net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   11
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107 };
 108
 109 static const u16 mgmt_events[] = {
 110         MGMT_EV_CONTROLLER_ERROR,
 111         MGMT_EV_INDEX_ADDED,
 112         MGMT_EV_INDEX_REMOVED,
 113         MGMT_EV_NEW_SETTINGS,
 114         MGMT_EV_CLASS_OF_DEV_CHANGED,
 115         MGMT_EV_LOCAL_NAME_CHANGED,
 116         MGMT_EV_NEW_LINK_KEY,
 117         MGMT_EV_NEW_LONG_TERM_KEY,
 118         MGMT_EV_DEVICE_CONNECTED,
 119         MGMT_EV_DEVICE_DISCONNECTED,
 120         MGMT_EV_CONNECT_FAILED,
 121         MGMT_EV_PIN_CODE_REQUEST,
 122         MGMT_EV_USER_CONFIRM_REQUEST,
 123         MGMT_EV_USER_PASSKEY_REQUEST,
 124         MGMT_EV_AUTH_FAILED,
 125         MGMT_EV_DEVICE_FOUND,
 126         MGMT_EV_DISCOVERING,
 127         MGMT_EV_DEVICE_BLOCKED,
 128         MGMT_EV_DEVICE_UNBLOCKED,
 129         MGMT_EV_DEVICE_UNPAIRED,
 130         MGMT_EV_PASSKEY_NOTIFY,
 131         MGMT_EV_NEW_IRK,
 132         MGMT_EV_NEW_CSRK,
 133         MGMT_EV_DEVICE_ADDED,
 134         MGMT_EV_DEVICE_REMOVED,
 135         MGMT_EV_NEW_CONN_PARAM,
 136         MGMT_EV_UNCONF_INDEX_ADDED,
 137         MGMT_EV_UNCONF_INDEX_REMOVED,
 138         MGMT_EV_NEW_CONFIG_OPTIONS,
 139         MGMT_EV_EXT_INDEX_ADDED,
 140         MGMT_EV_EXT_INDEX_REMOVED,
 141         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 142         MGMT_EV_ADVERTISING_ADDED,
 143         MGMT_EV_ADVERTISING_REMOVED,
 144 };
 145
 146 static const u16 mgmt_untrusted_commands[] = {
 147         MGMT_OP_READ_INDEX_LIST,
 148         MGMT_OP_READ_INFO,
 149         MGMT_OP_READ_UNCONF_INDEX_LIST,
 150         MGMT_OP_READ_CONFIG_INFO,
 151         MGMT_OP_READ_EXT_INDEX_LIST,
 152 };
 153
 154 static const u16 mgmt_untrusted_events[] = {
 155         MGMT_EV_INDEX_ADDED,
 156         MGMT_EV_INDEX_REMOVED,
 157         MGMT_EV_NEW_SETTINGS,
 158         MGMT_EV_CLASS_OF_DEV_CHANGED,
 159         MGMT_EV_LOCAL_NAME_CHANGED,
 160         MGMT_EV_UNCONF_INDEX_ADDED,
 161         MGMT_EV_UNCONF_INDEX_REMOVED,
 162         MGMT_EV_NEW_CONFIG_OPTIONS,
 163         MGMT_EV_EXT_INDEX_ADDED,
 164         MGMT_EV_EXT_INDEX_REMOVED,
 165 };
 166
 167 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 168
 169 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 170                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 171
 172 /* HCI to MGMT error code conversion table */
 173 static u8 mgmt_status_table[] = {
 174         MGMT_STATUS_SUCCESS,
 175         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 176         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 177         MGMT_STATUS_FAILED,             /* Hardware Failure */
 178         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 179         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 180         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 181         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 182         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 183         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 184         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 185         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 186         MGMT_STATUS_BUSY,               /* Command Disallowed */
 187         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 188         MGMT_STATUS_REJECTED,           /* Rejected Security */
 189         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 190         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 192         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 193         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 194         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 195         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 196         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 197         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 198         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 199         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 200         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 201         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 202         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 203         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 204         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 205         MGMT_STATUS_FAILED,             /* Unspecified Error */
 206         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 207         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 208         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 209         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 210         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 211         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 212         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 214         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 215         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 216         MGMT_STATUS_FAILED,             /* Transaction Collision */
 217         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 218         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 219         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 220         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 221         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 222         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 223         MGMT_STATUS_FAILED,             /* Slot Violation */
 224         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 225         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 226         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 227         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 228         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 229         MGMT_STATUS_BUSY,               /* Controller Busy */
 230         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 231         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 232         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 233         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 234         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 235 };
 236
 237 static u8 mgmt_status(u8 hci_status)
 238 {
 239         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 240                 return mgmt_status_table[hci_status];
 241
 242         return MGMT_STATUS_FAILED;
 243 }
 244
 245 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 246                             u16 len, int flag)
 247 {
 248         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 249                                flag, NULL);
 250 }
 251
 252 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 253                               u16 len, int flag, struct sock *skip_sk)
 254 {
 255         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 256                                flag, skip_sk);
 257 }
 258
 259 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 260                               u16 len, struct sock *skip_sk)
 261 {
 262         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 263                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 264 }
 265
 266 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 267                       struct sock *skip_sk)
 268 {
 269         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 270                                HCI_SOCK_TRUSTED, skip_sk);
 271 }
 272
 273 static u8 le_addr_type(u8 mgmt_addr_type)
 274 {
 275         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 276                 return ADDR_LE_DEV_PUBLIC;
 277         else
 278                 return ADDR_LE_DEV_RANDOM;
 279 }
 280
 281 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 282                         u16 data_len)
 283 {
 284         struct mgmt_rp_read_version rp;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp.version = MGMT_VERSION;
 289         rp.revision = cpu_to_le16(MGMT_REVISION);
 290
 291         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 292                                  &rp, sizeof(rp));
 293 }
 294
 295 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 296                          u16 data_len)
 297 {
 298         struct mgmt_rp_read_commands *rp;
 299         u16 num_commands, num_events;
 300         size_t rp_size;
 301         int i, err;
 302
 303         BT_DBG("sock %p", sk);
 304
 305         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 306                 num_commands = ARRAY_SIZE(mgmt_commands);
 307                 num_events = ARRAY_SIZE(mgmt_events);
 308         } else {
 309                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 310                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 311         }
 312
 313         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 314
 315         rp = kmalloc(rp_size, GFP_KERNEL);
 316         if (!rp)
 317                 return -ENOMEM;
 318
 319         rp->num_commands = cpu_to_le16(num_commands);
 320         rp->num_events = cpu_to_le16(num_events);
 321
 322         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 323                 __le16 *opcode = rp->opcodes;
 324
 325                 for (i = 0; i < num_commands; i++, opcode++)
 326                         put_unaligned_le16(mgmt_commands[i], opcode);
 327
 328                 for (i = 0; i < num_events; i++, opcode++)
 329                         put_unaligned_le16(mgmt_events[i], opcode);
 330         } else {
 331                 __le16 *opcode = rp->opcodes;
 332
 333                 for (i = 0; i < num_commands; i++, opcode++)
 334                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 335
 336                 for (i = 0; i < num_events; i++, opcode++)
 337                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 338         }
 339
 340         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 341                                 rp, rp_size);
 342         kfree(rp);
 343
 344         return err;
 345 }
 346
 347 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 348                            u16 data_len)
 349 {
 350         struct mgmt_rp_read_index_list *rp;
 351         struct hci_dev *d;
 352         size_t rp_len;
 353         u16 count;
 354         int err;
 355
 356         BT_DBG("sock %p", sk);
 357
 358         read_lock(&hci_dev_list_lock);
 359
 360         count = 0;
 361         list_for_each_entry(d, &hci_dev_list, list) {
 362                 if (d->dev_type == HCI_BREDR &&
 363                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 364                         count++;
 365         }
 366
 367         rp_len = sizeof(*rp) + (2 * count);
 368         rp = kmalloc(rp_len, GFP_ATOMIC);
 369         if (!rp) {
 370                 read_unlock(&hci_dev_list_lock);
 371                 return -ENOMEM;
 372         }
 373
 374         count = 0;
 375         list_for_each_entry(d, &hci_dev_list, list) {
 376                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 377                     hci_dev_test_flag(d, HCI_CONFIG) ||
 378                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 379                         continue;
 380
 381                 /* Devices marked as raw-only are neither configured
 382                  * nor unconfigured controllers.
 383                  */
 384                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 385                         continue;
 386
 387                 if (d->dev_type == HCI_BREDR &&
 388                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 389                         rp->index[count++] = cpu_to_le16(d->id);
 390                         BT_DBG("Added hci%u", d->id);
 391                 }
 392         }
 393
 394         rp->num_controllers = cpu_to_le16(count);
 395         rp_len = sizeof(*rp) + (2 * count);
 396
 397         read_unlock(&hci_dev_list_lock);
 398
 399         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 400                                 0, rp, rp_len);
 401
 402         kfree(rp);
 403
 404         return err;
 405 }
 406
 407 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 408                                   void *data, u16 data_len)
 409 {
 410         struct mgmt_rp_read_unconf_index_list *rp;
 411         struct hci_dev *d;
 412         size_t rp_len;
 413         u16 count;
 414         int err;
 415
 416         BT_DBG("sock %p", sk);
 417
 418         read_lock(&hci_dev_list_lock);
 419
 420         count = 0;
 421         list_for_each_entry(d, &hci_dev_list, list) {
 422                 if (d->dev_type == HCI_BREDR &&
 423                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 424                         count++;
 425         }
 426
 427         rp_len = sizeof(*rp) + (2 * count);
 428         rp = kmalloc(rp_len, GFP_ATOMIC);
 429         if (!rp) {
 430                 read_unlock(&hci_dev_list_lock);
 431                 return -ENOMEM;
 432         }
 433
 434         count = 0;
 435         list_for_each_entry(d, &hci_dev_list, list) {
 436                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 437                     hci_dev_test_flag(d, HCI_CONFIG) ||
 438                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 439                         continue;
 440
 441                 /* Devices marked as raw-only are neither configured
 442                  * nor unconfigured controllers.
 443                  */
 444                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 445                         continue;
 446
 447                 if (d->dev_type == HCI_BREDR &&
 448                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 449                         rp->index[count++] = cpu_to_le16(d->id);
 450                         BT_DBG("Added hci%u", d->id);
 451                 }
 452         }
 453
 454         rp->num_controllers = cpu_to_le16(count);
 455         rp_len = sizeof(*rp) + (2 * count);
 456
 457         read_unlock(&hci_dev_list_lock);
 458
 459         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 460                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 461
 462         kfree(rp);
 463
 464         return err;
 465 }
 466
 467 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 468                                void *data, u16 data_len)
 469 {
 470         struct mgmt_rp_read_ext_index_list *rp;
 471         struct hci_dev *d;
 472         size_t rp_len;
 473         u16 count;
 474         int err;
 475
 476         BT_DBG("sock %p", sk);
 477
 478         read_lock(&hci_dev_list_lock);
 479
 480         count = 0;
 481         list_for_each_entry(d, &hci_dev_list, list) {
 482                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 483                         count++;
 484         }
 485
 486         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 487         rp = kmalloc(rp_len, GFP_ATOMIC);
 488         if (!rp) {
 489                 read_unlock(&hci_dev_list_lock);
 490                 return -ENOMEM;
 491         }
 492
 493         count = 0;
 494         list_for_each_entry(d, &hci_dev_list, list) {
 495                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 496                     hci_dev_test_flag(d, HCI_CONFIG) ||
 497                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 498                         continue;
 499
 500                 /* Devices marked as raw-only are neither configured
 501                  * nor unconfigured controllers.
 502                  */
 503                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 504                         continue;
 505
 506                 if (d->dev_type == HCI_BREDR) {
 507                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 508                                 rp->entry[count].type = 0x01;
 509                         else
 510                                 rp->entry[count].type = 0x00;
 511                 } else if (d->dev_type == HCI_AMP) {
 512                         rp->entry[count].type = 0x02;
 513                 } else {
 514                         continue;
 515                 }
 516
 517                 rp->entry[count].bus = d->bus;
 518                 rp->entry[count++].index = cpu_to_le16(d->id);
 519                 BT_DBG("Added hci%u", d->id);
 520         }
 521
 522         rp->num_controllers = cpu_to_le16(count);
 523         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 524
 525         read_unlock(&hci_dev_list_lock);
 526
 527         /* If this command is called at least once, then all the
 528          * default index and unconfigured index events are disabled
 529          * and from now on only extended index events are used.
 530          */
 531         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 532         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 533         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 534
 535         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 536                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 537
 538         kfree(rp);
 539
 540         return err;
 541 }
 542
 543 static bool is_configured(struct hci_dev *hdev)
 544 {
 545         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 546             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 547                 return false;
 548
 549         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 550             !bacmp(&hdev->public_addr, BDADDR_ANY))
 551                 return false;
 552
 553         return true;
 554 }
 555
 556 static __le32 get_missing_options(struct hci_dev *hdev)
 557 {
 558         u32 options = 0;
 559
 560         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 561             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 562                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 563
 564         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 565             !bacmp(&hdev->public_addr, BDADDR_ANY))
 566                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 567
 568         return cpu_to_le32(options);
 569 }
 570
 571 static int new_options(struct hci_dev *hdev, struct sock *skip)
 572 {
 573         __le32 options = get_missing_options(hdev);
 574
 575         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 576                                   sizeof(options), skip);
 577 }
 578
 579 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 580 {
 581         __le32 options = get_missing_options(hdev);
 582
 583         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 584                                  sizeof(options));
 585 }
 586
 587 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 588                             void *data, u16 data_len)
 589 {
 590         struct mgmt_rp_read_config_info rp;
 591         u32 options = 0;
 592
 593         BT_DBG("sock %p %s", sk, hdev->name);
 594
 595         hci_dev_lock(hdev);
 596
 597         memset(&rp, 0, sizeof(rp));
 598         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 599
 600         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 601                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 602
 603         if (hdev->set_bdaddr)
 604                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 605
 606         rp.supported_options = cpu_to_le32(options);
 607         rp.missing_options = get_missing_options(hdev);
 608
 609         hci_dev_unlock(hdev);
 610
 611         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 612                                  &rp, sizeof(rp));
 613 }
 614
 615 static u32 get_supported_settings(struct hci_dev *hdev)
 616 {
 617         u32 settings = 0;
 618
 619         settings |= MGMT_SETTING_POWERED;
 620         settings |= MGMT_SETTING_BONDABLE;
 621         settings |= MGMT_SETTING_DEBUG_KEYS;
 622         settings |= MGMT_SETTING_CONNECTABLE;
 623         settings |= MGMT_SETTING_DISCOVERABLE;
 624
 625         if (lmp_bredr_capable(hdev)) {
 626                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 627                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 628                 settings |= MGMT_SETTING_BREDR;
 629                 settings |= MGMT_SETTING_LINK_SECURITY;
 630
 631                 if (lmp_ssp_capable(hdev)) {
 632                         settings |= MGMT_SETTING_SSP;
 633                         settings |= MGMT_SETTING_HS;
 634                 }
 635
 636                 if (lmp_sc_capable(hdev))
 637                         settings |= MGMT_SETTING_SECURE_CONN;
 638         }
 639
 640         if (lmp_le_capable(hdev)) {
 641                 settings |= MGMT_SETTING_LE;
 642                 settings |= MGMT_SETTING_ADVERTISING;
 643                 settings |= MGMT_SETTING_SECURE_CONN;
 644                 settings |= MGMT_SETTING_PRIVACY;
 645                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 646         }
 647
 648         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 649             hdev->set_bdaddr)
 650                 settings |= MGMT_SETTING_CONFIGURATION;
 651
 652         return settings;
 653 }
 654
 655 static u32 get_current_settings(struct hci_dev *hdev)
 656 {
 657         u32 settings = 0;
 658
 659         if (hdev_is_powered(hdev))
 660                 settings |= MGMT_SETTING_POWERED;
 661
 662         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 663                 settings |= MGMT_SETTING_CONNECTABLE;
 664
 665         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 666                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 667
 668         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 669                 settings |= MGMT_SETTING_DISCOVERABLE;
 670
 671         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 672                 settings |= MGMT_SETTING_BONDABLE;
 673
 674         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 675                 settings |= MGMT_SETTING_BREDR;
 676
 677         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 678                 settings |= MGMT_SETTING_LE;
 679
 680         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 681                 settings |= MGMT_SETTING_LINK_SECURITY;
 682
 683         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 684                 settings |= MGMT_SETTING_SSP;
 685
 686         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 687                 settings |= MGMT_SETTING_HS;
 688
 689         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 690                 settings |= MGMT_SETTING_ADVERTISING;
 691
 692         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 693                 settings |= MGMT_SETTING_SECURE_CONN;
 694
 695         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 696                 settings |= MGMT_SETTING_DEBUG_KEYS;
 697
 698         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 699                 settings |= MGMT_SETTING_PRIVACY;
 700
 701         /* The current setting for static address has two purposes. The
 702          * first is to indicate if the static address will be used and
 703          * the second is to indicate if it is actually set.
 704          *
 705          * This means if the static address is not configured, this flag
 706          * will never be set. If the address is configured, then if the
 707          * address is actually used decides if the flag is set or not.
 708          *
 709          * For single mode LE only controllers and dual-mode controllers
 710          * with BR/EDR disabled, the existence of the static address will
 711          * be evaluated.
 712          */
 713         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 714             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 715             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 716                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 717                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 718         }
 719
 720         return settings;
 721 }
 722
 723 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 724 {
 725         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 726 }
 727
 728 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 729                                                   struct hci_dev *hdev,
 730                                                   const void *data)
 731 {
 732         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 733 }
 734
 735 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 736 {
 737         struct mgmt_pending_cmd *cmd;
 738
 739         /* If there's a pending mgmt command the flags will not yet have
 740          * their final values, so check for this first.
 741          */
 742         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 743         if (cmd) {
 744                 struct mgmt_mode *cp = cmd->param;
 745                 if (cp->val == 0x01)
 746                         return LE_AD_GENERAL;
 747                 else if (cp->val == 0x02)
 748                         return LE_AD_LIMITED;
 749         } else {
 750                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 751                         return LE_AD_LIMITED;
 752                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 753                         return LE_AD_GENERAL;
 754         }
 755
 756         return 0;
 757 }
 758
 759 bool mgmt_get_connectable(struct hci_dev *hdev)
 760 {
 761         struct mgmt_pending_cmd *cmd;
 762
 763         /* If there's a pending mgmt command the flag will not yet have
 764          * it's final value, so check for this first.
 765          */
 766         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 767         if (cmd) {
 768                 struct mgmt_mode *cp = cmd->param;
 769
 770                 return cp->val;
 771         }
 772
 773         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 774 }
 775
 776 static void service_cache_off(struct work_struct *work)
 777 {
 778         struct hci_dev *hdev = container_of(work, struct hci_dev,
 779                                             service_cache.work);
 780         struct hci_request req;
 781
 782         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 783                 return;
 784
 785         hci_req_init(&req, hdev);
 786
 787         hci_dev_lock(hdev);
 788
 789         __hci_req_update_eir(&req);
 790         __hci_req_update_class(&req);
 791
 792         hci_dev_unlock(hdev);
 793
 794         hci_req_run(&req, NULL);
 795 }
 796
 797 static void rpa_expired(struct work_struct *work)
 798 {
 799         struct hci_dev *hdev = container_of(work, struct hci_dev,
 800                                             rpa_expired.work);
 801         struct hci_request req;
 802
 803         BT_DBG("");
 804
 805         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 806
 807         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 808                 return;
 809
 810         /* The generation of a new RPA and programming it into the
 811          * controller happens in the hci_req_enable_advertising()
 812          * function.
 813          */
 814         hci_req_init(&req, hdev);
 815         __hci_req_enable_advertising(&req);
 816         hci_req_run(&req, NULL);
 817 }
 818
 819 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 820 {
 821         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 822                 return;
 823
 824         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 825         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 826
 827         /* Non-mgmt controlled devices get this bit set
 828          * implicitly so that pairing works for them, however
 829          * for mgmt we require user-space to explicitly enable
 830          * it
 831          */
 832         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 833 }
 834
 835 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 836                                 void *data, u16 data_len)
 837 {
 838         struct mgmt_rp_read_info rp;
 839
 840         BT_DBG("sock %p %s", sk, hdev->name);
 841
 842         hci_dev_lock(hdev);
 843
 844         memset(&rp, 0, sizeof(rp));
 845
 846         bacpy(&rp.bdaddr, &hdev->bdaddr);
 847
 848         rp.version = hdev->hci_ver;
 849         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 850
 851         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 852         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 853
 854         memcpy(rp.dev_class, hdev->dev_class, 3);
 855
 856         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 857         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 858
 859         hci_dev_unlock(hdev);
 860
 861         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 862                                  sizeof(rp));
 863 }
 864
 865 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 866 {
 867         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 868
 869         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
 870                                  sizeof(settings));
 871 }
 872
 873 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 874 {
 875         BT_DBG("%s status 0x%02x", hdev->name, status);
 876
 877         if (hci_conn_count(hdev) == 0) {
 878                 cancel_delayed_work(&hdev->power_off);
 879                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 880         }
 881 }
 882
 883 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
 884 {
 885         struct mgmt_ev_advertising_added ev;
 886
 887         ev.instance = instance;
 888
 889         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
 890 }
 891
 892 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
 893                               u8 instance)
 894 {
 895         struct mgmt_ev_advertising_removed ev;
 896
 897         ev.instance = instance;
 898
 899         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
 900 }
 901
 902 static void cancel_adv_timeout(struct hci_dev *hdev)
 903 {
 904         if (hdev->adv_instance_timeout) {
 905                 hdev->adv_instance_timeout = 0;
 906                 cancel_delayed_work(&hdev->adv_instance_expire);
 907         }
 908 }
 909
 910 static int clean_up_hci_state(struct hci_dev *hdev)
 911 {
 912         struct hci_request req;
 913         struct hci_conn *conn;
 914         bool discov_stopped;
 915         int err;
 916
 917         hci_req_init(&req, hdev);
 918
 919         if (test_bit(HCI_ISCAN, &hdev->flags) ||
 920             test_bit(HCI_PSCAN, &hdev->flags)) {
 921                 u8 scan = 0x00;
 922                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 923         }
 924
 925         hci_req_clear_adv_instance(hdev, NULL, 0x00, false);
 926
 927         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
 928                 __hci_req_disable_advertising(&req);
 929
 930         discov_stopped = hci_req_stop_discovery(&req);
 931
 932         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
 933                 /* 0x15 == Terminated due to Power Off */
 934                 __hci_abort_conn(&req, conn, 0x15);
 935         }
 936
 937         err = hci_req_run(&req, clean_up_hci_complete);
 938         if (!err && discov_stopped)
 939                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
 940
 941         return err;
 942 }
 943
 944 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 945                        u16 len)
 946 {
 947         struct mgmt_mode *cp = data;
 948         struct mgmt_pending_cmd *cmd;
 949         int err;
 950
 951         BT_DBG("request for %s", hdev->name);
 952
 953         if (cp->val != 0x00 && cp->val != 0x01)
 954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 955                                        MGMT_STATUS_INVALID_PARAMS);
 956
 957         hci_dev_lock(hdev);
 958
 959         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
 960                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 961                                       MGMT_STATUS_BUSY);
 962                 goto failed;
 963         }
 964
 965         if (!!cp->val == hdev_is_powered(hdev)) {
 966                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 967                 goto failed;
 968         }
 969
 970         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 971         if (!cmd) {
 972                 err = -ENOMEM;
 973                 goto failed;
 974         }
 975
 976         if (cp->val) {
 977                 queue_work(hdev->req_workqueue, &hdev->power_on);
 978                 err = 0;
 979         } else {
 980                 /* Disconnect connections, stop scans, etc */
 981                 err = clean_up_hci_state(hdev);
 982                 if (!err)
 983                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
 984                                            HCI_POWER_OFF_TIMEOUT);
 985
 986                 /* ENODATA means there were no HCI commands queued */
 987                 if (err == -ENODATA) {
 988                         cancel_delayed_work(&hdev->power_off);
 989                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
 990                         err = 0;
 991                 }
 992         }
 993
 994 failed:
 995         hci_dev_unlock(hdev);
 996         return err;
 997 }
 998
 999 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1000 {
1001         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1002
1003         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1004                                   sizeof(ev), skip);
1005 }
1006
1007 int mgmt_new_settings(struct hci_dev *hdev)
1008 {
1009         return new_settings(hdev, NULL);
1010 }
1011
1012 struct cmd_lookup {
1013         struct sock *sk;
1014         struct hci_dev *hdev;
1015         u8 mgmt_status;
1016 };
1017
1018 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1019 {
1020         struct cmd_lookup *match = data;
1021
1022         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1023
1024         list_del(&cmd->list);
1025
1026         if (match->sk == NULL) {
1027                 match->sk = cmd->sk;
1028                 sock_hold(match->sk);
1029         }
1030
1031         mgmt_pending_free(cmd);
1032 }
1033
1034 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1035 {
1036         u8 *status = data;
1037
1038         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1039         mgmt_pending_remove(cmd);
1040 }
1041
1042 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1043 {
1044         if (cmd->cmd_complete) {
1045                 u8 *status = data;
1046
1047                 cmd->cmd_complete(cmd, *status);
1048                 mgmt_pending_remove(cmd);
1049
1050                 return;
1051         }
1052
1053         cmd_status_rsp(cmd, data);
1054 }
1055
1056 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1057 {
1058         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1059                                  cmd->param, cmd->param_len);
1060 }
1061
1062 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1063 {
1064         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1065                                  cmd->param, sizeof(struct mgmt_addr_info));
1066 }
1067
1068 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1069 {
1070         if (!lmp_bredr_capable(hdev))
1071                 return MGMT_STATUS_NOT_SUPPORTED;
1072         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1073                 return MGMT_STATUS_REJECTED;
1074         else
1075                 return MGMT_STATUS_SUCCESS;
1076 }
1077
1078 static u8 mgmt_le_support(struct hci_dev *hdev)
1079 {
1080         if (!lmp_le_capable(hdev))
1081                 return MGMT_STATUS_NOT_SUPPORTED;
1082         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1083                 return MGMT_STATUS_REJECTED;
1084         else
1085                 return MGMT_STATUS_SUCCESS;
1086 }
1087
1088 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1089 {
1090         struct mgmt_pending_cmd *cmd;
1091
1092         BT_DBG("status 0x%02x", status);
1093
1094         hci_dev_lock(hdev);
1095
1096         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1097         if (!cmd)
1098                 goto unlock;
1099
1100         if (status) {
1101                 u8 mgmt_err = mgmt_status(status);
1102                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1103                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1104                 goto remove_cmd;
1105         }
1106
1107         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1108             hdev->discov_timeout > 0) {
1109                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1110                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1111         }
1112
1113         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1114         new_settings(hdev, cmd->sk);
1115
1116 remove_cmd:
1117         mgmt_pending_remove(cmd);
1118
1119 unlock:
1120         hci_dev_unlock(hdev);
1121 }
1122
1123 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1124                             u16 len)
1125 {
1126         struct mgmt_cp_set_discoverable *cp = data;
1127         struct mgmt_pending_cmd *cmd;
1128         u16 timeout;
1129         int err;
1130
1131         BT_DBG("request for %s", hdev->name);
1132
1133         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1134             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1136                                        MGMT_STATUS_REJECTED);
1137
1138         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1139                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1140                                        MGMT_STATUS_INVALID_PARAMS);
1141
1142         timeout = __le16_to_cpu(cp->timeout);
1143
1144         /* Disabling discoverable requires that no timeout is set,
1145          * and enabling limited discoverable requires a timeout.
