net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 223         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 225         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 226         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 227         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 228         MGMT_STATUS_FAILED,             /* Slot Violation */
 229         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 230         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 231         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 232         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 233         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 234         MGMT_STATUS_BUSY,               /* Controller Busy */
 235         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 236         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 237         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 238         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 239         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 240 };
 241
 242 static u8 mgmt_status(u8 hci_status)
 243 {
 244         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245                 return mgmt_status_table[hci_status];
 246
 247         return MGMT_STATUS_FAILED;
 248 }
 249
 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251                             u16 len, int flag)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, NULL);
 255 }
 256
 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, int flag, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                flag, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 void mgmt_fill_version_info(void *ver)
 280 {
 281         struct mgmt_rp_read_version *rp = ver;
 282
 283         rp->version = MGMT_VERSION;
 284         rp->revision = cpu_to_le16(MGMT_REVISION);
 285 }
 286
 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288                         u16 data_len)
 289 {
 290         struct mgmt_rp_read_version rp;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         mgmt_fill_version_info(&rp);
 295
 296         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297                                  &rp, sizeof(rp));
 298 }
 299
 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301                          u16 data_len)
 302 {
 303         struct mgmt_rp_read_commands *rp;
 304         u16 num_commands, num_events;
 305         size_t rp_size;
 306         int i, err;
 307
 308         BT_DBG("sock %p", sk);
 309
 310         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311                 num_commands = ARRAY_SIZE(mgmt_commands);
 312                 num_events = ARRAY_SIZE(mgmt_events);
 313         } else {
 314                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316         }
 317
 318         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320         rp = kmalloc(rp_size, GFP_KERNEL);
 321         if (!rp)
 322                 return -ENOMEM;
 323
 324         rp->num_commands = cpu_to_le16(num_commands);
 325         rp->num_events = cpu_to_le16(num_events);
 326
 327         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328                 __le16 *opcode = rp->opcodes;
 329
 330                 for (i = 0; i < num_commands; i++, opcode++)
 331                         put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333                 for (i = 0; i < num_events; i++, opcode++)
 334                         put_unaligned_le16(mgmt_events[i], opcode);
 335         } else {
 336                 __le16 *opcode = rp->opcodes;
 337
 338                 for (i = 0; i < num_commands; i++, opcode++)
 339                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341                 for (i = 0; i < num_events; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343         }
 344
 345         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346                                 rp, rp_size);
 347         kfree(rp);
 348
 349         return err;
 350 }
 351
 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353                            u16 data_len)
 354 {
 355         struct mgmt_rp_read_index_list *rp;
 356         struct hci_dev *d;
 357         size_t rp_len;
 358         u16 count;
 359         int err;
 360
 361         BT_DBG("sock %p", sk);
 362
 363         read_lock(&hci_dev_list_lock);
 364
 365         count = 0;
 366         list_for_each_entry(d, &hci_dev_list, list) {
 367                 if (d->dev_type == HCI_PRIMARY &&
 368                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369                         count++;
 370         }
 371
 372         rp_len = sizeof(*rp) + (2 * count);
 373         rp = kmalloc(rp_len, GFP_ATOMIC);
 374         if (!rp) {
 375                 read_unlock(&hci_dev_list_lock);
 376                 return -ENOMEM;
 377         }
 378
 379         count = 0;
 380         list_for_each_entry(d, &hci_dev_list, list) {
 381                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 382                     hci_dev_test_flag(d, HCI_CONFIG) ||
 383                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384                         continue;
 385
 386                 /* Devices marked as raw-only are neither configured
 387                  * nor unconfigured controllers.
 388                  */
 389                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390                         continue;
 391
 392                 if (d->dev_type == HCI_PRIMARY &&
 393                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394                         rp->index[count++] = cpu_to_le16(d->id);
 395                         BT_DBG("Added hci%u", d->id);
 396                 }
 397         }
 398
 399         rp->num_controllers = cpu_to_le16(count);
 400         rp_len = sizeof(*rp) + (2 * count);
 401
 402         read_unlock(&hci_dev_list_lock);
 403
 404         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405                                 0, rp, rp_len);
 406
 407         kfree(rp);
 408
 409         return err;
 410 }
 411
 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413                                   void *data, u16 data_len)
 414 {
 415         struct mgmt_rp_read_unconf_index_list *rp;
 416         struct hci_dev *d;
 417         size_t rp_len;
 418         u16 count;
 419         int err;
 420
 421         BT_DBG("sock %p", sk);
 422
 423         read_lock(&hci_dev_list_lock);
 424
 425         count = 0;
 426         list_for_each_entry(d, &hci_dev_list, list) {
 427                 if (d->dev_type == HCI_PRIMARY &&
 428                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429                         count++;
 430         }
 431
 432         rp_len = sizeof(*rp) + (2 * count);
 433         rp = kmalloc(rp_len, GFP_ATOMIC);
 434         if (!rp) {
 435                 read_unlock(&hci_dev_list_lock);
 436                 return -ENOMEM;
 437         }
 438
 439         count = 0;
 440         list_for_each_entry(d, &hci_dev_list, list) {
 441                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 442                     hci_dev_test_flag(d, HCI_CONFIG) ||
 443                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444                         continue;
 445
 446                 /* Devices marked as raw-only are neither configured
 447                  * nor unconfigured controllers.
 448                  */
 449                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450                         continue;
 451
 452                 if (d->dev_type == HCI_PRIMARY &&
 453                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454                         rp->index[count++] = cpu_to_le16(d->id);
 455                         BT_DBG("Added hci%u", d->id);
 456                 }
 457         }
 458
 459         rp->num_controllers = cpu_to_le16(count);
 460         rp_len = sizeof(*rp) + (2 * count);
 461
 462         read_unlock(&hci_dev_list_lock);
 463
 464         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467         kfree(rp);
 468
 469         return err;
 470 }
 471
 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473                                void *data, u16 data_len)
 474 {
 475         struct mgmt_rp_read_ext_index_list *rp;
 476         struct hci_dev *d;
 477         size_t rp_len;
 478         u16 count;
 479         int err;
 480
 481         BT_DBG("sock %p", sk);
 482
 483         read_lock(&hci_dev_list_lock);
 484
 485         count = 0;
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 488                         count++;
 489         }
 490
 491         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 492         rp = kmalloc(rp_len, GFP_ATOMIC);
 493         if (!rp) {
 494                 read_unlock(&hci_dev_list_lock);
 495                 return -ENOMEM;
 496         }
 497
 498         count = 0;
 499         list_for_each_entry(d, &hci_dev_list, list) {
 500                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 501                     hci_dev_test_flag(d, HCI_CONFIG) ||
 502                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 503                         continue;
 504
 505                 /* Devices marked as raw-only are neither configured
 506                  * nor unconfigured controllers.
 507                  */
 508                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 509                         continue;
 510
 511                 if (d->dev_type == HCI_PRIMARY) {
 512                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 513                                 rp->entry[count].type = 0x01;
 514                         else
 515                                 rp->entry[count].type = 0x00;
 516                 } else if (d->dev_type == HCI_AMP) {
 517                         rp->entry[count].type = 0x02;
 518                 } else {
 519                         continue;
 520                 }
 521
 522                 rp->entry[count].bus = d->bus;
 523                 rp->entry[count++].index = cpu_to_le16(d->id);
 524                 BT_DBG("Added hci%u", d->id);
 525         }
 526
 527         rp->num_controllers = cpu_to_le16(count);
 528         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 542
 543         kfree(rp);
 544
 545         return err;
 546 }
 547
 548 static bool is_configured(struct hci_dev *hdev)
 549 {
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 return false;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 return false;
 557
 558         return true;
 559 }
 560
 561 static __le32 get_missing_options(struct hci_dev *hdev)
 562 {
 563         u32 options = 0;
 564
 565         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 566             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 567                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 568
 569         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 570             !bacmp(&hdev->public_addr, BDADDR_ANY))
 571                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573         return cpu_to_le32(options);
 574 }
 575
 576 static int new_options(struct hci_dev *hdev, struct sock *skip)
 577 {
 578         __le32 options = get_missing_options(hdev);
 579
 580         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582 }
 583
 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585 {
 586         __le32 options = get_missing_options(hdev);
 587
 588         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589                                  sizeof(options));
 590 }
 591
 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593                             void *data, u16 data_len)
 594 {
 595         struct mgmt_rp_read_config_info rp;
 596         u32 options = 0;
 597
 598         BT_DBG("sock %p %s", sk, hdev->name);
 599
 600         hci_dev_lock(hdev);
 601
 602         memset(&rp, 0, sizeof(rp));
 603         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if (hdev->set_bdaddr)
 609                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611         rp.supported_options = cpu_to_le32(options);
 612         rp.missing_options = get_missing_options(hdev);
 613
 614         hci_dev_unlock(hdev);
 615
 616         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617                                  &rp, sizeof(rp));
 618 }
 619
 620 static u32 get_supported_settings(struct hci_dev *hdev)
 621 {
 622         u32 settings = 0;
 623
 624         settings |= MGMT_SETTING_POWERED;
 625         settings |= MGMT_SETTING_BONDABLE;
 626         settings |= MGMT_SETTING_DEBUG_KEYS;
 627         settings |= MGMT_SETTING_CONNECTABLE;
 628         settings |= MGMT_SETTING_DISCOVERABLE;
 629
 630         if (lmp_bredr_capable(hdev)) {
 631                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 632                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 633                 settings |= MGMT_SETTING_BREDR;
 634                 settings |= MGMT_SETTING_LINK_SECURITY;
 635
 636                 if (lmp_ssp_capable(hdev)) {
 637                         settings |= MGMT_SETTING_SSP;
 638                         settings |= MGMT_SETTING_HS;
 639                 }
 640
 641                 if (lmp_sc_capable(hdev))
 642                         settings |= MGMT_SETTING_SECURE_CONN;
 643         }
 644
 645         if (lmp_le_capable(hdev)) {
 646                 settings |= MGMT_SETTING_LE;
 647                 settings |= MGMT_SETTING_ADVERTISING;
 648                 settings |= MGMT_SETTING_SECURE_CONN;
 649                 settings |= MGMT_SETTING_PRIVACY;
 650                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 651         }
 652
 653         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 654             hdev->set_bdaddr)
 655                 settings |= MGMT_SETTING_CONFIGURATION;
 656
 657         return settings;
 658 }
 659
 660 static u32 get_current_settings(struct hci_dev *hdev)
 661 {
 662         u32 settings = 0;
 663
 664         if (hdev_is_powered(hdev))
 665                 settings |= MGMT_SETTING_POWERED;
 666
 667         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 668                 settings |= MGMT_SETTING_CONNECTABLE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 671                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 672
 673         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 674                 settings |= MGMT_SETTING_DISCOVERABLE;
 675
 676         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 677                 settings |= MGMT_SETTING_BONDABLE;
 678
 679         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 680                 settings |= MGMT_SETTING_BREDR;
 681
 682         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 683                 settings |= MGMT_SETTING_LE;
 684
 685         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 686                 settings |= MGMT_SETTING_LINK_SECURITY;
 687
 688         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 689                 settings |= MGMT_SETTING_SSP;
 690
 691         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 692                 settings |= MGMT_SETTING_HS;
 693
 694         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 695                 settings |= MGMT_SETTING_ADVERTISING;
 696
 697         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 698                 settings |= MGMT_SETTING_SECURE_CONN;
 699
 700         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 701                 settings |= MGMT_SETTING_DEBUG_KEYS;
 702
 703         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 704                 settings |= MGMT_SETTING_PRIVACY;
 705
 706         /* The current setting for static address has two purposes. The
 707          * first is to indicate if the static address will be used and
 708          * the second is to indicate if it is actually set.
 709          *
 710          * This means if the static address is not configured, this flag
 711          * will never be set. If the address is configured, then if the
 712          * address is actually used decides if the flag is set or not.
 713          *
 714          * For single mode LE only controllers and dual-mode controllers
 715          * with BR/EDR disabled, the existence of the static address will
 716          * be evaluated.
 717          */
 718         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 719             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 720             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 721                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 722                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 723         }
 724
 725         return settings;
 726 }
 727
 728 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 729 {
 730         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 731 }
 732
 733 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 734                                                   struct hci_dev *hdev,
 735                                                   const void *data)
 736 {
 737         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 738 }
 739
 740 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 741 {
 742         struct mgmt_pending_cmd *cmd;
 743
 744         /* If there's a pending mgmt command the flags will not yet have
 745          * their final values, so check for this first.
 746          */
 747         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 748         if (cmd) {
 749                 struct mgmt_mode *cp = cmd->param;
 750                 if (cp->val == 0x01)
 751                         return LE_AD_GENERAL;
 752                 else if (cp->val == 0x02)
 753                         return LE_AD_LIMITED;
 754         } else {
 755                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 756                         return LE_AD_LIMITED;
 757                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 758                         return LE_AD_GENERAL;
 759         }
 760
 761         return 0;
 762 }
 763
 764 bool mgmt_get_connectable(struct hci_dev *hdev)
 765 {
 766         struct mgmt_pending_cmd *cmd;
 767
 768         /* If there's a pending mgmt command the flag will not yet have
 769          * it's final value, so check for this first.
 770          */
 771         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 772         if (cmd) {
 773                 struct mgmt_mode *cp = cmd->param;
 774
 775                 return cp->val;
 776         }
 777
 778         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 779 }
 780
 781 static void service_cache_off(struct work_struct *work)
 782 {
 783         struct hci_dev *hdev = container_of(work, struct hci_dev,
 784                                             service_cache.work);
 785         struct hci_request req;
 786
 787         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 788                 return;
 789
 790         hci_req_init(&req, hdev);
 791
 792         hci_dev_lock(hdev);
 793
 794         __hci_req_update_eir(&req);
 795         __hci_req_update_class(&req);
 796
 797         hci_dev_unlock(hdev);
 798
 799         hci_req_run(&req, NULL);
 800 }
 801
 802 static void rpa_expired(struct work_struct *work)
 803 {
 804         struct hci_dev *hdev = container_of(work, struct hci_dev,
 805                                             rpa_expired.work);
 806         struct hci_request req;
 807
 808         BT_DBG("");
 809
 810         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 811
 812         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 813                 return;
 814
 815         /* The generation of a new RPA and programming it into the
 816          * controller happens in the hci_req_enable_advertising()
 817          * function.
 818          */
 819         hci_req_init(&req, hdev);
 820         __hci_req_enable_advertising(&req);
 821         hci_req_run(&req, NULL);
 822 }
 823
 824 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 825 {
 826         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 827                 return;
 828
 829         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 830         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 831
 832         /* Non-mgmt controlled devices get this bit set
 833          * implicitly so that pairing works for them, however
 834          * for mgmt we require user-space to explicitly enable
 835          * it
 836          */
 837         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 838 }
 839
 840 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 841                                 void *data, u16 data_len)
 842 {
 843         struct mgmt_rp_read_info rp;
 844
 845         BT_DBG("sock %p %s", sk, hdev->name);
 846
 847         hci_dev_lock(hdev);
 848
 849         memset(&rp, 0, sizeof(rp));
 850
 851         bacpy(&rp.bdaddr, &hdev->bdaddr);
 852
 853         rp.version = hdev->hci_ver;
 854         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 855
 856         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 857         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 858
 859         memcpy(rp.dev_class, hdev->dev_class, 3);
 860
 861         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 862         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 863
 864         hci_dev_unlock(hdev);
 865
 866         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 867                                  sizeof(rp));
 868 }
 869
 870 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 871 {
 872         u16 eir_len = 0;
 873         size_t name_len;
 874
 875         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 876                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
 877                                           hdev->dev_class, 3);
 878
 879         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
 881                                           hdev->appearance);
 882
 883         name_len = strlen(hdev->dev_name);
 884         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
 885                                   hdev->dev_name, name_len);
 886
 887         name_len = strlen(hdev->short_name);
 888         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
 889                                   hdev->short_name, name_len);
 890
 891         return eir_len;
 892 }
 893
 894 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
 895                                     void *data, u16 data_len)
 896 {
 897         char buf[512];
 898         struct mgmt_rp_read_ext_info *rp = (void *)buf;
 899         u16 eir_len;
 900
 901         BT_DBG("sock %p %s", sk, hdev->name);
 902
 903         memset(&buf, 0, sizeof(buf));
 904
 905         hci_dev_lock(hdev);
 906
 907         bacpy(&rp->bdaddr, &hdev->bdaddr);
 908
 909         rp->version = hdev->hci_ver;
 910         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
 911
 912         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
 913         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
 914
 915
 916         eir_len = append_eir_data_to_buf(hdev, rp->eir);
 917         rp->eir_len = cpu_to_le16(eir_len);
 918
 919         hci_dev_unlock(hdev);
 920
 921         /* If this command is called at least once, then the events
 922          * for class of device and local name changes are disabled
 923          * and only the new extended controller information event
 924          * is used.
