev);
2122         return err;
2123 }
2124
2125 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2126                         u16 len)
2127 {
2128         struct mgmt_mode *cp = data;
2129         bool changed;
2130         int err;
2131
2132         BT_DBG("request for %s", hdev->name);
2133
2134         if (cp->val != 0x00 && cp->val != 0x01)
2135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2136                                        MGMT_STATUS_INVALID_PARAMS);
2137
2138         hci_dev_lock(hdev);
2139
2140         if (cp->val)
2141                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2142         else
2143                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2144
2145         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2146         if (err < 0)
2147                 goto unlock;
2148
2149         if (changed)
2150                 err = new_settings(hdev, sk);
2151
2152 unlock:
2153         hci_dev_unlock(hdev);
2154         return err;
2155 }
2156
2157 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2158                              u16 len)
2159 {
2160         struct mgmt_mode *cp = data;
2161         struct mgmt_pending_cmd *cmd;
2162         u8 val, status;
2163         int err;
2164
2165         BT_DBG("request for %s", hdev->name);
2166
2167         status = mgmt_bredr_support(hdev);
2168         if (status)
2169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2170                                        status);
2171
2172         if (cp->val != 0x00 && cp->val != 0x01)
2173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2174                                        MGMT_STATUS_INVALID_PARAMS);
2175
2176         hci_dev_lock(hdev);
2177
2178         if (!hdev_is_powered(hdev)) {
2179                 bool changed = false;
2180
2181                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2182                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2183                         changed = true;
2184                 }
2185
2186                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2187                 if (err < 0)
2188                         goto failed;
2189
2190                 if (changed)
2191                         err = new_settings(hdev, sk);
2192
2193                 goto failed;
2194         }
2195
2196         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2197                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2198                                       MGMT_STATUS_BUSY);
2199                 goto failed;
2200         }
2201
2202         val = !!cp->val;
2203
2204         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2205                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2206                 goto failed;
2207         }
2208
2209         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2210         if (!cmd) {
2211                 err = -ENOMEM;
2212                 goto failed;
2213         }
2214
2215         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2216         if (err < 0) {
2217                 mgmt_pending_remove(cmd);
2218                 goto failed;
2219         }
2220
2221 failed:
2222         hci_dev_unlock(hdev);
2223         return err;
2224 }
2225
2226 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2227 {
2228         struct mgmt_mode *cp = data;
2229         struct mgmt_pending_cmd *cmd;
2230         u8 status;
2231         int err;
2232
2233         BT_DBG("request for %s", hdev->name);
2234
2235         status = mgmt_bredr_support(hdev);
2236         if (status)
2237                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2238
2239         if (!lmp_ssp_capable(hdev))
2240                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2241                                        MGMT_STATUS_NOT_SUPPORTED);
2242
2243         if (cp->val != 0x00 && cp->val != 0x01)
2244                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2245                                        MGMT_STATUS_INVALID_PARAMS);
2246
2247         hci_dev_lock(hdev);
2248
2249         if (!hdev_is_powered(hdev)) {
2250                 bool changed;
2251
2252                 if (cp->val) {
2253                         changed = !hci_dev_test_and_set_flag(hdev,
2254                                                              HCI_SSP_ENABLED);
2255                 } else {
2256                         changed = hci_dev_test_and_clear_flag(hdev,
2257                                                               HCI_SSP_ENABLED);
2258                         if (!changed)
2259                                 changed = hci_dev_test_and_clear_flag(hdev,
2260                                                                       HCI_HS_ENABLED);
2261                         else
2262                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2263                 }
2264
2265                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2266                 if (err < 0)
2267                         goto failed;
2268
2269                 if (changed)
2270                         err = new_settings(hdev, sk);
2271
2272                 goto failed;
2273         }
2274
2275         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2276                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2277                                       MGMT_STATUS_BUSY);
2278                 goto failed;
2279         }
2280
2281         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2282                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2283                 goto failed;
2284         }
2285
2286         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2287         if (!cmd) {
2288                 err = -ENOMEM;
2289                 goto failed;
2290         }
2291
2292         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2293                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2294                              sizeof(cp->val), &cp->val);
2295
2296         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2297         if (err < 0) {
2298                 mgmt_pending_remove(cmd);
2299                 goto failed;
2300         }
2301
2302 failed:
2303         hci_dev_unlock(hdev);
2304         return err;
2305 }
2306
2307 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2308 {
2309         struct mgmt_mode *cp = data;
2310         bool changed;
2311         u8 status;
2312         int err;
2313
2314         BT_DBG("request for %s", hdev->name);
2315
2316         status = mgmt_bredr_support(hdev);
2317         if (status)
2318                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2319
2320         if (!lmp_ssp_capable(hdev))
2321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2322                                        MGMT_STATUS_NOT_SUPPORTED);
2323
2324         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2325                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2326                                        MGMT_STATUS_REJECTED);
2327
2328         if (cp->val != 0x00 && cp->val != 0x01)
2329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2330                                        MGMT_STATUS_INVALID_PARAMS);
2331
2332         hci_dev_lock(hdev);
2333
2334         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2335                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2336                                       MGMT_STATUS_BUSY);
2337                 goto unlock;
2338         }
2339
2340         if (cp->val) {
2341                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2342         } else {
2343                 if (hdev_is_powered(hdev)) {
2344                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2345                                               MGMT_STATUS_REJECTED);
2346                         goto unlock;
2347                 }
2348
2349                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2350         }
2351
2352         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2353         if (err < 0)
2354                 goto unlock;
2355
2356         if (changed)
2357                 err = new_settings(hdev, sk);
2358
2359 unlock:
2360         hci_dev_unlock(hdev);
2361         return err;
2362 }
2363
2364 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2365 {
2366         struct cmd_lookup match = { NULL, hdev };
2367
2368         hci_dev_lock(hdev);
2369
2370         if (status) {
2371                 u8 mgmt_err = mgmt_status(status);
2372
2373                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2374                                      &mgmt_err);
2375                 goto unlock;
2376         }
2377
2378         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2379
2380         new_settings(hdev, match.sk);
2381
2382         if (match.sk)
2383                 sock_put(match.sk);
2384
2385         /* Make sure the controller has a good default for
2386          * advertising data. Restrict the update to when LE
2387          * has actually been enabled. During power on, the
2388          * update in powered_update_hci will take care of it.
2389          */
2390         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2391                 struct hci_request req;
2392
2393                 hci_req_init(&req, hdev);
2394                 update_adv_data(&req);
2395                 update_scan_rsp_data(&req);
2396                 __hci_update_background_scan(&req);
2397                 hci_req_run(&req, NULL);
2398         }
2399
2400 unlock:
2401         hci_dev_unlock(hdev);
2402 }
2403
2404 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2405 {
2406         struct mgmt_mode *cp = data;
2407         struct hci_cp_write_le_host_supported hci_cp;
2408         struct mgmt_pending_cmd *cmd;
2409         struct hci_request req;
2410         int err;
2411         u8 val, enabled;
2412
2413         BT_DBG("request for %s", hdev->name);
2414
2415         if (!lmp_le_capable(hdev))
2416                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2417                                        MGMT_STATUS_NOT_SUPPORTED);
2418
2419         if (cp->val != 0x00 && cp->val != 0x01)
2420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2421                                        MGMT_STATUS_INVALID_PARAMS);
2422
2423         /* Bluetooth single mode LE only controllers or dual-mode
2424          * controllers configured as LE only devices, do not allow
2425          * switching LE off. These have either LE enabled explicitly
2426          * or BR/EDR has been previously switched off.
2427          *
2428          * When trying to enable an already enabled LE, then gracefully
2429          * send a positive response. Trying to disable it however will
2430          * result into rejection.
2431          */
2432         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2433                 if (cp->val == 0x01)
2434                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2435
2436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2437                                        MGMT_STATUS_REJECTED);
2438         }
2439
2440         hci_dev_lock(hdev);
2441
2442         val = !!cp->val;
2443         enabled = lmp_host_le_capable(hdev);
2444
2445         if (!hdev_is_powered(hdev) || val == enabled) {
2446                 bool changed = false;
2447
2448                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2449                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2450                         changed = true;
2451                 }
2452
2453                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2454                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2455                         changed = true;
2456                 }
2457
2458                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2459                 if (err < 0)
2460                         goto unlock;
2461
2462                 if (changed)
2463                         err = new_settings(hdev, sk);
2464
2465                 goto unlock;
2466         }
2467
2468         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2469             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2470                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2471                                       MGMT_STATUS_BUSY);
2472                 goto unlock;
2473         }
2474
2475         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2476         if (!cmd) {
2477                 err = -ENOMEM;
2478                 goto unlock;
2479         }
2480
2481         hci_req_init(&req, hdev);
2482
2483         memset(&hci_cp, 0, sizeof(hci_cp));
2484
2485         if (val) {
2486                 hci_cp.le = val;
2487                 hci_cp.simul = 0x00;
2488         } else {
2489                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2490                         disable_advertising(&req);
2491         }
2492
2493         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2494                     &hci_cp);
2495
2496         err = hci_req_run(&req, le_enable_complete);
2497         if (err < 0)
2498                 mgmt_pending_remove(cmd);
2499
2500 unlock:
2501         hci_dev_unlock(hdev);
2502         return err;
2503 }
2504
2505 /* This is a helper function to test for pending mgmt commands that can
2506  * cause CoD or EIR HCI commands. We can only allow one such pending
2507  * mgmt command at a time since otherwise we cannot easily track what
2508  * the current values are, will be, and based on that calculate if a new
2509  * HCI command needs to be sent and if yes with what value.
2510  */
2511 static bool pending_eir_or_class(struct hci_dev *hdev)
2512 {
2513         struct mgmt_pending_cmd *cmd;
2514
2515         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2516                 switch (cmd->opcode) {
2517                 case MGMT_OP_ADD_UUID:
2518                 case MGMT_OP_REMOVE_UUID:
2519                 case MGMT_OP_SET_DEV_CLASS:
2520                 case MGMT_OP_SET_POWERED:
2521                         return true;
2522                 }
2523         }
2524
2525         return false;
2526 }
2527
2528 static const u8 bluetooth_base_uuid[] = {
2529                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2530                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2531 };
2532
2533 static u8 get_uuid_size(const u8 *uuid)
2534 {
2535         u32 val;
2536
2537         if (memcmp(uuid, bluetooth_base_uuid, 12))
2538                 return 128;
2539
2540         val = get_unaligned_le32(&uuid[12]);
2541         if (val > 0xffff)
2542                 return 32;
2543
2544         return 16;
2545 }
2546
2547 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2548 {
2549         struct mgmt_pending_cmd *cmd;
2550
2551         hci_dev_lock(hdev);
2552
2553         cmd = pending_find(mgmt_op, hdev);
2554         if (!cmd)
2555                 goto unlock;
2556
2557         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2558                           mgmt_status(status), hdev->dev_class, 3);
2559
2560         mgmt_pending_remove(cmd);
2561
2562 unlock:
2563         hci_dev_unlock(hdev);
2564 }
2565
2566 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2567 {
2568         BT_DBG("status 0x%02x", status);
2569
2570         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2571 }
2572
2573 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2574 {
2575         struct mgmt_cp_add_uuid *cp = data;
2576         struct mgmt_pending_cmd *cmd;
2577         struct hci_request req;
2578         struct bt_uuid *uuid;
2579         int err;
2580
2581         BT_DBG("request for %s", hdev->name);
2582
2583         hci_dev_lock(hdev);
2584
2585         if (pending_eir_or_class(hdev)) {
2586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2587                                       MGMT_STATUS_BUSY);
2588                 goto failed;
2589         }
2590
2591         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2592         if (!uuid) {
2593                 err = -ENOMEM;
2594                 goto failed;
2595         }
2596
2597         memcpy(uuid->uuid, cp->uuid, 16);
2598         uuid->svc_hint = cp->svc_hint;
2599         uuid->size = get_uuid_size(cp->uuid);
2600
2601         list_add_tail(&uuid->list, &hdev->uuids);
2602
2603         hci_req_init(&req, hdev);
2604
2605         update_class(&req);
2606         update_eir(&req);
2607
2608         err = hci_req_run(&req, add_uuid_complete);
2609         if (err < 0) {
2610                 if (err != -ENODATA)
2611                         goto failed;
2612
2613                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2614                                         hdev->dev_class, 3);
2615                 goto failed;
2616         }
2617
2618         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2619         if (!cmd) {
2620                 err = -ENOMEM;
2621                 goto failed;
2622         }
2623
2624         err = 0;
2625
2626 failed:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static bool enable_service_cache(struct hci_dev *hdev)
2632 {
2633         if (!hdev_is_powered(hdev))
2634                 return false;
2635
2636         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2637                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2638                                    CACHE_TIMEOUT);
2639                 return true;
2640         }
2641
2642         return false;
2643 }
2644
2645 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2646 {
2647         BT_DBG("status 0x%02x", status);
2648
2649         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2650 }
2651
2652 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2653                        u16 len)
2654 {
2655         struct mgmt_cp_remove_uuid *cp = data;
2656         struct mgmt_pending_cmd *cmd;
2657         struct bt_uuid *match, *tmp;
2658         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2659         struct hci_request req;
2660         int err, found;
2661
2662         BT_DBG("request for %s", hdev->name);
2663
2664         hci_dev_lock(hdev);
2665
2666         if (pending_eir_or_class(hdev)) {
2667                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2668                                       MGMT_STATUS_BUSY);
2669                 goto unlock;
2670         }
2671
2672         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2673                 hci_uuids_clear(hdev);
2674
2675                 if (enable_service_cache(hdev)) {
2676                         err = mgmt_cmd_complete(sk, hdev->id,
2677                                                 MGMT_OP_REMOVE_UUID,
2678                                                 0, hdev->dev_class, 3);
2679                         goto unlock;
2680                 }
2681
2682                 goto update_class;
2683         }
2684
2685         found = 0;
2686
2687         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2688                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2689                         continue;
2690
2691                 list_del(&match->list);
2692                 kfree(match);
2693                 found++;
2694         }
2695
2696         if (found == 0) {
2697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2698                                       MGMT_STATUS_INVALID_PARAMS);
2699                 goto unlock;
2700         }
2701
2702 update_class:
2703         hci_req_init(&req, hdev);
2704
2705         update_class(&req);
2706         update_eir(&req);
2707
2708         err = hci_req_run(&req, remove_uuid_complete);
2709         if (err < 0) {
2710                 if (err != -ENODATA)
2711                         goto unlock;
2712
2713                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2714                                         hdev->dev_class, 3);
2715                 goto unlock;
2716         }
2717
2718         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2719         if (!cmd) {
2720                 err = -ENOMEM;
2721                 goto unlock;
2722         }
2723
2724         err = 0;
2725
2726 unlock:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2732 {
2733         BT_DBG("status 0x%02x", status);
2734
2735         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2736 }
2737
2738 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2739                          u16 len)
2740 {
2741         struct mgmt_cp_set_dev_class *cp = data;
2742         struct mgmt_pending_cmd *cmd;
2743         struct hci_request req;
2744         int err;
2745
2746         BT_DBG("request for %s", hdev->name);
2747
2748         if (!lmp_bredr_capable(hdev))
2749                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2750                                        MGMT_STATUS_NOT_SUPPORTED);
2751
2752         hci_dev_lock(hdev);
2753
2754         if (pending_eir_or_class(hdev)) {
2755                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2756                                       MGMT_STATUS_BUSY);
2757                 goto unlock;
2758         }
2759
2760         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2761                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2762                                       MGMT_STATUS_INVALID_PARAMS);
2763                 goto unlock;
2764         }
2765
2766         hdev->major_class = cp->major;
2767         hdev->minor_class = cp->minor;
2768
2769         if (!hdev_is_powered(hdev)) {
2770                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2771                                         hdev->dev_class, 3);
2772                 goto unlock;
2773         }
2774
2775         hci_req_init(&req, hdev);
2776
2777         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2778                 hci_dev_unlock(hdev);
2779                 cancel_delayed_work_sync(&hdev->service_cache);
2780                 hci_dev_lock(hdev);
2781                 update_eir(&req);
2782         }
2783
2784         update_class(&req);
2785
2786         err = hci_req_run(&req, set_class_complete);
2787         if (err < 0) {
2788                 if (err != -ENODATA)
2789                         goto unlock;
2790
2791                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2792                                         hdev->dev_class, 3);
2793                 goto unlock;
2794         }
2795
2796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2797         if (!cmd) {
2798                 err = -ENOMEM;
2799                 goto unlock;
2800         }
2801
2802         err = 0;
2803
2804 unlock:
2805         hci_dev_unlock(hdev);
2806         return err;
2807 }
2808
2809 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2810                           u16 len)
2811 {
2812         struct mgmt_cp_load_link_keys *cp = data;
2813         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2814                                    sizeof(struct mgmt_link_key_info));
2815         u16 key_count, expected_len;
2816         bool changed;
2817         int i;
2818
2819         BT_DBG("request for %s", hdev->name);
2820
2821         if (!lmp_bredr_capable(hdev))
2822                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2823                                        MGMT_STATUS_NOT_SUPPORTED);
2824
2825         key_count = __le16_to_cpu(cp->key_count);
2826         if (key_count > max_key_count) {
2827                 BT_ERR("load_link_keys: too big key_count value %u",
2828                        key_count);
2829                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2830                                        MGMT_STATUS_INVALID_PARAMS);
2831         }
2832
2833         expected_len = sizeof(*cp) + key_count *
2834                                         sizeof(struct mgmt_link_key_info);
2835         if (expected_len != len) {
2836                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2837                        expected_len, len);
2838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2839                                        MGMT_STATUS_INVALID_PARAMS);
2840         }
2841
2842         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2844                                        MGMT_STATUS_INVALID_PARAMS);
2845
2846         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2847                key_count);
2848
2849         for (i = 0; i < key_count; i++) {
2850                 struct mgmt_link_key_info *key = &cp->keys[i];
2851
2852                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2853                         return mgmt_cmd_status(sk, hdev->id,
2854                                                MGMT_OP_LOAD_LINK_KEYS,
2855                                                MGMT_STATUS_INVALID_PARAMS);
2856         }
2857
2858         hci_dev_lock(hdev);
2859
2860         hci_link_keys_clear(hdev);
2861
2862         if (cp->debug_keys)
2863                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2864         else
2865                 changed = hci_dev_test_and_clear_flag(hdev,
2866                                                       HCI_KEEP_DEBUG_KEYS);
2867
2868         if (changed)
2869                 new_settings(hdev, NULL);
2870
2871         for (i = 0; i < key_count; i++) {
2872                 struct mgmt_link_key_info *key = &cp->keys[i];
2873
2874                 /* Always ignore debug keys and require a new pairing if
2875                  * the user wants to use them.
2876                  */
2877                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2878                         continue;
2879
2880                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2881                                  key->type, key->pin_len, NULL);
2882         }
2883
2884         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2885
2886         hci_dev_unlock(hdev);
2887
2888         return 0;
2889 }
2890
2891 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2892                            u8 addr_type, struct sock *skip_sk)
2893 {
2894         struct mgmt_ev_device_unpaired ev;
2895
2896         bacpy(&ev.addr.bdaddr, bdaddr);
2897         ev.addr.type = addr_type;
2898
2899         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2900                           skip_sk);
2901 }
2902
2903 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2904                          u16 len)
2905 {
2906         struct mgmt_cp_unpair_device *cp = data;
2907         struct mgmt_rp_unpair_device rp;
2908         struct hci_cp_disconnect dc;
2909         struct mgmt_pending_cmd *cmd;
2910         struct hci_conn *conn;
2911         int err;
2912
2913         memset(&rp, 0, sizeof(rp));
2914         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2915         rp.addr.type = cp->addr.type;
2916
2917         if (!bdaddr_type_is_valid(cp->addr.type))
2918                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2919                                          MGMT_STATUS_INVALID_PARAMS,
2920                                          &rp, sizeof(rp));
2921
2922         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2923                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2924                                          MGMT_STATUS_INVALID_PARAMS,
2925                                          &rp, sizeof(rp));
2926
2927         hci_dev_lock(hdev);
2928
2929         if (!hdev_is_powered(hdev)) {
2930                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2931                                         MGMT_STATUS_NOT_POWERED, &rp,
2932                                         sizeof(rp));
2933                 goto unlock;
2934         }
2935
2936         if (cp->addr.type == BDADDR_BREDR) {
2937                 /* If disconnection is requested, then look up the
2938                  * connection. If the remote device is connected, it
2939                  * will be later used to terminate the link.
2940                  *
2941                  * Setting it to NULL explicitly will cause no
2942                  * termination of the link.
2943                  */
2944                 if (cp->disconnect)
2945                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2946                                                        &cp->addr.bdaddr);
2947                 else
2948                         conn = NULL;
2949
2950                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2951         } else {
2952                 u8 addr_type;
2953
2954                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2955                                                &cp->addr.bdaddr);
2956                 if (conn) {
2957                         /* Defer clearing up the connection parameters
2958                          * until closing to give a chance of keeping
2959                          * them if a repairing happens.