1146          */
1147         if ((cp->val == 0x00 && timeout > 0) ||
1148             (cp->val == 0x02 && timeout == 0))
1149                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1150                                        MGMT_STATUS_INVALID_PARAMS);
1151
1152         hci_dev_lock(hdev);
1153
1154         if (!hdev_is_powered(hdev) && timeout > 0) {
1155                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1156                                       MGMT_STATUS_NOT_POWERED);
1157                 goto failed;
1158         }
1159
1160         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1161             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1162                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1163                                       MGMT_STATUS_BUSY);
1164                 goto failed;
1165         }
1166
1167         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1168                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1169                                       MGMT_STATUS_REJECTED);
1170                 goto failed;
1171         }
1172
1173         if (!hdev_is_powered(hdev)) {
1174                 bool changed = false;
1175
1176                 /* Setting limited discoverable when powered off is
1177                  * not a valid operation since it requires a timeout
1178                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1179                  */
1180                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1181                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1182                         changed = true;
1183                 }
1184
1185                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1186                 if (err < 0)
1187                         goto failed;
1188
1189                 if (changed)
1190                         err = new_settings(hdev, sk);
1191
1192                 goto failed;
1193         }
1194
1195         /* If the current mode is the same, then just update the timeout
1196          * value with the new value. And if only the timeout gets updated,
1197          * then no need for any HCI transactions.
1198          */
1199         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1200             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1201                                                    HCI_LIMITED_DISCOVERABLE)) {
1202                 cancel_delayed_work(&hdev->discov_off);
1203                 hdev->discov_timeout = timeout;
1204
1205                 if (cp->val && hdev->discov_timeout > 0) {
1206                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1207                         queue_delayed_work(hdev->req_workqueue,
1208                                            &hdev->discov_off, to);
1209                 }
1210
1211                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1212                 goto failed;
1213         }
1214
1215         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1216         if (!cmd) {
1217                 err = -ENOMEM;
1218                 goto failed;
1219         }
1220
1221         /* Cancel any potential discoverable timeout that might be
1222          * still active and store new timeout value. The arming of
1223          * the timeout happens in the complete handler.
1224          */
1225         cancel_delayed_work(&hdev->discov_off);
1226         hdev->discov_timeout = timeout;
1227
1228         if (cp->val)
1229                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1230         else
1231                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1232
1233         /* Limited discoverable mode */
1234         if (cp->val == 0x02)
1235                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1236         else
1237                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1238
1239         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1240         err = 0;
1241
1242 failed:
1243         hci_dev_unlock(hdev);
1244         return err;
1245 }
1246
1247 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1248 {
1249         struct mgmt_pending_cmd *cmd;
1250
1251         BT_DBG("status 0x%02x", status);
1252
1253         hci_dev_lock(hdev);
1254
1255         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1256         if (!cmd)
1257                 goto unlock;
1258
1259         if (status) {
1260                 u8 mgmt_err = mgmt_status(status);
1261                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1262                 goto remove_cmd;
1263         }
1264
1265         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1266         new_settings(hdev, cmd->sk);
1267
1268 remove_cmd:
1269         mgmt_pending_remove(cmd);
1270
1271 unlock:
1272         hci_dev_unlock(hdev);
1273 }
1274
1275 static int set_connectable_update_settings(struct hci_dev *hdev,
1276                                            struct sock *sk, u8 val)
1277 {
1278         bool changed = false;
1279         int err;
1280
1281         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1282                 changed = true;
1283
1284         if (val) {
1285                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1286         } else {
1287                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1288                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1289         }
1290
1291         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1292         if (err < 0)
1293                 return err;
1294
1295         if (changed) {
1296                 hci_req_update_scan(hdev);
1297                 hci_update_background_scan(hdev);
1298                 return new_settings(hdev, sk);
1299         }
1300
1301         return 0;
1302 }
1303
1304 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1305                            u16 len)
1306 {
1307         struct mgmt_mode *cp = data;
1308         struct mgmt_pending_cmd *cmd;
1309         int err;
1310
1311         BT_DBG("request for %s", hdev->name);
1312
1313         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1314             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1315                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1316                                        MGMT_STATUS_REJECTED);
1317
1318         if (cp->val != 0x00 && cp->val != 0x01)
1319                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1320                                        MGMT_STATUS_INVALID_PARAMS);
1321
1322         hci_dev_lock(hdev);
1323
1324         if (!hdev_is_powered(hdev)) {
1325                 err = set_connectable_update_settings(hdev, sk, cp->val);
1326                 goto failed;
1327         }
1328
1329         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1330             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1331                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1332                                       MGMT_STATUS_BUSY);
1333                 goto failed;
1334         }
1335
1336         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1337         if (!cmd) {
1338                 err = -ENOMEM;
1339                 goto failed;
1340         }
1341
1342         if (cp->val) {
1343                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1344         } else {
1345                 if (hdev->discov_timeout > 0)
1346                         cancel_delayed_work(&hdev->discov_off);
1347
1348                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1349                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1350                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1351         }
1352
1353         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1354         err = 0;
1355
1356 failed:
1357         hci_dev_unlock(hdev);
1358         return err;
1359 }
1360
1361 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1362                         u16 len)
1363 {
1364         struct mgmt_mode *cp = data;
1365         bool changed;
1366         int err;
1367
1368         BT_DBG("request for %s", hdev->name);
1369
1370         if (cp->val != 0x00 && cp->val != 0x01)
1371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1372                                        MGMT_STATUS_INVALID_PARAMS);
1373
1374         hci_dev_lock(hdev);
1375
1376         if (cp->val)
1377                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1378         else
1379                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1380
1381         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1382         if (err < 0)
1383                 goto unlock;
1384
1385         if (changed)
1386                 err = new_settings(hdev, sk);
1387
1388 unlock:
1389         hci_dev_unlock(hdev);
1390         return err;
1391 }
1392
1393 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1394                              u16 len)
1395 {
1396         struct mgmt_mode *cp = data;
1397         struct mgmt_pending_cmd *cmd;
1398         u8 val, status;
1399         int err;
1400
1401         BT_DBG("request for %s", hdev->name);
1402
1403         status = mgmt_bredr_support(hdev);
1404         if (status)
1405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1406                                        status);
1407
1408         if (cp->val != 0x00 && cp->val != 0x01)
1409                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1410                                        MGMT_STATUS_INVALID_PARAMS);
1411
1412         hci_dev_lock(hdev);
1413
1414         if (!hdev_is_powered(hdev)) {
1415                 bool changed = false;
1416
1417                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1418                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1419                         changed = true;
1420                 }
1421
1422                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1423                 if (err < 0)
1424                         goto failed;
1425
1426                 if (changed)
1427                         err = new_settings(hdev, sk);
1428
1429                 goto failed;
1430         }
1431
1432         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1433                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1434                                       MGMT_STATUS_BUSY);
1435                 goto failed;
1436         }
1437
1438         val = !!cp->val;
1439
1440         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1441                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1442                 goto failed;
1443         }
1444
1445         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1446         if (!cmd) {
1447                 err = -ENOMEM;
1448                 goto failed;
1449         }
1450
1451         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1452         if (err < 0) {
1453                 mgmt_pending_remove(cmd);
1454                 goto failed;
1455         }
1456
1457 failed:
1458         hci_dev_unlock(hdev);
1459         return err;
1460 }
1461
1462 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1463 {
1464         struct mgmt_mode *cp = data;
1465         struct mgmt_pending_cmd *cmd;
1466         u8 status;
1467         int err;
1468
1469         BT_DBG("request for %s", hdev->name);
1470
1471         status = mgmt_bredr_support(hdev);
1472         if (status)
1473                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1474
1475         if (!lmp_ssp_capable(hdev))
1476                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1477                                        MGMT_STATUS_NOT_SUPPORTED);
1478
1479         if (cp->val != 0x00 && cp->val != 0x01)
1480                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1481                                        MGMT_STATUS_INVALID_PARAMS);
1482
1483         hci_dev_lock(hdev);
1484
1485         if (!hdev_is_powered(hdev)) {
1486                 bool changed;
1487
1488                 if (cp->val) {
1489                         changed = !hci_dev_test_and_set_flag(hdev,
1490                                                              HCI_SSP_ENABLED);
1491                 } else {
1492                         changed = hci_dev_test_and_clear_flag(hdev,
1493                                                               HCI_SSP_ENABLED);
1494                         if (!changed)
1495                                 changed = hci_dev_test_and_clear_flag(hdev,
1496                                                                       HCI_HS_ENABLED);
1497                         else
1498                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1499                 }
1500
1501                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1502                 if (err < 0)
1503                         goto failed;
1504
1505                 if (changed)
1506                         err = new_settings(hdev, sk);
1507
1508                 goto failed;
1509         }
1510
1511         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1512                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1513                                       MGMT_STATUS_BUSY);
1514                 goto failed;
1515         }
1516
1517         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1518                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1519                 goto failed;
1520         }
1521
1522         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1523         if (!cmd) {
1524                 err = -ENOMEM;
1525                 goto failed;
1526         }
1527
1528         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1529                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1530                              sizeof(cp->val), &cp->val);
1531
1532         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1533         if (err < 0) {
1534                 mgmt_pending_remove(cmd);
1535                 goto failed;
1536         }
1537
1538 failed:
1539         hci_dev_unlock(hdev);
1540         return err;
1541 }
1542
1543 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1544 {
1545         struct mgmt_mode *cp = data;
1546         bool changed;
1547         u8 status;
1548         int err;
1549
1550         BT_DBG("request for %s", hdev->name);
1551
1552         status = mgmt_bredr_support(hdev);
1553         if (status)
1554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1555
1556         if (!lmp_ssp_capable(hdev))
1557                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1558                                        MGMT_STATUS_NOT_SUPPORTED);
1559
1560         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1561                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1562                                        MGMT_STATUS_REJECTED);
1563
1564         if (cp->val != 0x00 && cp->val != 0x01)
1565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1566                                        MGMT_STATUS_INVALID_PARAMS);
1567
1568         hci_dev_lock(hdev);
1569
1570         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1571                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1572                                       MGMT_STATUS_BUSY);
1573                 goto unlock;
1574         }
1575
1576         if (cp->val) {
1577                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1578         } else {
1579                 if (hdev_is_powered(hdev)) {
1580                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1581                                               MGMT_STATUS_REJECTED);
1582                         goto unlock;
1583                 }
1584
1585                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1586         }
1587
1588         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1589         if (err < 0)
1590                 goto unlock;
1591
1592         if (changed)
1593                 err = new_settings(hdev, sk);
1594
1595 unlock:
1596         hci_dev_unlock(hdev);
1597         return err;
1598 }
1599
1600 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1601 {
1602         struct cmd_lookup match = { NULL, hdev };
1603
1604         hci_dev_lock(hdev);
1605
1606         if (status) {
1607                 u8 mgmt_err = mgmt_status(status);
1608
1609                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1610                                      &mgmt_err);
1611                 goto unlock;
1612         }
1613
1614         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1615
1616         new_settings(hdev, match.sk);
1617
1618         if (match.sk)
1619                 sock_put(match.sk);
1620
1621         /* Make sure the controller has a good default for
1622          * advertising data. Restrict the update to when LE
1623          * has actually been enabled. During power on, the
1624          * update in powered_update_hci will take care of it.
1625          */
1626         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1627                 struct hci_request req;
1628
1629                 hci_req_init(&req, hdev);
1630                 __hci_req_update_adv_data(&req, 0x00);
1631                 __hci_req_update_scan_rsp_data(&req, 0x00);
1632                 hci_req_run(&req, NULL);
1633                 hci_update_background_scan(hdev);
1634         }
1635
1636 unlock:
1637         hci_dev_unlock(hdev);
1638 }
1639
1640 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1641 {
1642         struct mgmt_mode *cp = data;
1643         struct hci_cp_write_le_host_supported hci_cp;
1644         struct mgmt_pending_cmd *cmd;
1645         struct hci_request req;
1646         int err;
1647         u8 val, enabled;
1648
1649         BT_DBG("request for %s", hdev->name);
1650
1651         if (!lmp_le_capable(hdev))
1652                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1653                                        MGMT_STATUS_NOT_SUPPORTED);
1654
1655         if (cp->val != 0x00 && cp->val != 0x01)
1656                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1657                                        MGMT_STATUS_INVALID_PARAMS);
1658
1659         /* Bluetooth single mode LE only controllers or dual-mode
1660          * controllers configured as LE only devices, do not allow
1661          * switching LE off. These have either LE enabled explicitly
1662          * or BR/EDR has been previously switched off.
1663          *
1664          * When trying to enable an already enabled LE, then gracefully
1665          * send a positive response. Trying to disable it however will
1666          * result into rejection.
1667          */
1668         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1669                 if (cp->val == 0x01)
1670                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1671
1672                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1673                                        MGMT_STATUS_REJECTED);
1674         }
1675
1676         hci_dev_lock(hdev);
1677
1678         val = !!cp->val;
1679         enabled = lmp_host_le_capable(hdev);
1680
1681         if (!val)
1682                 hci_req_clear_adv_instance(hdev, NULL, 0x00, true);
1683
1684         if (!hdev_is_powered(hdev) || val == enabled) {
1685                 bool changed = false;
1686
1687                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1688                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1689                         changed = true;
1690                 }
1691
1692                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1693                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1694                         changed = true;
1695                 }
1696
1697                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1698                 if (err < 0)
1699                         goto unlock;
1700
1701                 if (changed)
1702                         err = new_settings(hdev, sk);
1703
1704                 goto unlock;
1705         }
1706
1707         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1708             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1709                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1710                                       MGMT_STATUS_BUSY);
1711                 goto unlock;
1712         }
1713
1714         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1715         if (!cmd) {
1716                 err = -ENOMEM;
1717                 goto unlock;
1718         }
1719
1720         hci_req_init(&req, hdev);
1721
1722         memset(&hci_cp, 0, sizeof(hci_cp));
1723
1724         if (val) {
1725                 hci_cp.le = val;
1726                 hci_cp.simul = 0x00;
1727         } else {
1728                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1729                         __hci_req_disable_advertising(&req);
1730         }
1731
1732         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1733                     &hci_cp);
1734
1735         err = hci_req_run(&req, le_enable_complete);
1736         if (err < 0)
1737                 mgmt_pending_remove(cmd);
1738
1739 unlock:
1740         hci_dev_unlock(hdev);
1741         return err;
1742 }
1743
1744 /* This is a helper function to test for pending mgmt commands that can
1745  * cause CoD or EIR HCI commands. We can only allow one such pending
1746  * mgmt command at a time since otherwise we cannot easily track what
1747  * the current values are, will be, and based on that calculate if a new
1748  * HCI command needs to be sent and if yes with what value.
1749  */
1750 static bool pending_eir_or_class(struct hci_dev *hdev)
1751 {
1752         struct mgmt_pending_cmd *cmd;
1753
1754         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1755                 switch (cmd->opcode) {
1756                 case MGMT_OP_ADD_UUID:
1757                 case MGMT_OP_REMOVE_UUID:
1758                 case MGMT_OP_SET_DEV_CLASS:
1759                 case MGMT_OP_SET_POWERED:
1760                         return true;
1761                 }
1762         }
1763
1764         return false;
1765 }
1766
1767 static const u8 bluetooth_base_uuid[] = {
1768                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1769                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1770 };
1771
1772 static u8 get_uuid_size(const u8 *uuid)
1773 {
1774         u32 val;
1775
1776         if (memcmp(uuid, bluetooth_base_uuid, 12))
1777                 return 128;
1778
1779         val = get_unaligned_le32(&uuid[12]);
1780         if (val > 0xffff)
1781                 return 32;
1782
1783         return 16;
1784 }
1785
1786 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1787 {
1788         struct mgmt_pending_cmd *cmd;
1789
1790         hci_dev_lock(hdev);
1791
1792         cmd = pending_find(mgmt_op, hdev);
1793         if (!cmd)
1794                 goto unlock;
1795
1796         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
1797                           mgmt_status(status), hdev->dev_class, 3);
1798
1799         mgmt_pending_remove(cmd);
1800
1801 unlock:
1802         hci_dev_unlock(hdev);
1803 }
1804
1805 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1806 {
1807         BT_DBG("status 0x%02x", status);
1808
1809         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1810 }
1811
1812 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1813 {
1814         struct mgmt_cp_add_uuid *cp = data;
1815         struct mgmt_pending_cmd *cmd;
1816         struct hci_request req;
1817         struct bt_uuid *uuid;
1818         int err;
1819
1820         BT_DBG("request for %s", hdev->name);
1821
1822         hci_dev_lock(hdev);
1823
1824         if (pending_eir_or_class(hdev)) {
1825                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1826                                       MGMT_STATUS_BUSY);
1827                 goto failed;
1828         }
1829
1830         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1831         if (!uuid) {
1832                 err = -ENOMEM;
1833                 goto failed;
1834         }
1835
1836         memcpy(uuid->uuid, cp->uuid, 16);
1837         uuid->svc_hint = cp->svc_hint;
1838         uuid->size = get_uuid_size(cp->uuid);
1839
1840         list_add_tail(&uuid->list, &hdev->uuids);
1841
1842         hci_req_init(&req, hdev);
1843
1844         __hci_req_update_class(&req);
1845         __hci_req_update_eir(&req);
1846
1847         err = hci_req_run(&req, add_uuid_complete);
1848         if (err < 0) {
1849                 if (err != -ENODATA)
1850                         goto failed;
1851
1852                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1853                                         hdev->dev_class, 3);
1854                 goto failed;
1855         }
1856
1857         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1858         if (!cmd) {
1859                 err = -ENOMEM;
1860                 goto failed;
1861         }
1862
1863         err = 0;
1864
1865 failed:
1866         hci_dev_unlock(hdev);
1867         return err;
1868 }
1869
1870 static bool enable_service_cache(struct hci_dev *hdev)
1871 {
1872         if (!hdev_is_powered(hdev))
1873                 return false;
1874
1875         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
1876                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1877                                    CACHE_TIMEOUT);
1878                 return true;
1879         }
1880
1881         return false;
1882 }
1883
1884 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1885 {
1886         BT_DBG("status 0x%02x", status);
1887
1888         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1889 }
1890
1891 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1892                        u16 len)
1893 {
1894         struct mgmt_cp_remove_uuid *cp = data;
1895         struct mgmt_pending_cmd *cmd;
1896         struct bt_uuid *match, *tmp;
1897         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1898         struct hci_request req;
1899         int err, found;
1900
1901         BT_DBG("request for %s", hdev->name);
1902
1903         hci_dev_lock(hdev);
1904
1905         if (pending_eir_or_class(hdev)) {
1906                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1907                                       MGMT_STATUS_BUSY);
1908                 goto unlock;
1909         }
1910
1911         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1912                 hci_uuids_clear(hdev);
1913
1914                 if (enable_service_cache(hdev)) {
1915                         err = mgmt_cmd_complete(sk, hdev->id,
1916                                                 MGMT_OP_REMOVE_UUID,
1917                                                 0, hdev->dev_class, 3);
1918                         goto unlock;
1919                 }
1920
1921                 goto update_class;
1922         }
1923
1924         found = 0;
1925
1926         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1927                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1928                         continue;
1929
1930                 list_del(&match->list);
1931                 kfree(match);
1932                 found++;
1933         }
1934
1935         if (found == 0) {
1936                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1937                                       MGMT_STATUS_INVALID_PARAMS);
1938                 goto unlock;
1939         }
1940
1941 update_class:
1942         hci_req_init(&req, hdev);
1943
1944         __hci_req_update_class(&req);
1945         __hci_req_update_eir(&req);
1946
1947         err = hci_req_run(&req, remove_uuid_complete);
1948         if (err < 0) {
1949                 if (err != -ENODATA)
1950                         goto unlock;
1951
1952                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1953                                         hdev->dev_class, 3);
1954                 goto unlock;
1955         }
1956
1957         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1958         if (!cmd) {
1959                 err = -ENOMEM;
1960                 goto unlock;
1961         }
1962
1963         err = 0;
1964
1965 unlock:
1966         hci_dev_unlock(hdev);
1967         return err;
1968 }
1969
1970 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1971 {
1972         BT_DBG("status 0x%02x", status);
1973
1974         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1975 }
1976
1977 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1978                          u16 len)
1979 {
1980         struct mgmt_cp_set_dev_class *cp = data;
1981         struct mgmt_pending_cmd *cmd;
1982         struct hci_request req;
1983         int err;
1984
1985         BT_DBG("request for %s", hdev->name);
1986
1987         if (!lmp_bredr_capable(hdev))
1988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1989                                        MGMT_STATUS_NOT_SUPPORTED);
1990
1991         hci_dev_lock(hdev);
1992
1993         if (pending_eir_or_class(hdev)) {
1994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1995                                       MGMT_STATUS_BUSY);
1996                 goto unlock;
1997         }
1998
1999         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2001                                       MGMT_STATUS_INVALID_PARAMS);
2002                 goto unlock;
2003         }
2004
2005         hdev->major_class = cp->major;
2006         hdev->minor_class = cp->minor;
2007
2008         if (!hdev_is_powered(hdev)) {
2009                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2010                                         hdev->dev_class, 3);
2011                 goto unlock;
2012         }
2013
2014         hci_req_init(&req, hdev);
2015
2016         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2017                 hci_dev_unlock(hdev);
2018                 cancel_delayed_work_sync(&hdev->service_cache);
2019                 hci_dev_lock(hdev);
2020                 __hci_req_update_eir(&req);
2021         }
2022
2023         __hci_req_update_class(&req);
2024
2025         err = hci_req_run(&req, set_class_complete);
2026         if (err < 0) {
2027                 if (err != -ENODATA)
2028                         goto unlock;
2029
2030                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2031                                         hdev->dev_class, 3);
2032                 goto unlock;
2033         }
2034
2035         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2036         if (!cmd) {
2037                 err = -ENOMEM;
2038                 goto unlock;
2039         }
2040
2041         err = 0;
2042
2043 unlock:
2044         hci_dev_unlock(hdev);
2045         return err;
2046 }
2047
2048 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2049                           u16 len)
2050 {
2051         struct mgmt_cp_load_link_keys *cp = data;
2052         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2053                                    sizeof(struct mgmt_link_key_info));
2054         u16 key_count, expected_len;
2055         bool changed;
2056         int i;
2057
2058         BT_DBG("request for %s", hdev->name);
2059
2060         if (!lmp_bredr_capable(hdev))
2061                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2062                                        MGMT_STATUS_NOT_SUPPORTED);
2063
2064         key_count = __le16_to_cpu(cp->key_count);
2065         if (key_count > max_key_count) {
2066                 BT_ERR("load_link_keys: too big key_count value %u",
2067                        key_count);
2068                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2069                                        MGMT_STATUS_INVALID_PARAMS);
2070         }
2071
2072         expected_len = sizeof(*cp) + key_count *
2073                                         sizeof(struct mgmt_link_key_info);
2074         if (expected_len != len) {
2075                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2076                        expected_len, len);
2077                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2078                                        MGMT_STATUS_INVALID_PARAMS);
2079         }
2080
2081         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2082                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2083                                        MGMT_STATUS_INVALID_PARAMS);
2084
2085         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2086                key_count);
2087
2088         for (i = 0; i < key_count; i++) {
2089                 struct mgmt_link_key_info *key = &cp->keys[i];
2090
2091                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2092                         return mgmt_cmd_status(sk, hdev->id,
2093                                                MGMT_OP_LOAD_LINK_KEYS,
2094                                                MGMT_STATUS_INVALID_PARAMS);
2095         }
2096
2097         hci_dev_lock(hdev);
2098
2099         hci_link_keys_clear(hdev);
2100
2101         if (cp->debug_keys)
2102                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2103         else
2104                 changed = hci_dev_test_and_clear_flag(hdev,
2105                                                       HCI_KEEP_DEBUG_KEYS);
2106
2107         if (changed)
2108                 new_settings(hdev, NULL);
2109
2110         for (i = 0; i < key_count; i++) {
2111                 struct mgmt_link_key_info *key = &cp->keys[i];
2112
2113                 /* Always ignore debug keys and require a new pairing if
2114                  * the user wants to use them.