 925          */
 926         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
 927         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
 928         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
 929
 930         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
 931                                  sizeof(*rp) + eir_len);
 932 }
 933
 934 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
 935 {
 936         char buf[512];
 937         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
 938         u16 eir_len;
 939
 940         memset(buf, 0, sizeof(buf));
 941
 942         eir_len = append_eir_data_to_buf(hdev, ev->eir);
 943         ev->eir_len = cpu_to_le16(eir_len);
 944
 945         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
 946                                   sizeof(*ev) + eir_len,
 947                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
 948 }
 949
 950 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 951 {
 952         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 953
 954         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
 955                                  sizeof(settings));
 956 }
 957
 958 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 959 {
 960         BT_DBG("%s status 0x%02x", hdev->name, status);
 961
 962         if (hci_conn_count(hdev) == 0) {
 963                 cancel_delayed_work(&hdev->power_off);
 964                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 965         }
 966 }
 967
 968 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
 969 {
 970         struct mgmt_ev_advertising_added ev;
 971
 972         ev.instance = instance;
 973
 974         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
 975 }
 976
 977 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
 978                               u8 instance)
 979 {
 980         struct mgmt_ev_advertising_removed ev;
 981
 982         ev.instance = instance;
 983
 984         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
 985 }
 986
 987 static void cancel_adv_timeout(struct hci_dev *hdev)
 988 {
 989         if (hdev->adv_instance_timeout) {
 990                 hdev->adv_instance_timeout = 0;
 991                 cancel_delayed_work(&hdev->adv_instance_expire);
 992         }
 993 }
 994
 995 static int clean_up_hci_state(struct hci_dev *hdev)
 996 {
 997         struct hci_request req;
 998         struct hci_conn *conn;
 999         bool discov_stopped;
1000         int err;
1001
1002         hci_req_init(&req, hdev);
1003
1004         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1005             test_bit(HCI_PSCAN, &hdev->flags)) {
1006                 u8 scan = 0x00;
1007                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008         }
1009
1010         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1011
1012         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1013                 __hci_req_disable_advertising(&req);
1014
1015         discov_stopped = hci_req_stop_discovery(&req);
1016
1017         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1018                 /* 0x15 == Terminated due to Power Off */
1019                 __hci_abort_conn(&req, conn, 0x15);
1020         }
1021
1022         err = hci_req_run(&req, clean_up_hci_complete);
1023         if (!err && discov_stopped)
1024                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1025
1026         return err;
1027 }
1028
1029 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1030                        u16 len)
1031 {
1032         struct mgmt_mode *cp = data;
1033         struct mgmt_pending_cmd *cmd;
1034         int err;
1035
1036         BT_DBG("request for %s", hdev->name);
1037
1038         if (cp->val != 0x00 && cp->val != 0x01)
1039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1040                                        MGMT_STATUS_INVALID_PARAMS);
1041
1042         hci_dev_lock(hdev);
1043
1044         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1045                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1046                                       MGMT_STATUS_BUSY);
1047                 goto failed;
1048         }
1049
1050         if (!!cp->val == hdev_is_powered(hdev)) {
1051                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1052                 goto failed;
1053         }
1054
1055         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1056         if (!cmd) {
1057                 err = -ENOMEM;
1058                 goto failed;
1059         }
1060
1061         if (cp->val) {
1062                 queue_work(hdev->req_workqueue, &hdev->power_on);
1063                 err = 0;
1064         } else {
1065                 /* Disconnect connections, stop scans, etc */
1066                 err = clean_up_hci_state(hdev);
1067                 if (!err)
1068                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1069                                            HCI_POWER_OFF_TIMEOUT);
1070
1071                 /* ENODATA means there were no HCI commands queued */
1072                 if (err == -ENODATA) {
1073                         cancel_delayed_work(&hdev->power_off);
1074                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1075                         err = 0;
1076                 }
1077         }
1078
1079 failed:
1080         hci_dev_unlock(hdev);
1081         return err;
1082 }
1083
1084 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1085 {
1086         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1087
1088         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1089                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1090 }
1091
1092 int mgmt_new_settings(struct hci_dev *hdev)
1093 {
1094         return new_settings(hdev, NULL);
1095 }
1096
1097 struct cmd_lookup {
1098         struct sock *sk;
1099         struct hci_dev *hdev;
1100         u8 mgmt_status;
1101 };
1102
1103 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1104 {
1105         struct cmd_lookup *match = data;
1106
1107         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1108
1109         list_del(&cmd->list);
1110
1111         if (match->sk == NULL) {
1112                 match->sk = cmd->sk;
1113                 sock_hold(match->sk);
1114         }
1115
1116         mgmt_pending_free(cmd);
1117 }
1118
1119 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1120 {
1121         u8 *status = data;
1122
1123         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1124         mgmt_pending_remove(cmd);
1125 }
1126
1127 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1128 {
1129         if (cmd->cmd_complete) {
1130                 u8 *status = data;
1131
1132                 cmd->cmd_complete(cmd, *status);
1133                 mgmt_pending_remove(cmd);
1134
1135                 return;
1136         }
1137
1138         cmd_status_rsp(cmd, data);
1139 }
1140
1141 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1142 {
1143         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1144                                  cmd->param, cmd->param_len);
1145 }
1146
1147 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1148 {
1149         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1150                                  cmd->param, sizeof(struct mgmt_addr_info));
1151 }
1152
1153 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1154 {
1155         if (!lmp_bredr_capable(hdev))
1156                 return MGMT_STATUS_NOT_SUPPORTED;
1157         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1158                 return MGMT_STATUS_REJECTED;
1159         else
1160                 return MGMT_STATUS_SUCCESS;
1161 }
1162
1163 static u8 mgmt_le_support(struct hci_dev *hdev)
1164 {
1165         if (!lmp_le_capable(hdev))
1166                 return MGMT_STATUS_NOT_SUPPORTED;
1167         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1168                 return MGMT_STATUS_REJECTED;
1169         else
1170                 return MGMT_STATUS_SUCCESS;
1171 }
1172
1173 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1174 {
1175         struct mgmt_pending_cmd *cmd;
1176
1177         BT_DBG("status 0x%02x", status);
1178
1179         hci_dev_lock(hdev);
1180
1181         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1182         if (!cmd)
1183                 goto unlock;
1184
1185         if (status) {
1186                 u8 mgmt_err = mgmt_status(status);
1187                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1188                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1189                 goto remove_cmd;
1190         }
1191
1192         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1193             hdev->discov_timeout > 0) {
1194                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1195                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1196         }
1197
1198         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1199         new_settings(hdev, cmd->sk);
1200
1201 remove_cmd:
1202         mgmt_pending_remove(cmd);
1203
1204 unlock:
1205         hci_dev_unlock(hdev);
1206 }
1207
1208 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1209                             u16 len)
1210 {
1211         struct mgmt_cp_set_discoverable *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         u16 timeout;
1214         int err;
1215
1216         BT_DBG("request for %s", hdev->name);
1217
1218         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1219             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1220                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1221                                        MGMT_STATUS_REJECTED);
1222
1223         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1224                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1225                                        MGMT_STATUS_INVALID_PARAMS);
1226
1227         timeout = __le16_to_cpu(cp->timeout);
1228
1229         /* Disabling discoverable requires that no timeout is set,
1230          * and enabling limited discoverable requires a timeout.
1231          */
1232         if ((cp->val == 0x00 && timeout > 0) ||
1233             (cp->val == 0x02 && timeout == 0))
1234                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1235                                        MGMT_STATUS_INVALID_PARAMS);
1236
1237         hci_dev_lock(hdev);
1238
1239         if (!hdev_is_powered(hdev) && timeout > 0) {
1240                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1241                                       MGMT_STATUS_NOT_POWERED);
1242                 goto failed;
1243         }
1244
1245         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1246             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1247                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1248                                       MGMT_STATUS_BUSY);
1249                 goto failed;
1250         }
1251
1252         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1253                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1254                                       MGMT_STATUS_REJECTED);
1255                 goto failed;
1256         }
1257
1258         if (!hdev_is_powered(hdev)) {
1259                 bool changed = false;
1260
1261                 /* Setting limited discoverable when powered off is
1262                  * not a valid operation since it requires a timeout
1263                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1264                  */
1265                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1266                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1267                         changed = true;
1268                 }
1269
1270                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1271                 if (err < 0)
1272                         goto failed;
1273
1274                 if (changed)
1275                         err = new_settings(hdev, sk);
1276
1277                 goto failed;
1278         }
1279
1280         /* If the current mode is the same, then just update the timeout
1281          * value with the new value. And if only the timeout gets updated,
1282          * then no need for any HCI transactions.
1283          */
1284         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1285             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1286                                                    HCI_LIMITED_DISCOVERABLE)) {
1287                 cancel_delayed_work(&hdev->discov_off);
1288                 hdev->discov_timeout = timeout;
1289
1290                 if (cp->val && hdev->discov_timeout > 0) {
1291                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1292                         queue_delayed_work(hdev->req_workqueue,
1293                                            &hdev->discov_off, to);
1294                 }
1295
1296                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1297                 goto failed;
1298         }
1299
1300         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1301         if (!cmd) {
1302                 err = -ENOMEM;
1303                 goto failed;
1304         }
1305
1306         /* Cancel any potential discoverable timeout that might be
1307          * still active and store new timeout value. The arming of
1308          * the timeout happens in the complete handler.
1309          */
1310         cancel_delayed_work(&hdev->discov_off);
1311         hdev->discov_timeout = timeout;
1312
1313         if (cp->val)
1314                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1315         else
1316                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1317
1318         /* Limited discoverable mode */
1319         if (cp->val == 0x02)
1320                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1321         else
1322                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1323
1324         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1325         err = 0;
1326
1327 failed:
1328         hci_dev_unlock(hdev);
1329         return err;
1330 }
1331
1332 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1333 {
1334         struct mgmt_pending_cmd *cmd;
1335
1336         BT_DBG("status 0x%02x", status);
1337
1338         hci_dev_lock(hdev);
1339
1340         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1341         if (!cmd)
1342                 goto unlock;
1343
1344         if (status) {
1345                 u8 mgmt_err = mgmt_status(status);
1346                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1347                 goto remove_cmd;
1348         }
1349
1350         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1351         new_settings(hdev, cmd->sk);
1352
1353 remove_cmd:
1354         mgmt_pending_remove(cmd);
1355
1356 unlock:
1357         hci_dev_unlock(hdev);
1358 }
1359
1360 static int set_connectable_update_settings(struct hci_dev *hdev,
1361                                            struct sock *sk, u8 val)
1362 {
1363         bool changed = false;
1364         int err;
1365
1366         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1367                 changed = true;
1368
1369         if (val) {
1370                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1371         } else {
1372                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1373                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1374         }
1375
1376         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1377         if (err < 0)
1378                 return err;
1379
1380         if (changed) {
1381                 hci_req_update_scan(hdev);
1382                 hci_update_background_scan(hdev);
1383                 return new_settings(hdev, sk);
1384         }
1385
1386         return 0;
1387 }
1388
1389 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1390                            u16 len)
1391 {
1392         struct mgmt_mode *cp = data;
1393         struct mgmt_pending_cmd *cmd;
1394         int err;
1395
1396         BT_DBG("request for %s", hdev->name);
1397
1398         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1399             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1401                                        MGMT_STATUS_REJECTED);
1402
1403         if (cp->val != 0x00 && cp->val != 0x01)
1404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1405                                        MGMT_STATUS_INVALID_PARAMS);
1406
1407         hci_dev_lock(hdev);
1408
1409         if (!hdev_is_powered(hdev)) {
1410                 err = set_connectable_update_settings(hdev, sk, cp->val);
1411                 goto failed;
1412         }
1413
1414         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1415             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1417                                       MGMT_STATUS_BUSY);
1418                 goto failed;
1419         }
1420
1421         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1422         if (!cmd) {
1423                 err = -ENOMEM;
1424                 goto failed;
1425         }
1426
1427         if (cp->val) {
1428                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1429         } else {
1430                 if (hdev->discov_timeout > 0)
1431                         cancel_delayed_work(&hdev->discov_off);
1432
1433                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1434                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1435                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1436         }
1437
1438         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1439         err = 0;
1440
1441 failed:
1442         hci_dev_unlock(hdev);
1443         return err;
1444 }
1445
1446 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1447                         u16 len)
1448 {
1449         struct mgmt_mode *cp = data;
1450         bool changed;
1451         int err;
1452
1453         BT_DBG("request for %s", hdev->name);
1454
1455         if (cp->val != 0x00 && cp->val != 0x01)
1456                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1457                                        MGMT_STATUS_INVALID_PARAMS);
1458
1459         hci_dev_lock(hdev);
1460
1461         if (cp->val)
1462                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1463         else
1464                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1465
1466         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1467         if (err < 0)
1468                 goto unlock;
1469
1470         if (changed) {
1471                 /* In limited privacy mode the change of bondable mode
1472                  * may affect the local advertising address.
1473                  */
1474                 if (hdev_is_powered(hdev) &&
1475                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1476                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1477                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1478                         queue_work(hdev->req_workqueue,
1479                                    &hdev->discoverable_update);
1480
1481                 err = new_settings(hdev, sk);
1482         }
1483
1484 unlock:
1485         hci_dev_unlock(hdev);
1486         return err;
1487 }
1488
1489 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1490                              u16 len)
1491 {
1492         struct mgmt_mode *cp = data;
1493         struct mgmt_pending_cmd *cmd;
1494         u8 val, status;
1495         int err;
1496
1497         BT_DBG("request for %s", hdev->name);
1498
1499         status = mgmt_bredr_support(hdev);
1500         if (status)
1501                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1502                                        status);
1503
1504         if (cp->val != 0x00 && cp->val != 0x01)
1505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1506                                        MGMT_STATUS_INVALID_PARAMS);
1507
1508         hci_dev_lock(hdev);
1509
1510         if (!hdev_is_powered(hdev)) {
1511                 bool changed = false;
1512
1513                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1514                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1515                         changed = true;
1516                 }
1517
1518                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1519                 if (err < 0)
1520                         goto failed;
1521
1522                 if (changed)
1523                         err = new_settings(hdev, sk);
1524
1525                 goto failed;
1526         }
1527
1528         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1529                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1530                                       MGMT_STATUS_BUSY);
1531                 goto failed;
1532         }
1533
1534         val = !!cp->val;
1535
1536         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1537                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1538                 goto failed;
1539         }
1540
1541         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1542         if (!cmd) {
1543                 err = -ENOMEM;
1544                 goto failed;
1545         }
1546
1547         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1548         if (err < 0) {
1549                 mgmt_pending_remove(cmd);
1550                 goto failed;
1551         }
1552
1553 failed:
1554         hci_dev_unlock(hdev);
1555         return err;
1556 }
1557
1558 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1559 {
1560         struct mgmt_mode *cp = data;
1561         struct mgmt_pending_cmd *cmd;
1562         u8 status;
1563         int err;
1564
1565         BT_DBG("request for %s", hdev->name);
1566
1567         status = mgmt_bredr_support(hdev);
1568         if (status)
1569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1570
1571         if (!lmp_ssp_capable(hdev))
1572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1573                                        MGMT_STATUS_NOT_SUPPORTED);
1574
1575         if (cp->val != 0x00 && cp->val != 0x01)
1576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1577                                        MGMT_STATUS_INVALID_PARAMS);
1578
1579         hci_dev_lock(hdev);
1580
1581         if (!hdev_is_powered(hdev)) {
1582                 bool changed;
1583
1584                 if (cp->val) {
1585                         changed = !hci_dev_test_and_set_flag(hdev,
1586                                                              HCI_SSP_ENABLED);
1587                 } else {
1588                         changed = hci_dev_test_and_clear_flag(hdev,
1589                                                               HCI_SSP_ENABLED);
1590                         if (!changed)
1591                                 changed = hci_dev_test_and_clear_flag(hdev,
1592                                                                       HCI_HS_ENABLED);
1593                         else
1594                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1595                 }
1596
1597                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1598                 if (err < 0)
1599                         goto failed;
1600
1601                 if (changed)
1602                         err = new_settings(hdev, sk);
1603
1604                 goto failed;
1605         }
1606
1607         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1608                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1609                                       MGMT_STATUS_BUSY);
1610                 goto failed;
1611         }
1612
1613         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1614                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1615                 goto failed;
1616         }
1617
1618         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1619         if (!cmd) {
1620                 err = -ENOMEM;
1621                 goto failed;
1622         }
1623
1624         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1625                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1626                              sizeof(cp->val), &cp->val);
1627
1628         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1629         if (err < 0) {
1630                 mgmt_pending_remove(cmd);
1631                 goto failed;
1632         }
1633
1634 failed:
1635         hci_dev_unlock(hdev);
1636         return err;
1637 }
1638
1639 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1640 {
1641         struct mgmt_mode *cp = data;
1642         bool changed;
1643         u8 status;
1644         int err;
1645
1646         BT_DBG("request for %s", hdev->name);
1647
1648         status = mgmt_bredr_support(hdev);
1649         if (status)
1650                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1651
1652         if (!lmp_ssp_capable(hdev))
1653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1654                                        MGMT_STATUS_NOT_SUPPORTED);
1655
1656         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1658                                        MGMT_STATUS_REJECTED);
1659
1660         if (cp->val != 0x00 && cp->val != 0x01)
1661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1662                                        MGMT_STATUS_INVALID_PARAMS);
1663
1664         hci_dev_lock(hdev);
1665
1666         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1667                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1668                                       MGMT_STATUS_BUSY);
1669                 goto unlock;
1670         }
1671
1672         if (cp->val) {
1673                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1674         } else {
1675                 if (hdev_is_powered(hdev)) {
1676                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1677                                               MGMT_STATUS_REJECTED);
1678                         goto unlock;
1679                 }
1680
1681                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1682         }
1683
1684         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1685         if (err < 0)
1686                 goto unlock;
1687
1688         if (changed)
1689                 err = new_settings(hdev, sk);
1690
1691 unlock:
1692         hci_dev_unlock(hdev);
1693         return err;
1694 }
1695
1696 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1697 {
1698         struct cmd_lookup match = { NULL, hdev };
1699
1700         hci_dev_lock(hdev);
1701
1702         if (status) {
1703                 u8 mgmt_err = mgmt_status(status);
1704
1705                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1706                                      &mgmt_err);
1707                 goto unlock;
1708         }
1709
1710         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1711
1712         new_settings(hdev, match.sk);
1713
1714         if (match.sk)
1715                 sock_put(match.sk);
1716
1717         /* Make sure the controller has a good default for
1718          * advertising data. Restrict the update to when LE
1719          * has actually been enabled. During power on, the
1720          * update in powered_update_hci will take care of it.