2960                          */
2961                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2962
2963                         /* If disconnection is not requested, then
2964                          * clear the connection variable so that the
2965                          * link is not terminated.
2966                          */
2967                         if (!cp->disconnect)
2968                                 conn = NULL;
2969                 }
2970
2971                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2972                         addr_type = ADDR_LE_DEV_PUBLIC;
2973                 else
2974                         addr_type = ADDR_LE_DEV_RANDOM;
2975
2976                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2977
2978                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2979         }
2980
2981         if (err < 0) {
2982                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2983                                         MGMT_STATUS_NOT_PAIRED, &rp,
2984                                         sizeof(rp));
2985                 goto unlock;
2986         }
2987
2988         /* If the connection variable is set, then termination of the
2989          * link is requested.
2990          */
2991         if (!conn) {
2992                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2993                                         &rp, sizeof(rp));
2994                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2995                 goto unlock;
2996         }
2997
2998         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2999                                sizeof(*cp));
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 goto unlock;
3003         }
3004
3005         cmd->cmd_complete = addr_cmd_complete;
3006
3007         dc.handle = cpu_to_le16(conn->handle);
3008         dc.reason = 0x13; /* Remote User Terminated Connection */
3009         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3010         if (err < 0)
3011                 mgmt_pending_remove(cmd);
3012
3013 unlock:
3014         hci_dev_unlock(hdev);
3015         return err;
3016 }
3017
3018 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3019                       u16 len)
3020 {
3021         struct mgmt_cp_disconnect *cp = data;
3022         struct mgmt_rp_disconnect rp;
3023         struct mgmt_pending_cmd *cmd;
3024         struct hci_conn *conn;
3025         int err;
3026
3027         BT_DBG("");
3028
3029         memset(&rp, 0, sizeof(rp));
3030         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3031         rp.addr.type = cp->addr.type;
3032
3033         if (!bdaddr_type_is_valid(cp->addr.type))
3034                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3035                                          MGMT_STATUS_INVALID_PARAMS,
3036                                          &rp, sizeof(rp));
3037
3038         hci_dev_lock(hdev);
3039
3040         if (!test_bit(HCI_UP, &hdev->flags)) {
3041                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3042                                         MGMT_STATUS_NOT_POWERED, &rp,
3043                                         sizeof(rp));
3044                 goto failed;
3045         }
3046
3047         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3048                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3049                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3050                 goto failed;
3051         }
3052
3053         if (cp->addr.type == BDADDR_BREDR)
3054                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3055                                                &cp->addr.bdaddr);
3056         else
3057                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
3058
3059         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3060                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3061                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3062                                         sizeof(rp));
3063                 goto failed;
3064         }
3065
3066         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3067         if (!cmd) {
3068                 err = -ENOMEM;
3069                 goto failed;
3070         }
3071
3072         cmd->cmd_complete = generic_cmd_complete;
3073
3074         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3075         if (err < 0)
3076                 mgmt_pending_remove(cmd);
3077
3078 failed:
3079         hci_dev_unlock(hdev);
3080         return err;
3081 }
3082
3083 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3084 {
3085         switch (link_type) {
3086         case LE_LINK:
3087                 switch (addr_type) {
3088                 case ADDR_LE_DEV_PUBLIC:
3089                         return BDADDR_LE_PUBLIC;
3090
3091                 default:
3092                         /* Fallback to LE Random address type */
3093                         return BDADDR_LE_RANDOM;
3094                 }
3095
3096         default:
3097                 /* Fallback to BR/EDR type */
3098                 return BDADDR_BREDR;
3099         }
3100 }
3101
3102 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3103                            u16 data_len)
3104 {
3105         struct mgmt_rp_get_connections *rp;
3106         struct hci_conn *c;
3107         size_t rp_len;
3108         int err;
3109         u16 i;
3110
3111         BT_DBG("");
3112
3113         hci_dev_lock(hdev);
3114
3115         if (!hdev_is_powered(hdev)) {
3116                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3117                                       MGMT_STATUS_NOT_POWERED);
3118                 goto unlock;
3119         }
3120
3121         i = 0;
3122         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3123                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3124                         i++;
3125         }
3126
3127         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3128         rp = kmalloc(rp_len, GFP_KERNEL);
3129         if (!rp) {
3130                 err = -ENOMEM;
3131                 goto unlock;
3132         }
3133
3134         i = 0;
3135         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3136                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3137                         continue;
3138                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3139                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3140                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3141                         continue;
3142                 i++;
3143         }
3144
3145         rp->conn_count = cpu_to_le16(i);
3146
3147         /* Recalculate length in case of filtered SCO connections, etc */
3148         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3149
3150         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3151                                 rp_len);
3152
3153         kfree(rp);
3154
3155 unlock:
3156         hci_dev_unlock(hdev);
3157         return err;
3158 }
3159
3160 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3161                                    struct mgmt_cp_pin_code_neg_reply *cp)
3162 {
3163         struct mgmt_pending_cmd *cmd;
3164         int err;
3165
3166         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3167                                sizeof(*cp));
3168         if (!cmd)
3169                 return -ENOMEM;
3170
3171         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3172                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3173         if (err < 0)
3174                 mgmt_pending_remove(cmd);
3175
3176         return err;
3177 }
3178
3179 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3180                           u16 len)
3181 {
3182         struct hci_conn *conn;
3183         struct mgmt_cp_pin_code_reply *cp = data;
3184         struct hci_cp_pin_code_reply reply;
3185         struct mgmt_pending_cmd *cmd;
3186         int err;
3187
3188         BT_DBG("");
3189
3190         hci_dev_lock(hdev);
3191
3192         if (!hdev_is_powered(hdev)) {
3193                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3194                                       MGMT_STATUS_NOT_POWERED);
3195                 goto failed;
3196         }
3197
3198         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3199         if (!conn) {
3200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3201                                       MGMT_STATUS_NOT_CONNECTED);
3202                 goto failed;
3203         }
3204
3205         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3206                 struct mgmt_cp_pin_code_neg_reply ncp;
3207
3208                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3209
3210                 BT_ERR("PIN code is not 16 bytes long");
3211
3212                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3213                 if (err >= 0)
3214                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3215                                               MGMT_STATUS_INVALID_PARAMS);
3216
3217                 goto failed;
3218         }
3219
3220         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3221         if (!cmd) {
3222                 err = -ENOMEM;
3223                 goto failed;
3224         }
3225
3226         cmd->cmd_complete = addr_cmd_complete;
3227
3228         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3229         reply.pin_len = cp->pin_len;
3230         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3231
3232         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3233         if (err < 0)
3234                 mgmt_pending_remove(cmd);
3235
3236 failed:
3237         hci_dev_unlock(hdev);
3238         return err;
3239 }
3240
3241 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3242                              u16 len)
3243 {
3244         struct mgmt_cp_set_io_capability *cp = data;
3245
3246         BT_DBG("");
3247
3248         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3249                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3250                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3251
3252         hci_dev_lock(hdev);
3253
3254         hdev->io_capability = cp->io_capability;
3255
3256         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3257                hdev->io_capability);
3258
3259         hci_dev_unlock(hdev);
3260
3261         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3262                                  NULL, 0);
3263 }
3264
3265 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3266 {
3267         struct hci_dev *hdev = conn->hdev;
3268         struct mgmt_pending_cmd *cmd;
3269
3270         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3271                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3272                         continue;
3273
3274                 if (cmd->user_data != conn)
3275                         continue;
3276
3277                 return cmd;
3278         }
3279
3280         return NULL;
3281 }
3282
3283 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3284 {
3285         struct mgmt_rp_pair_device rp;
3286         struct hci_conn *conn = cmd->user_data;
3287         int err;
3288
3289         bacpy(&rp.addr.bdaddr, &conn->dst);
3290         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3291
3292         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3293                                 status, &rp, sizeof(rp));
3294
3295         /* So we don't get further callbacks for this connection */
3296         conn->connect_cfm_cb = NULL;
3297         conn->security_cfm_cb = NULL;
3298         conn->disconn_cfm_cb = NULL;
3299
3300         hci_conn_drop(conn);
3301
3302         /* The device is paired so there is no need to remove
3303          * its connection parameters anymore.
3304          */
3305         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3306
3307         hci_conn_put(conn);
3308
3309         return err;
3310 }
3311
3312 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3313 {
3314         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3315         struct mgmt_pending_cmd *cmd;
3316
3317         cmd = find_pairing(conn);
3318         if (cmd) {
3319                 cmd->cmd_complete(cmd, status);
3320                 mgmt_pending_remove(cmd);
3321         }
3322 }
3323
3324 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3325 {
3326         struct mgmt_pending_cmd *cmd;
3327
3328         BT_DBG("status %u", status);
3329
3330         cmd = find_pairing(conn);
3331         if (!cmd) {
3332                 BT_DBG("Unable to find a pending command");
3333                 return;
3334         }
3335
3336         cmd->cmd_complete(cmd, mgmt_status(status));
3337         mgmt_pending_remove(cmd);
3338 }
3339
3340 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3341 {
3342         struct mgmt_pending_cmd *cmd;
3343
3344         BT_DBG("status %u", status);
3345
3346         if (!status)
3347                 return;
3348
3349         cmd = find_pairing(conn);
3350         if (!cmd) {
3351                 BT_DBG("Unable to find a pending command");
3352                 return;
3353         }
3354
3355         cmd->cmd_complete(cmd, mgmt_status(status));
3356         mgmt_pending_remove(cmd);
3357 }
3358
3359 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3360                        u16 len)
3361 {
3362         struct mgmt_cp_pair_device *cp = data;
3363         struct mgmt_rp_pair_device rp;
3364         struct mgmt_pending_cmd *cmd;
3365         u8 sec_level, auth_type;
3366         struct hci_conn *conn;
3367         int err;
3368
3369         BT_DBG("");
3370
3371         memset(&rp, 0, sizeof(rp));
3372         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3373         rp.addr.type = cp->addr.type;
3374
3375         if (!bdaddr_type_is_valid(cp->addr.type))
3376                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3377                                          MGMT_STATUS_INVALID_PARAMS,
3378                                          &rp, sizeof(rp));
3379
3380         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3381                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3382                                          MGMT_STATUS_INVALID_PARAMS,
3383                                          &rp, sizeof(rp));
3384
3385         hci_dev_lock(hdev);
3386
3387         if (!hdev_is_powered(hdev)) {
3388                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3389                                         MGMT_STATUS_NOT_POWERED, &rp,
3390                                         sizeof(rp));
3391                 goto unlock;
3392         }
3393
3394         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3395                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3396                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3397                                         sizeof(rp));
3398                 goto unlock;
3399         }
3400
3401         sec_level = BT_SECURITY_MEDIUM;
3402         auth_type = HCI_AT_DEDICATED_BONDING;
3403
3404         if (cp->addr.type == BDADDR_BREDR) {
3405                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3406                                        auth_type);
3407         } else {
3408                 u8 addr_type;
3409
3410                 /* Convert from L2CAP channel address type to HCI address type
3411                  */
3412                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3413                         addr_type = ADDR_LE_DEV_PUBLIC;
3414                 else
3415                         addr_type = ADDR_LE_DEV_RANDOM;
3416
3417                 /* When pairing a new device, it is expected to remember
3418                  * this device for future connections. Adding the connection
3419                  * parameter information ahead of time allows tracking
3420                  * of the slave preferred values and will speed up any
3421                  * further connection establishment.
3422                  *
3423                  * If connection parameters already exist, then they
3424                  * will be kept and this function does nothing.
3425                  */
3426                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3427
3428                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3429                                       sec_level, HCI_LE_CONN_TIMEOUT,
3430                                       HCI_ROLE_MASTER);
3431         }
3432
3433         if (IS_ERR(conn)) {
3434                 int status;
3435
3436                 if (PTR_ERR(conn) == -EBUSY)
3437                         status = MGMT_STATUS_BUSY;
3438                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3439                         status = MGMT_STATUS_NOT_SUPPORTED;
3440                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3441                         status = MGMT_STATUS_REJECTED;
3442                 else
3443                         status = MGMT_STATUS_CONNECT_FAILED;
3444
3445                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3446                                         status, &rp, sizeof(rp));
3447                 goto unlock;
3448         }
3449
3450         if (conn->connect_cfm_cb) {
3451                 hci_conn_drop(conn);
3452                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3453                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3454                 goto unlock;
3455         }
3456
3457         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3458         if (!cmd) {
3459                 err = -ENOMEM;
3460                 hci_conn_drop(conn);
3461                 goto unlock;
3462         }
3463
3464         cmd->cmd_complete = pairing_complete;
3465
3466         /* For LE, just connecting isn't a proof that the pairing finished */
3467         if (cp->addr.type == BDADDR_BREDR) {
3468                 conn->connect_cfm_cb = pairing_complete_cb;
3469                 conn->security_cfm_cb = pairing_complete_cb;
3470                 conn->disconn_cfm_cb = pairing_complete_cb;
3471         } else {
3472                 conn->connect_cfm_cb = le_pairing_complete_cb;
3473                 conn->security_cfm_cb = le_pairing_complete_cb;
3474                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3475         }
3476
3477         conn->io_capability = cp->io_cap;
3478         cmd->user_data = hci_conn_get(conn);
3479
3480         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3481             hci_conn_security(conn, sec_level, auth_type, true)) {
3482                 cmd->cmd_complete(cmd, 0);
3483                 mgmt_pending_remove(cmd);
3484         }
3485
3486         err = 0;
3487
3488 unlock:
3489         hci_dev_unlock(hdev);
3490         return err;
3491 }
3492
3493 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3494                               u16 len)
3495 {
3496         struct mgmt_addr_info *addr = data;
3497         struct mgmt_pending_cmd *cmd;
3498         struct hci_conn *conn;
3499         int err;
3500
3501         BT_DBG("");
3502
3503         hci_dev_lock(hdev);
3504
3505         if (!hdev_is_powered(hdev)) {
3506                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3507                                       MGMT_STATUS_NOT_POWERED);
3508                 goto unlock;
3509         }
3510
3511         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3512         if (!cmd) {
3513                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3514                                       MGMT_STATUS_INVALID_PARAMS);
3515                 goto unlock;
3516         }
3517
3518         conn = cmd->user_data;
3519
3520         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3521                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3522                                       MGMT_STATUS_INVALID_PARAMS);
3523                 goto unlock;
3524         }
3525
3526         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3527         mgmt_pending_remove(cmd);
3528
3529         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3530                                 addr, sizeof(*addr));
3531 unlock:
3532         hci_dev_unlock(hdev);
3533         return err;
3534 }
3535
3536 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3537                              struct mgmt_addr_info *addr, u16 mgmt_op,
3538                              u16 hci_op, __le32 passkey)
3539 {
3540         struct mgmt_pending_cmd *cmd;
3541         struct hci_conn *conn;
3542         int err;
3543
3544         hci_dev_lock(hdev);
3545
3546         if (!hdev_is_powered(hdev)) {
3547                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3548                                         MGMT_STATUS_NOT_POWERED, addr,
3549                                         sizeof(*addr));
3550                 goto done;
3551         }
3552
3553         if (addr->type == BDADDR_BREDR)
3554                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3555         else
3556                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3557
3558         if (!conn) {
3559                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3560                                         MGMT_STATUS_NOT_CONNECTED, addr,
3561                                         sizeof(*addr));
3562                 goto done;
3563         }
3564
3565         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3566                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3567                 if (!err)
3568                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3569                                                 MGMT_STATUS_SUCCESS, addr,
3570                                                 sizeof(*addr));
3571                 else
3572                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3573                                                 MGMT_STATUS_FAILED, addr,
3574                                                 sizeof(*addr));
3575
3576                 goto done;
3577         }
3578
3579         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3580         if (!cmd) {
3581                 err = -ENOMEM;
3582                 goto done;
3583         }
3584
3585         cmd->cmd_complete = addr_cmd_complete;
3586
3587         /* Continue with pairing via HCI */
3588         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3589                 struct hci_cp_user_passkey_reply cp;
3590
3591                 bacpy(&cp.bdaddr, &addr->bdaddr);
3592                 cp.passkey = passkey;
3593                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3594         } else
3595                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3596                                    &addr->bdaddr);
3597
3598         if (err < 0)
3599                 mgmt_pending_remove(cmd);
3600
3601 done:
3602         hci_dev_unlock(hdev);
3603         return err;
3604 }
3605
3606 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3607                               void *data, u16 len)
3608 {
3609         struct mgmt_cp_pin_code_neg_reply *cp = data;
3610
3611         BT_DBG("");
3612
3613         return user_pairing_resp(sk, hdev, &cp->addr,
3614                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3615                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3616 }
3617
3618 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3619                               u16 len)
3620 {
3621         struct mgmt_cp_user_confirm_reply *cp = data;
3622
3623         BT_DBG("");
3624
3625         if (len != sizeof(*cp))
3626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3627                                        MGMT_STATUS_INVALID_PARAMS);
3628
3629         return user_pairing_resp(sk, hdev, &cp->addr,
3630                                  MGMT_OP_USER_CONFIRM_REPLY,
3631                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3632 }
3633
3634 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3635                                   void *data, u16 len)
3636 {
3637         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3638
3639         BT_DBG("");
3640
3641         return user_pairing_resp(sk, hdev, &cp->addr,
3642                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3643                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3644 }
3645
3646 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3647                               u16 len)
3648 {
3649         struct mgmt_cp_user_passkey_reply *cp = data;
3650
3651         BT_DBG("");
3652
3653         return user_pairing_resp(sk, hdev, &cp->addr,
3654                                  MGMT_OP_USER_PASSKEY_REPLY,
3655                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3656 }
3657
3658 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3659                                   void *data, u16 len)
3660 {
3661         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3662
3663         BT_DBG("");
3664
3665         return user_pairing_resp(sk, hdev, &cp->addr,
3666                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3667                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3668 }
3669
3670 static void update_name(struct hci_request *req)
3671 {
3672         struct hci_dev *hdev = req->hdev;
3673         struct hci_cp_write_local_name cp;
3674
3675         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3676
3677         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3678 }
3679
3680 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3681 {
3682         struct mgmt_cp_set_local_name *cp;
3683         struct mgmt_pending_cmd *cmd;
3684
3685         BT_DBG("status 0x%02x", status);
3686
3687         hci_dev_lock(hdev);
3688
3689         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3690         if (!cmd)
3691                 goto unlock;
3692
3693         cp = cmd->param;
3694
3695         if (status)
3696                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3697                                 mgmt_status(status));
3698         else
3699                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3700                                   cp, sizeof(*cp));
3701
3702         mgmt_pending_remove(cmd);
3703
3704 unlock:
3705         hci_dev_unlock(hdev);
3706 }
3707
3708 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3709                           u16 len)
3710 {
3711         struct mgmt_cp_set_local_name *cp = data;
3712         struct mgmt_pending_cmd *cmd;
3713         struct hci_request req;
3714         int err;
3715
3716         BT_DBG("");
3717
3718         hci_dev_lock(hdev);
3719
3720         /* If the old values are the same as the new ones just return a
3721          * direct command complete event.
3722          */
3723         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3724             !memcmp(hdev->short_name, cp->short_name,
3725                     sizeof(hdev->short_name))) {
3726                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3727                                         data, len);
3728                 goto failed;
3729         }
3730
3731         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3732
3733         if (!hdev_is_powered(hdev)) {
3734                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3735
3736                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3737                                         data, len);
3738                 if (err < 0)
3739                         goto failed;
3740
3741                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3742                                          data, len, sk);
3743
3744                 goto failed;
3745         }
3746
3747         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3748         if (!cmd) {
3749                 err = -ENOMEM;
3750                 goto failed;
3751         }
3752
3753         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3754
3755         hci_req_init(&req, hdev);
3756
3757         if (lmp_bredr_capable(hdev)) {
3758                 update_name(&req);
3759                 update_eir(&req);
3760         }
3761
3762         /* The name is stored in the scan response data and so
3763          * no need to udpate the advertising data here.