2115                  */
2116                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2117                         continue;
2118
2119                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2120                                  key->type, key->pin_len, NULL);
2121         }
2122
2123         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2124
2125         hci_dev_unlock(hdev);
2126
2127         return 0;
2128 }
2129
2130 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2131                            u8 addr_type, struct sock *skip_sk)
2132 {
2133         struct mgmt_ev_device_unpaired ev;
2134
2135         bacpy(&ev.addr.bdaddr, bdaddr);
2136         ev.addr.type = addr_type;
2137
2138         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2139                           skip_sk);
2140 }
2141
2142 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2143                          u16 len)
2144 {
2145         struct mgmt_cp_unpair_device *cp = data;
2146         struct mgmt_rp_unpair_device rp;
2147         struct hci_conn_params *params;
2148         struct mgmt_pending_cmd *cmd;
2149         struct hci_conn *conn;
2150         u8 addr_type;
2151         int err;
2152
2153         memset(&rp, 0, sizeof(rp));
2154         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2155         rp.addr.type = cp->addr.type;
2156
2157         if (!bdaddr_type_is_valid(cp->addr.type))
2158                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2159                                          MGMT_STATUS_INVALID_PARAMS,
2160                                          &rp, sizeof(rp));
2161
2162         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2163                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2164                                          MGMT_STATUS_INVALID_PARAMS,
2165                                          &rp, sizeof(rp));
2166
2167         hci_dev_lock(hdev);
2168
2169         if (!hdev_is_powered(hdev)) {
2170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2171                                         MGMT_STATUS_NOT_POWERED, &rp,
2172                                         sizeof(rp));
2173                 goto unlock;
2174         }
2175
2176         if (cp->addr.type == BDADDR_BREDR) {
2177                 /* If disconnection is requested, then look up the
2178                  * connection. If the remote device is connected, it
2179                  * will be later used to terminate the link.
2180                  *
2181                  * Setting it to NULL explicitly will cause no
2182                  * termination of the link.
2183                  */
2184                 if (cp->disconnect)
2185                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2186                                                        &cp->addr.bdaddr);
2187                 else
2188                         conn = NULL;
2189
2190                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2191                 if (err < 0) {
2192                         err = mgmt_cmd_complete(sk, hdev->id,
2193                                                 MGMT_OP_UNPAIR_DEVICE,
2194                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2195                                                 sizeof(rp));
2196                         goto unlock;
2197                 }
2198
2199                 goto done;
2200         }
2201
2202         /* LE address type */
2203         addr_type = le_addr_type(cp->addr.type);
2204
2205         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2206
2207         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2208         if (err < 0) {
2209                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2210                                         MGMT_STATUS_NOT_PAIRED, &rp,
2211                                         sizeof(rp));
2212                 goto unlock;
2213         }
2214
2215         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2216         if (!conn) {
2217                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2218                 goto done;
2219         }
2220
2221         /* Abort any ongoing SMP pairing */
2222         smp_cancel_pairing(conn);
2223
2224         /* Defer clearing up the connection parameters until closing to
2225          * give a chance of keeping them if a repairing happens.
2226          */
2227         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2228
2229         /* Disable auto-connection parameters if present */
2230         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2231         if (params) {
2232                 if (params->explicit_connect)
2233                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2234                 else
2235                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2236         }
2237
2238         /* If disconnection is not requested, then clear the connection
2239          * variable so that the link is not terminated.
2240          */
2241         if (!cp->disconnect)
2242                 conn = NULL;
2243
2244 done:
2245         /* If the connection variable is set, then termination of the
2246          * link is requested.
2247          */
2248         if (!conn) {
2249                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2250                                         &rp, sizeof(rp));
2251                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2252                 goto unlock;
2253         }
2254
2255         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2256                                sizeof(*cp));
2257         if (!cmd) {
2258                 err = -ENOMEM;
2259                 goto unlock;
2260         }
2261
2262         cmd->cmd_complete = addr_cmd_complete;
2263
2264         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2265         if (err < 0)
2266                 mgmt_pending_remove(cmd);
2267
2268 unlock:
2269         hci_dev_unlock(hdev);
2270         return err;
2271 }
2272
2273 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2274                       u16 len)
2275 {
2276         struct mgmt_cp_disconnect *cp = data;
2277         struct mgmt_rp_disconnect rp;
2278         struct mgmt_pending_cmd *cmd;
2279         struct hci_conn *conn;
2280         int err;
2281
2282         BT_DBG("");
2283
2284         memset(&rp, 0, sizeof(rp));
2285         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2286         rp.addr.type = cp->addr.type;
2287
2288         if (!bdaddr_type_is_valid(cp->addr.type))
2289                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2290                                          MGMT_STATUS_INVALID_PARAMS,
2291                                          &rp, sizeof(rp));
2292
2293         hci_dev_lock(hdev);
2294
2295         if (!test_bit(HCI_UP, &hdev->flags)) {
2296                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2297                                         MGMT_STATUS_NOT_POWERED, &rp,
2298                                         sizeof(rp));
2299                 goto failed;
2300         }
2301
2302         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2303                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2304                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2305                 goto failed;
2306         }
2307
2308         if (cp->addr.type == BDADDR_BREDR)
2309                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2310                                                &cp->addr.bdaddr);
2311         else
2312                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2313                                                le_addr_type(cp->addr.type));
2314
2315         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2317                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2318                                         sizeof(rp));
2319                 goto failed;
2320         }
2321
2322         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2323         if (!cmd) {
2324                 err = -ENOMEM;
2325                 goto failed;
2326         }
2327
2328         cmd->cmd_complete = generic_cmd_complete;
2329
2330         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2331         if (err < 0)
2332                 mgmt_pending_remove(cmd);
2333
2334 failed:
2335         hci_dev_unlock(hdev);
2336         return err;
2337 }
2338
2339 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2340 {
2341         switch (link_type) {
2342         case LE_LINK:
2343                 switch (addr_type) {
2344                 case ADDR_LE_DEV_PUBLIC:
2345                         return BDADDR_LE_PUBLIC;
2346
2347                 default:
2348                         /* Fallback to LE Random address type */
2349                         return BDADDR_LE_RANDOM;
2350                 }
2351
2352         default:
2353                 /* Fallback to BR/EDR type */
2354                 return BDADDR_BREDR;
2355         }
2356 }
2357
2358 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2359                            u16 data_len)
2360 {
2361         struct mgmt_rp_get_connections *rp;
2362         struct hci_conn *c;
2363         size_t rp_len;
2364         int err;
2365         u16 i;
2366
2367         BT_DBG("");
2368
2369         hci_dev_lock(hdev);
2370
2371         if (!hdev_is_powered(hdev)) {
2372                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2373                                       MGMT_STATUS_NOT_POWERED);
2374                 goto unlock;
2375         }
2376
2377         i = 0;
2378         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2379                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2380                         i++;
2381         }
2382
2383         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2384         rp = kmalloc(rp_len, GFP_KERNEL);
2385         if (!rp) {
2386                 err = -ENOMEM;
2387                 goto unlock;
2388         }
2389
2390         i = 0;
2391         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2392                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2393                         continue;
2394                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2395                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2396                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2397                         continue;
2398                 i++;
2399         }
2400
2401         rp->conn_count = cpu_to_le16(i);
2402
2403         /* Recalculate length in case of filtered SCO connections, etc */
2404         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2405
2406         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2407                                 rp_len);
2408
2409         kfree(rp);
2410
2411 unlock:
2412         hci_dev_unlock(hdev);
2413         return err;
2414 }
2415
2416 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2417                                    struct mgmt_cp_pin_code_neg_reply *cp)
2418 {
2419         struct mgmt_pending_cmd *cmd;
2420         int err;
2421
2422         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2423                                sizeof(*cp));
2424         if (!cmd)
2425                 return -ENOMEM;
2426
2427         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2428                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2429         if (err < 0)
2430                 mgmt_pending_remove(cmd);
2431
2432         return err;
2433 }
2434
2435 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2436                           u16 len)
2437 {
2438         struct hci_conn *conn;
2439         struct mgmt_cp_pin_code_reply *cp = data;
2440         struct hci_cp_pin_code_reply reply;
2441         struct mgmt_pending_cmd *cmd;
2442         int err;
2443
2444         BT_DBG("");
2445
2446         hci_dev_lock(hdev);
2447
2448         if (!hdev_is_powered(hdev)) {
2449                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2450                                       MGMT_STATUS_NOT_POWERED);
2451                 goto failed;
2452         }
2453
2454         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2455         if (!conn) {
2456                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2457                                       MGMT_STATUS_NOT_CONNECTED);
2458                 goto failed;
2459         }
2460
2461         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2462                 struct mgmt_cp_pin_code_neg_reply ncp;
2463
2464                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2465
2466                 BT_ERR("PIN code is not 16 bytes long");
2467
2468                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2469                 if (err >= 0)
2470                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2471                                               MGMT_STATUS_INVALID_PARAMS);
2472
2473                 goto failed;
2474         }
2475
2476         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2477         if (!cmd) {
2478                 err = -ENOMEM;
2479                 goto failed;
2480         }
2481
2482         cmd->cmd_complete = addr_cmd_complete;
2483
2484         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2485         reply.pin_len = cp->pin_len;
2486         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2487
2488         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2489         if (err < 0)
2490                 mgmt_pending_remove(cmd);
2491
2492 failed:
2493         hci_dev_unlock(hdev);
2494         return err;
2495 }
2496
2497 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2498                              u16 len)
2499 {
2500         struct mgmt_cp_set_io_capability *cp = data;
2501
2502         BT_DBG("");
2503
2504         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2505                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2506                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2507
2508         hci_dev_lock(hdev);
2509
2510         hdev->io_capability = cp->io_capability;
2511
2512         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2513                hdev->io_capability);
2514
2515         hci_dev_unlock(hdev);
2516
2517         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2518                                  NULL, 0);
2519 }
2520
2521 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2522 {
2523         struct hci_dev *hdev = conn->hdev;
2524         struct mgmt_pending_cmd *cmd;
2525
2526         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2527                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2528                         continue;
2529
2530                 if (cmd->user_data != conn)
2531                         continue;
2532
2533                 return cmd;
2534         }
2535
2536         return NULL;
2537 }
2538
2539 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2540 {
2541         struct mgmt_rp_pair_device rp;
2542         struct hci_conn *conn = cmd->user_data;
2543         int err;
2544
2545         bacpy(&rp.addr.bdaddr, &conn->dst);
2546         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2547
2548         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2549                                 status, &rp, sizeof(rp));
2550
2551         /* So we don't get further callbacks for this connection */
2552         conn->connect_cfm_cb = NULL;
2553         conn->security_cfm_cb = NULL;
2554         conn->disconn_cfm_cb = NULL;
2555
2556         hci_conn_drop(conn);
2557
2558         /* The device is paired so there is no need to remove
2559          * its connection parameters anymore.
2560          */
2561         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2562
2563         hci_conn_put(conn);
2564
2565         return err;
2566 }
2567
2568 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2569 {
2570         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2571         struct mgmt_pending_cmd *cmd;
2572
2573         cmd = find_pairing(conn);
2574         if (cmd) {
2575                 cmd->cmd_complete(cmd, status);
2576                 mgmt_pending_remove(cmd);
2577         }
2578 }
2579
2580 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2581 {
2582         struct mgmt_pending_cmd *cmd;
2583
2584         BT_DBG("status %u", status);
2585
2586         cmd = find_pairing(conn);
2587         if (!cmd) {
2588                 BT_DBG("Unable to find a pending command");
2589                 return;
2590         }
2591
2592         cmd->cmd_complete(cmd, mgmt_status(status));
2593         mgmt_pending_remove(cmd);
2594 }
2595
2596 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2597 {
2598         struct mgmt_pending_cmd *cmd;
2599
2600         BT_DBG("status %u", status);
2601
2602         if (!status)
2603                 return;
2604
2605         cmd = find_pairing(conn);
2606         if (!cmd) {
2607                 BT_DBG("Unable to find a pending command");
2608                 return;
2609         }
2610
2611         cmd->cmd_complete(cmd, mgmt_status(status));
2612         mgmt_pending_remove(cmd);
2613 }
2614
2615 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2616                        u16 len)
2617 {
2618         struct mgmt_cp_pair_device *cp = data;
2619         struct mgmt_rp_pair_device rp;
2620         struct mgmt_pending_cmd *cmd;
2621         u8 sec_level, auth_type;
2622         struct hci_conn *conn;
2623         int err;
2624
2625         BT_DBG("");
2626
2627         memset(&rp, 0, sizeof(rp));
2628         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2629         rp.addr.type = cp->addr.type;
2630
2631         if (!bdaddr_type_is_valid(cp->addr.type))
2632                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2633                                          MGMT_STATUS_INVALID_PARAMS,
2634                                          &rp, sizeof(rp));
2635
2636         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2637                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2638                                          MGMT_STATUS_INVALID_PARAMS,
2639                                          &rp, sizeof(rp));
2640
2641         hci_dev_lock(hdev);
2642
2643         if (!hdev_is_powered(hdev)) {
2644                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2645                                         MGMT_STATUS_NOT_POWERED, &rp,
2646                                         sizeof(rp));
2647                 goto unlock;
2648         }
2649
2650         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2651                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2652                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2653                                         sizeof(rp));
2654                 goto unlock;
2655         }
2656
2657         sec_level = BT_SECURITY_MEDIUM;
2658         auth_type = HCI_AT_DEDICATED_BONDING;
2659
2660         if (cp->addr.type == BDADDR_BREDR) {
2661                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2662                                        auth_type);
2663         } else {
2664                 u8 addr_type = le_addr_type(cp->addr.type);
2665                 struct hci_conn_params *p;
2666
2667                 /* When pairing a new device, it is expected to remember
2668                  * this device for future connections. Adding the connection
2669                  * parameter information ahead of time allows tracking
2670                  * of the slave preferred values and will speed up any
2671                  * further connection establishment.
2672                  *
2673                  * If connection parameters already exist, then they
2674                  * will be kept and this function does nothing.
2675                  */
2676                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2677
2678                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2679                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2680
2681                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2682                                            addr_type, sec_level,
2683                                            HCI_LE_CONN_TIMEOUT);
2684         }
2685
2686         if (IS_ERR(conn)) {
2687                 int status;
2688
2689                 if (PTR_ERR(conn) == -EBUSY)
2690                         status = MGMT_STATUS_BUSY;
2691                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2692                         status = MGMT_STATUS_NOT_SUPPORTED;
2693                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2694                         status = MGMT_STATUS_REJECTED;
2695                 else
2696                         status = MGMT_STATUS_CONNECT_FAILED;
2697
2698                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2699                                         status, &rp, sizeof(rp));
2700                 goto unlock;
2701         }
2702
2703         if (conn->connect_cfm_cb) {
2704                 hci_conn_drop(conn);
2705                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2706                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2707                 goto unlock;
2708         }
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2711         if (!cmd) {
2712                 err = -ENOMEM;
2713                 hci_conn_drop(conn);
2714                 goto unlock;
2715         }
2716
2717         cmd->cmd_complete = pairing_complete;
2718
2719         /* For LE, just connecting isn't a proof that the pairing finished */
2720         if (cp->addr.type == BDADDR_BREDR) {
2721                 conn->connect_cfm_cb = pairing_complete_cb;
2722                 conn->security_cfm_cb = pairing_complete_cb;
2723                 conn->disconn_cfm_cb = pairing_complete_cb;
2724         } else {
2725                 conn->connect_cfm_cb = le_pairing_complete_cb;
2726                 conn->security_cfm_cb = le_pairing_complete_cb;
2727                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2728         }
2729
2730         conn->io_capability = cp->io_cap;
2731         cmd->user_data = hci_conn_get(conn);
2732
2733         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2734             hci_conn_security(conn, sec_level, auth_type, true)) {
2735                 cmd->cmd_complete(cmd, 0);
2736                 mgmt_pending_remove(cmd);
2737         }
2738
2739         err = 0;
2740
2741 unlock:
2742         hci_dev_unlock(hdev);
2743         return err;
2744 }
2745
2746 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2747                               u16 len)
2748 {
2749         struct mgmt_addr_info *addr = data;
2750         struct mgmt_pending_cmd *cmd;
2751         struct hci_conn *conn;
2752         int err;
2753
2754         BT_DBG("");
2755
2756         hci_dev_lock(hdev);
2757
2758         if (!hdev_is_powered(hdev)) {
2759                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2760                                       MGMT_STATUS_NOT_POWERED);
2761                 goto unlock;
2762         }
2763
2764         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2765         if (!cmd) {
2766                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2767                                       MGMT_STATUS_INVALID_PARAMS);
2768                 goto unlock;
2769         }
2770
2771         conn = cmd->user_data;
2772
2773         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2774                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2775                                       MGMT_STATUS_INVALID_PARAMS);
2776                 goto unlock;
2777         }
2778
2779         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
2780         mgmt_pending_remove(cmd);
2781
2782         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2783                                 addr, sizeof(*addr));
2784 unlock:
2785         hci_dev_unlock(hdev);
2786         return err;
2787 }
2788
2789 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2790                              struct mgmt_addr_info *addr, u16 mgmt_op,
2791                              u16 hci_op, __le32 passkey)
2792 {
2793         struct mgmt_pending_cmd *cmd;
2794         struct hci_conn *conn;
2795         int err;
2796
2797         hci_dev_lock(hdev);
2798
2799         if (!hdev_is_powered(hdev)) {
2800                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2801                                         MGMT_STATUS_NOT_POWERED, addr,
2802                                         sizeof(*addr));
2803                 goto done;
2804         }
2805
2806         if (addr->type == BDADDR_BREDR)
2807                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2808         else
2809                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
2810                                                le_addr_type(addr->type));
2811
2812         if (!conn) {
2813                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2814                                         MGMT_STATUS_NOT_CONNECTED, addr,
2815                                         sizeof(*addr));
2816                 goto done;
2817         }
2818
2819         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2820                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2821                 if (!err)
2822                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2823                                                 MGMT_STATUS_SUCCESS, addr,
2824                                                 sizeof(*addr));
2825                 else
2826                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2827                                                 MGMT_STATUS_FAILED, addr,
2828                                                 sizeof(*addr));
2829
2830                 goto done;
2831         }
2832
2833         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2834         if (!cmd) {
2835                 err = -ENOMEM;
2836                 goto done;
2837         }
2838
2839         cmd->cmd_complete = addr_cmd_complete;
2840
2841         /* Continue with pairing via HCI */
2842         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2843                 struct hci_cp_user_passkey_reply cp;
2844
2845                 bacpy(&cp.bdaddr, &addr->bdaddr);
2846                 cp.passkey = passkey;
2847                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2848         } else
2849                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2850                                    &addr->bdaddr);
2851
2852         if (err < 0)
2853                 mgmt_pending_remove(cmd);
2854
2855 done:
2856         hci_dev_unlock(hdev);
2857         return err;
2858 }
2859
2860 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2861                               void *data, u16 len)
2862 {
2863         struct mgmt_cp_pin_code_neg_reply *cp = data;
2864
2865         BT_DBG("");
2866
2867         return user_pairing_resp(sk, hdev, &cp->addr,
2868                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2869                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2870 }
2871
2872 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2873                               u16 len)
2874 {
2875         struct mgmt_cp_user_confirm_reply *cp = data;
2876
2877         BT_DBG("");
2878
2879         if (len != sizeof(*cp))
2880                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2881                                        MGMT_STATUS_INVALID_PARAMS);
2882
2883         return user_pairing_resp(sk, hdev, &cp->addr,
2884                                  MGMT_OP_USER_CONFIRM_REPLY,
2885                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2886 }
2887
2888 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2889                                   void *data, u16 len)
2890 {
2891         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2892
2893         BT_DBG("");
2894
2895         return user_pairing_resp(sk, hdev, &cp->addr,
2896                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2897                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2898 }
2899
2900 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2901                               u16 len)
2902 {
2903         struct mgmt_cp_user_passkey_reply *cp = data;
2904
2905         BT_DBG("");
2906
2907         return user_pairing_resp(sk, hdev, &cp->addr,
2908                                  MGMT_OP_USER_PASSKEY_REPLY,
2909                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2910 }
2911
2912 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2913                                   void *data, u16 len)
2914 {
2915         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2916
2917         BT_DBG("");
2918
2919         return user_pairing_resp(sk, hdev, &cp->addr,
2920                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2921                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2922 }
2923
2924 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2925 {
2926         struct mgmt_cp_set_local_name *cp;
2927         struct mgmt_pending_cmd *cmd;
2928
2929         BT_DBG("status 0x%02x", status);
2930
2931         hci_dev_lock(hdev);
2932
2933         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2934         if (!cmd)
2935                 goto unlock;
2936
2937         cp = cmd->param;
2938
2939         if (status)
2940                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2941                                 mgmt_status(status));
2942         else
2943                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2944                                   cp, sizeof(*cp));
2945
2946         mgmt_pending_remove(cmd);
2947
2948 unlock:
2949         hci_dev_unlock(hdev);
2950 }
2951
2952 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2953                           u16 len)
2954 {
2955         struct mgmt_cp_set_local_name *cp = data;
2956         struct mgmt_pending_cmd *cmd;
2957         struct hci_request req;
2958         int err;
2959
2960         BT_DBG("");
2961
2962         hci_dev_lock(hdev);
2963
2964         /* If the old values are the same as the new ones just return a
2965          * direct command complete event.