1721          */
1722         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1723                 struct hci_request req;
1724
1725                 hci_req_init(&req, hdev);
1726                 __hci_req_update_adv_data(&req, 0x00);
1727                 __hci_req_update_scan_rsp_data(&req, 0x00);
1728                 hci_req_run(&req, NULL);
1729                 hci_update_background_scan(hdev);
1730         }
1731
1732 unlock:
1733         hci_dev_unlock(hdev);
1734 }
1735
1736 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738         struct mgmt_mode *cp = data;
1739         struct hci_cp_write_le_host_supported hci_cp;
1740         struct mgmt_pending_cmd *cmd;
1741         struct hci_request req;
1742         int err;
1743         u8 val, enabled;
1744
1745         BT_DBG("request for %s", hdev->name);
1746
1747         if (!lmp_le_capable(hdev))
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1749                                        MGMT_STATUS_NOT_SUPPORTED);
1750
1751         if (cp->val != 0x00 && cp->val != 0x01)
1752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1753                                        MGMT_STATUS_INVALID_PARAMS);
1754
1755         /* Bluetooth single mode LE only controllers or dual-mode
1756          * controllers configured as LE only devices, do not allow
1757          * switching LE off. These have either LE enabled explicitly
1758          * or BR/EDR has been previously switched off.
1759          *
1760          * When trying to enable an already enabled LE, then gracefully
1761          * send a positive response. Trying to disable it however will
1762          * result into rejection.
1763          */
1764         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1765                 if (cp->val == 0x01)
1766                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1767
1768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1769                                        MGMT_STATUS_REJECTED);
1770         }
1771
1772         hci_dev_lock(hdev);
1773
1774         val = !!cp->val;
1775         enabled = lmp_host_le_capable(hdev);
1776
1777         if (!val)
1778                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1779
1780         if (!hdev_is_powered(hdev) || val == enabled) {
1781                 bool changed = false;
1782
1783                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1784                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1785                         changed = true;
1786                 }
1787
1788                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1789                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1790                         changed = true;
1791                 }
1792
1793                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1794                 if (err < 0)
1795                         goto unlock;
1796
1797                 if (changed)
1798                         err = new_settings(hdev, sk);
1799
1800                 goto unlock;
1801         }
1802
1803         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1804             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1805                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1806                                       MGMT_STATUS_BUSY);
1807                 goto unlock;
1808         }
1809
1810         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1811         if (!cmd) {
1812                 err = -ENOMEM;
1813                 goto unlock;
1814         }
1815
1816         hci_req_init(&req, hdev);
1817
1818         memset(&hci_cp, 0, sizeof(hci_cp));
1819
1820         if (val) {
1821                 hci_cp.le = val;
1822                 hci_cp.simul = 0x00;
1823         } else {
1824                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1825                         __hci_req_disable_advertising(&req);
1826         }
1827
1828         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1829                     &hci_cp);
1830
1831         err = hci_req_run(&req, le_enable_complete);
1832         if (err < 0)
1833                 mgmt_pending_remove(cmd);
1834
1835 unlock:
1836         hci_dev_unlock(hdev);
1837         return err;
1838 }
1839
1840 /* This is a helper function to test for pending mgmt commands that can
1841  * cause CoD or EIR HCI commands. We can only allow one such pending
1842  * mgmt command at a time since otherwise we cannot easily track what
1843  * the current values are, will be, and based on that calculate if a new
1844  * HCI command needs to be sent and if yes with what value.
1845  */
1846 static bool pending_eir_or_class(struct hci_dev *hdev)
1847 {
1848         struct mgmt_pending_cmd *cmd;
1849
1850         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1851                 switch (cmd->opcode) {
1852                 case MGMT_OP_ADD_UUID:
1853                 case MGMT_OP_REMOVE_UUID:
1854                 case MGMT_OP_SET_DEV_CLASS:
1855                 case MGMT_OP_SET_POWERED:
1856                         return true;
1857                 }
1858         }
1859
1860         return false;
1861 }
1862
1863 static const u8 bluetooth_base_uuid[] = {
1864                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1865                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1866 };
1867
1868 static u8 get_uuid_size(const u8 *uuid)
1869 {
1870         u32 val;
1871
1872         if (memcmp(uuid, bluetooth_base_uuid, 12))
1873                 return 128;
1874
1875         val = get_unaligned_le32(&uuid[12]);
1876         if (val > 0xffff)
1877                 return 32;
1878
1879         return 16;
1880 }
1881
1882 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1883 {
1884         struct mgmt_pending_cmd *cmd;
1885
1886         hci_dev_lock(hdev);
1887
1888         cmd = pending_find(mgmt_op, hdev);
1889         if (!cmd)
1890                 goto unlock;
1891
1892         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
1893                           mgmt_status(status), hdev->dev_class, 3);
1894
1895         mgmt_pending_remove(cmd);
1896
1897 unlock:
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1902 {
1903         BT_DBG("status 0x%02x", status);
1904
1905         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1906 }
1907
1908 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1909 {
1910         struct mgmt_cp_add_uuid *cp = data;
1911         struct mgmt_pending_cmd *cmd;
1912         struct hci_request req;
1913         struct bt_uuid *uuid;
1914         int err;
1915
1916         BT_DBG("request for %s", hdev->name);
1917
1918         hci_dev_lock(hdev);
1919
1920         if (pending_eir_or_class(hdev)) {
1921                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1922                                       MGMT_STATUS_BUSY);
1923                 goto failed;
1924         }
1925
1926         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1927         if (!uuid) {
1928                 err = -ENOMEM;
1929                 goto failed;
1930         }
1931
1932         memcpy(uuid->uuid, cp->uuid, 16);
1933         uuid->svc_hint = cp->svc_hint;
1934         uuid->size = get_uuid_size(cp->uuid);
1935
1936         list_add_tail(&uuid->list, &hdev->uuids);
1937
1938         hci_req_init(&req, hdev);
1939
1940         __hci_req_update_class(&req);
1941         __hci_req_update_eir(&req);
1942
1943         err = hci_req_run(&req, add_uuid_complete);
1944         if (err < 0) {
1945                 if (err != -ENODATA)
1946                         goto failed;
1947
1948                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1949                                         hdev->dev_class, 3);
1950                 goto failed;
1951         }
1952
1953         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1954         if (!cmd) {
1955                 err = -ENOMEM;
1956                 goto failed;
1957         }
1958
1959         err = 0;
1960
1961 failed:
1962         hci_dev_unlock(hdev);
1963         return err;
1964 }
1965
1966 static bool enable_service_cache(struct hci_dev *hdev)
1967 {
1968         if (!hdev_is_powered(hdev))
1969                 return false;
1970
1971         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
1972                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1973                                    CACHE_TIMEOUT);
1974                 return true;
1975         }
1976
1977         return false;
1978 }
1979
1980 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1981 {
1982         BT_DBG("status 0x%02x", status);
1983
1984         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1985 }
1986
1987 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1988                        u16 len)
1989 {
1990         struct mgmt_cp_remove_uuid *cp = data;
1991         struct mgmt_pending_cmd *cmd;
1992         struct bt_uuid *match, *tmp;
1993         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1994         struct hci_request req;
1995         int err, found;
1996
1997         BT_DBG("request for %s", hdev->name);
1998
1999         hci_dev_lock(hdev);
2000
2001         if (pending_eir_or_class(hdev)) {
2002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2003                                       MGMT_STATUS_BUSY);
2004                 goto unlock;
2005         }
2006
2007         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2008                 hci_uuids_clear(hdev);
2009
2010                 if (enable_service_cache(hdev)) {
2011                         err = mgmt_cmd_complete(sk, hdev->id,
2012                                                 MGMT_OP_REMOVE_UUID,
2013                                                 0, hdev->dev_class, 3);
2014                         goto unlock;
2015                 }
2016
2017                 goto update_class;
2018         }
2019
2020         found = 0;
2021
2022         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2023                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2024                         continue;
2025
2026                 list_del(&match->list);
2027                 kfree(match);
2028                 found++;
2029         }
2030
2031         if (found == 0) {
2032                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2033                                       MGMT_STATUS_INVALID_PARAMS);
2034                 goto unlock;
2035         }
2036
2037 update_class:
2038         hci_req_init(&req, hdev);
2039
2040         __hci_req_update_class(&req);
2041         __hci_req_update_eir(&req);
2042
2043         err = hci_req_run(&req, remove_uuid_complete);
2044         if (err < 0) {
2045                 if (err != -ENODATA)
2046                         goto unlock;
2047
2048                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2049                                         hdev->dev_class, 3);
2050                 goto unlock;
2051         }
2052
2053         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2054         if (!cmd) {
2055                 err = -ENOMEM;
2056                 goto unlock;
2057         }
2058
2059         err = 0;
2060
2061 unlock:
2062         hci_dev_unlock(hdev);
2063         return err;
2064 }
2065
2066 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2067 {
2068         BT_DBG("status 0x%02x", status);
2069
2070         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2071 }
2072
2073 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2074                          u16 len)
2075 {
2076         struct mgmt_cp_set_dev_class *cp = data;
2077         struct mgmt_pending_cmd *cmd;
2078         struct hci_request req;
2079         int err;
2080
2081         BT_DBG("request for %s", hdev->name);
2082
2083         if (!lmp_bredr_capable(hdev))
2084                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2085                                        MGMT_STATUS_NOT_SUPPORTED);
2086
2087         hci_dev_lock(hdev);
2088
2089         if (pending_eir_or_class(hdev)) {
2090                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2091                                       MGMT_STATUS_BUSY);
2092                 goto unlock;
2093         }
2094
2095         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2097                                       MGMT_STATUS_INVALID_PARAMS);
2098                 goto unlock;
2099         }
2100
2101         hdev->major_class = cp->major;
2102         hdev->minor_class = cp->minor;
2103
2104         if (!hdev_is_powered(hdev)) {
2105                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2106                                         hdev->dev_class, 3);
2107                 goto unlock;
2108         }
2109
2110         hci_req_init(&req, hdev);
2111
2112         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2113                 hci_dev_unlock(hdev);
2114                 cancel_delayed_work_sync(&hdev->service_cache);
2115                 hci_dev_lock(hdev);
2116                 __hci_req_update_eir(&req);
2117         }
2118
2119         __hci_req_update_class(&req);
2120
2121         err = hci_req_run(&req, set_class_complete);
2122         if (err < 0) {
2123                 if (err != -ENODATA)
2124                         goto unlock;
2125
2126                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2127                                         hdev->dev_class, 3);
2128                 goto unlock;
2129         }
2130
2131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2132         if (!cmd) {
2133                 err = -ENOMEM;
2134                 goto unlock;
2135         }
2136
2137         err = 0;
2138
2139 unlock:
2140         hci_dev_unlock(hdev);
2141         return err;
2142 }
2143
2144 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2145                           u16 len)
2146 {
2147         struct mgmt_cp_load_link_keys *cp = data;
2148         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2149                                    sizeof(struct mgmt_link_key_info));
2150         u16 key_count, expected_len;
2151         bool changed;
2152         int i;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         if (!lmp_bredr_capable(hdev))
2157                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2158                                        MGMT_STATUS_NOT_SUPPORTED);
2159
2160         key_count = __le16_to_cpu(cp->key_count);
2161         if (key_count > max_key_count) {
2162                 BT_ERR("load_link_keys: too big key_count value %u",
2163                        key_count);
2164                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2165                                        MGMT_STATUS_INVALID_PARAMS);
2166         }
2167
2168         expected_len = sizeof(*cp) + key_count *
2169                                         sizeof(struct mgmt_link_key_info);
2170         if (expected_len != len) {
2171                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2172                        expected_len, len);
2173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2174                                        MGMT_STATUS_INVALID_PARAMS);
2175         }
2176
2177         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2178                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2179                                        MGMT_STATUS_INVALID_PARAMS);
2180
2181         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2182                key_count);
2183
2184         for (i = 0; i < key_count; i++) {
2185                 struct mgmt_link_key_info *key = &cp->keys[i];
2186
2187                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2188                         return mgmt_cmd_status(sk, hdev->id,
2189                                                MGMT_OP_LOAD_LINK_KEYS,
2190                                                MGMT_STATUS_INVALID_PARAMS);
2191         }
2192
2193         hci_dev_lock(hdev);
2194
2195         hci_link_keys_clear(hdev);
2196
2197         if (cp->debug_keys)
2198                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2199         else
2200                 changed = hci_dev_test_and_clear_flag(hdev,
2201                                                       HCI_KEEP_DEBUG_KEYS);
2202
2203         if (changed)
2204                 new_settings(hdev, NULL);
2205
2206         for (i = 0; i < key_count; i++) {
2207                 struct mgmt_link_key_info *key = &cp->keys[i];
2208
2209                 /* Always ignore debug keys and require a new pairing if
2210                  * the user wants to use them.
2211                  */
2212                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2213                         continue;
2214
2215                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2216                                  key->type, key->pin_len, NULL);
2217         }
2218
2219         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2220
2221         hci_dev_unlock(hdev);
2222
2223         return 0;
2224 }
2225
2226 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2227                            u8 addr_type, struct sock *skip_sk)
2228 {
2229         struct mgmt_ev_device_unpaired ev;
2230
2231         bacpy(&ev.addr.bdaddr, bdaddr);
2232         ev.addr.type = addr_type;
2233
2234         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2235                           skip_sk);
2236 }
2237
2238 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2239                          u16 len)
2240 {
2241         struct mgmt_cp_unpair_device *cp = data;
2242         struct mgmt_rp_unpair_device rp;
2243         struct hci_conn_params *params;
2244         struct mgmt_pending_cmd *cmd;
2245         struct hci_conn *conn;
2246         u8 addr_type;
2247         int err;
2248
2249         memset(&rp, 0, sizeof(rp));
2250         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2251         rp.addr.type = cp->addr.type;
2252
2253         if (!bdaddr_type_is_valid(cp->addr.type))
2254                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2255                                          MGMT_STATUS_INVALID_PARAMS,
2256                                          &rp, sizeof(rp));
2257
2258         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2259                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2260                                          MGMT_STATUS_INVALID_PARAMS,
2261                                          &rp, sizeof(rp));
2262
2263         hci_dev_lock(hdev);
2264
2265         if (!hdev_is_powered(hdev)) {
2266                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2267                                         MGMT_STATUS_NOT_POWERED, &rp,
2268                                         sizeof(rp));
2269                 goto unlock;
2270         }
2271
2272         if (cp->addr.type == BDADDR_BREDR) {
2273                 /* If disconnection is requested, then look up the
2274                  * connection. If the remote device is connected, it
2275                  * will be later used to terminate the link.