3764          */
3765         if (lmp_le_capable(hdev))
3766                 update_scan_rsp_data(&req);
3767
3768         err = hci_req_run(&req, set_name_complete);
3769         if (err < 0)
3770                 mgmt_pending_remove(cmd);
3771
3772 failed:
3773         hci_dev_unlock(hdev);
3774         return err;
3775 }
3776
3777 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3778                                          u16 opcode, struct sk_buff *skb)
3779 {
3780         struct mgmt_rp_read_local_oob_data mgmt_rp;
3781         size_t rp_size = sizeof(mgmt_rp);
3782         struct mgmt_pending_cmd *cmd;
3783
3784         BT_DBG("%s status %u", hdev->name, status);
3785
3786         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3787         if (!cmd)
3788                 return;
3789
3790         if (status || !skb) {
3791                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3792                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3793                 goto remove;
3794         }
3795
3796         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3797
3798         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3799                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3800
3801                 if (skb->len < sizeof(*rp)) {
3802                         mgmt_cmd_status(cmd->sk, hdev->id,
3803                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3804                                         MGMT_STATUS_FAILED);
3805                         goto remove;
3806                 }
3807
3808                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3809                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3810
3811                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3812         } else {
3813                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3814
3815                 if (skb->len < sizeof(*rp)) {
3816                         mgmt_cmd_status(cmd->sk, hdev->id,
3817                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3818                                         MGMT_STATUS_FAILED);
3819                         goto remove;
3820                 }
3821
3822                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3823                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3824
3825                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3826                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3827         }
3828
3829         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3830                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3831
3832 remove:
3833         mgmt_pending_remove(cmd);
3834 }
3835
3836 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3837                                void *data, u16 data_len)
3838 {
3839         struct mgmt_pending_cmd *cmd;
3840         struct hci_request req;
3841         int err;
3842
3843         BT_DBG("%s", hdev->name);
3844
3845         hci_dev_lock(hdev);
3846
3847         if (!hdev_is_powered(hdev)) {
3848                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3849                                       MGMT_STATUS_NOT_POWERED);
3850                 goto unlock;
3851         }
3852
3853         if (!lmp_ssp_capable(hdev)) {
3854                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3855                                       MGMT_STATUS_NOT_SUPPORTED);
3856                 goto unlock;
3857         }
3858
3859         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3860                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3861                                       MGMT_STATUS_BUSY);
3862                 goto unlock;
3863         }
3864
3865         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3866         if (!cmd) {
3867                 err = -ENOMEM;
3868                 goto unlock;
3869         }
3870
3871         hci_req_init(&req, hdev);
3872
3873         if (bredr_sc_enabled(hdev))
3874                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3875         else
3876                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3877
3878         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3879         if (err < 0)
3880                 mgmt_pending_remove(cmd);
3881
3882 unlock:
3883         hci_dev_unlock(hdev);
3884         return err;
3885 }
3886
3887 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3888                                void *data, u16 len)
3889 {
3890         struct mgmt_addr_info *addr = data;
3891         int err;
3892
3893         BT_DBG("%s ", hdev->name);
3894
3895         if (!bdaddr_type_is_valid(addr->type))
3896                 return mgmt_cmd_complete(sk, hdev->id,
3897                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3898                                          MGMT_STATUS_INVALID_PARAMS,
3899                                          addr, sizeof(*addr));
3900
3901         hci_dev_lock(hdev);
3902
3903         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3904                 struct mgmt_cp_add_remote_oob_data *cp = data;
3905                 u8 status;
3906
3907                 if (cp->addr.type != BDADDR_BREDR) {
3908                         err = mgmt_cmd_complete(sk, hdev->id,
3909                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3910                                                 MGMT_STATUS_INVALID_PARAMS,
3911                                                 &cp->addr, sizeof(cp->addr));
3912                         goto unlock;
3913                 }
3914
3915                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3916                                               cp->addr.type, cp->hash,
3917                                               cp->rand, NULL, NULL);
3918                 if (err < 0)
3919                         status = MGMT_STATUS_FAILED;
3920                 else
3921                         status = MGMT_STATUS_SUCCESS;
3922
3923                 err = mgmt_cmd_complete(sk, hdev->id,
3924                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3925                                         &cp->addr, sizeof(cp->addr));
3926         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3927                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3928                 u8 *rand192, *hash192, *rand256, *hash256;
3929                 u8 status;
3930
3931                 if (bdaddr_type_is_le(cp->addr.type)) {
3932                         /* Enforce zero-valued 192-bit parameters as
3933                          * long as legacy SMP OOB isn't implemented.
3934                          */
3935                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3936                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3937                                 err = mgmt_cmd_complete(sk, hdev->id,
3938                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3939                                                         MGMT_STATUS_INVALID_PARAMS,
3940                                                         addr, sizeof(*addr));
3941                                 goto unlock;
3942                         }
3943
3944                         rand192 = NULL;
3945                         hash192 = NULL;
3946                 } else {
3947                         /* In case one of the P-192 values is set to zero,
3948                          * then just disable OOB data for P-192.
3949                          */
3950                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3951                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3952                                 rand192 = NULL;
3953                                 hash192 = NULL;
3954                         } else {
3955                                 rand192 = cp->rand192;
3956                                 hash192 = cp->hash192;
3957                         }
3958                 }
3959
3960                 /* In case one of the P-256 values is set to zero, then just
3961                  * disable OOB data for P-256.
3962                  */
3963                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3964                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3965                         rand256 = NULL;
3966                         hash256 = NULL;
3967                 } else {
3968                         rand256 = cp->rand256;
3969                         hash256 = cp->hash256;
3970                 }
3971
3972                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3973                                               cp->addr.type, hash192, rand192,
3974                                               hash256, rand256);
3975                 if (err < 0)
3976                         status = MGMT_STATUS_FAILED;
3977                 else
3978                         status = MGMT_STATUS_SUCCESS;
3979
3980                 err = mgmt_cmd_complete(sk, hdev->id,
3981                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3982                                         status, &cp->addr, sizeof(cp->addr));
3983         } else {
3984                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3985                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3986                                       MGMT_STATUS_INVALID_PARAMS);
3987         }
3988
3989 unlock:
3990         hci_dev_unlock(hdev);
3991         return err;
3992 }
3993
3994 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3995                                   void *data, u16 len)
3996 {
3997         struct mgmt_cp_remove_remote_oob_data *cp = data;
3998         u8 status;
3999         int err;
4000
4001         BT_DBG("%s", hdev->name);
4002
4003         if (cp->addr.type != BDADDR_BREDR)
4004                 return mgmt_cmd_complete(sk, hdev->id,
4005                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4006                                          MGMT_STATUS_INVALID_PARAMS,
4007                                          &cp->addr, sizeof(cp->addr));
4008
4009         hci_dev_lock(hdev);
4010
4011         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4012                 hci_remote_oob_data_clear(hdev);
4013                 status = MGMT_STATUS_SUCCESS;
4014                 goto done;
4015         }
4016
4017         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4018         if (err < 0)
4019                 status = MGMT_STATUS_INVALID_PARAMS;
4020         else
4021                 status = MGMT_STATUS_SUCCESS;
4022
4023 done:
4024         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4025                                 status, &cp->addr, sizeof(cp->addr));
4026
4027         hci_dev_unlock(hdev);
4028         return err;
4029 }
4030
4031 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
4032 {
4033         struct hci_dev *hdev = req->hdev;
4034         struct hci_cp_inquiry cp;
4035         /* General inquiry access code (GIAC) */
4036         u8 lap[3] = { 0x33, 0x8b, 0x9e };
4037
4038         *status = mgmt_bredr_support(hdev);
4039         if (*status)
4040                 return false;
4041
4042         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4043                 *status = MGMT_STATUS_BUSY;
4044                 return false;
4045         }
4046
4047         hci_inquiry_cache_flush(hdev);
4048
4049         memset(&cp, 0, sizeof(cp));
4050         memcpy(&cp.lap, lap, sizeof(cp.lap));
4051         cp.length = DISCOV_BREDR_INQUIRY_LEN;
4052
4053         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4054
4055         return true;
4056 }
4057
4058 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4059 {
4060         struct hci_dev *hdev = req->hdev;
4061         struct hci_cp_le_set_scan_param param_cp;
4062         struct hci_cp_le_set_scan_enable enable_cp;
4063         u8 own_addr_type;
4064         int err;
4065
4066         *status = mgmt_le_support(hdev);
4067         if (*status)
4068                 return false;
4069
4070         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4071                 /* Don't let discovery abort an outgoing connection attempt
4072                  * that's using directed advertising.
4073                  */
4074                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4075                         *status = MGMT_STATUS_REJECTED;
4076                         return false;
4077                 }
4078
4079                 disable_advertising(req);
4080         }
4081
4082         /* If controller is scanning, it means the background scanning is
4083          * running. Thus, we should temporarily stop it in order to set the
4084          * discovery scanning parameters.
4085          */
4086         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4087                 hci_req_add_le_scan_disable(req);
4088
4089         /* All active scans will be done with either a resolvable private
4090          * address (when privacy feature has been enabled) or non-resolvable
4091          * private address.
4092          */
4093         err = hci_update_random_address(req, true, &own_addr_type);
4094         if (err < 0) {
4095                 *status = MGMT_STATUS_FAILED;
4096                 return false;
4097         }
4098
4099         memset(&param_cp, 0, sizeof(param_cp));
4100         param_cp.type = LE_SCAN_ACTIVE;
4101         param_cp.interval = cpu_to_le16(interval);
4102         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4103         param_cp.own_address_type = own_addr_type;
4104
4105         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4106                     &param_cp);
4107
4108         memset(&enable_cp, 0, sizeof(enable_cp));
4109         enable_cp.enable = LE_SCAN_ENABLE;
4110         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4111
4112         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4113                     &enable_cp);
4114
4115         return true;
4116 }
4117
4118 static bool trigger_discovery(struct hci_request *req, u8 *status)
4119 {
4120         struct hci_dev *hdev = req->hdev;
4121
4122         switch (hdev->discovery.type) {
4123         case DISCOV_TYPE_BREDR:
4124                 if (!trigger_bredr_inquiry(req, status))
4125                         return false;
4126                 break;
4127
4128         case DISCOV_TYPE_INTERLEAVED:
4129                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4130                              &hdev->quirks)) {
4131                         /* During simultaneous discovery, we double LE scan
4132                          * interval. We must leave some time for the controller
4133                          * to do BR/EDR inquiry.
4134                          */
4135                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4136                                              status))
4137                                 return false;
4138
4139                         if (!trigger_bredr_inquiry(req, status))
4140                                 return false;
4141
4142                         return true;
4143                 }
4144
4145                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4146                         *status = MGMT_STATUS_NOT_SUPPORTED;
4147                         return false;
4148                 }
4149                 /* fall through */
4150
4151         case DISCOV_TYPE_LE:
4152                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4153                         return false;
4154                 break;
4155
4156         default:
4157                 *status = MGMT_STATUS_INVALID_PARAMS;
4158                 return false;
4159         }
4160
4161         return true;
4162 }
4163
4164 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4165                                      u16 opcode)
4166 {
4167         struct mgmt_pending_cmd *cmd;
4168         unsigned long timeout;
4169
4170         BT_DBG("status %d", status);
4171
4172         hci_dev_lock(hdev);
4173
4174         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4175         if (!cmd)
4176                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4177
4178         if (cmd) {
4179                 cmd->cmd_complete(cmd, mgmt_status(status));
4180                 mgmt_pending_remove(cmd);
4181         }
4182
4183         if (status) {
4184                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4185                 goto unlock;
4186         }
4187
4188         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4189
4190         /* If the scan involves LE scan, pick proper timeout to schedule
4191          * hdev->le_scan_disable that will stop it.
4192          */
4193         switch (hdev->discovery.type) {
4194         case DISCOV_TYPE_LE:
4195                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4196                 break;
4197         case DISCOV_TYPE_INTERLEAVED:
4198                  /* When running simultaneous discovery, the LE scanning time
4199                  * should occupy the whole discovery time sine BR/EDR inquiry
4200                  * and LE scanning are scheduled by the controller.
4201                  *
4202                  * For interleaving discovery in comparison, BR/EDR inquiry
4203                  * and LE scanning are done sequentially with separate
4204                  * timeouts.
4205                  */
4206                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4207                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4208                 else
4209                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4210                 break;
4211         case DISCOV_TYPE_BREDR:
4212                 timeout = 0;
4213                 break;
4214         default:
4215                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4216                 timeout = 0;
4217                 break;
4218         }
4219
4220         if (timeout) {
4221                 /* When service discovery is used and the controller has
4222                  * a strict duplicate filter, it is important to remember
4223                  * the start and duration of the scan. This is required
4224                  * for restarting scanning during the discovery phase.
4225                  */
4226                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4227                              &hdev->quirks) &&
4228                     hdev->discovery.result_filtering) {
4229                         hdev->discovery.scan_start = jiffies;
4230                         hdev->discovery.scan_duration = timeout;
4231                 }
4232
4233                 queue_delayed_work(hdev->workqueue,
4234                                    &hdev->le_scan_disable, timeout);
4235         }
4236
4237 unlock:
4238         hci_dev_unlock(hdev);
4239 }
4240
4241 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4242                            void *data, u16 len)
4243 {
4244         struct mgmt_cp_start_discovery *cp = data;
4245         struct mgmt_pending_cmd *cmd;
4246         struct hci_request req;
4247         u8 status;
4248         int err;
4249
4250         BT_DBG("%s", hdev->name);
4251
4252         hci_dev_lock(hdev);
4253
4254         if (!hdev_is_powered(hdev)) {
4255                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4256                                         MGMT_STATUS_NOT_POWERED,
4257                                         &cp->type, sizeof(cp->type));
4258                 goto failed;
4259         }
4260
4261         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4262             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4263                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4264                                         MGMT_STATUS_BUSY, &cp->type,
4265                                         sizeof(cp->type));
4266                 goto failed;
4267         }
4268
4269         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4270         if (!cmd) {
4271                 err = -ENOMEM;
4272                 goto failed;
4273         }
4274
4275         cmd->cmd_complete = generic_cmd_complete;
4276
4277         /* Clear the discovery filter first to free any previously
4278          * allocated memory for the UUID list.
4279          */
4280         hci_discovery_filter_clear(hdev);
4281
4282         hdev->discovery.type = cp->type;
4283         hdev->discovery.report_invalid_rssi = false;
4284
4285         hci_req_init(&req, hdev);
4286
4287         if (!trigger_discovery(&req, &status)) {
4288                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4289                                         status, &cp->type, sizeof(cp->type));
4290                 mgmt_pending_remove(cmd);
4291                 goto failed;
4292         }
4293
4294         err = hci_req_run(&req, start_discovery_complete);
4295         if (err < 0) {
4296                 mgmt_pending_remove(cmd);
4297                 goto failed;
4298         }
4299
4300         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4301
4302 failed:
4303         hci_dev_unlock(hdev);
4304         return err;
4305 }
4306
4307 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4308                                           u8 status)
4309 {
4310         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4311                                  cmd->param, 1);
4312 }
4313
4314 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4315                                    void *data, u16 len)
4316 {
4317         struct mgmt_cp_start_service_discovery *cp = data;
4318         struct mgmt_pending_cmd *cmd;
4319         struct hci_request req;
4320         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4321         u16 uuid_count, expected_len;
4322         u8 status;
4323         int err;
4324
4325         BT_DBG("%s", hdev->name);
4326
4327         hci_dev_lock(hdev);
4328
4329         if (!hdev_is_powered(hdev)) {
4330                 err = mgmt_cmd_complete(sk, hdev->id,
4331                                         MGMT_OP_START_SERVICE_DISCOVERY,
4332                                         MGMT_STATUS_NOT_POWERED,
4333                                         &cp->type, sizeof(cp->type));
4334                 goto failed;
4335         }
4336
4337         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4338             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4339                 err = mgmt_cmd_complete(sk, hdev->id,
4340                                         MGMT_OP_START_SERVICE_DISCOVERY,
4341                                         MGMT_STATUS_BUSY, &cp->type,
4342                                         sizeof(cp->type));
4343                 goto failed;
4344         }
4345
4346         uuid_count = __le16_to_cpu(cp->uuid_count);
4347         if (uuid_count > max_uuid_count) {
4348                 BT_ERR("service_discovery: too big uuid_count value %u",
4349                        uuid_count);
4350                 err = mgmt_cmd_complete(sk, hdev->id,
4351                                         MGMT_OP_START_SERVICE_DISCOVERY,
4352                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4353                                         sizeof(cp->type));
4354                 goto failed;
4355         }
4356
4357         expected_len = sizeof(*cp) + uuid_count * 16;
4358         if (expected_len != len) {
4359                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4360                        expected_len, len);
4361                 err = mgmt_cmd_complete(sk, hdev->id,
4362                                         MGMT_OP_START_SERVICE_DISCOVERY,
4363                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4364                                         sizeof(cp->type));
4365                 goto failed;
4366         }
4367
4368         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4369                                hdev, data, len);
4370         if (!cmd) {
4371                 err = -ENOMEM;
4372                 goto failed;
4373         }
4374
4375         cmd->cmd_complete = service_discovery_cmd_complete;
4376
4377         /* Clear the discovery filter first to free any previously
4378          * allocated memory for the UUID list.
4379          */
4380         hci_discovery_filter_clear(hdev);
4381
4382         hdev->discovery.result_filtering = true;
4383         hdev->discovery.type = cp->type;
4384         hdev->discovery.rssi = cp->rssi;
4385         hdev->discovery.uuid_count = uuid_count;
4386
4387         if (uuid_count > 0) {
4388                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4389                                                 GFP_KERNEL);
4390                 if (!hdev->discovery.uuids) {
4391                         err = mgmt_cmd_complete(sk, hdev->id,
4392                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4393                                                 MGMT_STATUS_FAILED,
4394                                                 &cp->type, sizeof(cp->type));
4395                         mgmt_pending_remove(cmd);
4396                         goto failed;
4397                 }
4398         }
4399
4400         hci_req_init(&req, hdev);
4401
4402         if (!trigger_discovery(&req, &status)) {
4403                 err = mgmt_cmd_complete(sk, hdev->id,
4404                                         MGMT_OP_START_SERVICE_DISCOVERY,
4405                                         status, &cp->type, sizeof(cp->type));
4406                 mgmt_pending_remove(cmd);
4407                 goto failed;
4408         }
4409
4410         err = hci_req_run(&req, start_discovery_complete);
4411         if (err < 0) {
4412                 mgmt_pending_remove(cmd);
4413                 goto failed;
4414         }
4415
4416         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4417
4418 failed:
4419         hci_dev_unlock(hdev);
4420         return err;
4421 }
4422
4423 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4424 {
4425         struct mgmt_pending_cmd *cmd;
4426
4427         BT_DBG("status %d", status);
4428
4429         hci_dev_lock(hdev);
4430
4431         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4432         if (cmd) {
4433                 cmd->cmd_complete(cmd, mgmt_status(status));
4434                 mgmt_pending_remove(cmd);
4435         }
4436
4437         if (!status)
4438                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4439
4440         hci_dev_unlock(hdev);
4441 }
4442
4443 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4444                           u16 len)
4445 {
4446         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4447         struct mgmt_pending_cmd *cmd;
4448         struct hci_request req;
4449         int err;
4450
4451         BT_DBG("%s", hdev->name);
4452
4453         hci_dev_lock(hdev);
4454
4455         if (!hci_discovery_active(hdev)) {
4456                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4457                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4458                                         sizeof(mgmt_cp->type));
4459                 goto unlock;
4460         }
4461
4462         if (hdev->discovery.type != mgmt_cp->type) {
4463                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4464                                         MGMT_STATUS_INVALID_PARAMS,
4465                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4466                 goto unlock;
4467         }
4468
4469         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4470         if (!cmd) {
4471                 err = -ENOMEM;
4472                 goto unlock;
4473         }
4474
4475         cmd->cmd_complete = generic_cmd_complete;
4476
4477         hci_req_init(&req, hdev);
4478
4479         hci_stop_discovery(&req);
4480
4481         err = hci_req_run(&req, stop_discovery_complete);
4482         if (!err) {
4483                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4484                 goto unlock;
4485         }
4486
4487         mgmt_pending_remove(cmd);
4488
4489         /* If no HCI commands were sent we're done */
4490         if (err == -ENODATA) {
4491                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4492                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4493                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4494         }
4495
4496 unlock:
4497         hci_dev_unlock(hdev);
4498         return err;
4499 }
4500
4501 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4502                         u16 len)
4503 {
4504         struct mgmt_cp_confirm_name *cp = data;
4505         struct inquiry_entry *e;
4506         int err;
4507
4508         BT_DBG("%s", hdev->name);
4509
4510         hci_dev_lock(hdev);
4511
4512         if (!hci_discovery_active(hdev)) {
4513                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4514                                         MGMT_STATUS_FAILED, &cp->addr,
4515                                         sizeof(cp->addr));
4516                 goto failed;
4517         }
4518
4519         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4520         if (!e) {
4521                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4522                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4523                                         sizeof(cp->addr));
4524                 goto failed;
4525         }
4526
4527         if (cp->name_known) {
4528                 e->name_state = NAME_KNOWN;
4529                 list_del(&e->list);
4530         } else {
4531                 e->name_state = NAME_NEEDED;
4532                 hci_inquiry_cache_update_resolve(hdev, e);
4533         }
4534
4535         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4536                                 &cp->addr, sizeof(cp->addr));
4537
4538 failed:
4539         hci_dev_unlock(hdev);
4540         return err;
4541 }
4542
4543 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4544                         u16 len)
4545 {
4546         struct mgmt_cp_block_device *cp = data;
4547         u8 status;
4548         int err;
4549
4550         BT_DBG("%s", hdev->name);
4551
4552         if (!bdaddr_type_is_valid(cp->addr.type))
4553                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4554                                          MGMT_STATUS_INVALID_PARAMS,
4555                                          &cp->addr, sizeof(cp->addr));
4556
4557         hci_dev_lock(hdev);
4558
4559         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4560                                   cp->addr.type);
4561         if (err < 0) {
4562                 status = MGMT_STATUS_FAILED;
4563                 goto done;
4564         }
4565
4566         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4567                    sk);
4568         status = MGMT_STATUS_SUCCESS;
4569
4570 done:
4571         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4572                                 &cp->addr, sizeof(cp->addr));
4573
4574         hci_dev_unlock(hdev);
4575
4576         return err;
4577 }
4578
4579 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4580                           u16 len)
4581 {
4582         struct mgmt_cp_unblock_device *cp = data;
4583         u8 status;
4584         int err;
4585
4586         BT_DBG("%s", hdev->name);
4587
4588         if (!bdaddr_type_is_valid(cp->addr.type))
4589                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4590                                          MGMT_STATUS_INVALID_PARAMS,
4591                                          &cp->addr, sizeof(cp->addr));
4592
4593         hci_dev_lock(hdev);
4594
4595         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4596                                   cp->addr.type);
4597         if (err < 0) {
4598                 status = MGMT_STATUS_INVALID_PARAMS;
4599                 goto done;
4600         }
4601
4602         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4603                    sk);
4604         status = MGMT_STATUS_SUCCESS;
4605
4606 done:
4607         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4608                                 &cp->addr, sizeof(cp->addr));
4609
4610         hci_dev_unlock(hdev);
4611
4612         return err;
4613 }
4614
4615 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4616                          u16 len)
4617 {
4618         struct mgmt_cp_set_device_id *cp = data;
4619         struct hci_request req;
4620         int err;
4621         __u16 source;
4622
4623         BT_DBG("%s", hdev->name);
4624
4625         source = __le16_to_cpu(cp->source);
4626
4627         if (source > 0x0002)
4628                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4629                                        MGMT_STATUS_INVALID_PARAMS);
4630
4631         hci_dev_lock(hdev);
4632
4633         hdev->devid_source = source;
4634         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4635         hdev->devid_product = __le16_to_cpu(cp->product);
4636         hdev->devid_version = __le16_to_cpu(cp->version);
4637
4638         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4639                                 NULL, 0);
4640
4641         hci_req_init(&req, hdev);
4642         update_eir(&req);
4643         hci_req_run(&req, NULL);
4644
4645         hci_dev_unlock(hdev);
4646
4647         return err;
4648 }
4649
4650 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4651                                         u16 opcode)
4652 {
4653         BT_DBG("status %d", status);
4654 }
4655
4656 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4657                                      u16 opcode)
4658 {
4659         struct cmd_lookup match = { NULL, hdev };
4660         struct hci_request req;
4661
4662         hci_dev_lock(hdev);
4663
4664         if (status) {
4665                 u8 mgmt_err = mgmt_status(status);
4666
4667                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4668                                      cmd_status_rsp, &mgmt_err);
4669                 goto unlock;
4670         }
4671
4672         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4673                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4674         else
4675                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4676
4677         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4678                              &match);
4679
4680         new_settings(hdev, match.sk);
4681
4682         if (match.sk)
4683                 sock_put(match.sk);
4684
4685         /* If "Set Advertising" was just disabled and instance advertising was
4686          * set up earlier, then enable the advertising instance.