2966          */
2967         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2968             !memcmp(hdev->short_name, cp->short_name,
2969                     sizeof(hdev->short_name))) {
2970                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2971                                         data, len);
2972                 goto failed;
2973         }
2974
2975         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2976
2977         if (!hdev_is_powered(hdev)) {
2978                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2979
2980                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2981                                         data, len);
2982                 if (err < 0)
2983                         goto failed;
2984
2985                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
2986                                          data, len, sk);
2987
2988                 goto failed;
2989         }
2990
2991         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2992         if (!cmd) {
2993                 err = -ENOMEM;
2994                 goto failed;
2995         }
2996
2997         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2998
2999         hci_req_init(&req, hdev);
3000
3001         if (lmp_bredr_capable(hdev)) {
3002                 __hci_req_update_name(&req);
3003                 __hci_req_update_eir(&req);
3004         }
3005
3006         /* The name is stored in the scan response data and so
3007          * no need to udpate the advertising data here.
3008          */
3009         if (lmp_le_capable(hdev))
3010                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3011
3012         err = hci_req_run(&req, set_name_complete);
3013         if (err < 0)
3014                 mgmt_pending_remove(cmd);
3015
3016 failed:
3017         hci_dev_unlock(hdev);
3018         return err;
3019 }
3020
3021 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3022                                          u16 opcode, struct sk_buff *skb)
3023 {
3024         struct mgmt_rp_read_local_oob_data mgmt_rp;
3025         size_t rp_size = sizeof(mgmt_rp);
3026         struct mgmt_pending_cmd *cmd;
3027
3028         BT_DBG("%s status %u", hdev->name, status);
3029
3030         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3031         if (!cmd)
3032                 return;
3033
3034         if (status || !skb) {
3035                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3036                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3037                 goto remove;
3038         }
3039
3040         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3041
3042         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3043                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3044
3045                 if (skb->len < sizeof(*rp)) {
3046                         mgmt_cmd_status(cmd->sk, hdev->id,
3047                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3048                                         MGMT_STATUS_FAILED);
3049                         goto remove;
3050                 }
3051
3052                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3053                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3054
3055                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3056         } else {
3057                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3058
3059                 if (skb->len < sizeof(*rp)) {
3060                         mgmt_cmd_status(cmd->sk, hdev->id,
3061                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3062                                         MGMT_STATUS_FAILED);
3063                         goto remove;
3064                 }
3065
3066                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3067                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3068
3069                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3070                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3071         }
3072
3073         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3074                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3075
3076 remove:
3077         mgmt_pending_remove(cmd);
3078 }
3079
3080 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3081                                void *data, u16 data_len)
3082 {
3083         struct mgmt_pending_cmd *cmd;
3084         struct hci_request req;
3085         int err;
3086
3087         BT_DBG("%s", hdev->name);
3088
3089         hci_dev_lock(hdev);
3090
3091         if (!hdev_is_powered(hdev)) {
3092                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3093                                       MGMT_STATUS_NOT_POWERED);
3094                 goto unlock;
3095         }
3096
3097         if (!lmp_ssp_capable(hdev)) {
3098                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3099                                       MGMT_STATUS_NOT_SUPPORTED);
3100                 goto unlock;
3101         }
3102
3103         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3104                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3105                                       MGMT_STATUS_BUSY);
3106                 goto unlock;
3107         }
3108
3109         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3110         if (!cmd) {
3111                 err = -ENOMEM;
3112                 goto unlock;
3113         }
3114
3115         hci_req_init(&req, hdev);
3116
3117         if (bredr_sc_enabled(hdev))
3118                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3119         else
3120                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3121
3122         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3123         if (err < 0)
3124                 mgmt_pending_remove(cmd);
3125
3126 unlock:
3127         hci_dev_unlock(hdev);
3128         return err;
3129 }
3130
3131 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3132                                void *data, u16 len)
3133 {
3134         struct mgmt_addr_info *addr = data;
3135         int err;
3136
3137         BT_DBG("%s ", hdev->name);
3138
3139         if (!bdaddr_type_is_valid(addr->type))
3140                 return mgmt_cmd_complete(sk, hdev->id,
3141                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3142                                          MGMT_STATUS_INVALID_PARAMS,
3143                                          addr, sizeof(*addr));
3144
3145         hci_dev_lock(hdev);
3146
3147         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3148                 struct mgmt_cp_add_remote_oob_data *cp = data;
3149                 u8 status;
3150
3151                 if (cp->addr.type != BDADDR_BREDR) {
3152                         err = mgmt_cmd_complete(sk, hdev->id,
3153                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3154                                                 MGMT_STATUS_INVALID_PARAMS,
3155                                                 &cp->addr, sizeof(cp->addr));
3156                         goto unlock;
3157                 }
3158
3159                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3160                                               cp->addr.type, cp->hash,
3161                                               cp->rand, NULL, NULL);
3162                 if (err < 0)
3163                         status = MGMT_STATUS_FAILED;
3164                 else
3165                         status = MGMT_STATUS_SUCCESS;
3166
3167                 err = mgmt_cmd_complete(sk, hdev->id,
3168                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3169                                         &cp->addr, sizeof(cp->addr));
3170         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3171                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3172                 u8 *rand192, *hash192, *rand256, *hash256;
3173                 u8 status;
3174
3175                 if (bdaddr_type_is_le(cp->addr.type)) {
3176                         /* Enforce zero-valued 192-bit parameters as
3177                          * long as legacy SMP OOB isn't implemented.
3178                          */
3179                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3180                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3181                                 err = mgmt_cmd_complete(sk, hdev->id,
3182                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3183                                                         MGMT_STATUS_INVALID_PARAMS,
3184                                                         addr, sizeof(*addr));
3185                                 goto unlock;
3186                         }
3187
3188                         rand192 = NULL;
3189                         hash192 = NULL;
3190                 } else {
3191                         /* In case one of the P-192 values is set to zero,
3192                          * then just disable OOB data for P-192.
3193                          */
3194                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3195                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3196                                 rand192 = NULL;
3197                                 hash192 = NULL;
3198                         } else {
3199                                 rand192 = cp->rand192;
3200                                 hash192 = cp->hash192;
3201                         }
3202                 }
3203
3204                 /* In case one of the P-256 values is set to zero, then just
3205                  * disable OOB data for P-256.
3206                  */
3207                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3208                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3209                         rand256 = NULL;
3210                         hash256 = NULL;
3211                 } else {
3212                         rand256 = cp->rand256;
3213                         hash256 = cp->hash256;
3214                 }
3215
3216                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3217                                               cp->addr.type, hash192, rand192,
3218                                               hash256, rand256);
3219                 if (err < 0)
3220                         status = MGMT_STATUS_FAILED;
3221                 else
3222                         status = MGMT_STATUS_SUCCESS;
3223
3224                 err = mgmt_cmd_complete(sk, hdev->id,
3225                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3226                                         status, &cp->addr, sizeof(cp->addr));
3227         } else {
3228                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3230                                       MGMT_STATUS_INVALID_PARAMS);
3231         }
3232
3233 unlock:
3234         hci_dev_unlock(hdev);
3235         return err;
3236 }
3237
3238 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3239                                   void *data, u16 len)
3240 {
3241         struct mgmt_cp_remove_remote_oob_data *cp = data;
3242         u8 status;
3243         int err;
3244
3245         BT_DBG("%s", hdev->name);
3246
3247         if (cp->addr.type != BDADDR_BREDR)
3248                 return mgmt_cmd_complete(sk, hdev->id,
3249                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3250                                          MGMT_STATUS_INVALID_PARAMS,
3251                                          &cp->addr, sizeof(cp->addr));
3252
3253         hci_dev_lock(hdev);
3254
3255         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3256                 hci_remote_oob_data_clear(hdev);
3257                 status = MGMT_STATUS_SUCCESS;
3258                 goto done;
3259         }
3260
3261         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3262         if (err < 0)
3263                 status = MGMT_STATUS_INVALID_PARAMS;
3264         else
3265                 status = MGMT_STATUS_SUCCESS;
3266
3267 done:
3268         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3269                                 status, &cp->addr, sizeof(cp->addr));
3270
3271         hci_dev_unlock(hdev);
3272         return err;
3273 }
3274
3275 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3276 {
3277         struct mgmt_pending_cmd *cmd;
3278
3279         BT_DBG("status %d", status);
3280
3281         hci_dev_lock(hdev);
3282
3283         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3284         if (!cmd)
3285                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3286
3287         if (!cmd)
3288                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3289
3290         if (cmd) {
3291                 cmd->cmd_complete(cmd, mgmt_status(status));
3292                 mgmt_pending_remove(cmd);
3293         }
3294
3295         hci_dev_unlock(hdev);
3296 }
3297
3298 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3299                                     uint8_t *mgmt_status)
3300 {
3301         switch (type) {
3302         case DISCOV_TYPE_LE:
3303                 *mgmt_status = mgmt_le_support(hdev);
3304                 if (*mgmt_status)
3305                         return false;
3306                 break;
3307         case DISCOV_TYPE_INTERLEAVED:
3308                 *mgmt_status = mgmt_le_support(hdev);
3309                 if (*mgmt_status)
3310                         return false;
3311                 /* Intentional fall-through */
3312         case DISCOV_TYPE_BREDR:
3313                 *mgmt_status = mgmt_bredr_support(hdev);
3314                 if (*mgmt_status)
3315                         return false;
3316                 break;
3317         default:
3318                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3319                 return false;
3320         }
3321
3322         return true;
3323 }
3324
3325 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3326                                     u16 op, void *data, u16 len)
3327 {
3328         struct mgmt_cp_start_discovery *cp = data;
3329         struct mgmt_pending_cmd *cmd;
3330         u8 status;
3331         int err;
3332
3333         BT_DBG("%s", hdev->name);
3334
3335         hci_dev_lock(hdev);
3336
3337         if (!hdev_is_powered(hdev)) {
3338                 err = mgmt_cmd_complete(sk, hdev->id, op,
3339                                         MGMT_STATUS_NOT_POWERED,
3340                                         &cp->type, sizeof(cp->type));
3341                 goto failed;
3342         }
3343
3344         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3345             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3346                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3347                                         &cp->type, sizeof(cp->type));
3348                 goto failed;
3349         }
3350
3351         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3352                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3353                                         &cp->type, sizeof(cp->type));
3354                 goto failed;
3355         }
3356
3357         /* Clear the discovery filter first to free any previously
3358          * allocated memory for the UUID list.
3359          */
3360         hci_discovery_filter_clear(hdev);
3361
3362         hdev->discovery.type = cp->type;
3363         hdev->discovery.report_invalid_rssi = false;
3364         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3365                 hdev->discovery.limited = true;
3366         else
3367                 hdev->discovery.limited = false;
3368
3369         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3370         if (!cmd) {
3371                 err = -ENOMEM;
3372                 goto failed;
3373         }
3374
3375         cmd->cmd_complete = generic_cmd_complete;
3376
3377         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3378         queue_work(hdev->req_workqueue, &hdev->discov_update);
3379         err = 0;
3380
3381 failed:
3382         hci_dev_unlock(hdev);
3383         return err;
3384 }
3385
3386 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3387                            void *data, u16 len)
3388 {
3389         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3390                                         data, len);
3391 }
3392
3393 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3394                                    void *data, u16 len)
3395 {
3396         return start_discovery_internal(sk, hdev,
3397                                         MGMT_OP_START_LIMITED_DISCOVERY,
3398                                         data, len);
3399 }
3400
3401 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3402                                           u8 status)
3403 {
3404         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3405                                  cmd->param, 1);
3406 }
3407
3408 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3409                                    void *data, u16 len)
3410 {
3411         struct mgmt_cp_start_service_discovery *cp = data;
3412         struct mgmt_pending_cmd *cmd;
3413         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3414         u16 uuid_count, expected_len;
3415         u8 status;
3416         int err;
3417
3418         BT_DBG("%s", hdev->name);
3419
3420         hci_dev_lock(hdev);
3421
3422         if (!hdev_is_powered(hdev)) {
3423                 err = mgmt_cmd_complete(sk, hdev->id,
3424                                         MGMT_OP_START_SERVICE_DISCOVERY,
3425                                         MGMT_STATUS_NOT_POWERED,
3426                                         &cp->type, sizeof(cp->type));
3427                 goto failed;
3428         }
3429
3430         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3431             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3432                 err = mgmt_cmd_complete(sk, hdev->id,
3433                                         MGMT_OP_START_SERVICE_DISCOVERY,
3434                                         MGMT_STATUS_BUSY, &cp->type,
3435                                         sizeof(cp->type));
3436                 goto failed;
3437         }
3438
3439         uuid_count = __le16_to_cpu(cp->uuid_count);
3440         if (uuid_count > max_uuid_count) {
3441                 BT_ERR("service_discovery: too big uuid_count value %u",
3442                        uuid_count);
3443                 err = mgmt_cmd_complete(sk, hdev->id,
3444                                         MGMT_OP_START_SERVICE_DISCOVERY,
3445                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3446                                         sizeof(cp->type));
3447                 goto failed;
3448         }
3449
3450         expected_len = sizeof(*cp) + uuid_count * 16;
3451         if (expected_len != len) {
3452                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
3453                        expected_len, len);
3454                 err = mgmt_cmd_complete(sk, hdev->id,
3455                                         MGMT_OP_START_SERVICE_DISCOVERY,
3456                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3457                                         sizeof(cp->type));
3458                 goto failed;
3459         }
3460
3461         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3462                 err = mgmt_cmd_complete(sk, hdev->id,
3463                                         MGMT_OP_START_SERVICE_DISCOVERY,
3464                                         status, &cp->type, sizeof(cp->type));
3465                 goto failed;
3466         }
3467
3468         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3469                                hdev, data, len);
3470         if (!cmd) {
3471                 err = -ENOMEM;
3472                 goto failed;
3473         }
3474
3475         cmd->cmd_complete = service_discovery_cmd_complete;
3476
3477         /* Clear the discovery filter first to free any previously
3478          * allocated memory for the UUID list.
3479          */
3480         hci_discovery_filter_clear(hdev);
3481
3482         hdev->discovery.result_filtering = true;
3483         hdev->discovery.type = cp->type;
3484         hdev->discovery.rssi = cp->rssi;
3485         hdev->discovery.uuid_count = uuid_count;
3486
3487         if (uuid_count > 0) {
3488                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
3489                                                 GFP_KERNEL);
3490                 if (!hdev->discovery.uuids) {
3491                         err = mgmt_cmd_complete(sk, hdev->id,
3492                                                 MGMT_OP_START_SERVICE_DISCOVERY,
3493                                                 MGMT_STATUS_FAILED,
3494                                                 &cp->type, sizeof(cp->type));
3495                         mgmt_pending_remove(cmd);
3496                         goto failed;
3497                 }
3498         }
3499
3500         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3501         queue_work(hdev->req_workqueue, &hdev->discov_update);
3502         err = 0;
3503
3504 failed:
3505         hci_dev_unlock(hdev);
3506         return err;
3507 }
3508
3509 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
3510 {
3511         struct mgmt_pending_cmd *cmd;
3512
3513         BT_DBG("status %d", status);
3514
3515         hci_dev_lock(hdev);
3516
3517         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3518         if (cmd) {
3519                 cmd->cmd_complete(cmd, mgmt_status(status));
3520                 mgmt_pending_remove(cmd);
3521         }
3522
3523         hci_dev_unlock(hdev);
3524 }
3525
3526 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3527                           u16 len)
3528 {
3529         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3530         struct mgmt_pending_cmd *cmd;
3531         int err;
3532
3533         BT_DBG("%s", hdev->name);
3534
3535         hci_dev_lock(hdev);
3536
3537         if (!hci_discovery_active(hdev)) {
3538                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3539                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
3540                                         sizeof(mgmt_cp->type));
3541                 goto unlock;
3542         }
3543
3544         if (hdev->discovery.type != mgmt_cp->type) {
3545                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3546                                         MGMT_STATUS_INVALID_PARAMS,
3547                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
3548                 goto unlock;
3549         }
3550
3551         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
3552         if (!cmd) {
3553                 err = -ENOMEM;
3554                 goto unlock;
3555         }
3556
3557         cmd->cmd_complete = generic_cmd_complete;
3558
3559         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3560         queue_work(hdev->req_workqueue, &hdev->discov_update);
3561         err = 0;
3562
3563 unlock:
3564         hci_dev_unlock(hdev);
3565         return err;
3566 }
3567
3568 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3569                         u16 len)
3570 {
3571         struct mgmt_cp_confirm_name *cp = data;
3572         struct inquiry_entry *e;
3573         int err;
3574
3575         BT_DBG("%s", hdev->name);
3576
3577         hci_dev_lock(hdev);
3578
3579         if (!hci_discovery_active(hdev)) {
3580                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3581                                         MGMT_STATUS_FAILED, &cp->addr,
3582                                         sizeof(cp->addr));
3583                 goto failed;
3584         }
3585
3586         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3587         if (!e) {
3588                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3589                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3590                                         sizeof(cp->addr));
3591                 goto failed;
3592         }
3593
3594         if (cp->name_known) {
3595                 e->name_state = NAME_KNOWN;
3596                 list_del(&e->list);
3597         } else {
3598                 e->name_state = NAME_NEEDED;
3599                 hci_inquiry_cache_update_resolve(hdev, e);
3600         }
3601
3602         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
3603                                 &cp->addr, sizeof(cp->addr));
3604
3605 failed:
3606         hci_dev_unlock(hdev);
3607         return err;
3608 }
3609
3610 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3611                         u16 len)
3612 {
3613         struct mgmt_cp_block_device *cp = data;
3614         u8 status;
3615         int err;
3616
3617         BT_DBG("%s", hdev->name);
3618
3619         if (!bdaddr_type_is_valid(cp->addr.type))
3620                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3621                                          MGMT_STATUS_INVALID_PARAMS,
3622                                          &cp->addr, sizeof(cp->addr));
3623
3624         hci_dev_lock(hdev);
3625
3626         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3627                                   cp->addr.type);
3628         if (err < 0) {
3629                 status = MGMT_STATUS_FAILED;
3630                 goto done;
3631         }
3632
3633         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3634                    sk);
3635         status = MGMT_STATUS_SUCCESS;
3636
3637 done:
3638         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3639                                 &cp->addr, sizeof(cp->addr));
3640
3641         hci_dev_unlock(hdev);
3642
3643         return err;
3644 }
3645
3646 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3647                           u16 len)
3648 {
3649         struct mgmt_cp_unblock_device *cp = data;
3650         u8 status;
3651         int err;
3652
3653         BT_DBG("%s", hdev->name);
3654
3655         if (!bdaddr_type_is_valid(cp->addr.type))
3656                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3657                                          MGMT_STATUS_INVALID_PARAMS,
3658                                          &cp->addr, sizeof(cp->addr));
3659
3660         hci_dev_lock(hdev);
3661
3662         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
3663                                   cp->addr.type);
3664         if (err < 0) {
3665                 status = MGMT_STATUS_INVALID_PARAMS;
3666                 goto done;
3667         }
3668
3669         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3670                    sk);
3671         status = MGMT_STATUS_SUCCESS;
3672
3673 done:
3674         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3675                                 &cp->addr, sizeof(cp->addr));
3676
3677         hci_dev_unlock(hdev);
3678
3679         return err;
3680 }
3681
3682 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3683                          u16 len)
3684 {
3685         struct mgmt_cp_set_device_id *cp = data;
3686         struct hci_request req;
3687         int err;
3688         __u16 source;
3689
3690         BT_DBG("%s", hdev->name);
3691
3692         source = __le16_to_cpu(cp->source);
3693
3694         if (source > 0x0002)
3695                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3696                                        MGMT_STATUS_INVALID_PARAMS);
3697
3698         hci_dev_lock(hdev);
3699
3700         hdev->devid_source = source;
3701         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3702         hdev->devid_product = __le16_to_cpu(cp->product);
3703         hdev->devid_version = __le16_to_cpu(cp->version);
3704
3705         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
3706                                 NULL, 0);
3707
3708         hci_req_init(&req, hdev);
3709         __hci_req_update_eir(&req);
3710         hci_req_run(&req, NULL);
3711
3712         hci_dev_unlock(hdev);
3713
3714         return err;
3715 }
3716
3717 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
3718                                         u16 opcode)
3719 {
3720         BT_DBG("status %d", status);
3721 }
3722
3723 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
3724                                      u16 opcode)
3725 {
3726         struct cmd_lookup match = { NULL, hdev };
3727         struct hci_request req;
3728         u8 instance;
3729         struct adv_info *adv_instance;
3730         int err;
3731
3732         hci_dev_lock(hdev);
3733
3734         if (status) {
3735                 u8 mgmt_err = mgmt_status(status);
3736
3737                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3738                                      cmd_status_rsp, &mgmt_err);
3739                 goto unlock;
3740         }
3741
3742         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3743                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
3744         else
3745                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3746
3747         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3748                              &match);
3749
3750         new_settings(hdev, match.sk);
3751
3752         if (match.sk)
3753                 sock_put(match.sk);
3754
3755         /* If "Set Advertising" was just disabled and instance advertising was
3756          * set up earlier, then re-enable multi-instance advertising.
3757          */
3758         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3759             list_empty(&hdev->adv_instances))
3760                 goto unlock;
3761
3762         instance = hdev->cur_adv_instance;
3763         if (!instance) {
3764                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
3765                                                         struct adv_info, list);
3766                 if (!adv_instance)
3767                         goto unlock;
3768
3769                 instance = adv_instance->instance;
3770         }
3771
3772         hci_req_init(&req, hdev);
3773
3774         err = __hci_req_schedule_adv_instance(&req, instance, true);
3775
3776         if (!err)
3777                 err = hci_req_run(&req, enable_advertising_instance);
3778
3779         if (err)
3780                 BT_ERR("Failed to re-configure advertising");
3781
3782 unlock:
3783         hci_dev_unlock(hdev);
3784 }
3785
3786 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3787                            u16 len)
3788 {
3789         struct mgmt_mode *cp = data;
3790         struct mgmt_pending_cmd *cmd;
3791         struct hci_request req;
3792         u8 val, status;
3793         int err;
3794
3795         BT_DBG("request for %s", hdev->name);
3796
3797         status = mgmt_le_support(hdev);
3798         if (status)
3799                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3800                                        status);
3801
3802         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
3803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3804                                        MGMT_STATUS_INVALID_PARAMS);
3805
3806         hci_dev_lock(hdev);
3807
3808         val = !!cp->val;
3809
3810         /* The following conditions are ones which mean that we should
3811          * not do any HCI communication but directly send a mgmt
3812          * response to user space (after toggling the flag if
3813          * necessary).
3814          */
3815         if (!hdev_is_powered(hdev) ||
3816             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
3817              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
3818             hci_conn_num(hdev, LE_LINK) > 0 ||
3819             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3820              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
3821                 bool changed;
3822
3823                 if (cp->val) {
3824                         hdev->cur_adv_instance = 0x00;
3825                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
3826                         if (cp->val == 0x02)
3827                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3828                         else
3829                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3830                 } else {
3831                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
3832                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3833                 }
3834
3835                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3836                 if (err < 0)
3837                         goto unlock;
3838
3839                 if (changed)
3840                         err = new_settings(hdev, sk);
3841
3842                 goto unlock;
3843         }
3844
3845         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3846             pending_find(MGMT_OP_SET_LE, hdev)) {
3847                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3848                                       MGMT_STATUS_BUSY);
3849                 goto unlock;
3850         }
3851
3852         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3853         if (!cmd) {
3854                 err = -ENOMEM;
3855                 goto unlock;
3856         }
3857
3858         hci_req_init(&req, hdev);
3859
3860         if (cp->val == 0x02)
3861                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3862         else
3863                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3864
3865         cancel_adv_timeout(hdev);
3866
3867         if (val) {
3868                 /* Switch to instance "0" for the Set Advertising setting.