2276                  *
2277                  * Setting it to NULL explicitly will cause no
2278                  * termination of the link.
2279                  */
2280                 if (cp->disconnect)
2281                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2282                                                        &cp->addr.bdaddr);
2283                 else
2284                         conn = NULL;
2285
2286                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2287                 if (err < 0) {
2288                         err = mgmt_cmd_complete(sk, hdev->id,
2289                                                 MGMT_OP_UNPAIR_DEVICE,
2290                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2291                                                 sizeof(rp));
2292                         goto unlock;
2293                 }
2294
2295                 goto done;
2296         }
2297
2298         /* LE address type */
2299         addr_type = le_addr_type(cp->addr.type);
2300
2301         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2302
2303         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2304         if (err < 0) {
2305                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2306                                         MGMT_STATUS_NOT_PAIRED, &rp,
2307                                         sizeof(rp));
2308                 goto unlock;
2309         }
2310
2311         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2312         if (!conn) {
2313                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2314                 goto done;
2315         }
2316
2317         /* Abort any ongoing SMP pairing */
2318         smp_cancel_pairing(conn);
2319
2320         /* Defer clearing up the connection parameters until closing to
2321          * give a chance of keeping them if a repairing happens.
2322          */
2323         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2324
2325         /* Disable auto-connection parameters if present */
2326         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2327         if (params) {
2328                 if (params->explicit_connect)
2329                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2330                 else
2331                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2332         }
2333
2334         /* If disconnection is not requested, then clear the connection
2335          * variable so that the link is not terminated.
2336          */
2337         if (!cp->disconnect)
2338                 conn = NULL;
2339
2340 done:
2341         /* If the connection variable is set, then termination of the
2342          * link is requested.
2343          */
2344         if (!conn) {
2345                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2346                                         &rp, sizeof(rp));
2347                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2348                 goto unlock;
2349         }
2350
2351         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2352                                sizeof(*cp));
2353         if (!cmd) {
2354                 err = -ENOMEM;
2355                 goto unlock;
2356         }
2357
2358         cmd->cmd_complete = addr_cmd_complete;
2359
2360         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2361         if (err < 0)
2362                 mgmt_pending_remove(cmd);
2363
2364 unlock:
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2370                       u16 len)
2371 {
2372         struct mgmt_cp_disconnect *cp = data;
2373         struct mgmt_rp_disconnect rp;
2374         struct mgmt_pending_cmd *cmd;
2375         struct hci_conn *conn;
2376         int err;
2377
2378         BT_DBG("");
2379
2380         memset(&rp, 0, sizeof(rp));
2381         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2382         rp.addr.type = cp->addr.type;
2383
2384         if (!bdaddr_type_is_valid(cp->addr.type))
2385                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2386                                          MGMT_STATUS_INVALID_PARAMS,
2387                                          &rp, sizeof(rp));
2388
2389         hci_dev_lock(hdev);
2390
2391         if (!test_bit(HCI_UP, &hdev->flags)) {
2392                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2393                                         MGMT_STATUS_NOT_POWERED, &rp,
2394                                         sizeof(rp));
2395                 goto failed;
2396         }
2397
2398         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2399                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2400                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2401                 goto failed;
2402         }
2403
2404         if (cp->addr.type == BDADDR_BREDR)
2405                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2406                                                &cp->addr.bdaddr);
2407         else
2408                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2409                                                le_addr_type(cp->addr.type));
2410
2411         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2412                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2413                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2414                                         sizeof(rp));
2415                 goto failed;
2416         }
2417
2418         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2419         if (!cmd) {
2420                 err = -ENOMEM;
2421                 goto failed;
2422         }
2423
2424         cmd->cmd_complete = generic_cmd_complete;
2425
2426         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2427         if (err < 0)
2428                 mgmt_pending_remove(cmd);
2429
2430 failed:
2431         hci_dev_unlock(hdev);
2432         return err;
2433 }
2434
2435 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2436 {
2437         switch (link_type) {
2438         case LE_LINK:
2439                 switch (addr_type) {
2440                 case ADDR_LE_DEV_PUBLIC:
2441                         return BDADDR_LE_PUBLIC;
2442
2443                 default:
2444                         /* Fallback to LE Random address type */
2445                         return BDADDR_LE_RANDOM;
2446                 }
2447
2448         default:
2449                 /* Fallback to BR/EDR type */
2450                 return BDADDR_BREDR;
2451         }
2452 }
2453
2454 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2455                            u16 data_len)
2456 {
2457         struct mgmt_rp_get_connections *rp;
2458         struct hci_conn *c;
2459         size_t rp_len;
2460         int err;
2461         u16 i;
2462
2463         BT_DBG("");
2464
2465         hci_dev_lock(hdev);
2466
2467         if (!hdev_is_powered(hdev)) {
2468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2469                                       MGMT_STATUS_NOT_POWERED);
2470                 goto unlock;
2471         }
2472
2473         i = 0;
2474         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2475                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2476                         i++;
2477         }
2478
2479         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2480         rp = kmalloc(rp_len, GFP_KERNEL);
2481         if (!rp) {
2482                 err = -ENOMEM;
2483                 goto unlock;
2484         }
2485
2486         i = 0;
2487         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2488                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2489                         continue;
2490                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2491                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2492                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2493                         continue;
2494                 i++;
2495         }
2496
2497         rp->conn_count = cpu_to_le16(i);
2498
2499         /* Recalculate length in case of filtered SCO connections, etc */
2500         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2501
2502         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2503                                 rp_len);
2504
2505         kfree(rp);
2506
2507 unlock:
2508         hci_dev_unlock(hdev);
2509         return err;
2510 }
2511
2512 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2513                                    struct mgmt_cp_pin_code_neg_reply *cp)
2514 {
2515         struct mgmt_pending_cmd *cmd;
2516         int err;
2517
2518         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2519                                sizeof(*cp));
2520         if (!cmd)
2521                 return -ENOMEM;
2522
2523         cmd->cmd_complete = addr_cmd_complete;
2524
2525         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2526                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2527         if (err < 0)
2528                 mgmt_pending_remove(cmd);
2529
2530         return err;
2531 }
2532
2533 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2534                           u16 len)
2535 {
2536         struct hci_conn *conn;
2537         struct mgmt_cp_pin_code_reply *cp = data;
2538         struct hci_cp_pin_code_reply reply;
2539         struct mgmt_pending_cmd *cmd;
2540         int err;
2541
2542         BT_DBG("");
2543
2544         hci_dev_lock(hdev);
2545
2546         if (!hdev_is_powered(hdev)) {
2547                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2548                                       MGMT_STATUS_NOT_POWERED);
2549                 goto failed;
2550         }
2551
2552         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2553         if (!conn) {
2554                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2555                                       MGMT_STATUS_NOT_CONNECTED);
2556                 goto failed;
2557         }
2558
2559         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2560                 struct mgmt_cp_pin_code_neg_reply ncp;
2561
2562                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2563
2564                 BT_ERR("PIN code is not 16 bytes long");
2565
2566                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2567                 if (err >= 0)
2568                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2569                                               MGMT_STATUS_INVALID_PARAMS);
2570
2571                 goto failed;
2572         }
2573
2574         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2575         if (!cmd) {
2576                 err = -ENOMEM;
2577                 goto failed;
2578         }
2579
2580         cmd->cmd_complete = addr_cmd_complete;
2581
2582         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2583         reply.pin_len = cp->pin_len;
2584         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2585
2586         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2587         if (err < 0)
2588                 mgmt_pending_remove(cmd);
2589
2590 failed:
2591         hci_dev_unlock(hdev);
2592         return err;
2593 }
2594
2595 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2596                              u16 len)
2597 {
2598         struct mgmt_cp_set_io_capability *cp = data;
2599
2600         BT_DBG("");
2601
2602         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2603                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2604                                        MGMT_STATUS_INVALID_PARAMS);
2605
2606         hci_dev_lock(hdev);
2607
2608         hdev->io_capability = cp->io_capability;
2609
2610         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2611                hdev->io_capability);
2612
2613         hci_dev_unlock(hdev);
2614
2615         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2616                                  NULL, 0);
2617 }
2618
2619 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2620 {
2621         struct hci_dev *hdev = conn->hdev;
2622         struct mgmt_pending_cmd *cmd;
2623
2624         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2625                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2626                         continue;
2627
2628                 if (cmd->user_data != conn)
2629                         continue;
2630
2631                 return cmd;
2632         }
2633
2634         return NULL;
2635 }
2636
2637 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2638 {
2639         struct mgmt_rp_pair_device rp;
2640         struct hci_conn *conn = cmd->user_data;
2641         int err;
2642
2643         bacpy(&rp.addr.bdaddr, &conn->dst);
2644         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2645
2646         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2647                                 status, &rp, sizeof(rp));
2648
2649         /* So we don't get further callbacks for this connection */
2650         conn->connect_cfm_cb = NULL;
2651         conn->security_cfm_cb = NULL;
2652         conn->disconn_cfm_cb = NULL;
2653
2654         hci_conn_drop(conn);
2655
2656         /* The device is paired so there is no need to remove
2657          * its connection parameters anymore.
2658          */
2659         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2660
2661         hci_conn_put(conn);
2662
2663         return err;
2664 }
2665
2666 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2667 {
2668         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2669         struct mgmt_pending_cmd *cmd;
2670
2671         cmd = find_pairing(conn);
2672         if (cmd) {
2673                 cmd->cmd_complete(cmd, status);
2674                 mgmt_pending_remove(cmd);
2675         }
2676 }
2677
2678 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2679 {
2680         struct mgmt_pending_cmd *cmd;
2681
2682         BT_DBG("status %u", status);
2683
2684         cmd = find_pairing(conn);
2685         if (!cmd) {
2686                 BT_DBG("Unable to find a pending command");
2687                 return;
2688         }
2689
2690         cmd->cmd_complete(cmd, mgmt_status(status));
2691         mgmt_pending_remove(cmd);
2692 }
2693
2694 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2695 {
2696         struct mgmt_pending_cmd *cmd;
2697
2698         BT_DBG("status %u", status);
2699
2700         if (!status)
2701                 return;
2702
2703         cmd = find_pairing(conn);
2704         if (!cmd) {
2705                 BT_DBG("Unable to find a pending command");
2706                 return;
2707         }
2708
2709         cmd->cmd_complete(cmd, mgmt_status(status));
2710         mgmt_pending_remove(cmd);
2711 }
2712
2713 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2714                        u16 len)
2715 {
2716         struct mgmt_cp_pair_device *cp = data;
2717         struct mgmt_rp_pair_device rp;
2718         struct mgmt_pending_cmd *cmd;
2719         u8 sec_level, auth_type;
2720         struct hci_conn *conn;
2721         int err;
2722
2723         BT_DBG("");
2724
2725         memset(&rp, 0, sizeof(rp));
2726         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2727         rp.addr.type = cp->addr.type;
2728
2729         if (!bdaddr_type_is_valid(cp->addr.type))
2730                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2731                                          MGMT_STATUS_INVALID_PARAMS,
2732                                          &rp, sizeof(rp));
2733
2734         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2735                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2736                                          MGMT_STATUS_INVALID_PARAMS,
2737                                          &rp, sizeof(rp));
2738
2739         hci_dev_lock(hdev);
2740
2741         if (!hdev_is_powered(hdev)) {
2742                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2743                                         MGMT_STATUS_NOT_POWERED, &rp,
2744                                         sizeof(rp));
2745                 goto unlock;
2746         }
2747
2748         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2749                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2750                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2751                                         sizeof(rp));
2752                 goto unlock;
2753         }
2754
2755         sec_level = BT_SECURITY_MEDIUM;
2756         auth_type = HCI_AT_DEDICATED_BONDING;
2757
2758         if (cp->addr.type == BDADDR_BREDR) {
2759                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2760                                        auth_type);
2761         } else {
2762                 u8 addr_type = le_addr_type(cp->addr.type);
2763                 struct hci_conn_params *p;
2764
2765                 /* When pairing a new device, it is expected to remember
2766                  * this device for future connections. Adding the connection
2767                  * parameter information ahead of time allows tracking
2768                  * of the slave preferred values and will speed up any
2769                  * further connection establishment.
2770                  *
2771                  * If connection parameters already exist, then they
2772                  * will be kept and this function does nothing.
2773                  */
2774                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2775
2776                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2777                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2778
2779                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2780                                            addr_type, sec_level,
2781                                            HCI_LE_CONN_TIMEOUT);
2782         }
2783
2784         if (IS_ERR(conn)) {
2785                 int status;
2786
2787                 if (PTR_ERR(conn) == -EBUSY)
2788                         status = MGMT_STATUS_BUSY;
2789                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2790                         status = MGMT_STATUS_NOT_SUPPORTED;
2791                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2792                         status = MGMT_STATUS_REJECTED;
2793                 else
2794                         status = MGMT_STATUS_CONNECT_FAILED;
2795
2796                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2797                                         status, &rp, sizeof(rp));
2798                 goto unlock;
2799         }
2800
2801         if (conn->connect_cfm_cb) {
2802                 hci_conn_drop(conn);
2803                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2804                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2805                 goto unlock;
2806         }
2807
2808         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2809         if (!cmd) {
2810                 err = -ENOMEM;
2811                 hci_conn_drop(conn);
2812                 goto unlock;
2813         }
2814
2815         cmd->cmd_complete = pairing_complete;
2816
2817         /* For LE, just connecting isn't a proof that the pairing finished */
2818         if (cp->addr.type == BDADDR_BREDR) {
2819                 conn->connect_cfm_cb = pairing_complete_cb;
2820                 conn->security_cfm_cb = pairing_complete_cb;
2821                 conn->disconn_cfm_cb = pairing_complete_cb;
2822         } else {
2823                 conn->connect_cfm_cb = le_pairing_complete_cb;
2824                 conn->security_cfm_cb = le_pairing_complete_cb;
2825                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2826         }
2827
2828         conn->io_capability = cp->io_cap;
2829         cmd->user_data = hci_conn_get(conn);
2830
2831         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2832             hci_conn_security(conn, sec_level, auth_type, true)) {
2833                 cmd->cmd_complete(cmd, 0);
2834                 mgmt_pending_remove(cmd);
2835         }
2836
2837         err = 0;
2838
2839 unlock:
2840         hci_dev_unlock(hdev);
2841         return err;
2842 }
2843
2844 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2845                               u16 len)
2846 {
2847         struct mgmt_addr_info *addr = data;
2848         struct mgmt_pending_cmd *cmd;
2849         struct hci_conn *conn;
2850         int err;
2851
2852         BT_DBG("");
2853
2854         hci_dev_lock(hdev);
2855
2856         if (!hdev_is_powered(hdev)) {
2857                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2858                                       MGMT_STATUS_NOT_POWERED);
2859                 goto unlock;
2860         }
2861
2862         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2863         if (!cmd) {
2864                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2865                                       MGMT_STATUS_INVALID_PARAMS);
2866                 goto unlock;
2867         }
2868
2869         conn = cmd->user_data;
2870
2871         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2872                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2873                                       MGMT_STATUS_INVALID_PARAMS);
2874                 goto unlock;
2875         }
2876
2877         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
2878         mgmt_pending_remove(cmd);
2879
2880         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2881                                 addr, sizeof(*addr));
2882 unlock:
2883         hci_dev_unlock(hdev);
2884         return err;
2885 }
2886
2887 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2888                              struct mgmt_addr_info *addr, u16 mgmt_op,
2889                              u16 hci_op, __le32 passkey)
2890 {
2891         struct mgmt_pending_cmd *cmd;
2892         struct hci_conn *conn;
2893         int err;
2894
2895         hci_dev_lock(hdev);
2896
2897         if (!hdev_is_powered(hdev)) {
2898                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2899                                         MGMT_STATUS_NOT_POWERED, addr,
2900                                         sizeof(*addr));
2901                 goto done;
2902         }
2903
2904         if (addr->type == BDADDR_BREDR)
2905                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2906         else
2907                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
2908                                                le_addr_type(addr->type));
2909
2910         if (!conn) {
2911                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2912                                         MGMT_STATUS_NOT_CONNECTED, addr,
2913                                         sizeof(*addr));
2914                 goto done;
2915         }
2916
2917         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2918                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2919                 if (!err)
2920                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2921                                                 MGMT_STATUS_SUCCESS, addr,
2922                                                 sizeof(*addr));
2923                 else
2924                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2925                                                 MGMT_STATUS_FAILED, addr,
2926                                                 sizeof(*addr));
2927
2928                 goto done;
2929         }
2930
2931         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2932         if (!cmd) {
2933                 err = -ENOMEM;
2934                 goto done;
2935         }
2936
2937         cmd->cmd_complete = addr_cmd_complete;
2938
2939         /* Continue with pairing via HCI */
2940         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2941                 struct hci_cp_user_passkey_reply cp;
2942
2943                 bacpy(&cp.bdaddr, &addr->bdaddr);
2944                 cp.passkey = passkey;
2945                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2946         } else
2947                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2948                                    &addr->bdaddr);
2949
2950         if (err < 0)
2951                 mgmt_pending_remove(cmd);
2952
2953 done:
2954         hci_dev_unlock(hdev);
2955         return err;
2956 }
2957
2958 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2959                               void *data, u16 len)
2960 {
2961         struct mgmt_cp_pin_code_neg_reply *cp = data;
2962
2963         BT_DBG("");
2964
2965         return user_pairing_resp(sk, hdev, &cp->addr,
2966                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2967                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2968 }
2969
2970 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2971                               u16 len)
2972 {
2973         struct mgmt_cp_user_confirm_reply *cp = data;
2974
2975         BT_DBG("");
2976
2977         if (len != sizeof(*cp))
2978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2979                                        MGMT_STATUS_INVALID_PARAMS);
2980
2981         return user_pairing_resp(sk, hdev, &cp->addr,
2982                                  MGMT_OP_USER_CONFIRM_REPLY,
2983                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2984 }
2985
2986 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2987                                   void *data, u16 len)
2988 {
2989         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2990
2991         BT_DBG("");
2992
2993         return user_pairing_resp(sk, hdev, &cp->addr,
2994                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2995                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2996 }
2997
2998 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2999                               u16 len)
3000 {
3001         struct mgmt_cp_user_passkey_reply *cp = data;
3002
3003         BT_DBG("");
3004
3005         return user_pairing_resp(sk, hdev, &cp->addr,
3006                                  MGMT_OP_USER_PASSKEY_REPLY,
3007                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3008 }
3009
3010 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3011                                   void *data, u16 len)
3012 {
3013         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3014
3015         BT_DBG("");
3016
3017         return user_pairing_resp(sk, hdev, &cp->addr,
3018                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3019                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3020 }
3021
3022 static void adv_expire(struct hci_dev *hdev, u32 flags)
3023 {
3024         struct adv_info *adv_instance;
3025         struct hci_request req;
3026         int err;
3027
3028         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3029         if (!adv_instance)
3030                 return;
3031
3032         /* stop if current instance doesn't need to be changed */
3033         if (!(adv_instance->flags & flags))
3034                 return;
3035
3036         cancel_adv_timeout(hdev);
3037
3038         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3039         if (!adv_instance)
3040                 return;
3041
3042         hci_req_init(&req, hdev);
3043         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3044                                               true);
3045         if (err)
3046                 return;
3047
3048         hci_req_run(&req, NULL);
3049 }
3050
3051 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3052 {
3053         struct mgmt_cp_set_local_name *cp;
3054         struct mgmt_pending_cmd *cmd;
3055
3056         BT_DBG("status 0x%02x", status);
3057
3058         hci_dev_lock(hdev);
3059
3060         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3061         if (!cmd)
3062                 goto unlock;
3063
3064         cp = cmd->param;
3065
3066         if (status) {
3067                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3068                                 mgmt_status(status));
3069         } else {
3070                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3071                                   cp, sizeof(*cp));
3072
3073                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3074                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3075         }
3076
3077         mgmt_pending_remove(cmd);
3078
3079 unlock:
3080         hci_dev_unlock(hdev);
3081 }
3082
3083 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3084                           u16 len)
3085 {
3086         struct mgmt_cp_set_local_name *cp = data;
3087         struct mgmt_pending_cmd *cmd;
3088         struct hci_request req;
3089         int err;
3090
3091         BT_DBG("");
3092
3093         hci_dev_lock(hdev);
3094
3095         /* If the old values are the same as the new ones just return a
3096          * direct command complete event.