4687          */
4688         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4689             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4690                 goto unlock;
4691
4692         hci_req_init(&req, hdev);
4693
4694         update_adv_data(&req);
4695         enable_advertising(&req);
4696
4697         if (hci_req_run(&req, enable_advertising_instance) < 0)
4698                 BT_ERR("Failed to re-configure advertising");
4699
4700 unlock:
4701         hci_dev_unlock(hdev);
4702 }
4703
4704 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4705                            u16 len)
4706 {
4707         struct mgmt_mode *cp = data;
4708         struct mgmt_pending_cmd *cmd;
4709         struct hci_request req;
4710         u8 val, status;
4711         int err;
4712
4713         BT_DBG("request for %s", hdev->name);
4714
4715         status = mgmt_le_support(hdev);
4716         if (status)
4717                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4718                                        status);
4719
4720         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4721                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4722                                        MGMT_STATUS_INVALID_PARAMS);
4723
4724         hci_dev_lock(hdev);
4725
4726         val = !!cp->val;
4727
4728         /* The following conditions are ones which mean that we should
4729          * not do any HCI communication but directly send a mgmt
4730          * response to user space (after toggling the flag if
4731          * necessary).
4732          */
4733         if (!hdev_is_powered(hdev) ||
4734             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4735              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4736             hci_conn_num(hdev, LE_LINK) > 0 ||
4737             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4738              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4739                 bool changed;
4740
4741                 if (cp->val) {
4742                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4743                         if (cp->val == 0x02)
4744                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4745                         else
4746                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4747                 } else {
4748                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4749                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4750                 }
4751
4752                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4753                 if (err < 0)
4754                         goto unlock;
4755
4756                 if (changed)
4757                         err = new_settings(hdev, sk);
4758
4759                 goto unlock;
4760         }
4761
4762         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4763             pending_find(MGMT_OP_SET_LE, hdev)) {
4764                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4765                                       MGMT_STATUS_BUSY);
4766                 goto unlock;
4767         }
4768
4769         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4770         if (!cmd) {
4771                 err = -ENOMEM;
4772                 goto unlock;
4773         }
4774
4775         hci_req_init(&req, hdev);
4776
4777         if (cp->val == 0x02)
4778                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4779         else
4780                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4781
4782         if (val) {
4783                 /* Switch to instance "0" for the Set Advertising setting. */
4784                 update_inst_adv_data(&req, 0x00);
4785                 update_inst_scan_rsp_data(&req, 0x00);
4786                 enable_advertising(&req);
4787         } else {
4788                 disable_advertising(&req);
4789         }
4790
4791         err = hci_req_run(&req, set_advertising_complete);
4792         if (err < 0)
4793                 mgmt_pending_remove(cmd);
4794
4795 unlock:
4796         hci_dev_unlock(hdev);
4797         return err;
4798 }
4799
4800 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4801                               void *data, u16 len)
4802 {
4803         struct mgmt_cp_set_static_address *cp = data;
4804         int err;
4805
4806         BT_DBG("%s", hdev->name);
4807
4808         if (!lmp_le_capable(hdev))
4809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4810                                        MGMT_STATUS_NOT_SUPPORTED);
4811
4812         if (hdev_is_powered(hdev))
4813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4814                                        MGMT_STATUS_REJECTED);
4815
4816         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4817                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4818                         return mgmt_cmd_status(sk, hdev->id,
4819                                                MGMT_OP_SET_STATIC_ADDRESS,
4820                                                MGMT_STATUS_INVALID_PARAMS);
4821
4822                 /* Two most significant bits shall be set */
4823                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4824                         return mgmt_cmd_status(sk, hdev->id,
4825                                                MGMT_OP_SET_STATIC_ADDRESS,
4826                                                MGMT_STATUS_INVALID_PARAMS);
4827         }
4828
4829         hci_dev_lock(hdev);
4830
4831         bacpy(&hdev->static_addr, &cp->bdaddr);
4832
4833         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4834         if (err < 0)
4835                 goto unlock;
4836
4837         err = new_settings(hdev, sk);
4838
4839 unlock:
4840         hci_dev_unlock(hdev);
4841         return err;
4842 }
4843
4844 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4845                            void *data, u16 len)
4846 {
4847         struct mgmt_cp_set_scan_params *cp = data;
4848         __u16 interval, window;
4849         int err;
4850
4851         BT_DBG("%s", hdev->name);
4852
4853         if (!lmp_le_capable(hdev))
4854                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4855                                        MGMT_STATUS_NOT_SUPPORTED);
4856
4857         interval = __le16_to_cpu(cp->interval);
4858
4859         if (interval < 0x0004 || interval > 0x4000)
4860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4861                                        MGMT_STATUS_INVALID_PARAMS);
4862
4863         window = __le16_to_cpu(cp->window);
4864
4865         if (window < 0x0004 || window > 0x4000)
4866                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4867                                        MGMT_STATUS_INVALID_PARAMS);
4868
4869         if (window > interval)
4870                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4871                                        MGMT_STATUS_INVALID_PARAMS);
4872
4873         hci_dev_lock(hdev);
4874
4875         hdev->le_scan_interval = interval;
4876         hdev->le_scan_window = window;
4877
4878         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4879                                 NULL, 0);
4880
4881         /* If background scan is running, restart it so new parameters are
4882          * loaded.
4883          */
4884         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4885             hdev->discovery.state == DISCOVERY_STOPPED) {
4886                 struct hci_request req;
4887
4888                 hci_req_init(&req, hdev);
4889
4890                 hci_req_add_le_scan_disable(&req);
4891                 hci_req_add_le_passive_scan(&req);
4892
4893                 hci_req_run(&req, NULL);
4894         }
4895
4896         hci_dev_unlock(hdev);
4897
4898         return err;
4899 }
4900
4901 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4902                                       u16 opcode)
4903 {
4904         struct mgmt_pending_cmd *cmd;
4905
4906         BT_DBG("status 0x%02x", status);
4907
4908         hci_dev_lock(hdev);
4909
4910         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4911         if (!cmd)
4912                 goto unlock;
4913
4914         if (status) {
4915                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4916                                 mgmt_status(status));
4917         } else {
4918                 struct mgmt_mode *cp = cmd->param;
4919
4920                 if (cp->val)
4921                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4922                 else
4923                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4924
4925                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4926                 new_settings(hdev, cmd->sk);
4927         }
4928
4929         mgmt_pending_remove(cmd);
4930
4931 unlock:
4932         hci_dev_unlock(hdev);
4933 }
4934
4935 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4936                                 void *data, u16 len)
4937 {
4938         struct mgmt_mode *cp = data;
4939         struct mgmt_pending_cmd *cmd;
4940         struct hci_request req;
4941         int err;
4942
4943         BT_DBG("%s", hdev->name);
4944
4945         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4946             hdev->hci_ver < BLUETOOTH_VER_1_2)
4947                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4948                                        MGMT_STATUS_NOT_SUPPORTED);
4949
4950         if (cp->val != 0x00 && cp->val != 0x01)
4951                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4952                                        MGMT_STATUS_INVALID_PARAMS);
4953
4954         hci_dev_lock(hdev);
4955
4956         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4957                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4958                                       MGMT_STATUS_BUSY);
4959                 goto unlock;
4960         }
4961
4962         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4963                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4964                                         hdev);
4965                 goto unlock;
4966         }
4967
4968         if (!hdev_is_powered(hdev)) {
4969                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4970                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4971                                         hdev);
4972                 new_settings(hdev, sk);
4973                 goto unlock;
4974         }
4975
4976         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4977                                data, len);
4978         if (!cmd) {
4979                 err = -ENOMEM;
4980                 goto unlock;
4981         }
4982
4983         hci_req_init(&req, hdev);
4984
4985         write_fast_connectable(&req, cp->val);
4986
4987         err = hci_req_run(&req, fast_connectable_complete);
4988         if (err < 0) {
4989                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4990                                       MGMT_STATUS_FAILED);
4991                 mgmt_pending_remove(cmd);
4992         }
4993
4994 unlock:
4995         hci_dev_unlock(hdev);
4996
4997         return err;
4998 }
4999
5000 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5001 {
5002         struct mgmt_pending_cmd *cmd;
5003
5004         BT_DBG("status 0x%02x", status);
5005
5006         hci_dev_lock(hdev);
5007
5008         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5009         if (!cmd)
5010                 goto unlock;
5011
5012         if (status) {
5013                 u8 mgmt_err = mgmt_status(status);
5014
5015                 /* We need to restore the flag if related HCI commands
5016                  * failed.
5017                  */
5018                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5019
5020                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5021         } else {
5022                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5023                 new_settings(hdev, cmd->sk);
5024         }
5025
5026         mgmt_pending_remove(cmd);
5027
5028 unlock:
5029         hci_dev_unlock(hdev);
5030 }
5031
5032 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5033 {
5034         struct mgmt_mode *cp = data;
5035         struct mgmt_pending_cmd *cmd;
5036         struct hci_request req;
5037         int err;
5038
5039         BT_DBG("request for %s", hdev->name);
5040
5041         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5042                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5043                                        MGMT_STATUS_NOT_SUPPORTED);
5044
5045         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5046                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5047                                        MGMT_STATUS_REJECTED);
5048
5049         if (cp->val != 0x00 && cp->val != 0x01)
5050                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5051                                        MGMT_STATUS_INVALID_PARAMS);
5052
5053         hci_dev_lock(hdev);
5054
5055         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5056                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5057                 goto unlock;
5058         }
5059
5060         if (!hdev_is_powered(hdev)) {
5061                 if (!cp->val) {
5062                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5063                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5064                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5065                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5066                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5067                 }
5068
5069                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5070
5071                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5072                 if (err < 0)
5073                         goto unlock;
5074
5075                 err = new_settings(hdev, sk);
5076                 goto unlock;
5077         }
5078
5079         /* Reject disabling when powered on */
5080         if (!cp->val) {
5081                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5082                                       MGMT_STATUS_REJECTED);
5083                 goto unlock;
5084         } else {
5085                 /* When configuring a dual-mode controller to operate
5086                  * with LE only and using a static address, then switching
5087                  * BR/EDR back on is not allowed.
5088                  *
5089                  * Dual-mode controllers shall operate with the public
5090                  * address as its identity address for BR/EDR and LE. So
5091                  * reject the attempt to create an invalid configuration.
5092                  *
5093                  * The same restrictions applies when secure connections
5094                  * has been enabled. For BR/EDR this is a controller feature
5095                  * while for LE it is a host stack feature. This means that
5096                  * switching BR/EDR back on when secure connections has been
5097                  * enabled is not a supported transaction.
5098                  */
5099                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5100                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5101                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5102                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5103                                               MGMT_STATUS_REJECTED);
5104                         goto unlock;
5105                 }
5106         }
5107
5108         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5109                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5110                                       MGMT_STATUS_BUSY);
5111                 goto unlock;
5112         }
5113
5114         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5115         if (!cmd) {
5116                 err = -ENOMEM;
5117                 goto unlock;
5118         }
5119
5120         /* We need to flip the bit already here so that update_adv_data
5121          * generates the correct flags.
5122          */
5123         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5124
5125         hci_req_init(&req, hdev);
5126
5127         write_fast_connectable(&req, false);
5128         __hci_update_page_scan(&req);
5129
5130         /* Since only the advertising data flags will change, there
5131          * is no need to update the scan response data.