3869                  * We cannot use update_[adv|scan_rsp]_data() here as the
3870                  * HCI_ADVERTISING flag is not yet set.
3871                  */
3872                 hdev->cur_adv_instance = 0x00;
3873                 __hci_req_update_adv_data(&req, 0x00);
3874                 __hci_req_update_scan_rsp_data(&req, 0x00);
3875                 __hci_req_enable_advertising(&req);
3876         } else {
3877                 __hci_req_disable_advertising(&req);
3878         }
3879
3880         err = hci_req_run(&req, set_advertising_complete);
3881         if (err < 0)
3882                 mgmt_pending_remove(cmd);
3883
3884 unlock:
3885         hci_dev_unlock(hdev);
3886         return err;
3887 }
3888
3889 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3890                               void *data, u16 len)
3891 {
3892         struct mgmt_cp_set_static_address *cp = data;
3893         int err;
3894
3895         BT_DBG("%s", hdev->name);
3896
3897         if (!lmp_le_capable(hdev))
3898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3899                                        MGMT_STATUS_NOT_SUPPORTED);
3900
3901         if (hdev_is_powered(hdev))
3902                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3903                                        MGMT_STATUS_REJECTED);
3904
3905         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3906                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3907                         return mgmt_cmd_status(sk, hdev->id,
3908                                                MGMT_OP_SET_STATIC_ADDRESS,
3909                                                MGMT_STATUS_INVALID_PARAMS);
3910
3911                 /* Two most significant bits shall be set */
3912                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3913                         return mgmt_cmd_status(sk, hdev->id,
3914                                                MGMT_OP_SET_STATIC_ADDRESS,
3915                                                MGMT_STATUS_INVALID_PARAMS);
3916         }
3917
3918         hci_dev_lock(hdev);
3919
3920         bacpy(&hdev->static_addr, &cp->bdaddr);
3921
3922         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
3923         if (err < 0)
3924                 goto unlock;
3925
3926         err = new_settings(hdev, sk);
3927
3928 unlock:
3929         hci_dev_unlock(hdev);
3930         return err;
3931 }
3932
3933 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3934                            void *data, u16 len)
3935 {
3936         struct mgmt_cp_set_scan_params *cp = data;
3937         __u16 interval, window;
3938         int err;
3939
3940         BT_DBG("%s", hdev->name);
3941
3942         if (!lmp_le_capable(hdev))
3943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3944                                        MGMT_STATUS_NOT_SUPPORTED);
3945
3946         interval = __le16_to_cpu(cp->interval);
3947
3948         if (interval < 0x0004 || interval > 0x4000)
3949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3950                                        MGMT_STATUS_INVALID_PARAMS);
3951
3952         window = __le16_to_cpu(cp->window);
3953
3954         if (window < 0x0004 || window > 0x4000)
3955                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3956                                        MGMT_STATUS_INVALID_PARAMS);
3957
3958         if (window > interval)
3959                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3960                                        MGMT_STATUS_INVALID_PARAMS);
3961
3962         hci_dev_lock(hdev);
3963
3964         hdev->le_scan_interval = interval;
3965         hdev->le_scan_window = window;
3966
3967         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
3968                                 NULL, 0);
3969
3970         /* If background scan is running, restart it so new parameters are
3971          * loaded.
3972          */
3973         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3974             hdev->discovery.state == DISCOVERY_STOPPED) {
3975                 struct hci_request req;
3976
3977                 hci_req_init(&req, hdev);
3978
3979                 hci_req_add_le_scan_disable(&req);
3980                 hci_req_add_le_passive_scan(&req);
3981
3982                 hci_req_run(&req, NULL);
3983         }
3984
3985         hci_dev_unlock(hdev);
3986
3987         return err;
3988 }
3989
3990 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
3991                                       u16 opcode)
3992 {
3993         struct mgmt_pending_cmd *cmd;
3994
3995         BT_DBG("status 0x%02x", status);
3996
3997         hci_dev_lock(hdev);
3998
3999         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4000         if (!cmd)
4001                 goto unlock;
4002
4003         if (status) {
4004                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4005                                 mgmt_status(status));
4006         } else {
4007                 struct mgmt_mode *cp = cmd->param;
4008
4009                 if (cp->val)
4010                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4011                 else
4012                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4013
4014                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4015                 new_settings(hdev, cmd->sk);
4016         }
4017
4018         mgmt_pending_remove(cmd);
4019
4020 unlock:
4021         hci_dev_unlock(hdev);
4022 }
4023
4024 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4025                                 void *data, u16 len)
4026 {
4027         struct mgmt_mode *cp = data;
4028         struct mgmt_pending_cmd *cmd;
4029         struct hci_request req;
4030         int err;
4031
4032         BT_DBG("%s", hdev->name);
4033
4034         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4035             hdev->hci_ver < BLUETOOTH_VER_1_2)
4036                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4037                                        MGMT_STATUS_NOT_SUPPORTED);
4038
4039         if (cp->val != 0x00 && cp->val != 0x01)
4040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4041                                        MGMT_STATUS_INVALID_PARAMS);
4042
4043         hci_dev_lock(hdev);
4044
4045         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4047                                       MGMT_STATUS_BUSY);
4048                 goto unlock;
4049         }
4050
4051         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4052                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4053                                         hdev);
4054                 goto unlock;
4055         }
4056
4057         if (!hdev_is_powered(hdev)) {
4058                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4059                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4060                                         hdev);
4061                 new_settings(hdev, sk);
4062                 goto unlock;
4063         }
4064
4065         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4066                                data, len);
4067         if (!cmd) {
4068                 err = -ENOMEM;
4069                 goto unlock;
4070         }
4071
4072         hci_req_init(&req, hdev);
4073
4074         __hci_req_write_fast_connectable(&req, cp->val);
4075
4076         err = hci_req_run(&req, fast_connectable_complete);
4077         if (err < 0) {
4078                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4079                                       MGMT_STATUS_FAILED);
4080                 mgmt_pending_remove(cmd);
4081         }
4082
4083 unlock:
4084         hci_dev_unlock(hdev);
4085
4086         return err;
4087 }
4088
4089 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4090 {
4091         struct mgmt_pending_cmd *cmd;
4092
4093         BT_DBG("status 0x%02x", status);
4094
4095         hci_dev_lock(hdev);
4096
4097         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4098         if (!cmd)
4099                 goto unlock;
4100
4101         if (status) {
4102                 u8 mgmt_err = mgmt_status(status);
4103
4104                 /* We need to restore the flag if related HCI commands
4105                  * failed.
4106                  */
4107                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4108
4109                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4110         } else {
4111                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4112                 new_settings(hdev, cmd->sk);
4113         }
4114
4115         mgmt_pending_remove(cmd);
4116
4117 unlock:
4118         hci_dev_unlock(hdev);
4119 }
4120
4121 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4122 {
4123         struct mgmt_mode *cp = data;
4124         struct mgmt_pending_cmd *cmd;
4125         struct hci_request req;
4126         int err;
4127
4128         BT_DBG("request for %s", hdev->name);
4129
4130         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4131                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4132                                        MGMT_STATUS_NOT_SUPPORTED);
4133
4134         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4136                                        MGMT_STATUS_REJECTED);
4137
4138         if (cp->val != 0x00 && cp->val != 0x01)
4139                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4140                                        MGMT_STATUS_INVALID_PARAMS);
4141
4142         hci_dev_lock(hdev);
4143
4144         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4145                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4146                 goto unlock;
4147         }
4148
4149         if (!hdev_is_powered(hdev)) {
4150                 if (!cp->val) {
4151                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4152                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4153                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4154                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4155                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4156                 }
4157
4158                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4159
4160                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4161                 if (err < 0)
4162                         goto unlock;
4163
4164                 err = new_settings(hdev, sk);
4165                 goto unlock;
4166         }
4167
4168         /* Reject disabling when powered on */
4169         if (!cp->val) {
4170                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4171                                       MGMT_STATUS_REJECTED);
4172                 goto unlock;
4173         } else {
4174                 /* When configuring a dual-mode controller to operate
4175                  * with LE only and using a static address, then switching
4176                  * BR/EDR back on is not allowed.
4177                  *
4178                  * Dual-mode controllers shall operate with the public
4179                  * address as its identity address for BR/EDR and LE. So
4180                  * reject the attempt to create an invalid configuration.
4181                  *
4182                  * The same restrictions applies when secure connections
4183                  * has been enabled. For BR/EDR this is a controller feature
4184                  * while for LE it is a host stack feature. This means that
4185                  * switching BR/EDR back on when secure connections has been
4186                  * enabled is not a supported transaction.
4187                  */
4188                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4189                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4190                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4191                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4192                                               MGMT_STATUS_REJECTED);
4193                         goto unlock;
4194                 }
4195         }
4196
4197         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4198                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4199                                       MGMT_STATUS_BUSY);
4200                 goto unlock;
4201         }
4202
4203         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4204         if (!cmd) {
4205                 err = -ENOMEM;
4206                 goto unlock;
4207         }
4208
4209         /* We need to flip the bit already here so that
4210          * hci_req_update_adv_data generates the correct flags.
4211          */
4212         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4213
4214         hci_req_init(&req, hdev);
4215
4216         __hci_req_write_fast_connectable(&req, false);
4217         __hci_req_update_scan(&req);
4218
4219         /* Since only the advertising data flags will change, there
4220          * is no need to update the scan response data.
4221          */
4222         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4223
4224         err = hci_req_run(&req, set_bredr_complete);
4225         if (err < 0)
4226                 mgmt_pending_remove(cmd);
4227
4228 unlock:
4229         hci_dev_unlock(hdev);
4230         return err;
4231 }
4232
4233 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4234 {
4235         struct mgmt_pending_cmd *cmd;
4236         struct mgmt_mode *cp;
4237
4238         BT_DBG("%s status %u", hdev->name, status);
4239
4240         hci_dev_lock(hdev);
4241
4242         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4243         if (!cmd)
4244                 goto unlock;
4245
4246         if (status) {
4247                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4248                                 mgmt_status(status));
4249                 goto remove;
4250         }
4251
4252         cp = cmd->param;
4253
4254         switch (cp->val) {
4255         case 0x00:
4256                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4257                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4258                 break;
4259         case 0x01:
4260                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4261                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4262                 break;
4263         case 0x02:
4264                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4265                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4266                 break;
4267         }
4268
4269         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4270         new_settings(hdev, cmd->sk);
4271
4272 remove:
4273         mgmt_pending_remove(cmd);
4274 unlock:
4275         hci_dev_unlock(hdev);
4276 }
4277
4278 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4279                            void *data, u16 len)
4280 {
4281         struct mgmt_mode *cp = data;
4282         struct mgmt_pending_cmd *cmd;
4283         struct hci_request req;
4284         u8 val;
4285         int err;
4286
4287         BT_DBG("request for %s", hdev->name);
4288
4289         if (!lmp_sc_capable(hdev) &&
4290             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4291                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4292                                        MGMT_STATUS_NOT_SUPPORTED);
4293
4294         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4295             lmp_sc_capable(hdev) &&
4296             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4297                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4298                                        MGMT_STATUS_REJECTED);
4299
4300         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4302                                   MGMT_STATUS_INVALID_PARAMS);
4303
4304         hci_dev_lock(hdev);
4305
4306         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4307             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4308                 bool changed;
4309
4310                 if (cp->val) {
4311                         changed = !hci_dev_test_and_set_flag(hdev,
4312                                                              HCI_SC_ENABLED);
4313                         if (cp->val == 0x02)
4314                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4315                         else
4316                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4317                 } else {
4318                         changed = hci_dev_test_and_clear_flag(hdev,
4319                                                               HCI_SC_ENABLED);
4320                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4321                 }
4322
4323                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4324                 if (err < 0)
4325                         goto failed;
4326
4327                 if (changed)
4328                         err = new_settings(hdev, sk);
4329
4330                 goto failed;
4331         }
4332
4333         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4334                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4335                                       MGMT_STATUS_BUSY);
4336                 goto failed;
4337         }
4338
4339         val = !!cp->val;
4340
4341         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4342             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4343                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4344                 goto failed;
4345         }
4346
4347         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4348         if (!cmd) {
4349                 err = -ENOMEM;
4350                 goto failed;
4351         }
4352
4353         hci_req_init(&req, hdev);
4354         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4355         err = hci_req_run(&req, sc_enable_complete);
4356         if (err < 0) {
4357                 mgmt_pending_remove(cmd);
4358                 goto failed;
4359         }
4360
4361 failed:
4362         hci_dev_unlock(hdev);
4363         return err;
4364 }
4365
4366 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4367                           void *data, u16 len)
4368 {
4369         struct mgmt_mode *cp = data;
4370         bool changed, use_changed;
4371         int err;
4372
4373         BT_DBG("request for %s", hdev->name);
4374
4375         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4377                                        MGMT_STATUS_INVALID_PARAMS);
4378
4379         hci_dev_lock(hdev);
4380
4381         if (cp->val)
4382                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4383         else
4384                 changed = hci_dev_test_and_clear_flag(hdev,
4385                                                       HCI_KEEP_DEBUG_KEYS);
4386
4387         if (cp->val == 0x02)
4388                 use_changed = !hci_dev_test_and_set_flag(hdev,
4389                                                          HCI_USE_DEBUG_KEYS);
4390         else
4391                 use_changed = hci_dev_test_and_clear_flag(hdev,
4392                                                           HCI_USE_DEBUG_KEYS);
4393
4394         if (hdev_is_powered(hdev) && use_changed &&
4395             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4396                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4397                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4398                              sizeof(mode), &mode);
4399         }
4400
4401         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4402         if (err < 0)
4403                 goto unlock;
4404
4405         if (changed)
4406                 err = new_settings(hdev, sk);
4407
4408 unlock:
4409         hci_dev_unlock(hdev);
4410         return err;
4411 }
4412
4413 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4414                        u16 len)
4415 {
4416         struct mgmt_cp_set_privacy *cp = cp_data;
4417         bool changed;
4418         int err;
4419
4420         BT_DBG("request for %s", hdev->name);
4421
4422         if (!lmp_le_capable(hdev))
4423                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4424                                        MGMT_STATUS_NOT_SUPPORTED);
4425
4426         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4427                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4428                                        MGMT_STATUS_INVALID_PARAMS);
4429
4430         if (hdev_is_powered(hdev))
4431                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4432                                        MGMT_STATUS_REJECTED);
4433
4434         hci_dev_lock(hdev);
4435
4436         /* If user space supports this command it is also expected to
4437          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4438          */
4439         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4440
4441         if (cp->privacy) {
4442                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4443                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4444                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4445         } else {
4446                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4447                 memset(hdev->irk, 0, sizeof(hdev->irk));
4448                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4449         }
4450
4451         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4452         if (err < 0)
4453                 goto unlock;
4454
4455         if (changed)
4456                 err = new_settings(hdev, sk);
4457
4458 unlock:
4459         hci_dev_unlock(hdev);
4460         return err;
4461 }
4462
4463 static bool irk_is_valid(struct mgmt_irk_info *irk)
4464 {
4465         switch (irk->addr.type) {
4466         case BDADDR_LE_PUBLIC:
4467                 return true;
4468
4469         case BDADDR_LE_RANDOM:
4470                 /* Two most significant bits shall be set */
4471                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4472                         return false;
4473                 return true;
4474         }
4475
4476         return false;
4477 }
4478
4479 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4480                      u16 len)
4481 {
4482         struct mgmt_cp_load_irks *cp = cp_data;
4483         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4484                                    sizeof(struct mgmt_irk_info));
4485         u16 irk_count, expected_len;
4486         int i, err;
4487
4488         BT_DBG("request for %s", hdev->name);
4489
4490         if (!lmp_le_capable(hdev))
4491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4492                                        MGMT_STATUS_NOT_SUPPORTED);
4493
4494         irk_count = __le16_to_cpu(cp->irk_count);
4495         if (irk_count > max_irk_count) {
4496                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4498                                        MGMT_STATUS_INVALID_PARAMS);
4499         }
4500
4501         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4502         if (expected_len != len) {
4503                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4504                        expected_len, len);
4505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4506                                        MGMT_STATUS_INVALID_PARAMS);
4507         }
4508
4509         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4510
4511         for (i = 0; i < irk_count; i++) {
4512                 struct mgmt_irk_info *key = &cp->irks[i];
4513
4514                 if (!irk_is_valid(key))
4515                         return mgmt_cmd_status(sk, hdev->id,
4516                                                MGMT_OP_LOAD_IRKS,
4517                                                MGMT_STATUS_INVALID_PARAMS);
4518         }
4519
4520         hci_dev_lock(hdev);
4521
4522         hci_smp_irks_clear(hdev);
4523
4524         for (i = 0; i < irk_count; i++) {
4525                 struct mgmt_irk_info *irk = &cp->irks[i];
4526
4527                 hci_add_irk(hdev, &irk->addr.bdaddr,
4528                             le_addr_type(irk->addr.type), irk->val,
4529                             BDADDR_ANY);
4530         }
4531
4532         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4533
4534         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4535
4536         hci_dev_unlock(hdev);
4537
4538         return err;
4539 }
4540
4541 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4542 {
4543         if (key->master != 0x00 && key->master != 0x01)
4544                 return false;
4545
4546         switch (key->addr.type) {
4547         case BDADDR_LE_PUBLIC:
4548                 return true;
4549
4550         case BDADDR_LE_RANDOM:
4551                 /* Two most significant bits shall be set */
4552                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4553                         return false;
4554                 return true;
4555         }
4556
4557         return false;
4558 }
4559
4560 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4561                                void *cp_data, u16 len)
4562 {
4563         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4564         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4565                                    sizeof(struct mgmt_ltk_info));
4566         u16 key_count, expected_len;
4567         int i, err;
4568
4569         BT_DBG("request for %s", hdev->name);
4570
4571         if (!lmp_le_capable(hdev))
4572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4573                                        MGMT_STATUS_NOT_SUPPORTED);
4574
4575         key_count = __le16_to_cpu(cp->key_count);
4576         if (key_count > max_key_count) {
4577                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4579                                        MGMT_STATUS_INVALID_PARAMS);
4580         }
4581
4582         expected_len = sizeof(*cp) + key_count *
4583                                         sizeof(struct mgmt_ltk_info);
4584         if (expected_len != len) {
4585                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4586                        expected_len, len);
4587                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4588                                        MGMT_STATUS_INVALID_PARAMS);
4589         }
4590
4591         BT_DBG("%s key_count %u", hdev->name, key_count);
4592
4593         for (i = 0; i < key_count; i++) {
4594                 struct mgmt_ltk_info *key = &cp->keys[i];
4595
4596                 if (!ltk_is_valid(key))
4597                         return mgmt_cmd_status(sk, hdev->id,
4598                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
4599                                                MGMT_STATUS_INVALID_PARAMS);
4600         }
4601
4602         hci_dev_lock(hdev);
4603
4604         hci_smp_ltks_clear(hdev);
4605
4606         for (i = 0; i < key_count; i++) {
4607                 struct mgmt_ltk_info *key = &cp->keys[i];
4608                 u8 type, authenticated;
4609
4610                 switch (key->type) {
4611                 case MGMT_LTK_UNAUTHENTICATED:
4612                         authenticated = 0x00;
4613                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4614                         break;
4615                 case MGMT_LTK_AUTHENTICATED:
4616                         authenticated = 0x01;
4617                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4618                         break;
4619                 case MGMT_LTK_P256_UNAUTH:
4620                         authenticated = 0x00;
4621                         type = SMP_LTK_P256;
4622                         break;
4623                 case MGMT_LTK_P256_AUTH:
4624                         authenticated = 0x01;
4625                         type = SMP_LTK_P256;
4626                         break;
4627                 case MGMT_LTK_P256_DEBUG:
4628                         authenticated = 0x00;
4629                         type = SMP_LTK_P256_DEBUG;
4630                 default:
4631                         continue;
4632                 }
4633
4634                 hci_add_ltk(hdev, &key->addr.bdaddr,
4635                             le_addr_type(key->addr.type), type, authenticated,
4636                             key->val, key->enc_size, key->ediv, key->rand);
4637         }
4638
4639         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4640                            NULL, 0);
4641
4642         hci_dev_unlock(hdev);
4643
4644         return err;
4645 }
4646
4647 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4648 {
4649         struct hci_conn *conn = cmd->user_data;
4650         struct mgmt_rp_get_conn_info rp;
4651         int err;
4652
4653         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
4654
4655         if (status == MGMT_STATUS_SUCCESS) {
4656                 rp.rssi = conn->rssi;
4657                 rp.tx_power = conn->tx_power;
4658                 rp.max_tx_power = conn->max_tx_power;
4659         } else {
4660                 rp.rssi = HCI_RSSI_INVALID;
4661                 rp.tx_power = HCI_TX_POWER_INVALID;
4662                 rp.max_tx_power = HCI_TX_POWER_INVALID;
4663         }
4664
4665         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4666                                 status, &rp, sizeof(rp));
4667
4668         hci_conn_drop(conn);
4669         hci_conn_put(conn);
4670
4671         return err;
4672 }
4673
4674 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
4675                                        u16 opcode)
4676 {
4677         struct hci_cp_read_rssi *cp;
4678         struct mgmt_pending_cmd *cmd;
4679         struct hci_conn *conn;
4680         u16 handle;
4681         u8 status;
4682
4683         BT_DBG("status 0x%02x", hci_status);
4684
4685         hci_dev_lock(hdev);
4686
4687         /* Commands sent in request are either Read RSSI or Read Transmit Power
4688          * Level so we check which one was last sent to retrieve connection
4689          * handle.  Both commands have handle as first parameter so it's safe to
4690          * cast data on the same command struct.
4691          *
4692          * First command sent is always Read RSSI and we fail only if it fails.
4693          * In other case we simply override error to indicate success as we
4694          * already remembered if TX power value is actually valid.
4695          */
4696         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4697         if (!cp) {
4698                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4699                 status = MGMT_STATUS_SUCCESS;
4700         } else {
4701                 status = mgmt_status(hci_status);
4702         }
4703
4704         if (!cp) {
4705                 BT_ERR("invalid sent_cmd in conn_info response");
4706                 goto unlock;
4707         }
4708
4709         handle = __le16_to_cpu(cp->handle);
4710         conn = hci_conn_hash_lookup_handle(hdev, handle);
4711         if (!conn) {
4712                 BT_ERR("unknown handle (%d) in conn_info response", handle);
4713                 goto unlock;
4714         }
4715
4716         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
4717         if (!cmd)
4718                 goto unlock;
4719
4720         cmd->cmd_complete(cmd, status);
4721         mgmt_pending_remove(cmd);
4722
4723 unlock:
4724         hci_dev_unlock(hdev);
4725 }
4726
4727 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4728                          u16 len)
4729 {
4730         struct mgmt_cp_get_conn_info *cp = data;
4731         struct mgmt_rp_get_conn_info rp;
4732         struct hci_conn *conn;
4733         unsigned long conn_info_age;
4734         int err = 0;
4735
4736         BT_DBG("%s", hdev->name);
4737
4738         memset(&rp, 0, sizeof(rp));
4739         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4740         rp.addr.type = cp->addr.type;
4741
4742         if (!bdaddr_type_is_valid(cp->addr.type))
4743                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4744                                          MGMT_STATUS_INVALID_PARAMS,
4745                                          &rp, sizeof(rp));
4746
4747         hci_dev_lock(hdev);
4748
4749         if (!hdev_is_powered(hdev)) {
4750                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4751                                         MGMT_STATUS_NOT_POWERED, &rp,
4752                                         sizeof(rp));
4753                 goto unlock;
4754         }
4755
4756         if (cp->addr.type == BDADDR_BREDR)
4757                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4758                                                &cp->addr.bdaddr);
4759         else
4760                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4761
4762         if (!conn || conn->state != BT_CONNECTED) {
4763                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4764                                         MGMT_STATUS_NOT_CONNECTED, &rp,
4765                                         sizeof(rp));
4766                 goto unlock;
4767         }
4768
4769         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
4770                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4771                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
4772                 goto unlock;
4773         }
4774
4775         /* To avoid client trying to guess when to poll again for information we
4776          * calculate conn info age as random value between min/max set in hdev.