3097          */
3098         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3099             !memcmp(hdev->short_name, cp->short_name,
3100                     sizeof(hdev->short_name))) {
3101                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3102                                         data, len);
3103                 goto failed;
3104         }
3105
3106         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3107
3108         if (!hdev_is_powered(hdev)) {
3109                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3110
3111                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3112                                         data, len);
3113                 if (err < 0)
3114                         goto failed;
3115
3116                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3117                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3118                 ext_info_changed(hdev, sk);
3119
3120                 goto failed;
3121         }
3122
3123         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3124         if (!cmd) {
3125                 err = -ENOMEM;
3126                 goto failed;
3127         }
3128
3129         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3130
3131         hci_req_init(&req, hdev);
3132
3133         if (lmp_bredr_capable(hdev)) {
3134                 __hci_req_update_name(&req);
3135                 __hci_req_update_eir(&req);
3136         }
3137
3138         /* The name is stored in the scan response data and so
3139          * no need to udpate the advertising data here.
3140          */
3141         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3142                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3143
3144         err = hci_req_run(&req, set_name_complete);
3145         if (err < 0)
3146                 mgmt_pending_remove(cmd);
3147
3148 failed:
3149         hci_dev_unlock(hdev);
3150         return err;
3151 }
3152
3153 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3154                           u16 len)
3155 {
3156         struct mgmt_cp_set_appearance *cp = data;
3157         u16 apperance;
3158         int err;
3159
3160         BT_DBG("");
3161
3162         if (!lmp_le_capable(hdev))
3163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3164                                        MGMT_STATUS_NOT_SUPPORTED);
3165
3166         apperance = le16_to_cpu(cp->appearance);
3167
3168         hci_dev_lock(hdev);
3169
3170         if (hdev->appearance != apperance) {
3171                 hdev->appearance = apperance;
3172
3173                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3174                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3175
3176                 ext_info_changed(hdev, sk);
3177         }
3178
3179         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3180                                 0);
3181
3182         hci_dev_unlock(hdev);
3183
3184         return err;
3185 }
3186
3187 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3188                                          u16 opcode, struct sk_buff *skb)
3189 {
3190         struct mgmt_rp_read_local_oob_data mgmt_rp;
3191         size_t rp_size = sizeof(mgmt_rp);
3192         struct mgmt_pending_cmd *cmd;
3193
3194         BT_DBG("%s status %u", hdev->name, status);
3195
3196         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3197         if (!cmd)
3198                 return;
3199
3200         if (status || !skb) {
3201                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3202                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3203                 goto remove;
3204         }
3205
3206         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3207
3208         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3209                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3210
3211                 if (skb->len < sizeof(*rp)) {
3212                         mgmt_cmd_status(cmd->sk, hdev->id,
3213                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3214                                         MGMT_STATUS_FAILED);
3215                         goto remove;
3216                 }
3217
3218                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3219                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3220
3221                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3222         } else {
3223                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3224
3225                 if (skb->len < sizeof(*rp)) {
3226                         mgmt_cmd_status(cmd->sk, hdev->id,
3227                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3228                                         MGMT_STATUS_FAILED);
3229                         goto remove;
3230                 }
3231
3232                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3233                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3234
3235                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3236                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3237         }
3238
3239         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3240                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3241
3242 remove:
3243         mgmt_pending_remove(cmd);
3244 }
3245
3246 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3247                                void *data, u16 data_len)
3248 {
3249         struct mgmt_pending_cmd *cmd;
3250         struct hci_request req;
3251         int err;
3252
3253         BT_DBG("%s", hdev->name);
3254
3255         hci_dev_lock(hdev);
3256
3257         if (!hdev_is_powered(hdev)) {
3258                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3259                                       MGMT_STATUS_NOT_POWERED);
3260                 goto unlock;
3261         }
3262
3263         if (!lmp_ssp_capable(hdev)) {
3264                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3265                                       MGMT_STATUS_NOT_SUPPORTED);
3266                 goto unlock;
3267         }
3268
3269         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3270                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3271                                       MGMT_STATUS_BUSY);
3272                 goto unlock;
3273         }
3274
3275         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3276         if (!cmd) {
3277                 err = -ENOMEM;
3278                 goto unlock;
3279         }
3280
3281         hci_req_init(&req, hdev);
3282
3283         if (bredr_sc_enabled(hdev))
3284                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3285         else
3286                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3287
3288         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3289         if (err < 0)
3290                 mgmt_pending_remove(cmd);
3291
3292 unlock:
3293         hci_dev_unlock(hdev);
3294         return err;
3295 }
3296
3297 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3298                                void *data, u16 len)
3299 {
3300         struct mgmt_addr_info *addr = data;
3301         int err;
3302
3303         BT_DBG("%s ", hdev->name);
3304
3305         if (!bdaddr_type_is_valid(addr->type))
3306                 return mgmt_cmd_complete(sk, hdev->id,
3307                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3308                                          MGMT_STATUS_INVALID_PARAMS,
3309                                          addr, sizeof(*addr));
3310
3311         hci_dev_lock(hdev);
3312
3313         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3314                 struct mgmt_cp_add_remote_oob_data *cp = data;
3315                 u8 status;
3316
3317                 if (cp->addr.type != BDADDR_BREDR) {
3318                         err = mgmt_cmd_complete(sk, hdev->id,
3319                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3320                                                 MGMT_STATUS_INVALID_PARAMS,
3321                                                 &cp->addr, sizeof(cp->addr));
3322                         goto unlock;
3323                 }
3324
3325                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3326                                               cp->addr.type, cp->hash,
3327                                               cp->rand, NULL, NULL);
3328                 if (err < 0)
3329                         status = MGMT_STATUS_FAILED;
3330                 else
3331                         status = MGMT_STATUS_SUCCESS;
3332
3333                 err = mgmt_cmd_complete(sk, hdev->id,
3334                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3335                                         &cp->addr, sizeof(cp->addr));
3336         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3337                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3338                 u8 *rand192, *hash192, *rand256, *hash256;
3339                 u8 status;
3340
3341                 if (bdaddr_type_is_le(cp->addr.type)) {
3342                         /* Enforce zero-valued 192-bit parameters as
3343                          * long as legacy SMP OOB isn't implemented.
3344                          */
3345                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3346                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3347                                 err = mgmt_cmd_complete(sk, hdev->id,
3348                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3349                                                         MGMT_STATUS_INVALID_PARAMS,
3350                                                         addr, sizeof(*addr));
3351                                 goto unlock;
3352                         }
3353
3354                         rand192 = NULL;
3355                         hash192 = NULL;
3356                 } else {
3357                         /* In case one of the P-192 values is set to zero,
3358                          * then just disable OOB data for P-192.
3359                          */
3360                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3361                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3362                                 rand192 = NULL;
3363                                 hash192 = NULL;
3364                         } else {
3365                                 rand192 = cp->rand192;
3366                                 hash192 = cp->hash192;
3367                         }
3368                 }
3369
3370                 /* In case one of the P-256 values is set to zero, then just
3371                  * disable OOB data for P-256.
3372                  */
3373                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3374                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3375                         rand256 = NULL;
3376                         hash256 = NULL;
3377                 } else {
3378                         rand256 = cp->rand256;
3379                         hash256 = cp->hash256;
3380                 }
3381
3382                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3383                                               cp->addr.type, hash192, rand192,
3384                                               hash256, rand256);
3385                 if (err < 0)
3386                         status = MGMT_STATUS_FAILED;
3387                 else
3388                         status = MGMT_STATUS_SUCCESS;
3389
3390                 err = mgmt_cmd_complete(sk, hdev->id,
3391                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3392                                         status, &cp->addr, sizeof(cp->addr));
3393         } else {
3394                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3395                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3396                                       MGMT_STATUS_INVALID_PARAMS);
3397         }
3398
3399 unlock:
3400         hci_dev_unlock(hdev);
3401         return err;
3402 }
3403
3404 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3405                                   void *data, u16 len)
3406 {
3407         struct mgmt_cp_remove_remote_oob_data *cp = data;
3408         u8 status;
3409         int err;
3410
3411         BT_DBG("%s", hdev->name);
3412
3413         if (cp->addr.type != BDADDR_BREDR)
3414                 return mgmt_cmd_complete(sk, hdev->id,
3415                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3416                                          MGMT_STATUS_INVALID_PARAMS,
3417                                          &cp->addr, sizeof(cp->addr));
3418
3419         hci_dev_lock(hdev);
3420
3421         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3422                 hci_remote_oob_data_clear(hdev);
3423                 status = MGMT_STATUS_SUCCESS;
3424                 goto done;
3425         }
3426
3427         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3428         if (err < 0)
3429                 status = MGMT_STATUS_INVALID_PARAMS;
3430         else
3431                 status = MGMT_STATUS_SUCCESS;
3432
3433 done:
3434         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3435                                 status, &cp->addr, sizeof(cp->addr));
3436
3437         hci_dev_unlock(hdev);
3438         return err;
3439 }
3440
3441 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3442 {
3443         struct mgmt_pending_cmd *cmd;
3444
3445         BT_DBG("status %d", status);
3446
3447         hci_dev_lock(hdev);
3448
3449         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3450         if (!cmd)
3451                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3452
3453         if (!cmd)
3454                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3455
3456         if (cmd) {
3457                 cmd->cmd_complete(cmd, mgmt_status(status));
3458                 mgmt_pending_remove(cmd);
3459         }
3460
3461         hci_dev_unlock(hdev);
3462 }
3463
3464 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3465                                     uint8_t *mgmt_status)
3466 {
3467         switch (type) {
3468         case DISCOV_TYPE_LE:
3469                 *mgmt_status = mgmt_le_support(hdev);
3470                 if (*mgmt_status)
3471                         return false;
3472                 break;
3473         case DISCOV_TYPE_INTERLEAVED:
3474                 *mgmt_status = mgmt_le_support(hdev);
3475                 if (*mgmt_status)
3476                         return false;
3477                 /* Intentional fall-through */
3478         case DISCOV_TYPE_BREDR:
3479                 *mgmt_status = mgmt_bredr_support(hdev);
3480                 if (*mgmt_status)
3481                         return false;
3482                 break;
3483         default:
3484                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3485                 return false;
3486         }
3487
3488         return true;
3489 }
3490
3491 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3492                                     u16 op, void *data, u16 len)
3493 {
3494         struct mgmt_cp_start_discovery *cp = data;
3495         struct mgmt_pending_cmd *cmd;
3496         u8 status;
3497         int err;
3498
3499         BT_DBG("%s", hdev->name);
3500
3501         hci_dev_lock(hdev);
3502
3503         if (!hdev_is_powered(hdev)) {
3504                 err = mgmt_cmd_complete(sk, hdev->id, op,
3505                                         MGMT_STATUS_NOT_POWERED,
3506                                         &cp->type, sizeof(cp->type));
3507                 goto failed;
3508         }
3509
3510         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3511             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3512                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3513                                         &cp->type, sizeof(cp->type));
3514                 goto failed;
3515         }
3516
3517         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3518                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3519                                         &cp->type, sizeof(cp->type));
3520                 goto failed;
3521         }
3522
3523         /* Clear the discovery filter first to free any previously
3524          * allocated memory for the UUID list.