5132          */
5133         update_adv_data(&req);
5134
5135         err = hci_req_run(&req, set_bredr_complete);
5136         if (err < 0)
5137                 mgmt_pending_remove(cmd);
5138
5139 unlock:
5140         hci_dev_unlock(hdev);
5141         return err;
5142 }
5143
5144 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5145 {
5146         struct mgmt_pending_cmd *cmd;
5147         struct mgmt_mode *cp;
5148
5149         BT_DBG("%s status %u", hdev->name, status);
5150
5151         hci_dev_lock(hdev);
5152
5153         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5154         if (!cmd)
5155                 goto unlock;
5156
5157         if (status) {
5158                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5159                                 mgmt_status(status));
5160                 goto remove;
5161         }
5162
5163         cp = cmd->param;
5164
5165         switch (cp->val) {
5166         case 0x00:
5167                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5168                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5169                 break;
5170         case 0x01:
5171                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5172                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5173                 break;
5174         case 0x02:
5175                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5176                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5177                 break;
5178         }
5179
5180         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5181         new_settings(hdev, cmd->sk);
5182
5183 remove:
5184         mgmt_pending_remove(cmd);
5185 unlock:
5186         hci_dev_unlock(hdev);
5187 }
5188
5189 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5190                            void *data, u16 len)
5191 {
5192         struct mgmt_mode *cp = data;
5193         struct mgmt_pending_cmd *cmd;
5194         struct hci_request req;
5195         u8 val;
5196         int err;
5197
5198         BT_DBG("request for %s", hdev->name);
5199
5200         if (!lmp_sc_capable(hdev) &&
5201             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5202                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5203                                        MGMT_STATUS_NOT_SUPPORTED);
5204
5205         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5206             lmp_sc_capable(hdev) &&
5207             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5209                                        MGMT_STATUS_REJECTED);
5210
5211         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5213                                   MGMT_STATUS_INVALID_PARAMS);
5214
5215         hci_dev_lock(hdev);
5216
5217         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5218             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5219                 bool changed;
5220
5221                 if (cp->val) {
5222                         changed = !hci_dev_test_and_set_flag(hdev,
5223                                                              HCI_SC_ENABLED);
5224                         if (cp->val == 0x02)
5225                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5226                         else
5227                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5228                 } else {
5229                         changed = hci_dev_test_and_clear_flag(hdev,
5230                                                               HCI_SC_ENABLED);
5231                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5232                 }
5233
5234                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5235                 if (err < 0)
5236                         goto failed;
5237
5238                 if (changed)
5239                         err = new_settings(hdev, sk);
5240
5241                 goto failed;
5242         }
5243
5244         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5245                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5246                                       MGMT_STATUS_BUSY);
5247                 goto failed;
5248         }
5249
5250         val = !!cp->val;
5251
5252         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5253             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5254                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5255                 goto failed;
5256         }
5257
5258         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5259         if (!cmd) {
5260                 err = -ENOMEM;
5261                 goto failed;
5262         }
5263
5264         hci_req_init(&req, hdev);
5265         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5266         err = hci_req_run(&req, sc_enable_complete);
5267         if (err < 0) {
5268                 mgmt_pending_remove(cmd);
5269                 goto failed;
5270         }
5271
5272 failed:
5273         hci_dev_unlock(hdev);
5274         return err;
5275 }
5276
5277 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5278                           void *data, u16 len)
5279 {
5280         struct mgmt_mode *cp = data;
5281         bool changed, use_changed;
5282         int err;
5283
5284         BT_DBG("request for %s", hdev->name);
5285
5286         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5287                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5288                                        MGMT_STATUS_INVALID_PARAMS);
5289
5290         hci_dev_lock(hdev);
5291
5292         if (cp->val)
5293                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5294         else
5295                 changed = hci_dev_test_and_clear_flag(hdev,
5296                                                       HCI_KEEP_DEBUG_KEYS);
5297
5298         if (cp->val == 0x02)
5299                 use_changed = !hci_dev_test_and_set_flag(hdev,
5300                                                          HCI_USE_DEBUG_KEYS);
5301         else
5302                 use_changed = hci_dev_test_and_clear_flag(hdev,
5303                                                           HCI_USE_DEBUG_KEYS);
5304
5305         if (hdev_is_powered(hdev) && use_changed &&
5306             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5307                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5308                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5309                              sizeof(mode), &mode);
5310         }
5311
5312         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5313         if (err < 0)
5314                 goto unlock;
5315
5316         if (changed)
5317                 err = new_settings(hdev, sk);
5318
5319 unlock:
5320         hci_dev_unlock(hdev);
5321         return err;
5322 }
5323
5324 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5325                        u16 len)
5326 {
5327         struct mgmt_cp_set_privacy *cp = cp_data;
5328         bool changed;
5329         int err;
5330
5331         BT_DBG("request for %s", hdev->name);
5332
5333         if (!lmp_le_capable(hdev))
5334                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5335                                        MGMT_STATUS_NOT_SUPPORTED);
5336
5337         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5339                                        MGMT_STATUS_INVALID_PARAMS);
5340
5341         if (hdev_is_powered(hdev))
5342                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5343                                        MGMT_STATUS_REJECTED);
5344
5345         hci_dev_lock(hdev);
5346
5347         /* If user space supports this command it is also expected to
5348          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5349          */
5350         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5351
5352         if (cp->privacy) {
5353                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5354                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5355                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5356         } else {
5357                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5358                 memset(hdev->irk, 0, sizeof(hdev->irk));
5359                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5360         }
5361
5362         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5363         if (err < 0)
5364                 goto unlock;
5365
5366         if (changed)
5367                 err = new_settings(hdev, sk);
5368
5369 unlock:
5370         hci_dev_unlock(hdev);
5371         return err;
5372 }
5373
5374 static bool irk_is_valid(struct mgmt_irk_info *irk)
5375 {
5376         switch (irk->addr.type) {
5377         case BDADDR_LE_PUBLIC:
5378                 return true;
5379
5380         case BDADDR_LE_RANDOM:
5381                 /* Two most significant bits shall be set */
5382                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5383                         return false;
5384                 return true;
5385         }
5386
5387         return false;
5388 }
5389
5390 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5391                      u16 len)
5392 {
5393         struct mgmt_cp_load_irks *cp = cp_data;
5394         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5395                                    sizeof(struct mgmt_irk_info));
5396         u16 irk_count, expected_len;
5397         int i, err;
5398
5399         BT_DBG("request for %s", hdev->name);
5400
5401         if (!lmp_le_capable(hdev))
5402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5403                                        MGMT_STATUS_NOT_SUPPORTED);
5404
5405         irk_count = __le16_to_cpu(cp->irk_count);
5406         if (irk_count > max_irk_count) {
5407                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5408                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5409                                        MGMT_STATUS_INVALID_PARAMS);
5410         }
5411
5412         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5413         if (expected_len != len) {
5414                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5415                        expected_len, len);
5416                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5417                                        MGMT_STATUS_INVALID_PARAMS);
5418         }
5419
5420         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5421
5422         for (i = 0; i < irk_count; i++) {
5423                 struct mgmt_irk_info *key = &cp->irks[i];
5424
5425                 if (!irk_is_valid(key))
5426                         return mgmt_cmd_status(sk, hdev->id,
5427                                                MGMT_OP_LOAD_IRKS,
5428                                                MGMT_STATUS_INVALID_PARAMS);
5429         }
5430
5431         hci_dev_lock(hdev);
5432
5433         hci_smp_irks_clear(hdev);
5434
5435         for (i = 0; i < irk_count; i++) {
5436                 struct mgmt_irk_info *irk = &cp->irks[i];
5437                 u8 addr_type;
5438
5439                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5440                         addr_type = ADDR_LE_DEV_PUBLIC;
5441                 else
5442                         addr_type = ADDR_LE_DEV_RANDOM;
5443
5444                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5445                             BDADDR_ANY);
5446         }
5447
5448         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5449
5450         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5451
5452         hci_dev_unlock(hdev);
5453
5454         return err;
5455 }
5456
5457 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5458 {
5459         if (key->master != 0x00 && key->master != 0x01)
5460                 return false;
5461
5462         switch (key->addr.type) {
5463         case BDADDR_LE_PUBLIC:
5464                 return true;
5465
5466         case BDADDR_LE_RANDOM:
5467                 /* Two most significant bits shall be set */
5468                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5469                         return false;
5470                 return true;
5471         }
5472
5473         return false;
5474 }
5475
5476 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5477                                void *cp_data, u16 len)
5478 {
5479         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5480         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5481                                    sizeof(struct mgmt_ltk_info));
5482         u16 key_count, expected_len;
5483         int i, err;
5484
5485         BT_DBG("request for %s", hdev->name);
5486
5487         if (!lmp_le_capable(hdev))
5488                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5489                                        MGMT_STATUS_NOT_SUPPORTED);
5490
5491         key_count = __le16_to_cpu(cp->key_count);
5492         if (key_count > max_key_count) {
5493                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5494                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5495                                        MGMT_STATUS_INVALID_PARAMS);
5496         }
5497
5498         expected_len = sizeof(*cp) + key_count *
5499                                         sizeof(struct mgmt_ltk_info);
5500         if (expected_len != len) {
5501                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5502                        expected_len, len);
5503                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5504                                        MGMT_STATUS_INVALID_PARAMS);
5505         }
5506
5507         BT_DBG("%s key_count %u", hdev->name, key_count);
5508
5509         for (i = 0; i < key_count; i++) {
5510                 struct mgmt_ltk_info *key = &cp->keys[i];
5511
5512                 if (!ltk_is_valid(key))
5513                         return mgmt_cmd_status(sk, hdev->id,
5514                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5515                                                MGMT_STATUS_INVALID_PARAMS);
5516         }
5517
5518         hci_dev_lock(hdev);
5519
5520         hci_smp_ltks_clear(hdev);
5521
5522         for (i = 0; i < key_count; i++) {
5523                 struct mgmt_ltk_info *key = &cp->keys[i];
5524                 u8 type, addr_type, authenticated;
5525
5526                 if (key->addr.type == BDADDR_LE_PUBLIC)
5527                         addr_type = ADDR_LE_DEV_PUBLIC;
5528                 else
5529                         addr_type = ADDR_LE_DEV_RANDOM;
5530
5531                 switch (key->type) {
5532                 case MGMT_LTK_UNAUTHENTICATED:
5533                         authenticated = 0x00;
5534                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5535                         break;
5536                 case MGMT_LTK_AUTHENTICATED:
5537                         authenticated = 0x01;
5538                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5539                         break;
5540                 case MGMT_LTK_P256_UNAUTH:
5541                         authenticated = 0x00;
5542                         type = SMP_LTK_P256;
5543                         break;
5544                 case MGMT_LTK_P256_AUTH:
5545                         authenticated = 0x01;
5546                         type = SMP_LTK_P256;
5547                         break;
5548                 case MGMT_LTK_P256_DEBUG:
5549                         authenticated = 0x00;
5550                         type = SMP_LTK_P256_DEBUG;
5551                 default:
5552                         continue;
5553                 }
5554
5555                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5556                             authenticated, key->val, key->enc_size, key->ediv,
5557                             key->rand);
5558         }
5559
5560         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5561                            NULL, 0);
5562
5563         hci_dev_unlock(hdev);
5564
5565         return err;
5566 }
5567
5568 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5569 {
5570         struct hci_conn *conn = cmd->user_data;
5571         struct mgmt_rp_get_conn_info rp;
5572         int err;
5573
5574         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5575
5576         if (status == MGMT_STATUS_SUCCESS) {
5577                 rp.rssi = conn->rssi;
5578                 rp.tx_power = conn->tx_power;
5579                 rp.max_tx_power = conn->max_tx_power;
5580         } else {
5581                 rp.rssi = HCI_RSSI_INVALID;
5582                 rp.tx_power = HCI_TX_POWER_INVALID;
5583                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5584         }
5585
5586         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5587                                 status, &rp, sizeof(rp));
5588
5589         hci_conn_drop(conn);
5590         hci_conn_put(conn);
5591
5592         return err;
5593 }
5594
5595 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5596                                        u16 opcode)
5597 {
5598         struct hci_cp_read_rssi *cp;
5599         struct mgmt_pending_cmd *cmd;
5600         struct hci_conn *conn;
5601         u16 handle;
5602         u8 status;
5603
5604         BT_DBG("status 0x%02x", hci_status);
5605
5606         hci_dev_lock(hdev);
5607
5608         /* Commands sent in request are either Read RSSI or Read Transmit Power
5609          * Level so we check which one was last sent to retrieve connection
5610          * handle.  Both commands have handle as first parameter so it's safe to
5611          * cast data on the same command struct.
5612          *
5613          * First command sent is always Read RSSI and we fail only if it fails.
5614          * In other case we simply override error to indicate success as we
5615          * already remembered if TX power value is actually valid.
5616          */
5617         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5618         if (!cp) {
5619                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5620                 status = MGMT_STATUS_SUCCESS;
5621         } else {
5622                 status = mgmt_status(hci_status);
5623         }
5624
5625         if (!cp) {
5626                 BT_ERR("invalid sent_cmd in conn_info response");
5627                 goto unlock;
5628         }
5629
5630         handle = __le16_to_cpu(cp->handle);
5631         conn = hci_conn_hash_lookup_handle(hdev, handle);
5632         if (!conn) {
5633                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5634                 goto unlock;
5635         }
5636
5637         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5638         if (!cmd)
5639                 goto unlock;
5640
5641         cmd->cmd_complete(cmd, status);
5642         mgmt_pending_remove(cmd);
5643
5644 unlock:
5645         hci_dev_unlock(hdev);
5646 }
5647
5648 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5649                          u16 len)
5650 {
5651         struct mgmt_cp_get_conn_info *cp = data;
5652         struct mgmt_rp_get_conn_info rp;
5653         struct hci_conn *conn;
5654         unsigned long conn_info_age;
5655         int err = 0;
5656
5657         BT_DBG("%s", hdev->name);
5658
5659         memset(&rp, 0, sizeof(rp));
5660         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5661         rp.addr.type = cp->addr.type;
5662
5663         if (!bdaddr_type_is_valid(cp->addr.type))
5664                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5665                                          MGMT_STATUS_INVALID_PARAMS,
5666                                          &rp, sizeof(rp));
5667
5668         hci_dev_lock(hdev);
5669
5670         if (!hdev_is_powered(hdev)) {
5671                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5672                                         MGMT_STATUS_NOT_POWERED, &rp,
5673                                         sizeof(rp));
5674                 goto unlock;
5675         }
5676
5677         if (cp->addr.type == BDADDR_BREDR)
5678                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5679                                                &cp->addr.bdaddr);
5680         else
5681                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5682
5683         if (!conn || conn->state != BT_CONNECTED) {
5684                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5685                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5686                                         sizeof(rp));
5687                 goto unlock;
5688         }
5689
5690         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5691                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5692                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5693                 goto unlock;
5694         }
5695
5696         /* To avoid client trying to guess when to poll again for information we
5697          * calculate conn info age as random value between min/max set in hdev.
5698          */
5699         conn_info_age = hdev->conn_info_min_age +
5700                         prandom_u32_max(hdev->conn_info_max_age -
5701                                         hdev->conn_info_min_age);
5702
5703         /* Query controller to refresh cached values if they are too old or were
5704          * never read.
5705          */
5706         if (time_after(jiffies, conn->conn_info_timestamp +
5707                        msecs_to_jiffies(conn_info_age)) ||
5708             !conn->conn_info_timestamp) {
5709                 struct hci_request req;
5710                 struct hci_cp_read_tx_power req_txp_cp;
5711                 struct hci_cp_read_rssi req_rssi_cp;
5712                 struct mgmt_pending_cmd *cmd;
5713
5714                 hci_req_init(&req, hdev);
5715                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5716                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5717                             &req_rssi_cp);
5718
5719                 /* For LE links TX power does not change thus we don't need to
5720                  * query for it once value is known.
5721                  */
5722                 if (!bdaddr_type_is_le(cp->addr.type) ||
5723                     conn->tx_power == HCI_TX_POWER_INVALID) {
5724                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5725                         req_txp_cp.type = 0x00;
5726                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5727                                     sizeof(req_txp_cp), &req_txp_cp);
5728                 }
5729
5730                 /* Max TX power needs to be read only once per connection */
5731                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5732                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5733                         req_txp_cp.type = 0x01;
5734                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5735                                     sizeof(req_txp_cp), &req_txp_cp);
5736                 }
5737
5738                 err = hci_req_run(&req, conn_info_refresh_complete);
5739                 if (err < 0)
5740                         goto unlock;
5741
5742                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5743                                        data, len);
5744                 if (!cmd) {
5745                         err = -ENOMEM;
5746                         goto unlock;
5747                 }
5748
5749                 hci_conn_hold(conn);
5750                 cmd->user_data = hci_conn_get(conn);
5751                 cmd->cmd_complete = conn_info_cmd_complete;
5752
5753                 conn->conn_info_timestamp = jiffies;
5754         } else {
5755                 /* Cache is valid, just reply with values cached in hci_conn */
5756                 rp.rssi = conn->rssi;
5757                 rp.tx_power = conn->tx_power;
5758                 rp.max_tx_power = conn->max_tx_power;
5759
5760                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5761                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5762         }
5763
5764 unlock:
5765         hci_dev_unlock(hdev);
5766         return err;
5767 }
5768
5769 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5770 {
5771         struct hci_conn *conn = cmd->user_data;
5772         struct mgmt_rp_get_clock_info rp;
5773         struct hci_dev *hdev;
5774         int err;
5775
5776         memset(&rp, 0, sizeof(rp));
5777         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5778
5779         if (status)
5780                 goto complete;
5781
5782         hdev = hci_dev_get(cmd->index);
5783         if (hdev) {
5784                 rp.local_clock = cpu_to_le32(hdev->clock);
5785                 hci_dev_put(hdev);
5786         }
5787
5788         if (conn) {
5789                 rp.piconet_clock = cpu_to_le32(conn->clock);
5790                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5791         }
5792
5793 complete:
5794         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5795                                 sizeof(rp));
5796
5797         if (conn) {
5798                 hci_conn_drop(conn);
5799                 hci_conn_put(conn);
5800         }
5801
5802         return err;
5803 }
5804
5805 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5806 {
5807         struct hci_cp_read_clock *hci_cp;
5808         struct mgmt_pending_cmd *cmd;
5809         struct hci_conn *conn;
5810
5811         BT_DBG("%s status %u", hdev->name, status);
5812
5813         hci_dev_lock(hdev);
5814
5815         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5816         if (!hci_cp)
5817                 goto unlock;
5818
5819         if (hci_cp->which) {
5820                 u16 handle = __le16_to_cpu(hci_cp->handle);
5821                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5822         } else {
5823                 conn = NULL;
5824         }
5825
5826         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5827         if (!cmd)
5828                 goto unlock;
5829
5830         cmd->cmd_complete(cmd, mgmt_status(status));
5831         mgmt_pending_remove(cmd);
5832
5833 unlock:
5834         hci_dev_unlock(hdev);
5835 }
5836
5837 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5838                          u16 len)
5839 {
5840         struct mgmt_cp_get_clock_info *cp = data;
5841         struct mgmt_rp_get_clock_info rp;
5842         struct hci_cp_read_clock hci_cp;
5843         struct mgmt_pending_cmd *cmd;
5844         struct hci_request req;
5845         struct hci_conn *conn;
5846         int err;
5847
5848         BT_DBG("%s", hdev->name);
5849
5850         memset(&rp, 0, sizeof(rp));
5851         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5852         rp.addr.type = cp->addr.type;
5853
5854         if (cp->addr.type != BDADDR_BREDR)
5855                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5856                                          MGMT_STATUS_INVALID_PARAMS,
5857                                          &rp, sizeof(rp));
5858
5859         hci_dev_lock(hdev);
5860
5861         if (!hdev_is_powered(hdev)) {
5862                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5863                                         MGMT_STATUS_NOT_POWERED, &rp,
5864                                         sizeof(rp));
5865                 goto unlock;
5866         }
5867
5868         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5869                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5870                                                &cp->addr.bdaddr);
5871                 if (!conn || conn->state != BT_CONNECTED) {
5872                         err = mgmt_cmd_complete(sk, hdev->id,
5873                                                 MGMT_OP_GET_CLOCK_INFO,
5874                                                 MGMT_STATUS_NOT_CONNECTED,
5875                                                 &rp, sizeof(rp));
5876                         goto unlock;
5877                 }
5878         } else {
5879                 conn = NULL;
5880         }
5881
5882         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5883         if (!cmd) {
5884                 err = -ENOMEM;
5885                 goto unlock;
5886         }
5887
5888         cmd->cmd_complete = clock_info_cmd_complete;
5889
5890         hci_req_init(&req, hdev);
5891
5892         memset(&hci_cp, 0, sizeof(hci_cp));
5893         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5894
5895         if (conn) {
5896                 hci_conn_hold(conn);
5897                 cmd->user_data = hci_conn_get(conn);
5898
5899                 hci_cp.handle = cpu_to_le16(conn->handle);
5900                 hci_cp.which = 0x01; /* Piconet clock */
5901                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5902         }
5903
5904         err = hci_req_run(&req, get_clock_info_complete);
5905         if (err < 0)
5906                 mgmt_pending_remove(cmd);
5907
5908 unlock:
5909         hci_dev_unlock(hdev);
5910         return err;
5911 }
5912
5913 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5914 {
5915         struct hci_conn *conn;
5916
5917         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5918         if (!conn)
5919                 return false;
5920
5921         if (conn->dst_type != type)
5922                 return false;
5923
5924         if (conn->state != BT_CONNECTED)
5925                 return false;
5926
5927         return true;
5928 }
5929
5930 /* This function requires the caller holds hdev->lock */
5931 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5932                                u8 addr_type, u8 auto_connect)
5933 {
5934         struct hci_dev *hdev = req->hdev;
5935         struct hci_conn_params *params;
5936
5937         params = hci_conn_params_add(hdev, addr, addr_type);
5938         if (!params)
5939                 return -EIO;
5940
5941         if (params->auto_connect == auto_connect)
5942                 return 0;
5943
5944         list_del_init(&params->action);
5945
5946         switch (auto_connect) {
5947         case HCI_AUTO_CONN_DISABLED:
5948         case HCI_AUTO_CONN_LINK_LOSS:
5949                 __hci_update_background_scan(req);
5950                 break;
5951         case HCI_AUTO_CONN_REPORT:
5952                 list_add(&params->action, &hdev->pend_le_reports);
5953                 __hci_update_background_scan(req);
5954                 break;
5955         case HCI_AUTO_CONN_DIRECT:
5956         case HCI_AUTO_CONN_ALWAYS:
5957                 if (!is_connected(hdev, addr, addr_type)) {
5958                         list_add(&params->action, &hdev->pend_le_conns);
5959                         __hci_update_background_scan(req);
5960                 }
5961                 break;
5962         }
5963
5964         params->auto_connect = auto_connect;
5965
5966         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5967                auto_connect);
5968
5969         return 0;
5970 }
5971
5972 static void device_added(struct sock *sk, struct hci_dev *hdev,
5973                          bdaddr_t *bdaddr, u8 type, u8 action)
5974 {
5975         struct mgmt_ev_device_added ev;
5976
5977         bacpy(&ev.addr.bdaddr, bdaddr);
5978         ev.addr.type = type;
5979         ev.action = action;
5980
5981         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5982 }
5983
5984 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5985 {
5986         struct mgmt_pending_cmd *cmd;
5987
5988         BT_DBG("status 0x%02x", status);
5989
5990         hci_dev_lock(hdev);
5991
5992         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5993         if (!cmd)
5994                 goto unlock;
5995
5996         cmd->cmd_complete(cmd, mgmt_status(status));
5997         mgmt_pending_remove(cmd);
5998
5999 unlock:
6000         hci_dev_unlock(hdev);
6001 }
6002
6003 static int add_device(struct sock *sk, struct hci_dev *hdev,
6004                       void *data, u16 len)
6005 {
6006         struct mgmt_cp_add_device *cp = data;
6007         struct mgmt_pending_cmd *cmd;
6008         struct hci_request req;
6009         u8 auto_conn, addr_type;
6010         int err;
6011
6012         BT_DBG("%s", hdev->name);
6013
6014         if (!bdaddr_type_is_valid(cp->addr.type) ||
6015             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6016                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6017                                          MGMT_STATUS_INVALID_PARAMS,
6018                                          &cp->addr, sizeof(cp->addr));
6019
6020         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6021                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6022                                          MGMT_STATUS_INVALID_PARAMS,
6023                                          &cp->addr, sizeof(cp->addr));
6024
6025         hci_req_init(&req, hdev);
6026
6027         hci_dev_lock(hdev);
6028
6029         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6030         if (!cmd) {
6031                 err = -ENOMEM;
6032                 goto unlock;
6033         }
6034
6035         cmd->cmd_complete = addr_cmd_complete;
6036
6037         if (cp->addr.type == BDADDR_BREDR) {
6038                 /* Only incoming connections action is supported for now */
6039                 if (cp->action != 0x01) {
6040                         err = cmd->cmd_complete(cmd,
6041                                                 MGMT_STATUS_INVALID_PARAMS);
6042                         mgmt_pending_remove(cmd);
6043                         goto unlock;
6044                 }
6045
6046                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6047                                           cp->addr.type);
6048                 if (err)
6049                         goto unlock;
6050
6051                 __hci_update_page_scan(&req);
6052
6053                 goto added;
6054         }
6055
6056         if (cp->addr.type == BDADDR_LE_PUBLIC)
6057                 addr_type = ADDR_LE_DEV_PUBLIC;
6058         else
6059                 addr_type = ADDR_LE_DEV_RANDOM;
6060
6061         if (cp->action == 0x02)
6062                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6063         else if (cp->action == 0x01)
6064                 auto_conn = HCI_AUTO_CONN_DIRECT;
6065         else
6066                 auto_conn = HCI_AUTO_CONN_REPORT;
6067
6068         /* If the connection parameters don't exist for this device,
6069          * they will be created and configured with defaults.
6070          */
6071         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
6072                                 auto_conn) < 0) {
6073                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
6074                 mgmt_pending_remove(cmd);
6075                 goto unlock;
6076         }
6077
6078 added:
6079         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6080
6081         err = hci_req_run(&req, add_device_complete);
6082         if (err < 0) {
6083                 /* ENODATA means no HCI commands were needed (e.g. if
6084                  * the adapter is powered off).