4777          */
4778         conn_info_age = hdev->conn_info_min_age +
4779                         prandom_u32_max(hdev->conn_info_max_age -
4780                                         hdev->conn_info_min_age);
4781
4782         /* Query controller to refresh cached values if they are too old or were
4783          * never read.
4784          */
4785         if (time_after(jiffies, conn->conn_info_timestamp +
4786                        msecs_to_jiffies(conn_info_age)) ||
4787             !conn->conn_info_timestamp) {
4788                 struct hci_request req;
4789                 struct hci_cp_read_tx_power req_txp_cp;
4790                 struct hci_cp_read_rssi req_rssi_cp;
4791                 struct mgmt_pending_cmd *cmd;
4792
4793                 hci_req_init(&req, hdev);
4794                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4795                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4796                             &req_rssi_cp);
4797
4798                 /* For LE links TX power does not change thus we don't need to
4799                  * query for it once value is known.
4800                  */
4801                 if (!bdaddr_type_is_le(cp->addr.type) ||
4802                     conn->tx_power == HCI_TX_POWER_INVALID) {
4803                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4804                         req_txp_cp.type = 0x00;
4805                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4806                                     sizeof(req_txp_cp), &req_txp_cp);
4807                 }
4808
4809                 /* Max TX power needs to be read only once per connection */
4810                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4811                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4812                         req_txp_cp.type = 0x01;
4813                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4814                                     sizeof(req_txp_cp), &req_txp_cp);
4815                 }
4816
4817                 err = hci_req_run(&req, conn_info_refresh_complete);
4818                 if (err < 0)
4819                         goto unlock;
4820
4821                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4822                                        data, len);
4823                 if (!cmd) {
4824                         err = -ENOMEM;
4825                         goto unlock;
4826                 }
4827
4828                 hci_conn_hold(conn);
4829                 cmd->user_data = hci_conn_get(conn);
4830                 cmd->cmd_complete = conn_info_cmd_complete;
4831
4832                 conn->conn_info_timestamp = jiffies;
4833         } else {
4834                 /* Cache is valid, just reply with values cached in hci_conn */
4835                 rp.rssi = conn->rssi;
4836                 rp.tx_power = conn->tx_power;
4837                 rp.max_tx_power = conn->max_tx_power;
4838
4839                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4840                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4841         }
4842
4843 unlock:
4844         hci_dev_unlock(hdev);
4845         return err;
4846 }
4847
4848 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4849 {
4850         struct hci_conn *conn = cmd->user_data;
4851         struct mgmt_rp_get_clock_info rp;
4852         struct hci_dev *hdev;
4853         int err;
4854
4855         memset(&rp, 0, sizeof(rp));
4856         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
4857
4858         if (status)
4859                 goto complete;
4860
4861         hdev = hci_dev_get(cmd->index);
4862         if (hdev) {
4863                 rp.local_clock = cpu_to_le32(hdev->clock);
4864                 hci_dev_put(hdev);
4865         }
4866
4867         if (conn) {
4868                 rp.piconet_clock = cpu_to_le32(conn->clock);
4869                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
4870         }
4871
4872 complete:
4873         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
4874                                 sizeof(rp));
4875
4876         if (conn) {
4877                 hci_conn_drop(conn);
4878                 hci_conn_put(conn);
4879         }
4880
4881         return err;
4882 }
4883
4884 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4885 {
4886         struct hci_cp_read_clock *hci_cp;
4887         struct mgmt_pending_cmd *cmd;
4888         struct hci_conn *conn;
4889
4890         BT_DBG("%s status %u", hdev->name, status);
4891
4892         hci_dev_lock(hdev);
4893
4894         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
4895         if (!hci_cp)
4896                 goto unlock;
4897
4898         if (hci_cp->which) {
4899                 u16 handle = __le16_to_cpu(hci_cp->handle);
4900                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4901         } else {
4902                 conn = NULL;
4903         }
4904
4905         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
4906         if (!cmd)
4907                 goto unlock;
4908
4909         cmd->cmd_complete(cmd, mgmt_status(status));
4910         mgmt_pending_remove(cmd);
4911
4912 unlock:
4913         hci_dev_unlock(hdev);
4914 }
4915
4916 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
4917                          u16 len)
4918 {
4919         struct mgmt_cp_get_clock_info *cp = data;
4920         struct mgmt_rp_get_clock_info rp;
4921         struct hci_cp_read_clock hci_cp;
4922         struct mgmt_pending_cmd *cmd;
4923         struct hci_request req;
4924         struct hci_conn *conn;
4925         int err;
4926
4927         BT_DBG("%s", hdev->name);
4928
4929         memset(&rp, 0, sizeof(rp));
4930         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4931         rp.addr.type = cp->addr.type;
4932
4933         if (cp->addr.type != BDADDR_BREDR)
4934                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
4935                                          MGMT_STATUS_INVALID_PARAMS,
4936                                          &rp, sizeof(rp));
4937
4938         hci_dev_lock(hdev);
4939
4940         if (!hdev_is_powered(hdev)) {
4941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
4942                                         MGMT_STATUS_NOT_POWERED, &rp,
4943                                         sizeof(rp));
4944                 goto unlock;
4945         }
4946
4947         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4948                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4949                                                &cp->addr.bdaddr);
4950                 if (!conn || conn->state != BT_CONNECTED) {
4951                         err = mgmt_cmd_complete(sk, hdev->id,
4952                                                 MGMT_OP_GET_CLOCK_INFO,
4953                                                 MGMT_STATUS_NOT_CONNECTED,
4954                                                 &rp, sizeof(rp));
4955                         goto unlock;
4956                 }
4957         } else {
4958                 conn = NULL;
4959         }
4960
4961         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
4962         if (!cmd) {
4963                 err = -ENOMEM;
4964                 goto unlock;
4965         }
4966
4967         cmd->cmd_complete = clock_info_cmd_complete;
4968
4969         hci_req_init(&req, hdev);
4970
4971         memset(&hci_cp, 0, sizeof(hci_cp));
4972         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
4973
4974         if (conn) {
4975                 hci_conn_hold(conn);
4976                 cmd->user_data = hci_conn_get(conn);
4977
4978                 hci_cp.handle = cpu_to_le16(conn->handle);
4979                 hci_cp.which = 0x01; /* Piconet clock */
4980                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
4981         }
4982
4983         err = hci_req_run(&req, get_clock_info_complete);
4984         if (err < 0)
4985                 mgmt_pending_remove(cmd);
4986
4987 unlock:
4988         hci_dev_unlock(hdev);
4989         return err;
4990 }
4991
4992 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
4993 {
4994         struct hci_conn *conn;
4995
4996         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
4997         if (!conn)
4998                 return false;
4999
5000         if (conn->dst_type != type)
5001                 return false;
5002
5003         if (conn->state != BT_CONNECTED)
5004                 return false;
5005
5006         return true;
5007 }
5008
5009 /* This function requires the caller holds hdev->lock */
5010 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5011                                u8 addr_type, u8 auto_connect)
5012 {
5013         struct hci_conn_params *params;
5014
5015         params = hci_conn_params_add(hdev, addr, addr_type);
5016         if (!params)
5017                 return -EIO;
5018
5019         if (params->auto_connect == auto_connect)
5020                 return 0;
5021
5022         list_del_init(&params->action);
5023
5024         switch (auto_connect) {
5025         case HCI_AUTO_CONN_DISABLED:
5026         case HCI_AUTO_CONN_LINK_LOSS:
5027                 /* If auto connect is being disabled when we're trying to
5028                  * connect to device, keep connecting.
5029                  */
5030                 if (params->explicit_connect)
5031                         list_add(&params->action, &hdev->pend_le_conns);
5032                 break;
5033         case HCI_AUTO_CONN_REPORT:
5034                 if (params->explicit_connect)
5035                         list_add(&params->action, &hdev->pend_le_conns);
5036                 else
5037                         list_add(&params->action, &hdev->pend_le_reports);
5038                 break;
5039         case HCI_AUTO_CONN_DIRECT:
5040         case HCI_AUTO_CONN_ALWAYS:
5041                 if (!is_connected(hdev, addr, addr_type))
5042                         list_add(&params->action, &hdev->pend_le_conns);
5043                 break;
5044         }
5045
5046         params->auto_connect = auto_connect;
5047
5048         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5049                auto_connect);
5050
5051         return 0;
5052 }
5053
5054 static void device_added(struct sock *sk, struct hci_dev *hdev,
5055                          bdaddr_t *bdaddr, u8 type, u8 action)
5056 {
5057         struct mgmt_ev_device_added ev;
5058
5059         bacpy(&ev.addr.bdaddr, bdaddr);
5060         ev.addr.type = type;
5061         ev.action = action;
5062
5063         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5064 }
5065
5066 static int add_device(struct sock *sk, struct hci_dev *hdev,
5067                       void *data, u16 len)
5068 {
5069         struct mgmt_cp_add_device *cp = data;
5070         u8 auto_conn, addr_type;
5071         int err;
5072
5073         BT_DBG("%s", hdev->name);
5074
5075         if (!bdaddr_type_is_valid(cp->addr.type) ||
5076             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5077                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5078                                          MGMT_STATUS_INVALID_PARAMS,
5079                                          &cp->addr, sizeof(cp->addr));
5080
5081         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5082                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5083                                          MGMT_STATUS_INVALID_PARAMS,
5084                                          &cp->addr, sizeof(cp->addr));
5085
5086         hci_dev_lock(hdev);
5087
5088         if (cp->addr.type == BDADDR_BREDR) {
5089                 /* Only incoming connections action is supported for now */
5090                 if (cp->action != 0x01) {
5091                         err = mgmt_cmd_complete(sk, hdev->id,
5092                                                 MGMT_OP_ADD_DEVICE,
5093                                                 MGMT_STATUS_INVALID_PARAMS,
5094                                                 &cp->addr, sizeof(cp->addr));
5095                         goto unlock;
5096                 }
5097
5098                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5099                                           cp->addr.type);
5100                 if (err)
5101                         goto unlock;
5102
5103                 hci_req_update_scan(hdev);
5104
5105                 goto added;
5106         }
5107
5108         addr_type = le_addr_type(cp->addr.type);
5109
5110         if (cp->action == 0x02)
5111                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5112         else if (cp->action == 0x01)
5113                 auto_conn = HCI_AUTO_CONN_DIRECT;
5114         else
5115                 auto_conn = HCI_AUTO_CONN_REPORT;
5116
5117         /* Kernel internally uses conn_params with resolvable private
5118          * address, but Add Device allows only identity addresses.
5119          * Make sure it is enforced before calling
5120          * hci_conn_params_lookup.
5121          */
5122         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5123                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5124                                         MGMT_STATUS_INVALID_PARAMS,
5125                                         &cp->addr, sizeof(cp->addr));
5126                 goto unlock;
5127         }
5128
5129         /* If the connection parameters don't exist for this device,
5130          * they will be created and configured with defaults.
5131          */
5132         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5133                                 auto_conn) < 0) {
5134                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5135                                         MGMT_STATUS_FAILED, &cp->addr,
5136                                         sizeof(cp->addr));
5137                 goto unlock;
5138         }
5139
5140         hci_update_background_scan(hdev);
5141
5142 added:
5143         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5144
5145         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5146                                 MGMT_STATUS_SUCCESS, &cp->addr,
5147                                 sizeof(cp->addr));
5148
5149 unlock:
5150         hci_dev_unlock(hdev);
5151         return err;
5152 }
5153
5154 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5155                            bdaddr_t *bdaddr, u8 type)
5156 {
5157         struct mgmt_ev_device_removed ev;
5158
5159         bacpy(&ev.addr.bdaddr, bdaddr);
5160         ev.addr.type = type;
5161
5162         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5163 }
5164
5165 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5166                          void *data, u16 len)
5167 {
5168         struct mgmt_cp_remove_device *cp = data;
5169         int err;
5170
5171         BT_DBG("%s", hdev->name);
5172
5173         hci_dev_lock(hdev);
5174
5175         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5176                 struct hci_conn_params *params;
5177                 u8 addr_type;
5178
5179                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5180                         err = mgmt_cmd_complete(sk, hdev->id,
5181                                                 MGMT_OP_REMOVE_DEVICE,
5182                                                 MGMT_STATUS_INVALID_PARAMS,
5183                                                 &cp->addr, sizeof(cp->addr));
5184                         goto unlock;
5185                 }
5186
5187                 if (cp->addr.type == BDADDR_BREDR) {
5188                         err = hci_bdaddr_list_del(&hdev->whitelist,
5189                                                   &cp->addr.bdaddr,
5190                                                   cp->addr.type);
5191                         if (err) {
5192                                 err = mgmt_cmd_complete(sk, hdev->id,
5193                                                         MGMT_OP_REMOVE_DEVICE,
5194                                                         MGMT_STATUS_INVALID_PARAMS,
5195                                                         &cp->addr,
5196                                                         sizeof(cp->addr));
5197                                 goto unlock;
5198                         }
5199
5200                         hci_req_update_scan(hdev);
5201
5202                         device_removed(sk, hdev, &cp->addr.bdaddr,
5203                                        cp->addr.type);
5204                         goto complete;
5205                 }
5206
5207                 addr_type = le_addr_type(cp->addr.type);
5208
5209                 /* Kernel internally uses conn_params with resolvable private
5210                  * address, but Remove Device allows only identity addresses.
5211                  * Make sure it is enforced before calling
5212                  * hci_conn_params_lookup.
5213                  */
5214                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5215                         err = mgmt_cmd_complete(sk, hdev->id,
5216                                                 MGMT_OP_REMOVE_DEVICE,
5217                                                 MGMT_STATUS_INVALID_PARAMS,
5218                                                 &cp->addr, sizeof(cp->addr));
5219                         goto unlock;
5220                 }
5221
5222                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5223                                                 addr_type);
5224                 if (!params) {
5225                         err = mgmt_cmd_complete(sk, hdev->id,
5226                                                 MGMT_OP_REMOVE_DEVICE,
5227                                                 MGMT_STATUS_INVALID_PARAMS,
5228                                                 &cp->addr, sizeof(cp->addr));
5229                         goto unlock;
5230                 }
5231
5232                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5233                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5234                         err = mgmt_cmd_complete(sk, hdev->id,
5235                                                 MGMT_OP_REMOVE_DEVICE,
5236                                                 MGMT_STATUS_INVALID_PARAMS,
5237                                                 &cp->addr, sizeof(cp->addr));
5238                         goto unlock;
5239                 }
5240
5241                 list_del(&params->action);
5242                 list_del(&params->list);
5243                 kfree(params);
5244                 hci_update_background_scan(hdev);
5245
5246                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5247         } else {
5248                 struct hci_conn_params *p, *tmp;
5249                 struct bdaddr_list *b, *btmp;
5250
5251                 if (cp->addr.type) {
5252                         err = mgmt_cmd_complete(sk, hdev->id,
5253                                                 MGMT_OP_REMOVE_DEVICE,
5254                                                 MGMT_STATUS_INVALID_PARAMS,
5255                                                 &cp->addr, sizeof(cp->addr));
5256                         goto unlock;
5257                 }
5258
5259                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5260                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5261                         list_del(&b->list);
5262                         kfree(b);
5263                 }
5264
5265                 hci_req_update_scan(hdev);
5266
5267                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5268                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5269                                 continue;
5270                         device_removed(sk, hdev, &p->addr, p->addr_type);
5271                         if (p->explicit_connect) {
5272                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5273                                 continue;
5274                         }
5275                         list_del(&p->action);
5276                         list_del(&p->list);
5277                         kfree(p);
5278                 }
5279
5280                 BT_DBG("All LE connection parameters were removed");
5281
5282                 hci_update_background_scan(hdev);
5283         }
5284
5285 complete:
5286         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5287                                 MGMT_STATUS_SUCCESS, &cp->addr,
5288                                 sizeof(cp->addr));
5289 unlock:
5290         hci_dev_unlock(hdev);
5291         return err;
5292 }
5293
5294 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5295                            u16 len)
5296 {
5297         struct mgmt_cp_load_conn_param *cp = data;
5298         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5299                                      sizeof(struct mgmt_conn_param));
5300         u16 param_count, expected_len;
5301         int i;
5302
5303         if (!lmp_le_capable(hdev))
5304                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5305                                        MGMT_STATUS_NOT_SUPPORTED);
5306
5307         param_count = __le16_to_cpu(cp->param_count);
5308         if (param_count > max_param_count) {
5309                 BT_ERR("load_conn_param: too big param_count value %u",
5310                        param_count);
5311                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5312                                        MGMT_STATUS_INVALID_PARAMS);
5313         }
5314
5315         expected_len = sizeof(*cp) + param_count *
5316                                         sizeof(struct mgmt_conn_param);
5317         if (expected_len != len) {
5318                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5319                        expected_len, len);
5320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5321                                        MGMT_STATUS_INVALID_PARAMS);
5322         }
5323
5324         BT_DBG("%s param_count %u", hdev->name, param_count);
5325
5326         hci_dev_lock(hdev);
5327
5328         hci_conn_params_clear_disabled(hdev);
5329
5330         for (i = 0; i < param_count; i++) {
5331                 struct mgmt_conn_param *param = &cp->params[i];
5332                 struct hci_conn_params *hci_param;
5333                 u16 min, max, latency, timeout;
5334                 u8 addr_type;
5335
5336                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5337                        param->addr.type);
5338
5339                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5340                         addr_type = ADDR_LE_DEV_PUBLIC;
5341                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5342                         addr_type = ADDR_LE_DEV_RANDOM;
5343                 } else {
5344                         BT_ERR("Ignoring invalid connection parameters");
5345                         continue;
5346                 }
5347
5348                 min = le16_to_cpu(param->min_interval);
5349                 max = le16_to_cpu(param->max_interval);
5350                 latency = le16_to_cpu(param->latency);
5351                 timeout = le16_to_cpu(param->timeout);
5352
5353                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5354                        min, max, latency, timeout);
5355
5356                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5357                         BT_ERR("Ignoring invalid connection parameters");
5358                         continue;
5359                 }
5360
5361                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5362                                                 addr_type);
5363                 if (!hci_param) {
5364                         BT_ERR("Failed to add connection parameters");
5365                         continue;
5366                 }
5367
5368                 hci_param->conn_min_interval = min;
5369                 hci_param->conn_max_interval = max;
5370                 hci_param->conn_latency = latency;
5371                 hci_param->supervision_timeout = timeout;
5372         }
5373
5374         hci_dev_unlock(hdev);
5375
5376         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5377                                  NULL, 0);
5378 }
5379
5380 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5381                                void *data, u16 len)
5382 {
5383         struct mgmt_cp_set_external_config *cp = data;
5384         bool changed;
5385         int err;
5386
5387         BT_DBG("%s", hdev->name);
5388
5389         if (hdev_is_powered(hdev))
5390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5391                                        MGMT_STATUS_REJECTED);
5392
5393         if (cp->config != 0x00 && cp->config != 0x01)
5394                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5395                                          MGMT_STATUS_INVALID_PARAMS);
5396
5397         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5399                                        MGMT_STATUS_NOT_SUPPORTED);
5400
5401         hci_dev_lock(hdev);
5402
5403         if (cp->config)
5404                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5405         else
5406                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5407
5408         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5409         if (err < 0)
5410                 goto unlock;
5411
5412         if (!changed)
5413                 goto unlock;
5414
5415         err = new_options(hdev, sk);
5416
5417         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5418                 mgmt_index_removed(hdev);
5419
5420                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5421                         hci_dev_set_flag(hdev, HCI_CONFIG);
5422                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5423
5424                         queue_work(hdev->req_workqueue, &hdev->power_on);
5425                 } else {
5426                         set_bit(HCI_RAW, &hdev->flags);
5427                         mgmt_index_added(hdev);
5428                 }
5429         }
5430
5431 unlock:
5432         hci_dev_unlock(hdev);
5433         return err;
5434 }
5435
5436 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5437                               void *data, u16 len)
5438 {
5439         struct mgmt_cp_set_public_address *cp = data;
5440         bool changed;
5441         int err;
5442
5443         BT_DBG("%s", hdev->name);
5444
5445         if (hdev_is_powered(hdev))
5446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5447                                        MGMT_STATUS_REJECTED);
5448
5449         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5451                                        MGMT_STATUS_INVALID_PARAMS);
5452
5453         if (!hdev->set_bdaddr)
5454                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5455                                        MGMT_STATUS_NOT_SUPPORTED);
5456
5457         hci_dev_lock(hdev);
5458
5459         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5460         bacpy(&hdev->public_addr, &cp->bdaddr);
5461
5462         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5463         if (err < 0)
5464                 goto unlock;
5465
5466         if (!changed)
5467                 goto unlock;
5468
5469         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5470                 err = new_options(hdev, sk);
5471
5472         if (is_configured(hdev)) {
5473                 mgmt_index_removed(hdev);
5474
5475                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
5476
5477                 hci_dev_set_flag(hdev, HCI_CONFIG);
5478                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5479
5480                 queue_work(hdev->req_workqueue, &hdev->power_on);
5481         }
5482
5483 unlock:
5484         hci_dev_unlock(hdev);
5485         return err;
5486 }
5487
5488 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5489                                   u8 data_len)
5490 {
5491         eir[eir_len++] = sizeof(type) + data_len;
5492         eir[eir_len++] = type;
5493         memcpy(&eir[eir_len], data, data_len);
5494         eir_len += data_len;
5495
5496         return eir_len;
5497 }
5498
5499 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
5500                                              u16 opcode, struct sk_buff *skb)
5501 {
5502         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
5503         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
5504         u8 *h192, *r192, *h256, *r256;
5505         struct mgmt_pending_cmd *cmd;
5506         u16 eir_len;
5507         int err;
5508
5509         BT_DBG("%s status %u", hdev->name, status);
5510
5511         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
5512         if (!cmd)
5513                 return;
5514
5515         mgmt_cp = cmd->param;
5516
5517         if (status) {
5518                 status = mgmt_status(status);
5519                 eir_len = 0;
5520
5521                 h192 = NULL;
5522                 r192 = NULL;
5523                 h256 = NULL;
5524                 r256 = NULL;
5525         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
5526                 struct hci_rp_read_local_oob_data *rp;
5527
5528                 if (skb->len != sizeof(*rp)) {
5529                         status = MGMT_STATUS_FAILED;
5530                         eir_len = 0;
5531                 } else {
5532                         status = MGMT_STATUS_SUCCESS;
5533                         rp = (void *)skb->data;
5534
5535                         eir_len = 5 + 18 + 18;
5536                         h192 = rp->hash;
5537                         r192 = rp->rand;
5538                         h256 = NULL;
5539                         r256 = NULL;
5540                 }
5541         } else {
5542                 struct hci_rp_read_local_oob_ext_data *rp;
5543
5544                 if (skb->len != sizeof(*rp)) {
5545                         status = MGMT_STATUS_FAILED;
5546                         eir_len = 0;
5547                 } else {
5548                         status = MGMT_STATUS_SUCCESS;
5549                         rp = (void *)skb->data;
5550
5551                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5552                                 eir_len = 5 + 18 + 18;
5553                                 h192 = NULL;
5554                                 r192 = NULL;
5555                         } else {
5556                                 eir_len = 5 + 18 + 18 + 18 + 18;
5557                                 h192 = rp->hash192;
5558                                 r192 = rp->rand192;
5559                         }
5560
5561                         h256 = rp->hash256;
5562                         r256 = rp->rand256;
5563                 }
5564         }
5565
5566         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
5567         if (!mgmt_rp)
5568                 goto done;
5569
5570         if (status)
5571                 goto send_rsp;
5572
5573         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
5574                                   hdev->dev_class, 3);
5575
5576         if (h192 && r192) {
5577                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5578                                           EIR_SSP_HASH_C192, h192, 16);
5579                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5580                                           EIR_SSP_RAND_R192, r192, 16);
5581         }
5582
5583         if (h256 && r256) {
5584                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5585                                           EIR_SSP_HASH_C256, h256, 16);
5586                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5587                                           EIR_SSP_RAND_R256, r256, 16);
5588         }
5589
5590 send_rsp:
5591         mgmt_rp->type = mgmt_cp->type;
5592         mgmt_rp->eir_len = cpu_to_le16(eir_len);
5593
5594         err = mgmt_cmd_complete(cmd->sk, hdev->id,
5595                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
5596                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
5597         if (err < 0 || status)
5598                 goto done;
5599
5600         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
5601
5602         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5603                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
5604                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
5605 done:
5606         kfree(mgmt_rp);
5607         mgmt_pending_remove(cmd);
5608 }
5609
5610 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
5611                                   struct mgmt_cp_read_local_oob_ext_data *cp)
5612 {
5613         struct mgmt_pending_cmd *cmd;
5614         struct hci_request req;
5615         int err;
5616
5617         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
5618                                cp, sizeof(*cp));
5619         if (!cmd)
5620                 return -ENOMEM;
5621
5622         hci_req_init(&req, hdev);
5623
5624         if (bredr_sc_enabled(hdev))
5625                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
5626         else
5627                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
5628
5629         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
5630         if (err < 0) {
5631                 mgmt_pending_remove(cmd);
5632                 return err;
5633         }
5634
5635         return 0;
5636 }
5637
5638 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
5639                                    void *data, u16 data_len)
5640 {
5641         struct mgmt_cp_read_local_oob_ext_data *cp = data;
5642         struct mgmt_rp_read_local_oob_ext_data *rp;
5643         size_t rp_len;
5644         u16 eir_len;
5645         u8 status, flags, role, addr[7], hash[16], rand[16];
5646         int err;
5647
5648         BT_DBG("%s", hdev->name);
5649
5650         if (hdev_is_powered(hdev)) {
5651                 switch (cp->type) {
5652                 case BIT(BDADDR_BREDR):
5653                         status = mgmt_bredr_support(hdev);
5654                         if (status)
5655                                 eir_len = 0;
5656                         else
5657                                 eir_len = 5;
5658                         break;
5659                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5660                         status = mgmt_le_support(hdev);
5661                         if (status)
5662                                 eir_len = 0;
5663                         else
5664                                 eir_len = 9 + 3 + 18 + 18 + 3;
5665                         break;
5666                 default:
5667                         status = MGMT_STATUS_INVALID_PARAMS;
5668                         eir_len = 0;
5669                         break;
5670                 }
5671         } else {
5672                 status = MGMT_STATUS_NOT_POWERED;
5673                 eir_len = 0;
5674         }
5675
5676         rp_len = sizeof(*rp) + eir_len;
5677         rp = kmalloc(rp_len, GFP_ATOMIC);
5678         if (!rp)
5679                 return -ENOMEM;
5680
5681         if (status)
5682                 goto complete;
5683
5684         hci_dev_lock(hdev);
5685
5686         eir_len = 0;
5687         switch (cp->type) {
5688         case BIT(BDADDR_BREDR):
5689                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5690                         err = read_local_ssp_oob_req(hdev, sk, cp);
5691                         hci_dev_unlock(hdev);
5692                         if (!err)
5693                                 goto done;
5694
5695                         status = MGMT_STATUS_FAILED;
5696                         goto complete;
5697                 } else {
5698                         eir_len = eir_append_data(rp->eir, eir_len,
5699                                                   EIR_CLASS_OF_DEV,
5700                                                   hdev->dev_class, 3);
5701                 }
5702                 break;
5703         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5704                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5705                     smp_generate_oob(hdev, hash, rand) < 0) {
5706                         hci_dev_unlock(hdev);
5707                         status = MGMT_STATUS_FAILED;
5708                         goto complete;
5709                 }
5710
5711                 /* This should return the active RPA, but since the RPA
5712                  * is only programmed on demand, it is really hard to fill
5713                  * this in at the moment. For now disallow retrieving
5714                  * local out-of-band data when privacy is in use.