3525          */
3526         hci_discovery_filter_clear(hdev);
3527
3528         hdev->discovery.type = cp->type;
3529         hdev->discovery.report_invalid_rssi = false;
3530         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3531                 hdev->discovery.limited = true;
3532         else
3533                 hdev->discovery.limited = false;
3534
3535         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3536         if (!cmd) {
3537                 err = -ENOMEM;
3538                 goto failed;
3539         }
3540
3541         cmd->cmd_complete = generic_cmd_complete;
3542
3543         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3544         queue_work(hdev->req_workqueue, &hdev->discov_update);
3545         err = 0;
3546
3547 failed:
3548         hci_dev_unlock(hdev);
3549         return err;
3550 }
3551
3552 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3553                            void *data, u16 len)
3554 {
3555         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3556                                         data, len);
3557 }
3558
3559 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3560                                    void *data, u16 len)
3561 {
3562         return start_discovery_internal(sk, hdev,
3563                                         MGMT_OP_START_LIMITED_DISCOVERY,
3564                                         data, len);
3565 }
3566
3567 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3568                                           u8 status)
3569 {
3570         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3571                                  cmd->param, 1);
3572 }
3573
3574 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3575                                    void *data, u16 len)
3576 {
3577         struct mgmt_cp_start_service_discovery *cp = data;
3578         struct mgmt_pending_cmd *cmd;
3579         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3580         u16 uuid_count, expected_len;
3581         u8 status;
3582         int err;
3583
3584         BT_DBG("%s", hdev->name);
3585
3586         hci_dev_lock(hdev);
3587
3588         if (!hdev_is_powered(hdev)) {
3589                 err = mgmt_cmd_complete(sk, hdev->id,
3590                                         MGMT_OP_START_SERVICE_DISCOVERY,
3591                                         MGMT_STATUS_NOT_POWERED,
3592                                         &cp->type, sizeof(cp->type));
3593                 goto failed;
3594         }
3595
3596         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3597             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3598                 err = mgmt_cmd_complete(sk, hdev->id,
3599                                         MGMT_OP_START_SERVICE_DISCOVERY,
3600                                         MGMT_STATUS_BUSY, &cp->type,
3601                                         sizeof(cp->type));
3602                 goto failed;
3603         }
3604
3605         uuid_count = __le16_to_cpu(cp->uuid_count);
3606         if (uuid_count > max_uuid_count) {
3607                 BT_ERR("service_discovery: too big uuid_count value %u",
3608                        uuid_count);
3609                 err = mgmt_cmd_complete(sk, hdev->id,
3610                                         MGMT_OP_START_SERVICE_DISCOVERY,
3611                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3612                                         sizeof(cp->type));
3613                 goto failed;
3614         }
3615
3616         expected_len = sizeof(*cp) + uuid_count * 16;
3617         if (expected_len != len) {
3618                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
3619                        expected_len, len);
3620                 err = mgmt_cmd_complete(sk, hdev->id,
3621                                         MGMT_OP_START_SERVICE_DISCOVERY,
3622                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3623                                         sizeof(cp->type));
3624                 goto failed;
3625         }
3626
3627         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3628                 err = mgmt_cmd_complete(sk, hdev->id,
3629                                         MGMT_OP_START_SERVICE_DISCOVERY,
3630                                         status, &cp->type, sizeof(cp->type));
3631                 goto failed;
3632         }
3633
3634         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3635                                hdev, data, len);
3636         if (!cmd) {
3637                 err = -ENOMEM;
3638                 goto failed;
3639         }
3640
3641         cmd->cmd_complete = service_discovery_cmd_complete;
3642
3643         /* Clear the discovery filter first to free any previously
3644          * allocated memory for the UUID list.
3645          */
3646         hci_discovery_filter_clear(hdev);
3647
3648         hdev->discovery.result_filtering = true;
3649         hdev->discovery.type = cp->type;
3650         hdev->discovery.rssi = cp->rssi;
3651         hdev->discovery.uuid_count = uuid_count;
3652
3653         if (uuid_count > 0) {
3654                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
3655                                                 GFP_KERNEL);
3656                 if (!hdev->discovery.uuids) {
3657                         err = mgmt_cmd_complete(sk, hdev->id,
3658                                                 MGMT_OP_START_SERVICE_DISCOVERY,
3659                                                 MGMT_STATUS_FAILED,
3660                                                 &cp->type, sizeof(cp->type));
3661                         mgmt_pending_remove(cmd);
3662                         goto failed;
3663                 }
3664         }
3665
3666         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3667         queue_work(hdev->req_workqueue, &hdev->discov_update);
3668         err = 0;
3669
3670 failed:
3671         hci_dev_unlock(hdev);
3672         return err;
3673 }
3674
3675 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
3676 {
3677         struct mgmt_pending_cmd *cmd;
3678
3679         BT_DBG("status %d", status);
3680
3681         hci_dev_lock(hdev);
3682
3683         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3684         if (cmd) {
3685                 cmd->cmd_complete(cmd, mgmt_status(status));
3686                 mgmt_pending_remove(cmd);
3687         }
3688
3689         hci_dev_unlock(hdev);
3690 }
3691
3692 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3693                           u16 len)
3694 {
3695         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3696         struct mgmt_pending_cmd *cmd;
3697         int err;
3698
3699         BT_DBG("%s", hdev->name);
3700
3701         hci_dev_lock(hdev);
3702
3703         if (!hci_discovery_active(hdev)) {
3704                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3705                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
3706                                         sizeof(mgmt_cp->type));
3707                 goto unlock;
3708         }
3709
3710         if (hdev->discovery.type != mgmt_cp->type) {
3711                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3712                                         MGMT_STATUS_INVALID_PARAMS,
3713                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
3714                 goto unlock;
3715         }
3716
3717         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
3718         if (!cmd) {
3719                 err = -ENOMEM;
3720                 goto unlock;
3721         }
3722
3723         cmd->cmd_complete = generic_cmd_complete;
3724
3725         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3726         queue_work(hdev->req_workqueue, &hdev->discov_update);
3727         err = 0;
3728
3729 unlock:
3730         hci_dev_unlock(hdev);
3731         return err;
3732 }
3733
3734 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3735                         u16 len)
3736 {
3737         struct mgmt_cp_confirm_name *cp = data;
3738         struct inquiry_entry *e;
3739         int err;
3740
3741         BT_DBG("%s", hdev->name);
3742
3743         hci_dev_lock(hdev);
3744
3745         if (!hci_discovery_active(hdev)) {
3746                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3747                                         MGMT_STATUS_FAILED, &cp->addr,
3748                                         sizeof(cp->addr));
3749                 goto failed;
3750         }
3751
3752         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3753         if (!e) {
3754                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3755                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3756                                         sizeof(cp->addr));
3757                 goto failed;
3758         }
3759
3760         if (cp->name_known) {
3761                 e->name_state = NAME_KNOWN;
3762                 list_del(&e->list);
3763         } else {
3764                 e->name_state = NAME_NEEDED;
3765                 hci_inquiry_cache_update_resolve(hdev, e);
3766         }
3767
3768         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
3769                                 &cp->addr, sizeof(cp->addr));
3770
3771 failed:
3772         hci_dev_unlock(hdev);
3773         return err;
3774 }
3775
3776 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3777                         u16 len)
3778 {
3779         struct mgmt_cp_block_device *cp = data;
3780         u8 status;
3781         int err;
3782
3783         BT_DBG("%s", hdev->name);
3784
3785         if (!bdaddr_type_is_valid(cp->addr.type))
3786                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3787                                          MGMT_STATUS_INVALID_PARAMS,
3788                                          &cp->addr, sizeof(cp->addr));
3789
3790         hci_dev_lock(hdev);
3791
3792         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3793                                   cp->addr.type);
3794         if (err < 0) {
3795                 status = MGMT_STATUS_FAILED;
3796                 goto done;
3797         }
3798
3799         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3800                    sk);
3801         status = MGMT_STATUS_SUCCESS;
3802
3803 done:
3804         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3805                                 &cp->addr, sizeof(cp->addr));
3806
3807         hci_dev_unlock(hdev);
3808
3809         return err;
3810 }
3811
3812 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3813                           u16 len)
3814 {
3815         struct mgmt_cp_unblock_device *cp = data;
3816         u8 status;
3817         int err;
3818
3819         BT_DBG("%s", hdev->name);
3820
3821         if (!bdaddr_type_is_valid(cp->addr.type))
3822                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3823                                          MGMT_STATUS_INVALID_PARAMS,
3824                                          &cp->addr, sizeof(cp->addr));
3825
3826         hci_dev_lock(hdev);
3827
3828         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
3829                                   cp->addr.type);
3830         if (err < 0) {
3831                 status = MGMT_STATUS_INVALID_PARAMS;
3832                 goto done;
3833         }
3834
3835         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3836                    sk);
3837         status = MGMT_STATUS_SUCCESS;
3838
3839 done:
3840         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3841                                 &cp->addr, sizeof(cp->addr));
3842
3843         hci_dev_unlock(hdev);
3844
3845         return err;
3846 }
3847
3848 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3849                          u16 len)
3850 {
3851         struct mgmt_cp_set_device_id *cp = data;
3852         struct hci_request req;
3853         int err;
3854         __u16 source;
3855
3856         BT_DBG("%s", hdev->name);
3857
3858         source = __le16_to_cpu(cp->source);
3859
3860         if (source > 0x0002)
3861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3862                                        MGMT_STATUS_INVALID_PARAMS);
3863
3864         hci_dev_lock(hdev);
3865
3866         hdev->devid_source = source;
3867         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3868         hdev->devid_product = __le16_to_cpu(cp->product);
3869         hdev->devid_version = __le16_to_cpu(cp->version);
3870
3871         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
3872                                 NULL, 0);
3873
3874         hci_req_init(&req, hdev);
3875         __hci_req_update_eir(&req);
3876         hci_req_run(&req, NULL);
3877
3878         hci_dev_unlock(hdev);
3879
3880         return err;
3881 }
3882
3883 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
3884                                         u16 opcode)
3885 {
3886         BT_DBG("status %d", status);
3887 }
3888
3889 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
3890                                      u16 opcode)
3891 {
3892         struct cmd_lookup match = { NULL, hdev };
3893         struct hci_request req;
3894         u8 instance;
3895         struct adv_info *adv_instance;
3896         int err;
3897
3898         hci_dev_lock(hdev);
3899
3900         if (status) {
3901                 u8 mgmt_err = mgmt_status(status);
3902
3903                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3904                                      cmd_status_rsp, &mgmt_err);
3905                 goto unlock;
3906         }
3907
3908         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3909                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
3910         else
3911                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3912
3913         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3914                              &match);
3915
3916         new_settings(hdev, match.sk);
3917
3918         if (match.sk)
3919                 sock_put(match.sk);
3920
3921         /* If "Set Advertising" was just disabled and instance advertising was
3922          * set up earlier, then re-enable multi-instance advertising.
3923          */
3924         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3925             list_empty(&hdev->adv_instances))
3926                 goto unlock;
3927
3928         instance = hdev->cur_adv_instance;
3929         if (!instance) {
3930                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
3931                                                         struct adv_info, list);
3932                 if (!adv_instance)
3933                         goto unlock;
3934
3935                 instance = adv_instance->instance;
3936         }
3937
3938         hci_req_init(&req, hdev);
3939
3940         err = __hci_req_schedule_adv_instance(&req, instance, true);
3941
3942         if (!err)
3943                 err = hci_req_run(&req, enable_advertising_instance);
3944
3945         if (err)
3946                 BT_ERR("Failed to re-configure advertising");
3947
3948 unlock:
3949         hci_dev_unlock(hdev);
3950 }
3951
3952 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3953                            u16 len)
3954 {
3955         struct mgmt_mode *cp = data;
3956         struct mgmt_pending_cmd *cmd;
3957         struct hci_request req;
3958         u8 val, status;
3959         int err;
3960
3961         BT_DBG("request for %s", hdev->name);
3962
3963         status = mgmt_le_support(hdev);
3964         if (status)
3965                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3966                                        status);
3967
3968         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
3969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3970                                        MGMT_STATUS_INVALID_PARAMS);
3971
3972         hci_dev_lock(hdev);
3973
3974         val = !!cp->val;
3975
3976         /* The following conditions are ones which mean that we should
3977          * not do any HCI communication but directly send a mgmt
3978          * response to user space (after toggling the flag if
3979          * necessary).
3980          */
3981         if (!hdev_is_powered(hdev) ||
3982             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
3983              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
3984             hci_conn_num(hdev, LE_LINK) > 0 ||
3985             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3986              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
3987                 bool changed;
3988
3989                 if (cp->val) {
3990                         hdev->cur_adv_instance = 0x00;
3991                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
3992                         if (cp->val == 0x02)
3993                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3994                         else
3995                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3996                 } else {
3997                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
3998                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3999                 }
4000
4001                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4002                 if (err < 0)
4003                         goto unlock;
4004
4005                 if (changed)
4006                         err = new_settings(hdev, sk);
4007
4008                 goto unlock;
4009         }
4010
4011         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4012             pending_find(MGMT_OP_SET_LE, hdev)) {
4013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4014                                       MGMT_STATUS_BUSY);
4015                 goto unlock;
4016         }
4017
4018         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4019         if (!cmd) {
4020                 err = -ENOMEM;
4021                 goto unlock;
4022         }
4023
4024         hci_req_init(&req, hdev);
4025
4026         if (cp->val == 0x02)
4027                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4028         else
4029                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4030
4031         cancel_adv_timeout(hdev);
4032
4033         if (val) {
4034                 /* Switch to instance "0" for the Set Advertising setting.
4035                  * We cannot use update_[adv|scan_rsp]_data() here as the
4036                  * HCI_ADVERTISING flag is not yet set.
4037                  */
4038                 hdev->cur_adv_instance = 0x00;
4039                 __hci_req_update_adv_data(&req, 0x00);
4040                 __hci_req_update_scan_rsp_data(&req, 0x00);
4041                 __hci_req_enable_advertising(&req);
4042         } else {
4043                 __hci_req_disable_advertising(&req);
4044         }
4045
4046         err = hci_req_run(&req, set_advertising_complete);
4047         if (err < 0)
4048                 mgmt_pending_remove(cmd);
4049
4050 unlock:
4051         hci_dev_unlock(hdev);
4052         return err;
4053 }
4054
4055 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4056                               void *data, u16 len)
4057 {
4058         struct mgmt_cp_set_static_address *cp = data;
4059         int err;
4060
4061         BT_DBG("%s", hdev->name);
4062
4063         if (!lmp_le_capable(hdev))
4064                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4065                                        MGMT_STATUS_NOT_SUPPORTED);
4066
4067         if (hdev_is_powered(hdev))
4068                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4069                                        MGMT_STATUS_REJECTED);
4070
4071         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4072                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4073                         return mgmt_cmd_status(sk, hdev->id,
4074                                                MGMT_OP_SET_STATIC_ADDRESS,
4075                                                MGMT_STATUS_INVALID_PARAMS);
4076
4077                 /* Two most significant bits shall be set */
4078                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4079                         return mgmt_cmd_status(sk, hdev->id,
4080                                                MGMT_OP_SET_STATIC_ADDRESS,
4081                                                MGMT_STATUS_INVALID_PARAMS);
4082         }
4083
4084         hci_dev_lock(hdev);
4085
4086         bacpy(&hdev->static_addr, &cp->bdaddr);
4087
4088         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4089         if (err < 0)
4090                 goto unlock;
4091
4092         err = new_settings(hdev, sk);
4093
4094 unlock:
4095         hci_dev_unlock(hdev);
4096         return err;
4097 }
4098
4099 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4100                            void *data, u16 len)
4101 {
4102         struct mgmt_cp_set_scan_params *cp = data;
4103         __u16 interval, window;
4104         int err;
4105
4106         BT_DBG("%s", hdev->name);
4107
4108         if (!lmp_le_capable(hdev))
4109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4110                                        MGMT_STATUS_NOT_SUPPORTED);
4111
4112         interval = __le16_to_cpu(cp->interval);
4113
4114         if (interval < 0x0004 || interval > 0x4000)
4115                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4116                                        MGMT_STATUS_INVALID_PARAMS);
4117
4118         window = __le16_to_cpu(cp->window);
4119
4120         if (window < 0x0004 || window > 0x4000)
4121                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4122                                        MGMT_STATUS_INVALID_PARAMS);
4123
4124         if (window > interval)
4125                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4126                                        MGMT_STATUS_INVALID_PARAMS);
4127
4128         hci_dev_lock(hdev);
4129
4130         hdev->le_scan_interval = interval;
4131         hdev->le_scan_window = window;
4132
4133         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4134                                 NULL, 0);
4135
4136         /* If background scan is running, restart it so new parameters are
4137          * loaded.