6085                  */
6086                 if (err == -ENODATA)
6087                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6088                 mgmt_pending_remove(cmd);
6089         }
6090
6091 unlock:
6092         hci_dev_unlock(hdev);
6093         return err;
6094 }
6095
6096 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6097                            bdaddr_t *bdaddr, u8 type)
6098 {
6099         struct mgmt_ev_device_removed ev;
6100
6101         bacpy(&ev.addr.bdaddr, bdaddr);
6102         ev.addr.type = type;
6103
6104         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6105 }
6106
6107 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6108 {
6109         struct mgmt_pending_cmd *cmd;
6110
6111         BT_DBG("status 0x%02x", status);
6112
6113         hci_dev_lock(hdev);
6114
6115         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6116         if (!cmd)
6117                 goto unlock;
6118
6119         cmd->cmd_complete(cmd, mgmt_status(status));
6120         mgmt_pending_remove(cmd);
6121
6122 unlock:
6123         hci_dev_unlock(hdev);
6124 }
6125
6126 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6127                          void *data, u16 len)
6128 {
6129         struct mgmt_cp_remove_device *cp = data;
6130         struct mgmt_pending_cmd *cmd;
6131         struct hci_request req;
6132         int err;
6133
6134         BT_DBG("%s", hdev->name);
6135
6136         hci_req_init(&req, hdev);
6137
6138         hci_dev_lock(hdev);
6139
6140         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6141         if (!cmd) {
6142                 err = -ENOMEM;
6143                 goto unlock;
6144         }
6145
6146         cmd->cmd_complete = addr_cmd_complete;
6147
6148         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6149                 struct hci_conn_params *params;
6150                 u8 addr_type;
6151
6152                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6153                         err = cmd->cmd_complete(cmd,
6154                                                 MGMT_STATUS_INVALID_PARAMS);
6155                         mgmt_pending_remove(cmd);
6156                         goto unlock;
6157                 }
6158
6159                 if (cp->addr.type == BDADDR_BREDR) {
6160                         err = hci_bdaddr_list_del(&hdev->whitelist,
6161                                                   &cp->addr.bdaddr,
6162                                                   cp->addr.type);
6163                         if (err) {
6164                                 err = cmd->cmd_complete(cmd,
6165                                                         MGMT_STATUS_INVALID_PARAMS);
6166                                 mgmt_pending_remove(cmd);
6167                                 goto unlock;
6168                         }
6169
6170                         __hci_update_page_scan(&req);
6171
6172                         device_removed(sk, hdev, &cp->addr.bdaddr,
6173                                        cp->addr.type);
6174                         goto complete;
6175                 }
6176
6177                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6178                         addr_type = ADDR_LE_DEV_PUBLIC;
6179                 else
6180                         addr_type = ADDR_LE_DEV_RANDOM;
6181
6182                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6183                                                 addr_type);
6184                 if (!params) {
6185                         err = cmd->cmd_complete(cmd,
6186                                                 MGMT_STATUS_INVALID_PARAMS);
6187                         mgmt_pending_remove(cmd);
6188                         goto unlock;
6189                 }
6190
6191                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
6192                         err = cmd->cmd_complete(cmd,
6193                                                 MGMT_STATUS_INVALID_PARAMS);
6194                         mgmt_pending_remove(cmd);
6195                         goto unlock;
6196                 }
6197
6198                 list_del(&params->action);
6199                 list_del(&params->list);
6200                 kfree(params);
6201                 __hci_update_background_scan(&req);
6202
6203                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6204         } else {
6205                 struct hci_conn_params *p, *tmp;
6206                 struct bdaddr_list *b, *btmp;
6207
6208                 if (cp->addr.type) {
6209                         err = cmd->cmd_complete(cmd,
6210                                                 MGMT_STATUS_INVALID_PARAMS);
6211                         mgmt_pending_remove(cmd);
6212                         goto unlock;
6213                 }
6214
6215                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6216                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6217                         list_del(&b->list);
6218                         kfree(b);
6219                 }
6220
6221                 __hci_update_page_scan(&req);
6222
6223                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6224                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6225                                 continue;
6226                         device_removed(sk, hdev, &p->addr, p->addr_type);
6227                         list_del(&p->action);
6228                         list_del(&p->list);
6229                         kfree(p);
6230                 }
6231
6232                 BT_DBG("All LE connection parameters were removed");
6233
6234                 __hci_update_background_scan(&req);
6235         }
6236
6237 complete:
6238         err = hci_req_run(&req, remove_device_complete);
6239         if (err < 0) {
6240                 /* ENODATA means no HCI commands were needed (e.g. if
6241                  * the adapter is powered off).
6242                  */
6243                 if (err == -ENODATA)
6244                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6245                 mgmt_pending_remove(cmd);
6246         }
6247
6248 unlock:
6249         hci_dev_unlock(hdev);
6250         return err;
6251 }
6252
6253 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6254                            u16 len)
6255 {
6256         struct mgmt_cp_load_conn_param *cp = data;
6257         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6258                                      sizeof(struct mgmt_conn_param));
6259         u16 param_count, expected_len;
6260         int i;
6261
6262         if (!lmp_le_capable(hdev))
6263                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6264                                        MGMT_STATUS_NOT_SUPPORTED);
6265
6266         param_count = __le16_to_cpu(cp->param_count);
6267         if (param_count > max_param_count) {
6268                 BT_ERR("load_conn_param: too big param_count value %u",
6269                        param_count);
6270                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6271                                        MGMT_STATUS_INVALID_PARAMS);
6272         }
6273
6274         expected_len = sizeof(*cp) + param_count *
6275                                         sizeof(struct mgmt_conn_param);
6276         if (expected_len != len) {
6277                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6278                        expected_len, len);
6279                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6280                                        MGMT_STATUS_INVALID_PARAMS);
6281         }
6282
6283         BT_DBG("%s param_count %u", hdev->name, param_count);
6284
6285         hci_dev_lock(hdev);
6286
6287         hci_conn_params_clear_disabled(hdev);
6288
6289         for (i = 0; i < param_count; i++) {
6290                 struct mgmt_conn_param *param = &cp->params[i];
6291                 struct hci_conn_params *hci_param;
6292                 u16 min, max, latency, timeout;
6293                 u8 addr_type;
6294
6295                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6296                        param->addr.type);
6297
6298                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6299                         addr_type = ADDR_LE_DEV_PUBLIC;
6300                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6301                         addr_type = ADDR_LE_DEV_RANDOM;
6302                 } else {
6303                         BT_ERR("Ignoring invalid connection parameters");
6304                         continue;
6305                 }
6306
6307                 min = le16_to_cpu(param->min_interval);
6308                 max = le16_to_cpu(param->max_interval);
6309                 latency = le16_to_cpu(param->latency);
6310                 timeout = le16_to_cpu(param->timeout);
6311
6312                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6313                        min, max, latency, timeout);
6314
6315                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6316                         BT_ERR("Ignoring invalid connection parameters");
6317                         continue;
6318                 }
6319
6320                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6321                                                 addr_type);
6322                 if (!hci_param) {
6323                         BT_ERR("Failed to add connection parameters");
6324                         continue;
6325                 }
6326
6327                 hci_param->conn_min_interval = min;
6328                 hci_param->conn_max_interval = max;
6329                 hci_param->conn_latency = latency;
6330                 hci_param->supervision_timeout = timeout;
6331         }
6332
6333         hci_dev_unlock(hdev);
6334
6335         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6336                                  NULL, 0);
6337 }
6338
6339 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6340                                void *data, u16 len)
6341 {
6342         struct mgmt_cp_set_external_config *cp = data;
6343         bool changed;
6344         int err;
6345
6346         BT_DBG("%s", hdev->name);
6347
6348         if (hdev_is_powered(hdev))
6349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6350                                        MGMT_STATUS_REJECTED);
6351
6352         if (cp->config != 0x00 && cp->config != 0x01)
6353                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6354                                          MGMT_STATUS_INVALID_PARAMS);
6355
6356         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6358                                        MGMT_STATUS_NOT_SUPPORTED);
6359
6360         hci_dev_lock(hdev);
6361
6362         if (cp->config)
6363                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6364         else
6365                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6366
6367         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6368         if (err < 0)
6369                 goto unlock;
6370
6371         if (!changed)
6372                 goto unlock;
6373
6374         err = new_options(hdev, sk);
6375
6376         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6377                 mgmt_index_removed(hdev);
6378
6379                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6380                         hci_dev_set_flag(hdev, HCI_CONFIG);
6381                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6382
6383                         queue_work(hdev->req_workqueue, &hdev->power_on);
6384                 } else {
6385                         set_bit(HCI_RAW, &hdev->flags);
6386                         mgmt_index_added(hdev);
6387                 }
6388         }
6389
6390 unlock:
6391         hci_dev_unlock(hdev);
6392         return err;
6393 }
6394
6395 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6396                               void *data, u16 len)
6397 {
6398         struct mgmt_cp_set_public_address *cp = data;
6399         bool changed;
6400         int err;
6401
6402         BT_DBG("%s", hdev->name);
6403
6404         if (hdev_is_powered(hdev))
6405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6406                                        MGMT_STATUS_REJECTED);
6407
6408         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6409                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6410                                        MGMT_STATUS_INVALID_PARAMS);
6411
6412         if (!hdev->set_bdaddr)
6413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6414                                        MGMT_STATUS_NOT_SUPPORTED);
6415
6416         hci_dev_lock(hdev);
6417
6418         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6419         bacpy(&hdev->public_addr, &cp->bdaddr);
6420
6421         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6422         if (err < 0)
6423                 goto unlock;
6424
6425         if (!changed)
6426                 goto unlock;
6427
6428         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6429                 err = new_options(hdev, sk);
6430
6431         if (is_configured(hdev)) {
6432                 mgmt_index_removed(hdev);
6433
6434                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6435
6436                 hci_dev_set_flag(hdev, HCI_CONFIG);
6437                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6438
6439                 queue_work(hdev->req_workqueue, &hdev->power_on);
6440         }
6441
6442 unlock:
6443         hci_dev_unlock(hdev);
6444         return err;
6445 }
6446
6447 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6448                                   u8 data_len)
6449 {
6450         eir[eir_len++] = sizeof(type) + data_len;
6451         eir[eir_len++] = type;
6452         memcpy(&eir[eir_len], data, data_len);
6453         eir_len += data_len;
6454
6455         return eir_len;
6456 }
6457
6458 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6459                                              u16 opcode, struct sk_buff *skb)
6460 {
6461         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6462         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6463         u8 *h192, *r192, *h256, *r256;
6464         struct mgmt_pending_cmd *cmd;
6465         u16 eir_len;
6466         int err;
6467
6468         BT_DBG("%s status %u", hdev->name, status);
6469
6470         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6471         if (!cmd)
6472                 return;
6473
6474         mgmt_cp = cmd->param;
6475
6476         if (status) {
6477                 status = mgmt_status(status);
6478                 eir_len = 0;
6479
6480                 h192 = NULL;
6481                 r192 = NULL;
6482                 h256 = NULL;
6483                 r256 = NULL;
6484         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6485                 struct hci_rp_read_local_oob_data *rp;
6486
6487                 if (skb->len != sizeof(*rp)) {
6488                         status = MGMT_STATUS_FAILED;
6489                         eir_len = 0;
6490                 } else {
6491                         status = MGMT_STATUS_SUCCESS;
6492                         rp = (void *)skb->data;
6493
6494                         eir_len = 5 + 18 + 18;
6495                         h192 = rp->hash;
6496                         r192 = rp->rand;
6497                         h256 = NULL;
6498                         r256 = NULL;
6499                 }
6500         } else {
6501                 struct hci_rp_read_local_oob_ext_data *rp;
6502
6503                 if (skb->len != sizeof(*rp)) {
6504                         status = MGMT_STATUS_FAILED;
6505                         eir_len = 0;
6506                 } else {
6507                         status = MGMT_STATUS_SUCCESS;
6508                         rp = (void *)skb->data;
6509
6510                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6511                                 eir_len = 5 + 18 + 18;
6512                                 h192 = NULL;
6513                                 r192 = NULL;
6514                         } else {
6515                                 eir_len = 5 + 18 + 18 + 18 + 18;
6516                                 h192 = rp->hash192;
6517                                 r192 = rp->rand192;
6518                         }
6519
6520                         h256 = rp->hash256;
6521                         r256 = rp->rand256;
6522                 }
6523         }
6524
6525         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6526         if (!mgmt_rp)
6527                 goto done;
6528
6529         if (status)
6530                 goto send_rsp;
6531
6532         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6533                                   hdev->dev_class, 3);
6534
6535         if (h192 && r192) {
6536                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6537                                           EIR_SSP_HASH_C192, h192, 16);
6538                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6539                                           EIR_SSP_RAND_R192, r192, 16);
6540         }
6541
6542         if (h256 && r256) {
6543                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6544                                           EIR_SSP_HASH_C256, h256, 16);
6545                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6546                                           EIR_SSP_RAND_R256, r256, 16);
6547         }
6548
6549 send_rsp:
6550         mgmt_rp->type = mgmt_cp->type;
6551         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6552
6553         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6554                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6555                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6556         if (err < 0 || status)
6557                 goto done;
6558
6559         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6560
6561         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6562                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6563                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6564 done:
6565         kfree(mgmt_rp);
6566         mgmt_pending_remove(cmd);
6567 }
6568
6569 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6570                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6571 {
6572         struct mgmt_pending_cmd *cmd;
6573         struct hci_request req;
6574         int err;
6575
6576         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6577                                cp, sizeof(*cp));
6578         if (!cmd)
6579                 return -ENOMEM;
6580
6581         hci_req_init(&req, hdev);
6582
6583         if (bredr_sc_enabled(hdev))
6584                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6585         else
6586                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6587
6588         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6589         if (err < 0) {
6590                 mgmt_pending_remove(cmd);
6591                 return err;
6592         }
6593
6594         return 0;
6595 }
6596
6597 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6598                                    void *data, u16 data_len)
6599 {
6600         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6601         struct mgmt_rp_read_local_oob_ext_data *rp;
6602         size_t rp_len;
6603         u16 eir_len;
6604         u8 status, flags, role, addr[7], hash[16], rand[16];
6605         int err;
6606
6607         BT_DBG("%s", hdev->name);
6608
6609         if (hdev_is_powered(hdev)) {
6610                 switch (cp->type) {
6611                 case BIT(BDADDR_BREDR):
6612                         status = mgmt_bredr_support(hdev);
6613                         if (status)
6614                                 eir_len = 0;
6615                         else
6616                                 eir_len = 5;
6617                         break;
6618                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6619                         status = mgmt_le_support(hdev);
6620                         if (status)
6621                                 eir_len = 0;
6622                         else
6623                                 eir_len = 9 + 3 + 18 + 18 + 3;
6624                         break;
6625                 default:
6626                         status = MGMT_STATUS_INVALID_PARAMS;
6627                         eir_len = 0;
6628                         break;
6629                 }
6630         } else {
6631                 status = MGMT_STATUS_NOT_POWERED;
6632                 eir_len = 0;
6633         }
6634
6635         rp_len = sizeof(*rp) + eir_len;
6636         rp = kmalloc(rp_len, GFP_ATOMIC);
6637         if (!rp)
6638                 return -ENOMEM;
6639
6640         if (status)
6641                 goto complete;
6642
6643         hci_dev_lock(hdev);
6644
6645         eir_len = 0;
6646         switch (cp->type) {
6647         case BIT(BDADDR_BREDR):
6648                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6649                         err = read_local_ssp_oob_req(hdev, sk, cp);
6650                         hci_dev_unlock(hdev);
6651                         if (!err)
6652                                 goto done;
6653
6654                         status = MGMT_STATUS_FAILED;
6655                         goto complete;
6656                 } else {
6657                         eir_len = eir_append_data(rp->eir, eir_len,
6658                                                   EIR_CLASS_OF_DEV,
6659                                                   hdev->dev_class, 3);
6660                 }
6661                 break;
6662         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6663                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6664                     smp_generate_oob(hdev, hash, rand) < 0) {
6665                         hci_dev_unlock(hdev);
6666                         status = MGMT_STATUS_FAILED;
6667                         goto complete;
6668                 }
6669
6670                 /* This should return the active RPA, but since the RPA
6671                  * is only programmed on demand, it is really hard to fill
6672                  * this in at the moment. For now disallow retrieving
6673                  * local out-of-band data when privacy is in use.
6674                  *
6675                  * Returning the identity address will not help here since
6676                  * pairing happens before the identity resolving key is
6677                  * known and thus the connection establishment happens
6678                  * based on the RPA and not the identity address.
6679                  */
6680                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6681                         hci_dev_unlock(hdev);
6682                         status = MGMT_STATUS_REJECTED;
6683                         goto complete;
6684                 }
6685
6686                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6687                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6688                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6689                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6690                         memcpy(addr, &hdev->static_addr, 6);
6691                         addr[6] = 0x01;
6692                 } else {
6693                         memcpy(addr, &hdev->bdaddr, 6);
6694                         addr[6] = 0x00;
6695                 }
6696
6697                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6698                                           addr, sizeof(addr));
6699
6700                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6701                         role = 0x02;
6702                 else
6703                         role = 0x01;
6704
6705                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6706                                           &role, sizeof(role));
6707
6708                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6709                         eir_len = eir_append_data(rp->eir, eir_len,
6710                                                   EIR_LE_SC_CONFIRM,
6711                                                   hash, sizeof(hash));
6712
6713                         eir_len = eir_append_data(rp->eir, eir_len,
6714                                                   EIR_LE_SC_RANDOM,
6715                                                   rand, sizeof(rand));
6716                 }
6717
6718                 flags = get_adv_discov_flags(hdev);
6719
6720                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6721                         flags |= LE_AD_NO_BREDR;
6722
6723                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6724                                           &flags, sizeof(flags));
6725                 break;
6726         }
6727
6728         hci_dev_unlock(hdev);
6729
6730         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6731
6732         status = MGMT_STATUS_SUCCESS;
6733
6734 complete:
6735         rp->type = cp->type;
6736         rp->eir_len = cpu_to_le16(eir_len);
6737
6738         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6739                                 status, rp, sizeof(*rp) + eir_len);
6740         if (err < 0 || status)
6741                 goto done;
6742
6743         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6744                                  rp, sizeof(*rp) + eir_len,
6745                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6746
6747 done:
6748         kfree(rp);
6749
6750         return err;
6751 }
6752
6753 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6754 {
6755         u32 flags = 0;
6756
6757         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6758         flags |= MGMT_ADV_FLAG_DISCOV;
6759         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6760         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6761
6762         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6763                 flags |= MGMT_ADV_FLAG_TX_POWER;
6764
6765         return flags;
6766 }
6767
6768 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6769                              void *data, u16 data_len)
6770 {
6771         struct mgmt_rp_read_adv_features *rp;
6772         size_t rp_len;
6773         int err, i;
6774         bool instance;
6775         struct adv_info *adv_instance;
6776         u32 supported_flags;
6777
6778         BT_DBG("%s", hdev->name);
6779
6780         if (!lmp_le_capable(hdev))
6781                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6782                                        MGMT_STATUS_REJECTED);
6783
6784         hci_dev_lock(hdev);
6785
6786         rp_len = sizeof(*rp);
6787
6788         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6789         if (instance)
6790                 rp_len += hdev->adv_instance_cnt;
6791
6792         rp = kmalloc(rp_len, GFP_ATOMIC);
6793         if (!rp) {
6794                 hci_dev_unlock(hdev);
6795                 return -ENOMEM;
6796         }
6797
6798         supported_flags = get_supported_adv_flags(hdev);
6799
6800         rp->supported_flags = cpu_to_le32(supported_flags);
6801         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6802         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6803         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6804
6805         if (instance) {
6806                 i = 0;
6807                 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6808                         if (i >= hdev->adv_instance_cnt)
6809                                 break;
6810
6811                         rp->instance[i] = adv_instance->instance;
6812                         i++;
6813                 }
6814                 rp->num_instances = hdev->adv_instance_cnt;
6815         } else {
6816                 rp->num_instances = 0;
6817         }
6818
6819         hci_dev_unlock(hdev);
6820
6821         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6822                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6823
6824         kfree(rp);
6825
6826         return err;
6827 }
6828
6829 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6830                               u8 len, bool is_adv_data)
6831 {
6832         u8 max_len = HCI_MAX_AD_LENGTH;
6833         int i, cur_len;
6834         bool flags_managed = false;
6835         bool tx_power_managed = false;
6836         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6837                            MGMT_ADV_FLAG_MANAGED_FLAGS;
6838
6839         if (is_adv_data && (adv_flags & flags_params)) {
6840                 flags_managed = true;
6841                 max_len -= 3;
6842         }
6843
6844         if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6845                 tx_power_managed = true;
6846                 max_len -= 3;
6847         }
6848
6849         if (len > max_len)
6850                 return false;
6851
6852         /* Make sure that the data is correctly formatted. */
6853         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6854                 cur_len = data[i];
6855
6856                 if (flags_managed && data[i + 1] == EIR_FLAGS)
6857                         return false;
6858
6859                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6860                         return false;
6861
6862                 /* If the current field length would exceed the total data
6863                  * length, then it's invalid.