5715                  *
5716                  * Returning the identity address will not help here since
5717                  * pairing happens before the identity resolving key is
5718                  * known and thus the connection establishment happens
5719                  * based on the RPA and not the identity address.
5720                  */
5721                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5722                         hci_dev_unlock(hdev);
5723                         status = MGMT_STATUS_REJECTED;
5724                         goto complete;
5725                 }
5726
5727                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
5728                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
5729                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5730                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
5731                         memcpy(addr, &hdev->static_addr, 6);
5732                         addr[6] = 0x01;
5733                 } else {
5734                         memcpy(addr, &hdev->bdaddr, 6);
5735                         addr[6] = 0x00;
5736                 }
5737
5738                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
5739                                           addr, sizeof(addr));
5740
5741                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5742                         role = 0x02;
5743                 else
5744                         role = 0x01;
5745
5746                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
5747                                           &role, sizeof(role));
5748
5749                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
5750                         eir_len = eir_append_data(rp->eir, eir_len,
5751                                                   EIR_LE_SC_CONFIRM,
5752                                                   hash, sizeof(hash));
5753
5754                         eir_len = eir_append_data(rp->eir, eir_len,
5755                                                   EIR_LE_SC_RANDOM,
5756                                                   rand, sizeof(rand));
5757                 }
5758
5759                 flags = mgmt_get_adv_discov_flags(hdev);
5760
5761                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5762                         flags |= LE_AD_NO_BREDR;
5763
5764                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
5765                                           &flags, sizeof(flags));
5766                 break;
5767         }
5768
5769         hci_dev_unlock(hdev);
5770
5771         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
5772
5773         status = MGMT_STATUS_SUCCESS;
5774
5775 complete:
5776         rp->type = cp->type;
5777         rp->eir_len = cpu_to_le16(eir_len);
5778
5779         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5780                                 status, rp, sizeof(*rp) + eir_len);
5781         if (err < 0 || status)
5782                 goto done;
5783
5784         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5785                                  rp, sizeof(*rp) + eir_len,
5786                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
5787
5788 done:
5789         kfree(rp);
5790
5791         return err;
5792 }
5793
5794 static u32 get_supported_adv_flags(struct hci_dev *hdev)
5795 {
5796         u32 flags = 0;
5797
5798         flags |= MGMT_ADV_FLAG_CONNECTABLE;
5799         flags |= MGMT_ADV_FLAG_DISCOV;
5800         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
5801         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
5802
5803         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
5804                 flags |= MGMT_ADV_FLAG_TX_POWER;
5805
5806         return flags;
5807 }
5808
5809 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
5810                              void *data, u16 data_len)
5811 {
5812         struct mgmt_rp_read_adv_features *rp;
5813         size_t rp_len;
5814         int err;
5815         struct adv_info *adv_instance;
5816         u32 supported_flags;
5817         u8 *instance;
5818
5819         BT_DBG("%s", hdev->name);
5820
5821         if (!lmp_le_capable(hdev))
5822                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5823                                        MGMT_STATUS_REJECTED);
5824
5825         hci_dev_lock(hdev);
5826
5827         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
5828         rp = kmalloc(rp_len, GFP_ATOMIC);
5829         if (!rp) {
5830                 hci_dev_unlock(hdev);
5831                 return -ENOMEM;
5832         }
5833
5834         supported_flags = get_supported_adv_flags(hdev);
5835
5836         rp->supported_flags = cpu_to_le32(supported_flags);
5837         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
5838         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
5839         rp->max_instances = HCI_MAX_ADV_INSTANCES;
5840         rp->num_instances = hdev->adv_instance_cnt;
5841
5842         instance = rp->instance;
5843         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
5844                 *instance = adv_instance->instance;
5845                 instance++;
5846         }
5847
5848         hci_dev_unlock(hdev);
5849
5850         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5851                                 MGMT_STATUS_SUCCESS, rp, rp_len);
5852
5853         kfree(rp);
5854
5855         return err;
5856 }
5857
5858 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
5859                               u8 len, bool is_adv_data)
5860 {
5861         u8 max_len = HCI_MAX_AD_LENGTH;
5862         int i, cur_len;
5863         bool flags_managed = false;
5864         bool tx_power_managed = false;
5865
5866         if (is_adv_data) {
5867                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
5868                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
5869                                  MGMT_ADV_FLAG_MANAGED_FLAGS)) {
5870                         flags_managed = true;
5871                         max_len -= 3;
5872                 }
5873
5874                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) {
5875                         tx_power_managed = true;
5876                         max_len -= 3;
5877                 }
5878         }
5879
5880         if (len > max_len)
5881                 return false;
5882
5883         /* Make sure that the data is correctly formatted. */
5884         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
5885                 cur_len = data[i];
5886
5887                 if (flags_managed && data[i + 1] == EIR_FLAGS)
5888                         return false;
5889
5890                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
5891                         return false;
5892
5893                 /* If the current field length would exceed the total data
5894                  * length, then it's invalid.
5895                  */
5896                 if (i + cur_len >= len)
5897                         return false;
5898         }
5899
5900         return true;
5901 }
5902
5903 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
5904                                      u16 opcode)
5905 {
5906         struct mgmt_pending_cmd *cmd;
5907         struct mgmt_cp_add_advertising *cp;
5908         struct mgmt_rp_add_advertising rp;
5909         struct adv_info *adv_instance, *n;
5910         u8 instance;
5911
5912         BT_DBG("status %d", status);
5913
5914         hci_dev_lock(hdev);
5915
5916         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
5917
5918         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
5919                 if (!adv_instance->pending)
5920                         continue;
5921
5922                 if (!status) {
5923                         adv_instance->pending = false;
5924                         continue;
5925                 }
5926
5927                 instance = adv_instance->instance;
5928
5929                 if (hdev->cur_adv_instance == instance)
5930                         cancel_adv_timeout(hdev);
5931
5932                 hci_remove_adv_instance(hdev, instance);
5933                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
5934         }
5935
5936         if (!cmd)
5937                 goto unlock;
5938
5939         cp = cmd->param;
5940         rp.instance = cp->instance;
5941
5942         if (status)
5943                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5944                                 mgmt_status(status));
5945         else
5946                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5947                                   mgmt_status(status), &rp, sizeof(rp));
5948
5949         mgmt_pending_remove(cmd);
5950
5951 unlock:
5952         hci_dev_unlock(hdev);
5953 }
5954
5955 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
5956                            void *data, u16 data_len)
5957 {
5958         struct mgmt_cp_add_advertising *cp = data;
5959         struct mgmt_rp_add_advertising rp;
5960         u32 flags;
5961         u32 supported_flags;
5962         u8 status;
5963         u16 timeout, duration;
5964         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
5965         u8 schedule_instance = 0;
5966         struct adv_info *next_instance;
5967         int err;
5968         struct mgmt_pending_cmd *cmd;
5969         struct hci_request req;
5970
5971         BT_DBG("%s", hdev->name);
5972
5973         status = mgmt_le_support(hdev);
5974         if (status)
5975                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
5976                                        status);
5977
5978         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
5979                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
5980                                        MGMT_STATUS_INVALID_PARAMS);
5981
5982         flags = __le32_to_cpu(cp->flags);
5983         timeout = __le16_to_cpu(cp->timeout);
5984         duration = __le16_to_cpu(cp->duration);
5985
5986         /* The current implementation only supports a subset of the specified
5987          * flags.
5988          */
5989         supported_flags = get_supported_adv_flags(hdev);
5990         if (flags & ~supported_flags)
5991                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
5992                                        MGMT_STATUS_INVALID_PARAMS);
5993
5994         hci_dev_lock(hdev);
5995
5996         if (timeout && !hdev_is_powered(hdev)) {
5997                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
5998                                       MGMT_STATUS_REJECTED);
5999                 goto unlock;
6000         }
6001
6002         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6003             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6004             pending_find(MGMT_OP_SET_LE, hdev)) {
6005                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6006                                       MGMT_STATUS_BUSY);
6007                 goto unlock;
6008         }
6009
6010         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6011             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6012                                cp->scan_rsp_len, false)) {
6013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6014                                       MGMT_STATUS_INVALID_PARAMS);
6015                 goto unlock;
6016         }
6017
6018         err = hci_add_adv_instance(hdev, cp->instance, flags,
6019                                    cp->adv_data_len, cp->data,
6020                                    cp->scan_rsp_len,
6021                                    cp->data + cp->adv_data_len,
6022                                    timeout, duration);
6023         if (err < 0) {
6024                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6025                                       MGMT_STATUS_FAILED);
6026                 goto unlock;
6027         }
6028
6029         /* Only trigger an advertising added event if a new instance was
6030          * actually added.
6031          */
6032         if (hdev->adv_instance_cnt > prev_instance_cnt)
6033                 mgmt_advertising_added(sk, hdev, cp->instance);
6034
6035         if (hdev->cur_adv_instance == cp->instance) {
6036                 /* If the currently advertised instance is being changed then
6037                  * cancel the current advertising and schedule the next
6038                  * instance. If there is only one instance then the overridden
6039                  * advertising data will be visible right away.
6040                  */
6041                 cancel_adv_timeout(hdev);
6042
6043                 next_instance = hci_get_next_instance(hdev, cp->instance);
6044                 if (next_instance)
6045                         schedule_instance = next_instance->instance;
6046         } else if (!hdev->adv_instance_timeout) {
6047                 /* Immediately advertise the new instance if no other
6048                  * instance is currently being advertised.
6049                  */
6050                 schedule_instance = cp->instance;
6051         }
6052
6053         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6054          * there is no instance to be advertised then we have no HCI
6055          * communication to make. Simply return.
6056          */
6057         if (!hdev_is_powered(hdev) ||
6058             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6059             !schedule_instance) {
6060                 rp.instance = cp->instance;
6061                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6062                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6063                 goto unlock;
6064         }
6065
6066         /* We're good to go, update advertising data, parameters, and start
6067          * advertising.
6068          */
6069         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6070                                data_len);
6071         if (!cmd) {
6072                 err = -ENOMEM;
6073                 goto unlock;
6074         }
6075
6076         hci_req_init(&req, hdev);
6077
6078         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6079
6080         if (!err)
6081                 err = hci_req_run(&req, add_advertising_complete);
6082
6083         if (err < 0)
6084                 mgmt_pending_remove(cmd);
6085
6086 unlock:
6087         hci_dev_unlock(hdev);
6088
6089         return err;
6090 }
6091
6092 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6093                                         u16 opcode)
6094 {
6095         struct mgmt_pending_cmd *cmd;
6096         struct mgmt_cp_remove_advertising *cp;
6097         struct mgmt_rp_remove_advertising rp;
6098
6099         BT_DBG("status %d", status);
6100
6101         hci_dev_lock(hdev);
6102
6103         /* A failure status here only means that we failed to disable
6104          * advertising. Otherwise, the advertising instance has been removed,
6105          * so report success.
6106          */
6107         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6108         if (!cmd)
6109                 goto unlock;
6110
6111         cp = cmd->param;
6112         rp.instance = cp->instance;
6113
6114         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6115                           &rp, sizeof(rp));
6116         mgmt_pending_remove(cmd);
6117
6118 unlock:
6119         hci_dev_unlock(hdev);
6120 }
6121
6122 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6123                               void *data, u16 data_len)
6124 {
6125         struct mgmt_cp_remove_advertising *cp = data;
6126         struct mgmt_rp_remove_advertising rp;
6127         struct mgmt_pending_cmd *cmd;
6128         struct hci_request req;
6129         int err;
6130
6131         BT_DBG("%s", hdev->name);
6132
6133         hci_dev_lock(hdev);
6134
6135         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6136                 err = mgmt_cmd_status(sk, hdev->id,
6137                                       MGMT_OP_REMOVE_ADVERTISING,
6138                                       MGMT_STATUS_INVALID_PARAMS);
6139                 goto unlock;
6140         }
6141
6142         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6143             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6144             pending_find(MGMT_OP_SET_LE, hdev)) {
6145                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6146                                       MGMT_STATUS_BUSY);
6147                 goto unlock;
6148         }
6149
6150         if (list_empty(&hdev->adv_instances)) {
6151                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6152                                       MGMT_STATUS_INVALID_PARAMS);
6153                 goto unlock;
6154         }
6155
6156         hci_req_init(&req, hdev);
6157
6158         hci_req_clear_adv_instance(hdev, &req, cp->instance, true);
6159
6160         if (list_empty(&hdev->adv_instances))
6161                 __hci_req_disable_advertising(&req);
6162
6163         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6164          * flag is set or the device isn't powered then we have no HCI
6165          * communication to make. Simply return.
6166          */
6167         if (skb_queue_empty(&req.cmd_q) ||
6168             !hdev_is_powered(hdev) ||
6169             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6170                 rp.instance = cp->instance;
6171                 err = mgmt_cmd_complete(sk, hdev->id,
6172                                         MGMT_OP_REMOVE_ADVERTISING,
6173                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6174                 goto unlock;
6175         }
6176
6177         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6178                                data_len);
6179         if (!cmd) {
6180                 err = -ENOMEM;
6181                 goto unlock;
6182         }
6183
6184         err = hci_req_run(&req, remove_advertising_complete);
6185         if (err < 0)
6186                 mgmt_pending_remove(cmd);
6187
6188 unlock:
6189         hci_dev_unlock(hdev);
6190
6191         return err;
6192 }
6193
6194 static u8 tlv_data_max_len(u32 adv_flags, bool is_adv_data)
6195 {
6196         u8 max_len = HCI_MAX_AD_LENGTH;
6197
6198         if (is_adv_data) {
6199                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6200                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6201                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6202                         max_len -= 3;
6203
6204                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6205                         max_len -= 3;
6206         }
6207
6208         return max_len;
6209 }
6210
6211 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6212                              void *data, u16 data_len)
6213 {
6214         struct mgmt_cp_get_adv_size_info *cp = data;
6215         struct mgmt_rp_get_adv_size_info rp;
6216         u32 flags, supported_flags;
6217         int err;
6218
6219         BT_DBG("%s", hdev->name);
6220
6221         if (!lmp_le_capable(hdev))
6222                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6223                                        MGMT_STATUS_REJECTED);
6224
6225         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6226                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6227                                        MGMT_STATUS_INVALID_PARAMS);
6228
6229         flags = __le32_to_cpu(cp->flags);
6230
6231         /* The current implementation only supports a subset of the specified
6232          * flags.
6233          */
6234         supported_flags = get_supported_adv_flags(hdev);
6235         if (flags & ~supported_flags)
6236                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6237                                        MGMT_STATUS_INVALID_PARAMS);
6238
6239         rp.instance = cp->instance;
6240         rp.flags = cp->flags;
6241         rp.max_adv_data_len = tlv_data_max_len(flags, true);
6242         rp.max_scan_rsp_len = tlv_data_max_len(flags, false);
6243
6244         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6245                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6246
6247         return err;
6248 }
6249
6250 static const struct hci_mgmt_handler mgmt_handlers[] = {
6251         { NULL }, /* 0x0000 (no command) */
6252         { read_version,            MGMT_READ_VERSION_SIZE,
6253                                                 HCI_MGMT_NO_HDEV |
6254                                                 HCI_MGMT_UNTRUSTED },
6255         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6256                                                 HCI_MGMT_NO_HDEV |
6257                                                 HCI_MGMT_UNTRUSTED },
6258         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6259                                                 HCI_MGMT_NO_HDEV |
6260                                                 HCI_MGMT_UNTRUSTED },
6261         { read_controller_info,    MGMT_READ_INFO_SIZE,
6262                                                 HCI_MGMT_UNTRUSTED },
6263         { set_powered,             MGMT_SETTING_SIZE },
6264         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6265         { set_connectable,         MGMT_SETTING_SIZE },
6266         { set_fast_connectable,    MGMT_SETTING_SIZE },
6267         { set_bondable,            MGMT_SETTING_SIZE },
6268         { set_link_security,       MGMT_SETTING_SIZE },
6269         { set_ssp,                 MGMT_SETTING_SIZE },
6270         { set_hs,                  MGMT_SETTING_SIZE },
6271         { set_le,                  MGMT_SETTING_SIZE },
6272         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6273         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6274         { add_uuid,                MGMT_ADD_UUID_SIZE },
6275         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6276         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6277                                                 HCI_MGMT_VAR_LEN },
6278         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6279                                                 HCI_MGMT_VAR_LEN },
6280         { disconnect,              MGMT_DISCONNECT_SIZE },
6281         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6282         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6283         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6284         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6285         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6286         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6287         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6288         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6289         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6290         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6291         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6292         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6293         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6294                                                 HCI_MGMT_VAR_LEN },
6295         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6296         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6297         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6298         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6299         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6300         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6301         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6302         { set_advertising,         MGMT_SETTING_SIZE },
6303         { set_bredr,               MGMT_SETTING_SIZE },
6304         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6305         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6306         { set_secure_conn,         MGMT_SETTING_SIZE },
6307         { set_debug_keys,          MGMT_SETTING_SIZE },
6308         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6309         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6310                                                 HCI_MGMT_VAR_LEN },
6311         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6312         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6313         { add_device,              MGMT_ADD_DEVICE_SIZE },
6314         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6315         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6316                                                 HCI_MGMT_VAR_LEN },
6317         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6318                                                 HCI_MGMT_NO_HDEV |
6319                                                 HCI_MGMT_UNTRUSTED },
6320         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6321                                                 HCI_MGMT_UNCONFIGURED |
6322                                                 HCI_MGMT_UNTRUSTED },
6323         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6324                                                 HCI_MGMT_UNCONFIGURED },
6325         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6326                                                 HCI_MGMT_UNCONFIGURED },
6327         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6328                                                 HCI_MGMT_VAR_LEN },
6329         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6330         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6331                                                 HCI_MGMT_NO_HDEV |
6332                                                 HCI_MGMT_UNTRUSTED },
6333         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6334         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6335                                                 HCI_MGMT_VAR_LEN },
6336         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6337         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6338         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6339 };
6340
6341 void mgmt_index_added(struct hci_dev *hdev)
6342 {
6343         struct mgmt_ev_ext_index ev;
6344
6345         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6346                 return;
6347
6348         switch (hdev->dev_type) {
6349         case HCI_BREDR:
6350                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6351                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6352                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6353                         ev.type = 0x01;
6354                 } else {
6355                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6356                                          HCI_MGMT_INDEX_EVENTS);
6357                         ev.type = 0x00;
6358                 }
6359                 break;
6360         case HCI_AMP:
6361                 ev.type = 0x02;
6362                 break;
6363         default:
6364                 return;
6365         }
6366
6367         ev.bus = hdev->bus;
6368
6369         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6370                          HCI_MGMT_EXT_INDEX_EVENTS);
6371 }
6372
6373 void mgmt_index_removed(struct hci_dev *hdev)
6374 {
6375         struct mgmt_ev_ext_index ev;
6376         u8 status = MGMT_STATUS_INVALID_INDEX;
6377
6378         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6379                 return;
6380
6381         switch (hdev->dev_type) {
6382         case HCI_BREDR:
6383                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6384
6385                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6386                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6387                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6388                         ev.type = 0x01;
6389                 } else {
6390                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6391                                          HCI_MGMT_INDEX_EVENTS);
6392                         ev.type = 0x00;
6393                 }
6394                 break;
6395         case HCI_AMP:
6396                 ev.type = 0x02;
6397                 break;
6398         default:
6399                 return;
6400         }
6401
6402         ev.bus = hdev->bus;
6403
6404         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6405                          HCI_MGMT_EXT_INDEX_EVENTS);
6406 }
6407
6408 /* This function requires the caller holds hdev->lock */
6409 static void restart_le_actions(struct hci_dev *hdev)
6410 {
6411         struct hci_conn_params *p;
6412
6413         list_for_each_entry(p, &hdev->le_conn_params, list) {
6414                 /* Needed for AUTO_OFF case where might not "really"
6415                  * have been powered off.