4138          */
4139         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4140             hdev->discovery.state == DISCOVERY_STOPPED) {
4141                 struct hci_request req;
4142
4143                 hci_req_init(&req, hdev);
4144
4145                 hci_req_add_le_scan_disable(&req);
4146                 hci_req_add_le_passive_scan(&req);
4147
4148                 hci_req_run(&req, NULL);
4149         }
4150
4151         hci_dev_unlock(hdev);
4152
4153         return err;
4154 }
4155
4156 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4157                                       u16 opcode)
4158 {
4159         struct mgmt_pending_cmd *cmd;
4160
4161         BT_DBG("status 0x%02x", status);
4162
4163         hci_dev_lock(hdev);
4164
4165         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4166         if (!cmd)
4167                 goto unlock;
4168
4169         if (status) {
4170                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4171                                 mgmt_status(status));
4172         } else {
4173                 struct mgmt_mode *cp = cmd->param;
4174
4175                 if (cp->val)
4176                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4177                 else
4178                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4179
4180                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4181                 new_settings(hdev, cmd->sk);
4182         }
4183
4184         mgmt_pending_remove(cmd);
4185
4186 unlock:
4187         hci_dev_unlock(hdev);
4188 }
4189
4190 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4191                                 void *data, u16 len)
4192 {
4193         struct mgmt_mode *cp = data;
4194         struct mgmt_pending_cmd *cmd;
4195         struct hci_request req;
4196         int err;
4197
4198         BT_DBG("%s", hdev->name);
4199
4200         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4201             hdev->hci_ver < BLUETOOTH_VER_1_2)
4202                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4203                                        MGMT_STATUS_NOT_SUPPORTED);
4204
4205         if (cp->val != 0x00 && cp->val != 0x01)
4206                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4207                                        MGMT_STATUS_INVALID_PARAMS);
4208
4209         hci_dev_lock(hdev);
4210
4211         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4212                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4213                                       MGMT_STATUS_BUSY);
4214                 goto unlock;
4215         }
4216
4217         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4218                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4219                                         hdev);
4220                 goto unlock;
4221         }
4222
4223         if (!hdev_is_powered(hdev)) {
4224                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4225                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4226                                         hdev);
4227                 new_settings(hdev, sk);
4228                 goto unlock;
4229         }
4230
4231         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4232                                data, len);
4233         if (!cmd) {
4234                 err = -ENOMEM;
4235                 goto unlock;
4236         }
4237
4238         hci_req_init(&req, hdev);
4239
4240         __hci_req_write_fast_connectable(&req, cp->val);
4241
4242         err = hci_req_run(&req, fast_connectable_complete);
4243         if (err < 0) {
4244                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4245                                       MGMT_STATUS_FAILED);
4246                 mgmt_pending_remove(cmd);
4247         }
4248
4249 unlock:
4250         hci_dev_unlock(hdev);
4251
4252         return err;
4253 }
4254
4255 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4256 {
4257         struct mgmt_pending_cmd *cmd;
4258
4259         BT_DBG("status 0x%02x", status);
4260
4261         hci_dev_lock(hdev);
4262
4263         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4264         if (!cmd)
4265                 goto unlock;
4266
4267         if (status) {
4268                 u8 mgmt_err = mgmt_status(status);
4269
4270                 /* We need to restore the flag if related HCI commands
4271                  * failed.
4272                  */
4273                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4274
4275                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4276         } else {
4277                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4278                 new_settings(hdev, cmd->sk);
4279         }
4280
4281         mgmt_pending_remove(cmd);
4282
4283 unlock:
4284         hci_dev_unlock(hdev);
4285 }
4286
4287 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4288 {
4289         struct mgmt_mode *cp = data;
4290         struct mgmt_pending_cmd *cmd;
4291         struct hci_request req;
4292         int err;
4293
4294         BT_DBG("request for %s", hdev->name);
4295
4296         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4297                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4298                                        MGMT_STATUS_NOT_SUPPORTED);
4299
4300         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4302                                        MGMT_STATUS_REJECTED);
4303
4304         if (cp->val != 0x00 && cp->val != 0x01)
4305                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4306                                        MGMT_STATUS_INVALID_PARAMS);
4307
4308         hci_dev_lock(hdev);
4309
4310         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4311                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4312                 goto unlock;
4313         }
4314
4315         if (!hdev_is_powered(hdev)) {
4316                 if (!cp->val) {
4317                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4318                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4319                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4320                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4321                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4322                 }
4323
4324                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4325
4326                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4327                 if (err < 0)
4328                         goto unlock;
4329
4330                 err = new_settings(hdev, sk);
4331                 goto unlock;
4332         }
4333
4334         /* Reject disabling when powered on */
4335         if (!cp->val) {
4336                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4337                                       MGMT_STATUS_REJECTED);
4338                 goto unlock;
4339         } else {
4340                 /* When configuring a dual-mode controller to operate
4341                  * with LE only and using a static address, then switching
4342                  * BR/EDR back on is not allowed.
4343                  *
4344                  * Dual-mode controllers shall operate with the public
4345                  * address as its identity address for BR/EDR and LE. So
4346                  * reject the attempt to create an invalid configuration.
4347                  *
4348                  * The same restrictions applies when secure connections
4349                  * has been enabled. For BR/EDR this is a controller feature
4350                  * while for LE it is a host stack feature. This means that
4351                  * switching BR/EDR back on when secure connections has been
4352                  * enabled is not a supported transaction.
4353                  */
4354                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4355                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4356                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4357                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4358                                               MGMT_STATUS_REJECTED);
4359                         goto unlock;
4360                 }
4361         }
4362
4363         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4364                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4365                                       MGMT_STATUS_BUSY);
4366                 goto unlock;
4367         }
4368
4369         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4370         if (!cmd) {
4371                 err = -ENOMEM;
4372                 goto unlock;
4373         }
4374
4375         /* We need to flip the bit already here so that
4376          * hci_req_update_adv_data generates the correct flags.
4377          */
4378         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4379
4380         hci_req_init(&req, hdev);
4381
4382         __hci_req_write_fast_connectable(&req, false);
4383         __hci_req_update_scan(&req);
4384
4385         /* Since only the advertising data flags will change, there
4386          * is no need to update the scan response data.
4387          */
4388         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4389
4390         err = hci_req_run(&req, set_bredr_complete);
4391         if (err < 0)
4392                 mgmt_pending_remove(cmd);
4393
4394 unlock:
4395         hci_dev_unlock(hdev);
4396         return err;
4397 }
4398
4399 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4400 {
4401         struct mgmt_pending_cmd *cmd;
4402         struct mgmt_mode *cp;
4403
4404         BT_DBG("%s status %u", hdev->name, status);
4405
4406         hci_dev_lock(hdev);
4407
4408         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4409         if (!cmd)
4410                 goto unlock;
4411
4412         if (status) {
4413                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4414                                 mgmt_status(status));
4415                 goto remove;
4416         }
4417
4418         cp = cmd->param;
4419
4420         switch (cp->val) {
4421         case 0x00:
4422                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4423                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4424                 break;
4425         case 0x01:
4426                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4427                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4428                 break;
4429         case 0x02:
4430                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4431                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4432                 break;
4433         }
4434
4435         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4436         new_settings(hdev, cmd->sk);
4437
4438 remove:
4439         mgmt_pending_remove(cmd);
4440 unlock:
4441         hci_dev_unlock(hdev);
4442 }
4443
4444 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4445                            void *data, u16 len)
4446 {
4447         struct mgmt_mode *cp = data;
4448         struct mgmt_pending_cmd *cmd;
4449         struct hci_request req;
4450         u8 val;
4451         int err;
4452
4453         BT_DBG("request for %s", hdev->name);
4454
4455         if (!lmp_sc_capable(hdev) &&
4456             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4457                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4458                                        MGMT_STATUS_NOT_SUPPORTED);
4459
4460         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4461             lmp_sc_capable(hdev) &&
4462             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4463                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4464                                        MGMT_STATUS_REJECTED);
4465
4466         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4468                                   MGMT_STATUS_INVALID_PARAMS);
4469
4470         hci_dev_lock(hdev);
4471
4472         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4473             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4474                 bool changed;
4475
4476                 if (cp->val) {
4477                         changed = !hci_dev_test_and_set_flag(hdev,
4478                                                              HCI_SC_ENABLED);
4479                         if (cp->val == 0x02)
4480                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4481                         else
4482                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4483                 } else {
4484                         changed = hci_dev_test_and_clear_flag(hdev,
4485                                                               HCI_SC_ENABLED);
4486                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4487                 }
4488
4489                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4490                 if (err < 0)
4491                         goto failed;
4492
4493                 if (changed)
4494                         err = new_settings(hdev, sk);
4495
4496                 goto failed;
4497         }
4498
4499         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4500                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4501                                       MGMT_STATUS_BUSY);
4502                 goto failed;
4503         }
4504
4505         val = !!cp->val;
4506
4507         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4508             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4509                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4510                 goto failed;
4511         }
4512
4513         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4514         if (!cmd) {
4515                 err = -ENOMEM;
4516                 goto failed;
4517         }
4518
4519         hci_req_init(&req, hdev);
4520         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4521         err = hci_req_run(&req, sc_enable_complete);
4522         if (err < 0) {
4523                 mgmt_pending_remove(cmd);
4524                 goto failed;
4525         }
4526
4527 failed:
4528         hci_dev_unlock(hdev);
4529         return err;
4530 }
4531
4532 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4533                           void *data, u16 len)
4534 {
4535         struct mgmt_mode *cp = data;
4536         bool changed, use_changed;
4537         int err;
4538
4539         BT_DBG("request for %s", hdev->name);
4540
4541         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4542                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4543                                        MGMT_STATUS_INVALID_PARAMS);
4544
4545         hci_dev_lock(hdev);
4546
4547         if (cp->val)
4548                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4549         else
4550                 changed = hci_dev_test_and_clear_flag(hdev,
4551                                                       HCI_KEEP_DEBUG_KEYS);
4552
4553         if (cp->val == 0x02)
4554                 use_changed = !hci_dev_test_and_set_flag(hdev,
4555                                                          HCI_USE_DEBUG_KEYS);
4556         else
4557                 use_changed = hci_dev_test_and_clear_flag(hdev,
4558                                                           HCI_USE_DEBUG_KEYS);
4559
4560         if (hdev_is_powered(hdev) && use_changed &&
4561             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4562                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4563                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4564                              sizeof(mode), &mode);
4565         }
4566
4567         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4568         if (err < 0)
4569                 goto unlock;
4570
4571         if (changed)
4572                 err = new_settings(hdev, sk);
4573
4574 unlock:
4575         hci_dev_unlock(hdev);
4576         return err;
4577 }
4578
4579 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4580                        u16 len)
4581 {
4582         struct mgmt_cp_set_privacy *cp = cp_data;
4583         bool changed;
4584         int err;
4585
4586         BT_DBG("request for %s", hdev->name);
4587
4588         if (!lmp_le_capable(hdev))
4589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4590                                        MGMT_STATUS_NOT_SUPPORTED);
4591
4592         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4593                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4594                                        MGMT_STATUS_INVALID_PARAMS);
4595
4596         if (hdev_is_powered(hdev))
4597                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4598                                        MGMT_STATUS_REJECTED);
4599
4600         hci_dev_lock(hdev);
4601
4602         /* If user space supports this command it is also expected to
4603          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4604          */
4605         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4606
4607         if (cp->privacy) {
4608                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4609                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4610                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4611                 if (cp->privacy == 0x02)
4612                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4613                 else
4614                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4615         } else {
4616                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4617                 memset(hdev->irk, 0, sizeof(hdev->irk));
4618                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4619                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4620         }
4621
4622         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4623         if (err < 0)
4624                 goto unlock;
4625
4626         if (changed)
4627                 err = new_settings(hdev, sk);
4628
4629 unlock:
4630         hci_dev_unlock(hdev);
4631         return err;
4632 }
4633
4634 static bool irk_is_valid(struct mgmt_irk_info *irk)
4635 {
4636         switch (irk->addr.type) {
4637         case BDADDR_LE_PUBLIC:
4638                 return true;
4639
4640         case BDADDR_LE_RANDOM:
4641                 /* Two most significant bits shall be set */
4642                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4643                         return false;
4644                 return true;
4645         }
4646
4647         return false;
4648 }
4649
4650 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4651                      u16 len)
4652 {
4653         struct mgmt_cp_load_irks *cp = cp_data;
4654         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4655                                    sizeof(struct mgmt_irk_info));
4656         u16 irk_count, expected_len;
4657         int i, err;
4658
4659         BT_DBG("request for %s", hdev->name);
4660
4661         if (!lmp_le_capable(hdev))
4662                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4663                                        MGMT_STATUS_NOT_SUPPORTED);
4664
4665         irk_count = __le16_to_cpu(cp->irk_count);
4666         if (irk_count > max_irk_count) {
4667                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4668                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4669                                        MGMT_STATUS_INVALID_PARAMS);
4670         }
4671
4672         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4673         if (expected_len != len) {
4674                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4675                        expected_len, len);
4676                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4677                                        MGMT_STATUS_INVALID_PARAMS);
4678         }
4679
4680         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4681
4682         for (i = 0; i < irk_count; i++) {
4683                 struct mgmt_irk_info *key = &cp->irks[i];
4684
4685                 if (!irk_is_valid(key))
4686                         return mgmt_cmd_status(sk, hdev->id,
4687                                                MGMT_OP_LOAD_IRKS,
4688                                                MGMT_STATUS_INVALID_PARAMS);
4689         }
4690
4691         hci_dev_lock(hdev);
4692
4693         hci_smp_irks_clear(hdev);
4694
4695         for (i = 0; i < irk_count; i++) {
4696                 struct mgmt_irk_info *irk = &cp->irks[i];
4697
4698                 hci_add_irk(hdev, &irk->addr.bdaddr,
4699                             le_addr_type(irk->addr.type), irk->val,
4700                             BDADDR_ANY);
4701         }
4702
4703         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4704
4705         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4706
4707         hci_dev_unlock(hdev);
4708
4709         return err;
4710 }
4711
4712 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4713 {
4714         if (key->master != 0x00 && key->master != 0x01)
4715                 return false;
4716
4717         switch (key->addr.type) {
4718         case BDADDR_LE_PUBLIC:
4719                 return true;
4720
4721         case BDADDR_LE_RANDOM:
4722                 /* Two most significant bits shall be set */
4723                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4724                         return false;
4725                 return true;
4726         }
4727
4728         return false;
4729 }
4730
4731 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4732                                void *cp_data, u16 len)
4733 {
4734         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4735         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4736                                    sizeof(struct mgmt_ltk_info));
4737         u16 key_count, expected_len;
4738         int i, err;
4739
4740         BT_DBG("request for %s", hdev->name);
4741
4742         if (!lmp_le_capable(hdev))
4743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4744                                        MGMT_STATUS_NOT_SUPPORTED);
4745
4746         key_count = __le16_to_cpu(cp->key_count);
4747         if (key_count > max_key_count) {
4748                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4749                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4750                                        MGMT_STATUS_INVALID_PARAMS);
4751         }
4752
4753         expected_len = sizeof(*cp) + key_count *
4754                                         sizeof(struct mgmt_ltk_info);
4755         if (expected_len != len) {
4756                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4757                        expected_len, len);
4758                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4759                                        MGMT_STATUS_INVALID_PARAMS);
4760         }
4761
4762         BT_DBG("%s key_count %u", hdev->name, key_count);
4763
4764         for (i = 0; i < key_count; i++) {
4765                 struct mgmt_ltk_info *key = &cp->keys[i];
4766
4767                 if (!ltk_is_valid(key))
4768                         return mgmt_cmd_status(sk, hdev->id,
4769                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
4770                                                MGMT_STATUS_INVALID_PARAMS);
4771         }
4772
4773         hci_dev_lock(hdev);
4774
4775         hci_smp_ltks_clear(hdev);
4776
4777         for (i = 0; i < key_count; i++) {
4778                 struct mgmt_ltk_info *key = &cp->keys[i];
4779                 u8 type, authenticated;
4780
4781                 switch (key->type) {
4782                 case MGMT_LTK_UNAUTHENTICATED:
4783                         authenticated = 0x00;
4784                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4785                         break;
4786                 case MGMT_LTK_AUTHENTICATED:
4787                         authenticated = 0x01;
4788                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4789                         break;
4790                 case MGMT_LTK_P256_UNAUTH:
4791                         authenticated = 0x00;
4792                         type = SMP_LTK_P256;
4793                         break;
4794                 case MGMT_LTK_P256_AUTH:
4795                         authenticated = 0x01;
4796                         type = SMP_LTK_P256;
4797                         break;
4798                 case MGMT_LTK_P256_DEBUG:
4799                         authenticated = 0x00;
4800                         type = SMP_LTK_P256_DEBUG;
4801                 default:
4802                         continue;
4803                 }
4804
4805                 hci_add_ltk(hdev, &key->addr.bdaddr,
4806                             le_addr_type(key->addr.type), type, authenticated,
4807                             key->val, key->enc_size, key->ediv, key->rand);
4808         }
4809
4810         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4811                            NULL, 0);
4812
4813         hci_dev_unlock(hdev);
4814
4815         return err;
4816 }
4817
4818 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4819 {
4820         struct hci_conn *conn = cmd->user_data;
4821         struct mgmt_rp_get_conn_info rp;
4822         int err;
4823
4824         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
4825
4826         if (status == MGMT_STATUS_SUCCESS) {
4827                 rp.rssi = conn->rssi;
4828                 rp.tx_power = conn->tx_power;
4829                 rp.max_tx_power = conn->max_tx_power;
4830         } else {
4831                 rp.rssi = HCI_RSSI_INVALID;
4832                 rp.tx_power = HCI_TX_POWER_INVALID;
4833                 rp.max_tx_power = HCI_TX_POWER_INVALID;
4834         }
4835
4836         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4837                                 status, &rp, sizeof(rp));
4838
4839         hci_conn_drop(conn);
4840         hci_conn_put(conn);
4841
4842         return err;
4843 }
4844
4845 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
4846                                        u16 opcode)
4847 {
4848         struct hci_cp_read_rssi *cp;
4849         struct mgmt_pending_cmd *cmd;
4850         struct hci_conn *conn;
4851         u16 handle;
4852         u8 status;
4853
4854         BT_DBG("status 0x%02x", hci_status);
4855
4856         hci_dev_lock(hdev);
4857
4858         /* Commands sent in request are either Read RSSI or Read Transmit Power
4859          * Level so we check which one was last sent to retrieve connection
4860          * handle.  Both commands have handle as first parameter so it's safe to
4861          * cast data on the same command struct.