6864                  */
6865                 if (i + cur_len >= len)
6866                         return false;
6867         }
6868
6869         return true;
6870 }
6871
6872 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6873                                      u16 opcode)
6874 {
6875         struct mgmt_pending_cmd *cmd;
6876         struct mgmt_rp_add_advertising rp;
6877
6878         BT_DBG("status %d", status);
6879
6880         hci_dev_lock(hdev);
6881
6882         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6883
6884         if (status) {
6885                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6886                 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6887                 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6888         }
6889
6890         if (!cmd)
6891                 goto unlock;
6892
6893         rp.instance = 0x01;
6894
6895         if (status)
6896                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6897                                 mgmt_status(status));
6898         else
6899                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6900                                   mgmt_status(status), &rp, sizeof(rp));
6901
6902         mgmt_pending_remove(cmd);
6903
6904 unlock:
6905         hci_dev_unlock(hdev);
6906 }
6907
6908 void mgmt_adv_timeout_expired(struct hci_dev *hdev)
6909 {
6910         hdev->adv_instance_timeout = 0;
6911
6912         hci_dev_lock(hdev);
6913         clear_adv_instance(hdev);
6914         hci_dev_unlock(hdev);
6915 }
6916
6917 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6918                            void *data, u16 data_len)
6919 {
6920         struct mgmt_cp_add_advertising *cp = data;
6921         struct mgmt_rp_add_advertising rp;
6922         u32 flags;
6923         u32 supported_flags;
6924         u8 status;
6925         u16 timeout;
6926         int err;
6927         struct mgmt_pending_cmd *cmd;
6928         struct hci_request req;
6929
6930         BT_DBG("%s", hdev->name);
6931
6932         status = mgmt_le_support(hdev);
6933         if (status)
6934                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6935                                        status);
6936
6937         flags = __le32_to_cpu(cp->flags);
6938         timeout = __le16_to_cpu(cp->timeout);
6939
6940         /* The current implementation only supports adding one instance and only
6941          * a subset of the specified flags.
6942          */
6943         supported_flags = get_supported_adv_flags(hdev);
6944         if (cp->instance != 0x01 || (flags & ~supported_flags))
6945                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6946                                        MGMT_STATUS_INVALID_PARAMS);
6947
6948         hci_dev_lock(hdev);
6949
6950         if (timeout && !hdev_is_powered(hdev)) {
6951                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6952                                       MGMT_STATUS_REJECTED);
6953                 goto unlock;
6954         }
6955
6956         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6957             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6958             pending_find(MGMT_OP_SET_LE, hdev)) {
6959                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6960                                       MGMT_STATUS_BUSY);
6961                 goto unlock;
6962         }
6963
6964         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6965             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6966                                cp->scan_rsp_len, false)) {
6967                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6968                                       MGMT_STATUS_INVALID_PARAMS);
6969                 goto unlock;
6970         }
6971
6972         hdev->adv_instance.flags = flags;
6973         hdev->adv_instance.adv_data_len = cp->adv_data_len;
6974         hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6975
6976         if (cp->adv_data_len)
6977                 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6978
6979         if (cp->scan_rsp_len)
6980                 memcpy(hdev->adv_instance.scan_rsp_data,
6981                        cp->data + cp->adv_data_len, cp->scan_rsp_len);
6982
6983         if (hdev->adv_instance_timeout)
6984                 cancel_delayed_work(&hdev->adv_instance_expire);
6985
6986         hdev->adv_instance_timeout = timeout;
6987
6988         if (timeout)
6989                 queue_delayed_work(hdev->workqueue,
6990                                    &hdev->adv_instance_expire,
6991                                    msecs_to_jiffies(timeout * 1000));
6992
6993         if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6994                 advertising_added(sk, hdev, 1);
6995
6996         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6997          * we have no HCI communication to make. Simply return.
6998          */
6999         if (!hdev_is_powered(hdev) ||
7000             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7001                 rp.instance = 0x01;
7002                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7003                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7004                 goto unlock;
7005         }
7006
7007         /* We're good to go, update advertising data, parameters, and start
7008          * advertising.
7009          */
7010         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7011                                data_len);
7012         if (!cmd) {
7013                 err = -ENOMEM;
7014                 goto unlock;
7015         }
7016
7017         hci_req_init(&req, hdev);
7018
7019         update_adv_data(&req);
7020         update_scan_rsp_data(&req);
7021         enable_advertising(&req);
7022
7023         err = hci_req_run(&req, add_advertising_complete);
7024         if (err < 0)
7025                 mgmt_pending_remove(cmd);
7026
7027 unlock:
7028         hci_dev_unlock(hdev);
7029
7030         return err;
7031 }
7032
7033 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7034                                         u16 opcode)
7035 {
7036         struct mgmt_pending_cmd *cmd;
7037         struct mgmt_rp_remove_advertising rp;
7038
7039         BT_DBG("status %d", status);
7040
7041         hci_dev_lock(hdev);
7042
7043         /* A failure status here only means that we failed to disable
7044          * advertising. Otherwise, the advertising instance has been removed,
7045          * so report success.
7046          */
7047         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7048         if (!cmd)
7049                 goto unlock;
7050
7051         rp.instance = 1;
7052
7053         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7054                           &rp, sizeof(rp));
7055         mgmt_pending_remove(cmd);
7056
7057 unlock:
7058         hci_dev_unlock(hdev);
7059 }
7060
7061 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7062                               void *data, u16 data_len)
7063 {
7064         struct mgmt_cp_remove_advertising *cp = data;
7065         struct mgmt_rp_remove_advertising rp;
7066         int err;
7067         struct mgmt_pending_cmd *cmd;
7068         struct hci_request req;
7069
7070         BT_DBG("%s", hdev->name);
7071
7072         /* The current implementation only allows modifying instance no 1. A
7073          * value of 0 indicates that all instances should be cleared.
7074          */
7075         if (cp->instance > 1)
7076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7077                                        MGMT_STATUS_INVALID_PARAMS);
7078
7079         hci_dev_lock(hdev);
7080
7081         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7082             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7083             pending_find(MGMT_OP_SET_LE, hdev)) {
7084                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7085                                       MGMT_STATUS_BUSY);
7086                 goto unlock;
7087         }
7088
7089         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7090                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7091                                       MGMT_STATUS_INVALID_PARAMS);
7092                 goto unlock;
7093         }
7094
7095         if (hdev->adv_instance_timeout)
7096                 cancel_delayed_work(&hdev->adv_instance_expire);
7097
7098         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
7099
7100         advertising_removed(sk, hdev, 1);
7101
7102         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
7103
7104         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
7105          * we have no HCI communication to make. Simply return.
7106          */
7107         if (!hdev_is_powered(hdev) ||
7108             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7109                 rp.instance = 1;
7110                 err = mgmt_cmd_complete(sk, hdev->id,
7111                                         MGMT_OP_REMOVE_ADVERTISING,
7112                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7113                 goto unlock;
7114         }
7115
7116         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7117                                data_len);
7118         if (!cmd) {
7119                 err = -ENOMEM;
7120                 goto unlock;
7121         }
7122
7123         hci_req_init(&req, hdev);
7124         disable_advertising(&req);
7125
7126         err = hci_req_run(&req, remove_advertising_complete);
7127         if (err < 0)
7128                 mgmt_pending_remove(cmd);
7129
7130 unlock:
7131         hci_dev_unlock(hdev);
7132
7133         return err;
7134 }
7135
7136 static const struct hci_mgmt_handler mgmt_handlers[] = {
7137         { NULL }, /* 0x0000 (no command) */
7138         { read_version,            MGMT_READ_VERSION_SIZE,
7139                                                 HCI_MGMT_NO_HDEV |
7140                                                 HCI_MGMT_UNTRUSTED },
7141         { read_commands,           MGMT_READ_COMMANDS_SIZE,
7142                                                 HCI_MGMT_NO_HDEV |
7143                                                 HCI_MGMT_UNTRUSTED },
7144         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
7145                                                 HCI_MGMT_NO_HDEV |
7146                                                 HCI_MGMT_UNTRUSTED },
7147         { read_controller_info,    MGMT_READ_INFO_SIZE,
7148                                                 HCI_MGMT_UNTRUSTED },
7149         { set_powered,             MGMT_SETTING_SIZE },
7150         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
7151         { set_connectable,         MGMT_SETTING_SIZE },
7152         { set_fast_connectable,    MGMT_SETTING_SIZE },
7153         { set_bondable,            MGMT_SETTING_SIZE },
7154         { set_link_security,       MGMT_SETTING_SIZE },
7155         { set_ssp,                 MGMT_SETTING_SIZE },
7156         { set_hs,                  MGMT_SETTING_SIZE },
7157         { set_le,                  MGMT_SETTING_SIZE },
7158         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
7159         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
7160         { add_uuid,                MGMT_ADD_UUID_SIZE },
7161         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
7162         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
7163                                                 HCI_MGMT_VAR_LEN },
7164         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7165                                                 HCI_MGMT_VAR_LEN },
7166         { disconnect,              MGMT_DISCONNECT_SIZE },
7167         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
7168         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
7169         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
7170         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
7171         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
7172         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
7173         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
7174         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
7175         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7176         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
7177         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7178         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
7179         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7180                                                 HCI_MGMT_VAR_LEN },
7181         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7182         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
7183         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
7184         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
7185         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
7186         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
7187         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
7188         { set_advertising,         MGMT_SETTING_SIZE },
7189         { set_bredr,               MGMT_SETTING_SIZE },
7190         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
7191         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
7192         { set_secure_conn,         MGMT_SETTING_SIZE },
7193         { set_debug_keys,          MGMT_SETTING_SIZE },
7194         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
7195         { load_irks,               MGMT_LOAD_IRKS_SIZE,
7196                                                 HCI_MGMT_VAR_LEN },
7197         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
7198         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
7199         { add_device,              MGMT_ADD_DEVICE_SIZE },
7200         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
7201         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
7202                                                 HCI_MGMT_VAR_LEN },
7203         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7204                                                 HCI_MGMT_NO_HDEV |
7205                                                 HCI_MGMT_UNTRUSTED },
7206         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
7207                                                 HCI_MGMT_UNCONFIGURED |
7208                                                 HCI_MGMT_UNTRUSTED },
7209         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
7210                                                 HCI_MGMT_UNCONFIGURED },
7211         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
7212                                                 HCI_MGMT_UNCONFIGURED },
7213         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7214                                                 HCI_MGMT_VAR_LEN },
7215         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7216         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
7217                                                 HCI_MGMT_NO_HDEV |
7218                                                 HCI_MGMT_UNTRUSTED },
7219         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
7220         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
7221                                                 HCI_MGMT_VAR_LEN },
7222         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
7223 };
7224
7225 void mgmt_index_added(struct hci_dev *hdev)
7226 {
7227         struct mgmt_ev_ext_index ev;
7228
7229         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7230                 return;
7231
7232         switch (hdev->dev_type) {
7233         case HCI_BREDR:
7234                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7235                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7236                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7237                         ev.type = 0x01;
7238                 } else {
7239                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7240                                          HCI_MGMT_INDEX_EVENTS);
7241                         ev.type = 0x00;
7242                 }
7243                 break;
7244         case HCI_AMP:
7245                 ev.type = 0x02;
7246                 break;
7247         default:
7248                 return;
7249         }
7250
7251         ev.bus = hdev->bus;
7252
7253         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7254                          HCI_MGMT_EXT_INDEX_EVENTS);
7255 }
7256
7257 void mgmt_index_removed(struct hci_dev *hdev)
7258 {
7259         struct mgmt_ev_ext_index ev;
7260         u8 status = MGMT_STATUS_INVALID_INDEX;
7261
7262         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7263                 return;
7264
7265         switch (hdev->dev_type) {
7266         case HCI_BREDR:
7267                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7268
7269                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7270                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7271                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7272                         ev.type = 0x01;
7273                 } else {
7274                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7275                                          HCI_MGMT_INDEX_EVENTS);
7276                         ev.type = 0x00;
7277                 }
7278                 break;
7279         case HCI_AMP:
7280                 ev.type = 0x02;
7281                 break;
7282         default:
7283                 return;
7284         }
7285
7286         ev.bus = hdev->bus;
7287
7288         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7289                          HCI_MGMT_EXT_INDEX_EVENTS);
7290 }
7291
7292 /* This function requires the caller holds hdev->lock */
7293 static void restart_le_actions(struct hci_request *req)
7294 {
7295         struct hci_dev *hdev = req->hdev;
7296         struct hci_conn_params *p;
7297
7298         list_for_each_entry(p, &hdev->le_conn_params, list) {
7299                 /* Needed for AUTO_OFF case where might not "really"
7300                  * have been powered off.
7301                  */
7302                 list_del_init(&p->action);
7303
7304                 switch (p->auto_connect) {
7305                 case HCI_AUTO_CONN_DIRECT:
7306                 case HCI_AUTO_CONN_ALWAYS:
7307                         list_add(&p->action, &hdev->pend_le_conns);
7308                         break;
7309                 case HCI_AUTO_CONN_REPORT:
7310                         list_add(&p->action, &hdev->pend_le_reports);
7311                         break;
7312                 default:
7313                         break;
7314                 }
7315         }
7316
7317         __hci_update_background_scan(req);
7318 }
7319
7320 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7321 {
7322         struct cmd_lookup match = { NULL, hdev };
7323
7324         BT_DBG("status 0x%02x", status);
7325
7326         if (!status) {
7327                 /* Register the available SMP channels (BR/EDR and LE) only
7328                  * when successfully powering on the controller. This late
7329                  * registration is required so that LE SMP can clearly
7330                  * decide if the public address or static address is used.
7331                  */
7332                 smp_register(hdev);
7333         }
7334
7335         hci_dev_lock(hdev);
7336
7337         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7338
7339         new_settings(hdev, match.sk);
7340
7341         hci_dev_unlock(hdev);
7342
7343         if (match.sk)
7344                 sock_put(match.sk);
7345 }
7346
7347 static int powered_update_hci(struct hci_dev *hdev)
7348 {
7349         struct hci_request req;
7350         u8 link_sec;
7351
7352         hci_req_init(&req, hdev);
7353
7354         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7355             !lmp_host_ssp_capable(hdev)) {
7356                 u8 mode = 0x01;
7357
7358                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7359
7360                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7361                         u8 support = 0x01;
7362
7363                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7364                                     sizeof(support), &support);
7365                 }
7366         }
7367
7368         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7369             lmp_bredr_capable(hdev)) {
7370                 struct hci_cp_write_le_host_supported cp;
7371
7372                 cp.le = 0x01;
7373                 cp.simul = 0x00;
7374
7375                 /* Check first if we already have the right
7376                  * host state (host features set)
7377                  */
7378                 if (cp.le != lmp_host_le_capable(hdev) ||
7379                     cp.simul != lmp_host_le_br_capable(hdev))
7380                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7381                                     sizeof(cp), &cp);
7382         }
7383
7384         if (lmp_le_capable(hdev)) {
7385                 /* Make sure the controller has a good default for
7386                  * advertising data. This also applies to the case
7387                  * where BR/EDR was toggled during the AUTO_OFF phase.
7388                  */
7389                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
7390                         update_adv_data(&req);
7391                         update_scan_rsp_data(&req);
7392                 }
7393
7394                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7395                     hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
7396                         enable_advertising(&req);
7397
7398                 restart_le_actions(&req);
7399         }
7400
7401         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7402         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7403                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7404                             sizeof(link_sec), &link_sec);
7405
7406         if (lmp_bredr_capable(hdev)) {
7407                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7408                         write_fast_connectable(&req, true);
7409                 else
7410                         write_fast_connectable(&req, false);
7411                 __hci_update_page_scan(&req);
7412                 update_class(&req);
7413                 update_name(&req);
7414                 update_eir(&req);
7415         }
7416
7417         return hci_req_run(&req, powered_complete);
7418 }
7419
7420 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7421 {
7422         struct cmd_lookup match = { NULL, hdev };
7423         u8 status, zero_cod[] = { 0, 0, 0 };
7424         int err;
7425
7426         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7427                 return 0;
7428
7429         if (powered) {
7430                 if (powered_update_hci(hdev) == 0)
7431                         return 0;
7432
7433                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7434                                      &match);
7435                 goto new_settings;
7436         }
7437
7438         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7439
7440         /* If the power off is because of hdev unregistration let
7441          * use the appropriate INVALID_INDEX status. Otherwise use
7442          * NOT_POWERED. We cover both scenarios here since later in
7443          * mgmt_index_removed() any hci_conn callbacks will have already
7444          * been triggered, potentially causing misleading DISCONNECTED
7445          * status responses.
7446          */
7447         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7448                 status = MGMT_STATUS_INVALID_INDEX;
7449         else
7450                 status = MGMT_STATUS_NOT_POWERED;
7451
7452         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7453
7454         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7455                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7456                                    zero_cod, sizeof(zero_cod), NULL);
7457
7458 new_settings:
7459         err = new_settings(hdev, match.sk);
7460
7461         if (match.sk)
7462                 sock_put(match.sk);
7463
7464         return err;
7465 }
7466
7467 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7468 {
7469         struct mgmt_pending_cmd *cmd;
7470         u8 status;
7471
7472         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7473         if (!cmd)
7474                 return;
7475
7476         if (err == -ERFKILL)
7477                 status = MGMT_STATUS_RFKILLED;
7478         else
7479                 status = MGMT_STATUS_FAILED;
7480
7481         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7482
7483         mgmt_pending_remove(cmd);
7484 }
7485
7486 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7487 {
7488         struct hci_request req;
7489
7490         hci_dev_lock(hdev);
7491
7492         /* When discoverable timeout triggers, then just make sure
7493          * the limited discoverable flag is cleared. Even in the case
7494          * of a timeout triggered from general discoverable, it is
7495          * safe to unconditionally clear the flag.
7496          */
7497         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7498         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7499
7500         hci_req_init(&req, hdev);
7501         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7502                 u8 scan = SCAN_PAGE;
7503                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7504                             sizeof(scan), &scan);
7505         }
7506         update_class(&req);
7507
7508         /* Advertising instances don't use the global discoverable setting, so
7509          * only update AD if advertising was enabled using Set Advertising.
7510          */
7511         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7512                 update_adv_data(&req);
7513
7514         hci_req_run(&req, NULL);
7515
7516         hdev->discov_timeout = 0;
7517
7518         new_settings(hdev, NULL);
7519
7520         hci_dev_unlock(hdev);
7521 }
7522
7523 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7524                        bool persistent)
7525 {
7526         struct mgmt_ev_new_link_key ev;
7527
7528         memset(&ev, 0, sizeof(ev));
7529
7530         ev.store_hint = persistent;
7531         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7532         ev.key.addr.type = BDADDR_BREDR;
7533         ev.key.type = key->type;
7534         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7535         ev.key.pin_len = key->pin_len;
7536
7537         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7538 }
7539
7540 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7541 {
7542         switch (ltk->type) {
7543         case SMP_LTK:
7544         case SMP_LTK_SLAVE:
7545                 if (ltk->authenticated)
7546                         return MGMT_LTK_AUTHENTICATED;
7547                 return MGMT_LTK_UNAUTHENTICATED;
7548         case SMP_LTK_P256:
7549                 if (ltk->authenticated)
7550                         return MGMT_LTK_P256_AUTH;
7551                 return MGMT_LTK_P256_UNAUTH;
7552         case SMP_LTK_P256_DEBUG:
7553                 return MGMT_LTK_P256_DEBUG;
7554         }
7555
7556         return MGMT_LTK_UNAUTHENTICATED;
7557 }
7558
7559 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7560 {
7561         struct mgmt_ev_new_long_term_key ev;
7562
7563         memset(&ev, 0, sizeof(ev));
7564
7565         /* Devices using resolvable or non-resolvable random addresses
7566          * without providing an identity resolving key don't require
7567          * to store long term keys. Their addresses will change the
7568          * next time around.
7569          *
7570          * Only when a remote device provides an identity address
7571          * make sure the long term key is stored. If the remote
7572          * identity is known, the long term keys are internally
7573          * mapped to the identity address. So allow static random
7574          * and public addresses here.
7575          */
7576         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7577             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7578                 ev.store_hint = 0x00;
7579         else
7580                 ev.store_hint = persistent;
7581
7582         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7583         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7584         ev.key.type = mgmt_ltk_type(key);
7585         ev.key.enc_size = key->enc_size;
7586         ev.key.ediv = key->ediv;
7587         ev.key.rand = key->rand;
7588
7589         if (key->type == SMP_LTK)
7590                 ev.key.master = 1;
7591
7592         /* Make sure we copy only the significant bytes based on the
7593          * encryption key size, and set the rest of the value to zeroes.