6416                  */
6417                 list_del_init(&p->action);
6418
6419                 switch (p->auto_connect) {
6420                 case HCI_AUTO_CONN_DIRECT:
6421                 case HCI_AUTO_CONN_ALWAYS:
6422                         list_add(&p->action, &hdev->pend_le_conns);
6423                         break;
6424                 case HCI_AUTO_CONN_REPORT:
6425                         list_add(&p->action, &hdev->pend_le_reports);
6426                         break;
6427                 default:
6428                         break;
6429                 }
6430         }
6431 }
6432
6433 void mgmt_power_on(struct hci_dev *hdev, int err)
6434 {
6435         struct cmd_lookup match = { NULL, hdev };
6436
6437         BT_DBG("err %d", err);
6438
6439         hci_dev_lock(hdev);
6440
6441         if (!err) {
6442                 restart_le_actions(hdev);
6443                 hci_update_background_scan(hdev);
6444         }
6445
6446         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6447
6448         new_settings(hdev, match.sk);
6449
6450         if (match.sk)
6451                 sock_put(match.sk);
6452
6453         hci_dev_unlock(hdev);
6454 }
6455
6456 void __mgmt_power_off(struct hci_dev *hdev)
6457 {
6458         struct cmd_lookup match = { NULL, hdev };
6459         u8 status, zero_cod[] = { 0, 0, 0 };
6460
6461         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6462
6463         /* If the power off is because of hdev unregistration let
6464          * use the appropriate INVALID_INDEX status. Otherwise use
6465          * NOT_POWERED. We cover both scenarios here since later in
6466          * mgmt_index_removed() any hci_conn callbacks will have already
6467          * been triggered, potentially causing misleading DISCONNECTED
6468          * status responses.
6469          */
6470         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6471                 status = MGMT_STATUS_INVALID_INDEX;
6472         else
6473                 status = MGMT_STATUS_NOT_POWERED;
6474
6475         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6476
6477         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6478                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6479                                    zero_cod, sizeof(zero_cod), NULL);
6480
6481         new_settings(hdev, match.sk);
6482
6483         if (match.sk)
6484                 sock_put(match.sk);
6485 }
6486
6487 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6488 {
6489         struct mgmt_pending_cmd *cmd;
6490         u8 status;
6491
6492         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6493         if (!cmd)
6494                 return;
6495
6496         if (err == -ERFKILL)
6497                 status = MGMT_STATUS_RFKILLED;
6498         else
6499                 status = MGMT_STATUS_FAILED;
6500
6501         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6502
6503         mgmt_pending_remove(cmd);
6504 }
6505
6506 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6507                        bool persistent)
6508 {
6509         struct mgmt_ev_new_link_key ev;
6510
6511         memset(&ev, 0, sizeof(ev));
6512
6513         ev.store_hint = persistent;
6514         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6515         ev.key.addr.type = BDADDR_BREDR;
6516         ev.key.type = key->type;
6517         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6518         ev.key.pin_len = key->pin_len;
6519
6520         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6521 }
6522
6523 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6524 {
6525         switch (ltk->type) {
6526         case SMP_LTK:
6527         case SMP_LTK_SLAVE:
6528                 if (ltk->authenticated)
6529                         return MGMT_LTK_AUTHENTICATED;
6530                 return MGMT_LTK_UNAUTHENTICATED;
6531         case SMP_LTK_P256:
6532                 if (ltk->authenticated)
6533                         return MGMT_LTK_P256_AUTH;
6534                 return MGMT_LTK_P256_UNAUTH;
6535         case SMP_LTK_P256_DEBUG:
6536                 return MGMT_LTK_P256_DEBUG;
6537         }
6538
6539         return MGMT_LTK_UNAUTHENTICATED;
6540 }
6541
6542 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6543 {
6544         struct mgmt_ev_new_long_term_key ev;
6545
6546         memset(&ev, 0, sizeof(ev));
6547
6548         /* Devices using resolvable or non-resolvable random addresses
6549          * without providing an identity resolving key don't require
6550          * to store long term keys. Their addresses will change the
6551          * next time around.
6552          *
6553          * Only when a remote device provides an identity address
6554          * make sure the long term key is stored. If the remote
6555          * identity is known, the long term keys are internally
6556          * mapped to the identity address. So allow static random
6557          * and public addresses here.
6558          */
6559         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6560             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6561                 ev.store_hint = 0x00;
6562         else
6563                 ev.store_hint = persistent;
6564
6565         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6566         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6567         ev.key.type = mgmt_ltk_type(key);
6568         ev.key.enc_size = key->enc_size;
6569         ev.key.ediv = key->ediv;
6570         ev.key.rand = key->rand;
6571
6572         if (key->type == SMP_LTK)
6573                 ev.key.master = 1;
6574
6575         /* Make sure we copy only the significant bytes based on the
6576          * encryption key size, and set the rest of the value to zeroes.
6577          */
6578         memcpy(ev.key.val, key->val, key->enc_size);
6579         memset(ev.key.val + key->enc_size, 0,
6580                sizeof(ev.key.val) - key->enc_size);
6581
6582         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6583 }
6584
6585 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
6586 {
6587         struct mgmt_ev_new_irk ev;
6588
6589         memset(&ev, 0, sizeof(ev));
6590
6591         ev.store_hint = persistent;
6592
6593         bacpy(&ev.rpa, &irk->rpa);
6594         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6595         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6596         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6597
6598         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6599 }
6600
6601 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6602                    bool persistent)
6603 {
6604         struct mgmt_ev_new_csrk ev;
6605
6606         memset(&ev, 0, sizeof(ev));
6607
6608         /* Devices using resolvable or non-resolvable random addresses
6609          * without providing an identity resolving key don't require
6610          * to store signature resolving keys. Their addresses will change
6611          * the next time around.
6612          *
6613          * Only when a remote device provides an identity address
6614          * make sure the signature resolving key is stored. So allow
6615          * static random and public addresses here.
6616          */
6617         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6618             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6619                 ev.store_hint = 0x00;
6620         else
6621                 ev.store_hint = persistent;
6622
6623         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6624         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6625         ev.key.type = csrk->type;
6626         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6627
6628         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6629 }
6630
6631 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6632                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6633                          u16 max_interval, u16 latency, u16 timeout)
6634 {
6635         struct mgmt_ev_new_conn_param ev;
6636
6637         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6638                 return;
6639
6640         memset(&ev, 0, sizeof(ev));
6641         bacpy(&ev.addr.bdaddr, bdaddr);
6642         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6643         ev.store_hint = store_hint;
6644         ev.min_interval = cpu_to_le16(min_interval);
6645         ev.max_interval = cpu_to_le16(max_interval);
6646         ev.latency = cpu_to_le16(latency);
6647         ev.timeout = cpu_to_le16(timeout);
6648
6649         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6650 }
6651
6652 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6653                            u32 flags, u8 *name, u8 name_len)
6654 {
6655         char buf[512];
6656         struct mgmt_ev_device_connected *ev = (void *) buf;
6657         u16 eir_len = 0;
6658
6659         bacpy(&ev->addr.bdaddr, &conn->dst);
6660         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6661
6662         ev->flags = __cpu_to_le32(flags);
6663
6664         /* We must ensure that the EIR Data fields are ordered and
6665          * unique. Keep it simple for now and avoid the problem by not
6666          * adding any BR/EDR data to the LE adv.
6667          */
6668         if (conn->le_adv_data_len > 0) {
6669                 memcpy(&ev->eir[eir_len],
6670                        conn->le_adv_data, conn->le_adv_data_len);
6671                 eir_len = conn->le_adv_data_len;
6672         } else {
6673                 if (name_len > 0)
6674                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6675                                                   name, name_len);
6676
6677                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6678                         eir_len = eir_append_data(ev->eir, eir_len,
6679                                                   EIR_CLASS_OF_DEV,
6680                                                   conn->dev_class, 3);
6681         }
6682
6683         ev->eir_len = cpu_to_le16(eir_len);
6684
6685         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6686                     sizeof(*ev) + eir_len, NULL);
6687 }
6688
6689 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6690 {
6691         struct sock **sk = data;
6692
6693         cmd->cmd_complete(cmd, 0);
6694
6695         *sk = cmd->sk;
6696         sock_hold(*sk);
6697
6698         mgmt_pending_remove(cmd);
6699 }
6700
6701 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6702 {
6703         struct hci_dev *hdev = data;
6704         struct mgmt_cp_unpair_device *cp = cmd->param;
6705
6706         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6707
6708         cmd->cmd_complete(cmd, 0);
6709         mgmt_pending_remove(cmd);
6710 }
6711
6712 bool mgmt_powering_down(struct hci_dev *hdev)
6713 {
6714         struct mgmt_pending_cmd *cmd;
6715         struct mgmt_mode *cp;
6716
6717         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6718         if (!cmd)
6719                 return false;
6720
6721         cp = cmd->param;
6722         if (!cp->val)
6723                 return true;
6724
6725         return false;
6726 }
6727
6728 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6729                               u8 link_type, u8 addr_type, u8 reason,
6730                               bool mgmt_connected)
6731 {
6732         struct mgmt_ev_device_disconnected ev;
6733         struct sock *sk = NULL;
6734
6735         /* The connection is still in hci_conn_hash so test for 1
6736          * instead of 0 to know if this is the last one.
6737          */
6738         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6739                 cancel_delayed_work(&hdev->power_off);
6740                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6741         }
6742
6743         if (!mgmt_connected)
6744                 return;
6745
6746         if (link_type != ACL_LINK && link_type != LE_LINK)
6747                 return;
6748
6749         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6750
6751         bacpy(&ev.addr.bdaddr, bdaddr);
6752         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6753         ev.reason = reason;
6754
6755         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6756
6757         if (sk)
6758                 sock_put(sk);
6759
6760         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6761                              hdev);
6762 }
6763
6764 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6765                             u8 link_type, u8 addr_type, u8 status)
6766 {
6767         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6768         struct mgmt_cp_disconnect *cp;
6769         struct mgmt_pending_cmd *cmd;
6770
6771         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6772                              hdev);
6773
6774         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6775         if (!cmd)
6776                 return;
6777
6778         cp = cmd->param;
6779
6780         if (bacmp(bdaddr, &cp->addr.bdaddr))
6781                 return;
6782
6783         if (cp->addr.type != bdaddr_type)
6784                 return;
6785
6786         cmd->cmd_complete(cmd, mgmt_status(status));
6787         mgmt_pending_remove(cmd);
6788 }
6789
6790 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6791                          u8 addr_type, u8 status)
6792 {
6793         struct mgmt_ev_connect_failed ev;
6794
6795         /* The connection is still in hci_conn_hash so test for 1
6796          * instead of 0 to know if this is the last one.
6797          */
6798         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6799                 cancel_delayed_work(&hdev->power_off);
6800                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6801         }
6802
6803         bacpy(&ev.addr.bdaddr, bdaddr);
6804         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6805         ev.status = mgmt_status(status);
6806
6807         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6808 }
6809
6810 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6811 {
6812         struct mgmt_ev_pin_code_request ev;
6813
6814         bacpy(&ev.addr.bdaddr, bdaddr);
6815         ev.addr.type = BDADDR_BREDR;
6816         ev.secure = secure;
6817
6818         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6819 }
6820
6821 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6822                                   u8 status)
6823 {
6824         struct mgmt_pending_cmd *cmd;
6825
6826         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6827         if (!cmd)
6828                 return;
6829
6830         cmd->cmd_complete(cmd, mgmt_status(status));
6831         mgmt_pending_remove(cmd);
6832 }
6833
6834 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6835                                       u8 status)
6836 {
6837         struct mgmt_pending_cmd *cmd;
6838
6839         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6840         if (!cmd)
6841                 return;
6842
6843         cmd->cmd_complete(cmd, mgmt_status(status));
6844         mgmt_pending_remove(cmd);
6845 }
6846
6847 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6848                               u8 link_type, u8 addr_type, u32 value,
6849                               u8 confirm_hint)
6850 {
6851         struct mgmt_ev_user_confirm_request ev;
6852
6853         BT_DBG("%s", hdev->name);
6854
6855         bacpy(&ev.addr.bdaddr, bdaddr);
6856         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6857         ev.confirm_hint = confirm_hint;
6858         ev.value = cpu_to_le32(value);
6859
6860         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6861                           NULL);
6862 }
6863
6864 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6865                               u8 link_type, u8 addr_type)
6866 {
6867         struct mgmt_ev_user_passkey_request ev;
6868
6869         BT_DBG("%s", hdev->name);
6870
6871         bacpy(&ev.addr.bdaddr, bdaddr);
6872         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6873
6874         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6875                           NULL);
6876 }
6877
6878 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6879                                       u8 link_type, u8 addr_type, u8 status,
6880                                       u8 opcode)
6881 {
6882         struct mgmt_pending_cmd *cmd;
6883
6884         cmd = pending_find(opcode, hdev);
6885         if (!cmd)
6886                 return -ENOENT;
6887
6888         cmd->cmd_complete(cmd, mgmt_status(status));
6889         mgmt_pending_remove(cmd);
6890
6891         return 0;
6892 }
6893
6894 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6895                                      u8 link_type, u8 addr_type, u8 status)
6896 {
6897         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6898                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6899 }
6900
6901 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6902                                          u8 link_type, u8 addr_type, u8 status)
6903 {
6904         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6905                                           status,
6906                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6907 }
6908
6909 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6910                                      u8 link_type, u8 addr_type, u8 status)
6911 {
6912         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6913                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6914 }
6915
6916 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6917                                          u8 link_type, u8 addr_type, u8 status)
6918 {
6919         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6920                                           status,
6921                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6922 }
6923
6924 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6925                              u8 link_type, u8 addr_type, u32 passkey,
6926                              u8 entered)
6927 {
6928         struct mgmt_ev_passkey_notify ev;
6929
6930         BT_DBG("%s", hdev->name);
6931
6932         bacpy(&ev.addr.bdaddr, bdaddr);
6933         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6934         ev.passkey = __cpu_to_le32(passkey);
6935         ev.entered = entered;
6936
6937         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6938 }
6939
6940 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6941 {
6942         struct mgmt_ev_auth_failed ev;
6943         struct mgmt_pending_cmd *cmd;
6944         u8 status = mgmt_status(hci_status);
6945
6946         bacpy(&ev.addr.bdaddr, &conn->dst);
6947         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6948         ev.status = status;
6949
6950         cmd = find_pairing(conn);
6951
6952         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6953                     cmd ? cmd->sk : NULL);
6954
6955         if (cmd) {
6956                 cmd->cmd_complete(cmd, status);
6957                 mgmt_pending_remove(cmd);
6958         }
6959 }
6960
6961 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6962 {
6963         struct cmd_lookup match = { NULL, hdev };
6964         bool changed;
6965
6966         if (status) {
6967                 u8 mgmt_err = mgmt_status(status);
6968                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6969                                      cmd_status_rsp, &mgmt_err);
6970                 return;
6971         }
6972
6973         if (test_bit(HCI_AUTH, &hdev->flags))
6974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
6975         else
6976                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
6977
6978         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6979                              &match);
6980
6981         if (changed)
6982                 new_settings(hdev, match.sk);
6983
6984         if (match.sk)
6985                 sock_put(match.sk);
6986 }
6987
6988 static void clear_eir(struct hci_request *req)
6989 {
6990         struct hci_dev *hdev = req->hdev;
6991         struct hci_cp_write_eir cp;
6992
6993         if (!lmp_ext_inq_capable(hdev))
6994                 return;
6995
6996         memset(hdev->eir, 0, sizeof(hdev->eir));
6997
6998         memset(&cp, 0, sizeof(cp));
6999
7000         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7001 }
7002
7003 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7004 {
7005         struct cmd_lookup match = { NULL, hdev };
7006         struct hci_request req;
7007         bool changed = false;
7008
7009         if (status) {
7010                 u8 mgmt_err = mgmt_status(status);
7011
7012                 if (enable && hci_dev_test_and_clear_flag(hdev,
7013                                                           HCI_SSP_ENABLED)) {
7014                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7015                         new_settings(hdev, NULL);
7016                 }
7017
7018                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7019                                      &mgmt_err);
7020                 return;
7021         }
7022
7023         if (enable) {
7024                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7025         } else {
7026                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7027                 if (!changed)
7028                         changed = hci_dev_test_and_clear_flag(hdev,
7029                                                               HCI_HS_ENABLED);
7030                 else
7031                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7032         }
7033
7034         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7035
7036         if (changed)
7037                 new_settings(hdev, match.sk);
7038
7039         if (match.sk)
7040                 sock_put(match.sk);
7041
7042         hci_req_init(&req, hdev);
7043
7044         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7045                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7046                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7047                                     sizeof(enable), &enable);
7048                 __hci_req_update_eir(&req);
7049         } else {
7050                 clear_eir(&req);
7051         }
7052
7053         hci_req_run(&req, NULL);
7054 }
7055
7056 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7057 {
7058         struct cmd_lookup *match = data;
7059
7060         if (match->sk == NULL) {
7061                 match->sk = cmd->sk;
7062                 sock_hold(match->sk);
7063         }
7064 }
7065
7066 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7067                                     u8 status)
7068 {
7069         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7070
7071         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7072         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7073         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7074
7075         if (!status)
7076                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7077                                    dev_class, 3, NULL);
7078
7079         if (match.sk)
7080                 sock_put(match.sk);
7081 }
7082
7083 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7084 {
7085         struct mgmt_cp_set_local_name ev;
7086         struct mgmt_pending_cmd *cmd;
7087
7088         if (status)
7089                 return;
7090
7091         memset(&ev, 0, sizeof(ev));
7092         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7093         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7094
7095         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7096         if (!cmd) {
7097                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7098
7099                 /* If this is a HCI command related to powering on the
7100                  * HCI dev don't send any mgmt signals.
7101                  */
7102                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7103                         return;
7104         }
7105
7106         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7107                            cmd ? cmd->sk : NULL);
7108 }
7109
7110 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7111 {
7112         int i;
7113
7114         for (i = 0; i < uuid_count; i++) {
7115                 if (!memcmp(uuid, uuids[i], 16))
7116                         return true;
7117         }
7118
7119         return false;
7120 }
7121
7122 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7123 {
7124         u16 parsed = 0;
7125
7126         while (parsed < eir_len) {
7127                 u8 field_len = eir[0];
7128                 u8 uuid[16];
7129                 int i;
7130
7131                 if (field_len == 0)
7132                         break;
7133
7134                 if (eir_len - parsed < field_len + 1)
7135                         break;
7136
7137                 switch (eir[1]) {
7138                 case EIR_UUID16_ALL:
7139                 case EIR_UUID16_SOME:
7140                         for (i = 0; i + 3 <= field_len; i += 2) {
7141                                 memcpy(uuid, bluetooth_base_uuid, 16);
7142                                 uuid[13] = eir[i + 3];
7143                                 uuid[12] = eir[i + 2];
7144                                 if (has_uuid(uuid, uuid_count, uuids))
7145                                         return true;
7146                         }
7147                         break;
7148                 case EIR_UUID32_ALL:
7149                 case EIR_UUID32_SOME:
7150                         for (i = 0; i + 5 <= field_len; i += 4) {
7151                                 memcpy(uuid, bluetooth_base_uuid, 16);
7152                                 uuid[15] = eir[i + 5];
7153                                 uuid[14] = eir[i + 4];
7154                                 uuid[13] = eir[i + 3];
7155                                 uuid[12] = eir[i + 2];
7156                                 if (has_uuid(uuid, uuid_count, uuids))
7157                                         return true;
7158                         }
7159                         break;
7160                 case EIR_UUID128_ALL:
7161                 case EIR_UUID128_SOME:
7162                         for (i = 0; i + 17 <= field_len; i += 16) {
7163                                 memcpy(uuid, eir + i + 2, 16);
7164                                 if (has_uuid(uuid, uuid_count, uuids))
7165                                         return true;
7166                         }
7167                         break;
7168                 }
7169
7170                 parsed += field_len + 1;
7171                 eir += field_len + 1;
7172         }
7173
7174         return false;
7175 }
7176
7177 static void restart_le_scan(struct hci_dev *hdev)
7178 {
7179         /* If controller is not scanning we are done. */
7180         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7181                 return;
7182
7183         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7184                        hdev->discovery.scan_start +
7185                        hdev->discovery.scan_duration))
7186                 return;
7187
7188         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7189                            DISCOV_LE_RESTART_DELAY);
7190 }
7191
7192 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7193                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7194 {
7195         /* If a RSSI threshold has been specified, and
7196          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7197          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7198          * is set, let it through for further processing, as we might need to
7199          * restart the scan.
7200          *
7201          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7202          * the results are also dropped.
7203          */
7204         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7205             (rssi == HCI_RSSI_INVALID ||
7206             (rssi < hdev->discovery.rssi &&
7207              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7208                 return  false;
7209
7210         if (hdev->discovery.uuid_count != 0) {
7211                 /* If a list of UUIDs is provided in filter, results with no
7212                  * matching UUID should be dropped.
7213                  */
7214                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7215                                    hdev->discovery.uuids) &&
7216                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7217                                    hdev->discovery.uuid_count,
7218                                    hdev->discovery.uuids))
7219                         return false;
7220         }
7221
7222         /* If duplicate filtering does not report RSSI changes, then restart
7223          * scanning to ensure updated result with updated RSSI values.
7224          */
7225         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7226                 restart_le_scan(hdev);
7227
7228                 /* Validate RSSI value against the RSSI threshold once more. */
7229                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7230                     rssi < hdev->discovery.rssi)
7231                         return false;
7232         }
7233
7234         return true;
7235 }
7236
7237 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7238                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7239                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7240 {
7241         char buf[512];
7242         struct mgmt_ev_device_found *ev = (void *)buf;
7243         size_t ev_size;
7244
7245         /* Don't send events for a non-kernel initiated discovery. With
7246          * LE one exception is if we have pend_le_reports > 0 in which
7247          * case we're doing passive scanning and want these events.
7248          */
7249         if (!hci_discovery_active(hdev)) {
7250                 if (link_type == ACL_LINK)
7251                         return;
7252                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7253                         return;
7254         }
7255
7256         if (hdev->discovery.result_filtering) {
7257                 /* We are using service discovery */
7258                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7259                                      scan_rsp_len))
7260                         return;
7261         }
7262
7263         if (hdev->discovery.limited) {
7264                 /* Check for limited discoverable bit */
7265                 if (dev_class) {
7266                         if (!(dev_class[1] & 0x20))
7267                                 return;
7268                 } else {
7269                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7270                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7271                                 return;
7272                 }
7273         }
7274
7275         /* Make sure that the buffer is big enough. The 5 extra bytes
7276          * are for the potential CoD field.
7277          */
7278         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7279                 return;
7280
7281         memset(buf, 0, sizeof(buf));
7282
7283         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7284          * RSSI value was reported as 0 when not available. This behavior
7285          * is kept when using device discovery. This is required for full
7286          * backwards compatibility with the API.
7287          *
7288          * However when using service discovery, the value 127 will be
7289          * returned when the RSSI is not available.
7290          */
7291         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7292             link_type == ACL_LINK)
7293                 rssi = 0;
7294
7295         bacpy(&ev->addr.bdaddr, bdaddr);
7296         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7297         ev->rssi = rssi;
7298         ev->flags = cpu_to_le32(flags);
7299
7300         if (eir_len > 0)
7301                 /* Copy EIR or advertising data into event */
7302                 memcpy(ev->eir, eir, eir_len);
7303
7304         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7305                                        NULL))
7306                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7307                                           dev_class, 3);
7308
7309         if (scan_rsp_len > 0)
7310                 /* Append scan response data to event */
7311                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7312
7313         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7314         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7315
7316         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7317 }
7318
7319 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7320                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7321 {
7322         struct mgmt_ev_device_found *ev;
7323         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7324         u16 eir_len;
7325
7326         ev = (struct mgmt_ev_device_found *) buf;
7327
7328         memset(buf, 0, sizeof(buf));
7329
7330         bacpy(&ev->addr.bdaddr, bdaddr);
7331         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7332         ev->rssi = rssi;
7333
7334         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7335                                   name_len);
7336
7337         ev->eir_len = cpu_to_le16(eir_len);
7338
7339         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7340 }
7341
7342 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7343 {
7344         struct mgmt_ev_discovering ev;
7345
7346         BT_DBG("%s discovering %u", hdev->name, discovering);
7347
7348         memset(&ev, 0, sizeof(ev));
7349         ev.type = hdev->discovery.type;
7350         ev.discovering = discovering;
7351
7352         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7353 }
7354
7355 static struct hci_mgmt_chan chan = {
7356         .channel        = HCI_CHANNEL_CONTROL,
7357         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7358         .handlers       = mgmt_handlers,
7359         .hdev_init      = mgmt_init_hdev,
7360 };
7361
7362 int mgmt_init(void)
7363 {
7364         return hci_mgmt_chan_register(&chan);
7365 }
7366
7367 void mgmt_exit(void)
7368 {
7369         hci_mgmt_chan_unregister(&chan);
7370 }