7594          */
7595         memcpy(ev.key.val, key->val, sizeof(key->enc_size));
7596         memset(ev.key.val + key->enc_size, 0,
7597                sizeof(ev.key.val) - key->enc_size);
7598
7599         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7600 }
7601
7602 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7603 {
7604         struct mgmt_ev_new_irk ev;
7605
7606         memset(&ev, 0, sizeof(ev));
7607
7608         /* For identity resolving keys from devices that are already
7609          * using a public address or static random address, do not
7610          * ask for storing this key. The identity resolving key really
7611          * is only mandatory for devices using resolvable random
7612          * addresses.
7613          *
7614          * Storing all identity resolving keys has the downside that
7615          * they will be also loaded on next boot of they system. More
7616          * identity resolving keys, means more time during scanning is
7617          * needed to actually resolve these addresses.
7618          */
7619         if (bacmp(&irk->rpa, BDADDR_ANY))
7620                 ev.store_hint = 0x01;
7621         else
7622                 ev.store_hint = 0x00;
7623
7624         bacpy(&ev.rpa, &irk->rpa);
7625         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7626         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7627         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7628
7629         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7630 }
7631
7632 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7633                    bool persistent)
7634 {
7635         struct mgmt_ev_new_csrk ev;
7636
7637         memset(&ev, 0, sizeof(ev));
7638
7639         /* Devices using resolvable or non-resolvable random addresses
7640          * without providing an identity resolving key don't require
7641          * to store signature resolving keys. Their addresses will change
7642          * the next time around.
7643          *
7644          * Only when a remote device provides an identity address
7645          * make sure the signature resolving key is stored. So allow
7646          * static random and public addresses here.
7647          */
7648         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7649             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7650                 ev.store_hint = 0x00;
7651         else
7652                 ev.store_hint = persistent;
7653
7654         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7655         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7656         ev.key.type = csrk->type;
7657         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7658
7659         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7660 }
7661
7662 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7663                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7664                          u16 max_interval, u16 latency, u16 timeout)
7665 {
7666         struct mgmt_ev_new_conn_param ev;
7667
7668         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7669                 return;
7670
7671         memset(&ev, 0, sizeof(ev));
7672         bacpy(&ev.addr.bdaddr, bdaddr);
7673         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7674         ev.store_hint = store_hint;
7675         ev.min_interval = cpu_to_le16(min_interval);
7676         ev.max_interval = cpu_to_le16(max_interval);
7677         ev.latency = cpu_to_le16(latency);
7678         ev.timeout = cpu_to_le16(timeout);
7679
7680         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7681 }
7682
7683 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7684                            u32 flags, u8 *name, u8 name_len)
7685 {
7686         char buf[512];
7687         struct mgmt_ev_device_connected *ev = (void *) buf;
7688         u16 eir_len = 0;
7689
7690         bacpy(&ev->addr.bdaddr, &conn->dst);
7691         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7692
7693         ev->flags = __cpu_to_le32(flags);
7694
7695         /* We must ensure that the EIR Data fields are ordered and
7696          * unique. Keep it simple for now and avoid the problem by not
7697          * adding any BR/EDR data to the LE adv.
7698          */
7699         if (conn->le_adv_data_len > 0) {
7700                 memcpy(&ev->eir[eir_len],
7701                        conn->le_adv_data, conn->le_adv_data_len);
7702                 eir_len = conn->le_adv_data_len;
7703         } else {
7704                 if (name_len > 0)
7705                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7706                                                   name, name_len);
7707
7708                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7709                         eir_len = eir_append_data(ev->eir, eir_len,
7710                                                   EIR_CLASS_OF_DEV,
7711                                                   conn->dev_class, 3);
7712         }
7713
7714         ev->eir_len = cpu_to_le16(eir_len);
7715
7716         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7717                     sizeof(*ev) + eir_len, NULL);
7718 }
7719
7720 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7721 {
7722         struct sock **sk = data;
7723
7724         cmd->cmd_complete(cmd, 0);
7725
7726         *sk = cmd->sk;
7727         sock_hold(*sk);
7728
7729         mgmt_pending_remove(cmd);
7730 }
7731
7732 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7733 {
7734         struct hci_dev *hdev = data;
7735         struct mgmt_cp_unpair_device *cp = cmd->param;
7736
7737         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7738
7739         cmd->cmd_complete(cmd, 0);
7740         mgmt_pending_remove(cmd);
7741 }
7742
7743 bool mgmt_powering_down(struct hci_dev *hdev)
7744 {
7745         struct mgmt_pending_cmd *cmd;
7746         struct mgmt_mode *cp;
7747
7748         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7749         if (!cmd)
7750                 return false;
7751
7752         cp = cmd->param;
7753         if (!cp->val)
7754                 return true;
7755
7756         return false;
7757 }
7758
7759 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7760                               u8 link_type, u8 addr_type, u8 reason,
7761                               bool mgmt_connected)
7762 {
7763         struct mgmt_ev_device_disconnected ev;
7764         struct sock *sk = NULL;
7765
7766         /* The connection is still in hci_conn_hash so test for 1
7767          * instead of 0 to know if this is the last one.
7768          */
7769         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7770                 cancel_delayed_work(&hdev->power_off);
7771                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7772         }
7773
7774         if (!mgmt_connected)
7775                 return;
7776
7777         if (link_type != ACL_LINK && link_type != LE_LINK)
7778                 return;
7779
7780         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7781
7782         bacpy(&ev.addr.bdaddr, bdaddr);
7783         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7784         ev.reason = reason;
7785
7786         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7787
7788         if (sk)
7789                 sock_put(sk);
7790
7791         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7792                              hdev);
7793 }
7794
7795 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7796                             u8 link_type, u8 addr_type, u8 status)
7797 {
7798         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7799         struct mgmt_cp_disconnect *cp;
7800         struct mgmt_pending_cmd *cmd;
7801
7802         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7803                              hdev);
7804
7805         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7806         if (!cmd)
7807                 return;
7808
7809         cp = cmd->param;
7810
7811         if (bacmp(bdaddr, &cp->addr.bdaddr))
7812                 return;
7813
7814         if (cp->addr.type != bdaddr_type)
7815                 return;
7816
7817         cmd->cmd_complete(cmd, mgmt_status(status));
7818         mgmt_pending_remove(cmd);
7819 }
7820
7821 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7822                          u8 addr_type, u8 status)
7823 {
7824         struct mgmt_ev_connect_failed ev;
7825
7826         /* The connection is still in hci_conn_hash so test for 1
7827          * instead of 0 to know if this is the last one.
7828          */
7829         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7830                 cancel_delayed_work(&hdev->power_off);
7831                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7832         }
7833
7834         bacpy(&ev.addr.bdaddr, bdaddr);
7835         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7836         ev.status = mgmt_status(status);
7837
7838         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7839 }
7840
7841 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7842 {
7843         struct mgmt_ev_pin_code_request ev;
7844
7845         bacpy(&ev.addr.bdaddr, bdaddr);
7846         ev.addr.type = BDADDR_BREDR;
7847         ev.secure = secure;
7848
7849         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7850 }
7851
7852 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7853                                   u8 status)
7854 {
7855         struct mgmt_pending_cmd *cmd;
7856
7857         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7858         if (!cmd)
7859                 return;
7860
7861         cmd->cmd_complete(cmd, mgmt_status(status));
7862         mgmt_pending_remove(cmd);
7863 }
7864
7865 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7866                                       u8 status)
7867 {
7868         struct mgmt_pending_cmd *cmd;
7869
7870         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7871         if (!cmd)
7872                 return;
7873
7874         cmd->cmd_complete(cmd, mgmt_status(status));
7875         mgmt_pending_remove(cmd);
7876 }
7877
7878 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7879                               u8 link_type, u8 addr_type, u32 value,
7880                               u8 confirm_hint)
7881 {
7882         struct mgmt_ev_user_confirm_request ev;
7883
7884         BT_DBG("%s", hdev->name);
7885
7886         bacpy(&ev.addr.bdaddr, bdaddr);
7887         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7888         ev.confirm_hint = confirm_hint;
7889         ev.value = cpu_to_le32(value);
7890
7891         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7892                           NULL);
7893 }
7894
7895 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7896                               u8 link_type, u8 addr_type)
7897 {
7898         struct mgmt_ev_user_passkey_request ev;
7899
7900         BT_DBG("%s", hdev->name);
7901
7902         bacpy(&ev.addr.bdaddr, bdaddr);
7903         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7904
7905         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7906                           NULL);
7907 }
7908
7909 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7910                                       u8 link_type, u8 addr_type, u8 status,
7911                                       u8 opcode)
7912 {
7913         struct mgmt_pending_cmd *cmd;
7914
7915         cmd = pending_find(opcode, hdev);
7916         if (!cmd)
7917                 return -ENOENT;
7918
7919         cmd->cmd_complete(cmd, mgmt_status(status));
7920         mgmt_pending_remove(cmd);
7921
7922         return 0;
7923 }
7924
7925 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7926                                      u8 link_type, u8 addr_type, u8 status)
7927 {
7928         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7929                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7930 }
7931
7932 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7933                                          u8 link_type, u8 addr_type, u8 status)
7934 {
7935         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7936                                           status,
7937                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7938 }
7939
7940 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7941                                      u8 link_type, u8 addr_type, u8 status)
7942 {
7943         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7944                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7945 }
7946
7947 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7948                                          u8 link_type, u8 addr_type, u8 status)
7949 {
7950         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7951                                           status,
7952                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7953 }
7954
7955 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7956                              u8 link_type, u8 addr_type, u32 passkey,
7957                              u8 entered)
7958 {
7959         struct mgmt_ev_passkey_notify ev;
7960
7961         BT_DBG("%s", hdev->name);
7962
7963         bacpy(&ev.addr.bdaddr, bdaddr);
7964         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7965         ev.passkey = __cpu_to_le32(passkey);
7966         ev.entered = entered;
7967
7968         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7969 }
7970
7971 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7972 {
7973         struct mgmt_ev_auth_failed ev;
7974         struct mgmt_pending_cmd *cmd;
7975         u8 status = mgmt_status(hci_status);
7976
7977         bacpy(&ev.addr.bdaddr, &conn->dst);
7978         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7979         ev.status = status;
7980
7981         cmd = find_pairing(conn);
7982
7983         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7984                     cmd ? cmd->sk : NULL);
7985
7986         if (cmd) {
7987                 cmd->cmd_complete(cmd, status);
7988                 mgmt_pending_remove(cmd);
7989         }
7990 }
7991
7992 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7993 {
7994         struct cmd_lookup match = { NULL, hdev };
7995         bool changed;
7996
7997         if (status) {
7998                 u8 mgmt_err = mgmt_status(status);
7999                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8000                                      cmd_status_rsp, &mgmt_err);
8001                 return;
8002         }
8003
8004         if (test_bit(HCI_AUTH, &hdev->flags))
8005                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
8006         else
8007                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
8008
8009         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8010                              &match);
8011
8012         if (changed)
8013                 new_settings(hdev, match.sk);
8014
8015         if (match.sk)
8016                 sock_put(match.sk);
8017 }
8018
8019 static void clear_eir(struct hci_request *req)
8020 {
8021         struct hci_dev *hdev = req->hdev;
8022         struct hci_cp_write_eir cp;
8023
8024         if (!lmp_ext_inq_capable(hdev))
8025                 return;
8026
8027         memset(hdev->eir, 0, sizeof(hdev->eir));
8028
8029         memset(&cp, 0, sizeof(cp));
8030
8031         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8032 }
8033
8034 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8035 {
8036         struct cmd_lookup match = { NULL, hdev };
8037         struct hci_request req;
8038         bool changed = false;
8039
8040         if (status) {
8041                 u8 mgmt_err = mgmt_status(status);
8042
8043                 if (enable && hci_dev_test_and_clear_flag(hdev,
8044                                                           HCI_SSP_ENABLED)) {
8045                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8046                         new_settings(hdev, NULL);
8047                 }
8048
8049                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8050                                      &mgmt_err);
8051                 return;
8052         }
8053
8054         if (enable) {
8055                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
8056         } else {
8057                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
8058                 if (!changed)
8059                         changed = hci_dev_test_and_clear_flag(hdev,
8060                                                               HCI_HS_ENABLED);
8061                 else
8062                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8063         }
8064
8065         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8066
8067         if (changed)
8068                 new_settings(hdev, match.sk);
8069
8070         if (match.sk)
8071                 sock_put(match.sk);
8072
8073         hci_req_init(&req, hdev);
8074
8075         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8076                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
8077                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8078                                     sizeof(enable), &enable);
8079                 update_eir(&req);
8080         } else {
8081                 clear_eir(&req);
8082         }
8083
8084         hci_req_run(&req, NULL);
8085 }
8086
8087 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
8088 {
8089         struct cmd_lookup *match = data;
8090
8091         if (match->sk == NULL) {
8092                 match->sk = cmd->sk;
8093                 sock_hold(match->sk);
8094         }
8095 }
8096
8097 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8098                                     u8 status)
8099 {
8100         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8101
8102         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8103         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8104         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8105
8106         if (!status)
8107                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8108                                    dev_class, 3, NULL);
8109
8110         if (match.sk)
8111                 sock_put(match.sk);
8112 }
8113
8114 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8115 {
8116         struct mgmt_cp_set_local_name ev;
8117         struct mgmt_pending_cmd *cmd;
8118
8119         if (status)
8120                 return;
8121
8122         memset(&ev, 0, sizeof(ev));
8123         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
8124         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
8125
8126         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
8127         if (!cmd) {
8128                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
8129
8130                 /* If this is a HCI command related to powering on the
8131                  * HCI dev don't send any mgmt signals.
8132                  */
8133                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
8134                         return;
8135         }
8136
8137         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8138                            cmd ? cmd->sk : NULL);
8139 }
8140
8141 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8142 {
8143         int i;
8144
8145         for (i = 0; i < uuid_count; i++) {
8146                 if (!memcmp(uuid, uuids[i], 16))
8147                         return true;
8148         }
8149
8150         return false;
8151 }
8152
8153 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8154 {
8155         u16 parsed = 0;
8156
8157         while (parsed < eir_len) {
8158                 u8 field_len = eir[0];
8159                 u8 uuid[16];
8160                 int i;
8161
8162                 if (field_len == 0)
8163                         break;
8164
8165                 if (eir_len - parsed < field_len + 1)
8166                         break;
8167
8168                 switch (eir[1]) {
8169                 case EIR_UUID16_ALL:
8170                 case EIR_UUID16_SOME:
8171                         for (i = 0; i + 3 <= field_len; i += 2) {
8172                                 memcpy(uuid, bluetooth_base_uuid, 16);
8173                                 uuid[13] = eir[i + 3];
8174                                 uuid[12] = eir[i + 2];
8175                                 if (has_uuid(uuid, uuid_count, uuids))
8176                                         return true;
8177                         }
8178                         break;
8179                 case EIR_UUID32_ALL:
8180                 case EIR_UUID32_SOME:
8181                         for (i = 0; i + 5 <= field_len; i += 4) {
8182                                 memcpy(uuid, bluetooth_base_uuid, 16);
8183                                 uuid[15] = eir[i + 5];
8184                                 uuid[14] = eir[i + 4];
8185                                 uuid[13] = eir[i + 3];
8186                                 uuid[12] = eir[i + 2];
8187                                 if (has_uuid(uuid, uuid_count, uuids))
8188                                         return true;
8189                         }
8190                         break;
8191                 case EIR_UUID128_ALL:
8192                 case EIR_UUID128_SOME:
8193                         for (i = 0; i + 17 <= field_len; i += 16) {
8194                                 memcpy(uuid, eir + i + 2, 16);
8195                                 if (has_uuid(uuid, uuid_count, uuids))
8196                                         return true;
8197                         }
8198                         break;
8199                 }
8200
8201                 parsed += field_len + 1;
8202                 eir += field_len + 1;
8203         }
8204
8205         return false;
8206 }
8207
8208 static void restart_le_scan(struct hci_dev *hdev)
8209 {
8210         /* If controller is not scanning we are done. */
8211         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8212                 return;
8213
8214         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8215                        hdev->discovery.scan_start +
8216                        hdev->discovery.scan_duration))
8217                 return;
8218
8219         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8220                            DISCOV_LE_RESTART_DELAY);
8221 }
8222
8223 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8224                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8225 {
8226         /* If a RSSI threshold has been specified, and
8227          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8228          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8229          * is set, let it through for further processing, as we might need to
8230          * restart the scan.
8231          *
8232          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8233          * the results are also dropped.
8234          */
8235         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8236             (rssi == HCI_RSSI_INVALID ||
8237             (rssi < hdev->discovery.rssi &&
8238              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8239                 return  false;
8240
8241         if (hdev->discovery.uuid_count != 0) {
8242                 /* If a list of UUIDs is provided in filter, results with no
8243                  * matching UUID should be dropped.
8244                  */
8245                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8246                                    hdev->discovery.uuids) &&
8247                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8248                                    hdev->discovery.uuid_count,
8249                                    hdev->discovery.uuids))
8250                         return false;
8251         }
8252
8253         /* If duplicate filtering does not report RSSI changes, then restart
8254          * scanning to ensure updated result with updated RSSI values.
8255          */
8256         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8257                 restart_le_scan(hdev);
8258
8259                 /* Validate RSSI value against the RSSI threshold once more. */
8260                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8261                     rssi < hdev->discovery.rssi)
8262                         return false;
8263         }
8264
8265         return true;
8266 }
8267
8268 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8269                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8270                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8271 {
8272         char buf[512];
8273         struct mgmt_ev_device_found *ev = (void *)buf;
8274         size_t ev_size;
8275
8276         /* Don't send events for a non-kernel initiated discovery. With
8277          * LE one exception is if we have pend_le_reports > 0 in which
8278          * case we're doing passive scanning and want these events.
8279          */
8280         if (!hci_discovery_active(hdev)) {
8281                 if (link_type == ACL_LINK)
8282                         return;
8283                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8284                         return;
8285         }
8286
8287         if (hdev->discovery.result_filtering) {
8288                 /* We are using service discovery */
8289                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8290                                      scan_rsp_len))
8291                         return;
8292         }
8293
8294         /* Make sure that the buffer is big enough. The 5 extra bytes
8295          * are for the potential CoD field.
8296          */
8297         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8298                 return;
8299
8300         memset(buf, 0, sizeof(buf));
8301
8302         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8303          * RSSI value was reported as 0 when not available. This behavior
8304          * is kept when using device discovery. This is required for full
8305          * backwards compatibility with the API.
8306          *
8307          * However when using service discovery, the value 127 will be
8308          * returned when the RSSI is not available.
8309          */
8310         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8311             link_type == ACL_LINK)
8312                 rssi = 0;
8313
8314         bacpy(&ev->addr.bdaddr, bdaddr);
8315         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8316         ev->rssi = rssi;
8317         ev->flags = cpu_to_le32(flags);
8318
8319         if (eir_len > 0)
8320                 /* Copy EIR or advertising data into event */
8321                 memcpy(ev->eir, eir, eir_len);
8322
8323         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8324                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8325                                           dev_class, 3);
8326
8327         if (scan_rsp_len > 0)
8328                 /* Append scan response data to event */
8329                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8330
8331         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8332         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8333
8334         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8335 }
8336
8337 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8338                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8339 {
8340         struct mgmt_ev_device_found *ev;
8341         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8342         u16 eir_len;
8343
8344         ev = (struct mgmt_ev_device_found *) buf;
8345
8346         memset(buf, 0, sizeof(buf));
8347
8348         bacpy(&ev->addr.bdaddr, bdaddr);
8349         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8350         ev->rssi = rssi;
8351
8352         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8353                                   name_len);
8354
8355         ev->eir_len = cpu_to_le16(eir_len);
8356
8357         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8358 }
8359
8360 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8361 {
8362         struct mgmt_ev_discovering ev;
8363
8364         BT_DBG("%s discovering %u", hdev->name, discovering);
8365
8366         memset(&ev, 0, sizeof(ev));
8367         ev.type = hdev->discovery.type;
8368         ev.discovering = discovering;
8369
8370         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8371 }
8372
8373 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8374 {
8375         BT_DBG("%s status %u", hdev->name, status);
8376 }
8377
8378 void mgmt_reenable_advertising(struct hci_dev *hdev)
8379 {
8380         struct hci_request req;
8381
8382         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8383             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8384                 return;
8385
8386         hci_req_init(&req, hdev);
8387         enable_advertising(&req);
8388         hci_req_run(&req, adv_enable_complete);
8389 }
8390
8391 static struct hci_mgmt_chan chan = {
8392         .channel        = HCI_CHANNEL_CONTROL,
8393         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8394         .handlers       = mgmt_handlers,
8395         .hdev_init      = mgmt_init_hdev,
8396 };
8397
8398 int mgmt_init(void)
8399 {
8400         return hci_mgmt_chan_register(&chan);
8401 }
8402
8403 void mgmt_exit(void)
8404 {
8405         hci_mgmt_chan_unregister(&chan);
8406 }