4862          *
4863          * First command sent is always Read RSSI and we fail only if it fails.
4864          * In other case we simply override error to indicate success as we
4865          * already remembered if TX power value is actually valid.
4866          */
4867         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4868         if (!cp) {
4869                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4870                 status = MGMT_STATUS_SUCCESS;
4871         } else {
4872                 status = mgmt_status(hci_status);
4873         }
4874
4875         if (!cp) {
4876                 BT_ERR("invalid sent_cmd in conn_info response");
4877                 goto unlock;
4878         }
4879
4880         handle = __le16_to_cpu(cp->handle);
4881         conn = hci_conn_hash_lookup_handle(hdev, handle);
4882         if (!conn) {
4883                 BT_ERR("unknown handle (%d) in conn_info response", handle);
4884                 goto unlock;
4885         }
4886
4887         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
4888         if (!cmd)
4889                 goto unlock;
4890
4891         cmd->cmd_complete(cmd, status);
4892         mgmt_pending_remove(cmd);
4893
4894 unlock:
4895         hci_dev_unlock(hdev);
4896 }
4897
4898 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4899                          u16 len)
4900 {
4901         struct mgmt_cp_get_conn_info *cp = data;
4902         struct mgmt_rp_get_conn_info rp;
4903         struct hci_conn *conn;
4904         unsigned long conn_info_age;
4905         int err = 0;
4906
4907         BT_DBG("%s", hdev->name);
4908
4909         memset(&rp, 0, sizeof(rp));
4910         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4911         rp.addr.type = cp->addr.type;
4912
4913         if (!bdaddr_type_is_valid(cp->addr.type))
4914                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4915                                          MGMT_STATUS_INVALID_PARAMS,
4916                                          &rp, sizeof(rp));
4917
4918         hci_dev_lock(hdev);
4919
4920         if (!hdev_is_powered(hdev)) {
4921                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4922                                         MGMT_STATUS_NOT_POWERED, &rp,
4923                                         sizeof(rp));
4924                 goto unlock;
4925         }
4926
4927         if (cp->addr.type == BDADDR_BREDR)
4928                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4929                                                &cp->addr.bdaddr);
4930         else
4931                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4932
4933         if (!conn || conn->state != BT_CONNECTED) {
4934                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4935                                         MGMT_STATUS_NOT_CONNECTED, &rp,
4936                                         sizeof(rp));
4937                 goto unlock;
4938         }
4939
4940         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
4941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4942                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
4943                 goto unlock;
4944         }
4945
4946         /* To avoid client trying to guess when to poll again for information we
4947          * calculate conn info age as random value between min/max set in hdev.
4948          */
4949         conn_info_age = hdev->conn_info_min_age +
4950                         prandom_u32_max(hdev->conn_info_max_age -
4951                                         hdev->conn_info_min_age);
4952
4953         /* Query controller to refresh cached values if they are too old or were
4954          * never read.
4955          */
4956         if (time_after(jiffies, conn->conn_info_timestamp +
4957                        msecs_to_jiffies(conn_info_age)) ||
4958             !conn->conn_info_timestamp) {
4959                 struct hci_request req;
4960                 struct hci_cp_read_tx_power req_txp_cp;
4961                 struct hci_cp_read_rssi req_rssi_cp;
4962                 struct mgmt_pending_cmd *cmd;
4963
4964                 hci_req_init(&req, hdev);
4965                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4966                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4967                             &req_rssi_cp);
4968
4969                 /* For LE links TX power does not change thus we don't need to
4970                  * query for it once value is known.
4971                  */
4972                 if (!bdaddr_type_is_le(cp->addr.type) ||
4973                     conn->tx_power == HCI_TX_POWER_INVALID) {
4974                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4975                         req_txp_cp.type = 0x00;
4976                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4977                                     sizeof(req_txp_cp), &req_txp_cp);
4978                 }
4979
4980                 /* Max TX power needs to be read only once per connection */
4981                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4982                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4983                         req_txp_cp.type = 0x01;
4984                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4985                                     sizeof(req_txp_cp), &req_txp_cp);
4986                 }
4987
4988                 err = hci_req_run(&req, conn_info_refresh_complete);
4989                 if (err < 0)
4990                         goto unlock;
4991
4992                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4993                                        data, len);
4994                 if (!cmd) {
4995                         err = -ENOMEM;
4996                         goto unlock;
4997                 }
4998
4999                 hci_conn_hold(conn);
5000                 cmd->user_data = hci_conn_get(conn);
5001                 cmd->cmd_complete = conn_info_cmd_complete;
5002
5003                 conn->conn_info_timestamp = jiffies;
5004         } else {
5005                 /* Cache is valid, just reply with values cached in hci_conn */
5006                 rp.rssi = conn->rssi;
5007                 rp.tx_power = conn->tx_power;
5008                 rp.max_tx_power = conn->max_tx_power;
5009
5010                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5011                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5012         }
5013
5014 unlock:
5015         hci_dev_unlock(hdev);
5016         return err;
5017 }
5018
5019 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5020 {
5021         struct hci_conn *conn = cmd->user_data;
5022         struct mgmt_rp_get_clock_info rp;
5023         struct hci_dev *hdev;
5024         int err;
5025
5026         memset(&rp, 0, sizeof(rp));
5027         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5028
5029         if (status)
5030                 goto complete;
5031
5032         hdev = hci_dev_get(cmd->index);
5033         if (hdev) {
5034                 rp.local_clock = cpu_to_le32(hdev->clock);
5035                 hci_dev_put(hdev);
5036         }
5037
5038         if (conn) {
5039                 rp.piconet_clock = cpu_to_le32(conn->clock);
5040                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5041         }
5042
5043 complete:
5044         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5045                                 sizeof(rp));
5046
5047         if (conn) {
5048                 hci_conn_drop(conn);
5049                 hci_conn_put(conn);
5050         }
5051
5052         return err;
5053 }
5054
5055 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5056 {
5057         struct hci_cp_read_clock *hci_cp;
5058         struct mgmt_pending_cmd *cmd;
5059         struct hci_conn *conn;
5060
5061         BT_DBG("%s status %u", hdev->name, status);
5062
5063         hci_dev_lock(hdev);
5064
5065         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5066         if (!hci_cp)
5067                 goto unlock;
5068
5069         if (hci_cp->which) {
5070                 u16 handle = __le16_to_cpu(hci_cp->handle);
5071                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5072         } else {
5073                 conn = NULL;
5074         }
5075
5076         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5077         if (!cmd)
5078                 goto unlock;
5079
5080         cmd->cmd_complete(cmd, mgmt_status(status));
5081         mgmt_pending_remove(cmd);
5082
5083 unlock:
5084         hci_dev_unlock(hdev);
5085 }
5086
5087 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5088                          u16 len)
5089 {
5090         struct mgmt_cp_get_clock_info *cp = data;
5091         struct mgmt_rp_get_clock_info rp;
5092         struct hci_cp_read_clock hci_cp;
5093         struct mgmt_pending_cmd *cmd;
5094         struct hci_request req;
5095         struct hci_conn *conn;
5096         int err;
5097
5098         BT_DBG("%s", hdev->name);
5099
5100         memset(&rp, 0, sizeof(rp));
5101         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5102         rp.addr.type = cp->addr.type;
5103
5104         if (cp->addr.type != BDADDR_BREDR)
5105                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5106                                          MGMT_STATUS_INVALID_PARAMS,
5107                                          &rp, sizeof(rp));
5108
5109         hci_dev_lock(hdev);
5110
5111         if (!hdev_is_powered(hdev)) {
5112                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5113                                         MGMT_STATUS_NOT_POWERED, &rp,
5114                                         sizeof(rp));
5115                 goto unlock;
5116         }
5117
5118         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5119                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5120                                                &cp->addr.bdaddr);
5121                 if (!conn || conn->state != BT_CONNECTED) {
5122                         err = mgmt_cmd_complete(sk, hdev->id,
5123                                                 MGMT_OP_GET_CLOCK_INFO,
5124                                                 MGMT_STATUS_NOT_CONNECTED,
5125                                                 &rp, sizeof(rp));
5126                         goto unlock;
5127                 }
5128         } else {
5129                 conn = NULL;
5130         }
5131
5132         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5133         if (!cmd) {
5134                 err = -ENOMEM;
5135                 goto unlock;
5136         }
5137
5138         cmd->cmd_complete = clock_info_cmd_complete;
5139
5140         hci_req_init(&req, hdev);
5141
5142         memset(&hci_cp, 0, sizeof(hci_cp));
5143         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5144
5145         if (conn) {
5146                 hci_conn_hold(conn);
5147                 cmd->user_data = hci_conn_get(conn);
5148
5149                 hci_cp.handle = cpu_to_le16(conn->handle);
5150                 hci_cp.which = 0x01; /* Piconet clock */
5151                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5152         }
5153
5154         err = hci_req_run(&req, get_clock_info_complete);
5155         if (err < 0)
5156                 mgmt_pending_remove(cmd);
5157
5158 unlock:
5159         hci_dev_unlock(hdev);
5160         return err;
5161 }
5162
5163 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5164 {
5165         struct hci_conn *conn;
5166
5167         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5168         if (!conn)
5169                 return false;
5170
5171         if (conn->dst_type != type)
5172                 return false;
5173
5174         if (conn->state != BT_CONNECTED)
5175                 return false;
5176
5177         return true;
5178 }
5179
5180 /* This function requires the caller holds hdev->lock */
5181 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5182                                u8 addr_type, u8 auto_connect)
5183 {
5184         struct hci_conn_params *params;
5185
5186         params = hci_conn_params_add(hdev, addr, addr_type);
5187         if (!params)
5188                 return -EIO;
5189
5190         if (params->auto_connect == auto_connect)
5191                 return 0;
5192
5193         list_del_init(&params->action);
5194
5195         switch (auto_connect) {
5196         case HCI_AUTO_CONN_DISABLED:
5197         case HCI_AUTO_CONN_LINK_LOSS:
5198                 /* If auto connect is being disabled when we're trying to
5199                  * connect to device, keep connecting.
5200                  */
5201                 if (params->explicit_connect)
5202                         list_add(&params->action, &hdev->pend_le_conns);
5203                 break;
5204         case HCI_AUTO_CONN_REPORT:
5205                 if (params->explicit_connect)
5206                         list_add(&params->action, &hdev->pend_le_conns);
5207                 else
5208                         list_add(&params->action, &hdev->pend_le_reports);
5209                 break;
5210         case HCI_AUTO_CONN_DIRECT:
5211         case HCI_AUTO_CONN_ALWAYS:
5212                 if (!is_connected(hdev, addr, addr_type))
5213                         list_add(&params->action, &hdev->pend_le_conns);
5214                 break;
5215         }
5216
5217         params->auto_connect = auto_connect;
5218
5219         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5220                auto_connect);
5221
5222         return 0;
5223 }
5224
5225 static void device_added(struct sock *sk, struct hci_dev *hdev,
5226                          bdaddr_t *bdaddr, u8 type, u8 action)
5227 {
5228         struct mgmt_ev_device_added ev;
5229
5230         bacpy(&ev.addr.bdaddr, bdaddr);
5231         ev.addr.type = type;
5232         ev.action = action;
5233
5234         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5235 }
5236
5237 static int add_device(struct sock *sk, struct hci_dev *hdev,
5238                       void *data, u16 len)
5239 {
5240         struct mgmt_cp_add_device *cp = data;
5241         u8 auto_conn, addr_type;
5242         int err;
5243
5244         BT_DBG("%s", hdev->name);
5245
5246         if (!bdaddr_type_is_valid(cp->addr.type) ||
5247             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5248                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5249                                          MGMT_STATUS_INVALID_PARAMS,
5250                                          &cp->addr, sizeof(cp->addr));
5251
5252         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5253                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5254                                          MGMT_STATUS_INVALID_PARAMS,
5255                                          &cp->addr, sizeof(cp->addr));
5256
5257         hci_dev_lock(hdev);
5258
5259         if (cp->addr.type == BDADDR_BREDR) {
5260                 /* Only incoming connections action is supported for now */
5261                 if (cp->action != 0x01) {
5262                         err = mgmt_cmd_complete(sk, hdev->id,
5263                                                 MGMT_OP_ADD_DEVICE,
5264                                                 MGMT_STATUS_INVALID_PARAMS,
5265                                                 &cp->addr, sizeof(cp->addr));
5266                         goto unlock;
5267                 }
5268
5269                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5270                                           cp->addr.type);
5271                 if (err)
5272                         goto unlock;
5273
5274                 hci_req_update_scan(hdev);
5275
5276                 goto added;
5277         }
5278
5279         addr_type = le_addr_type(cp->addr.type);
5280
5281         if (cp->action == 0x02)
5282                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5283         else if (cp->action == 0x01)
5284                 auto_conn = HCI_AUTO_CONN_DIRECT;
5285         else
5286                 auto_conn = HCI_AUTO_CONN_REPORT;
5287
5288         /* Kernel internally uses conn_params with resolvable private
5289          * address, but Add Device allows only identity addresses.
5290          * Make sure it is enforced before calling
5291          * hci_conn_params_lookup.
5292          */
5293         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5294                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5295                                         MGMT_STATUS_INVALID_PARAMS,
5296                                         &cp->addr, sizeof(cp->addr));
5297                 goto unlock;
5298         }
5299
5300         /* If the connection parameters don't exist for this device,
5301          * they will be created and configured with defaults.
5302          */
5303         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5304                                 auto_conn) < 0) {
5305                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5306                                         MGMT_STATUS_FAILED, &cp->addr,
5307                                         sizeof(cp->addr));
5308                 goto unlock;
5309         }
5310
5311         hci_update_background_scan(hdev);
5312
5313 added:
5314         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5315
5316         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5317                                 MGMT_STATUS_SUCCESS, &cp->addr,
5318                                 sizeof(cp->addr));
5319
5320 unlock:
5321         hci_dev_unlock(hdev);
5322         return err;
5323 }
5324
5325 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5326                            bdaddr_t *bdaddr, u8 type)
5327 {
5328         struct mgmt_ev_device_removed ev;
5329
5330         bacpy(&ev.addr.bdaddr, bdaddr);
5331         ev.addr.type = type;
5332
5333         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5334 }
5335
5336 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5337                          void *data, u16 len)
5338 {
5339         struct mgmt_cp_remove_device *cp = data;
5340         int err;
5341
5342         BT_DBG("%s", hdev->name);
5343
5344         hci_dev_lock(hdev);
5345
5346         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5347                 struct hci_conn_params *params;
5348                 u8 addr_type;
5349
5350                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5351                         err = mgmt_cmd_complete(sk, hdev->id,
5352                                                 MGMT_OP_REMOVE_DEVICE,
5353                                                 MGMT_STATUS_INVALID_PARAMS,
5354                                                 &cp->addr, sizeof(cp->addr));
5355                         goto unlock;
5356                 }
5357
5358                 if (cp->addr.type == BDADDR_BREDR) {
5359                         err = hci_bdaddr_list_del(&hdev->whitelist,
5360                                                   &cp->addr.bdaddr,
5361                                                   cp->addr.type);
5362                         if (err) {
5363                                 err = mgmt_cmd_complete(sk, hdev->id,
5364                                                         MGMT_OP_REMOVE_DEVICE,
5365                                                         MGMT_STATUS_INVALID_PARAMS,
5366                                                         &cp->addr,
5367                                                         sizeof(cp->addr));
5368                                 goto unlock;
5369                         }
5370
5371                         hci_req_update_scan(hdev);
5372
5373                         device_removed(sk, hdev, &cp->addr.bdaddr,
5374                                        cp->addr.type);
5375                         goto complete;
5376                 }
5377
5378                 addr_type = le_addr_type(cp->addr.type);
5379
5380                 /* Kernel internally uses conn_params with resolvable private
5381                  * address, but Remove Device allows only identity addresses.
5382                  * Make sure it is enforced before calling
5383                  * hci_conn_params_lookup.
5384                  */
5385                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5386                         err = mgmt_cmd_complete(sk, hdev->id,
5387                                                 MGMT_OP_REMOVE_DEVICE,
5388                                                 MGMT_STATUS_INVALID_PARAMS,
5389                                                 &cp->addr, sizeof(cp->addr));
5390                         goto unlock;
5391                 }
5392
5393                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5394                                                 addr_type);
5395                 if (!params) {
5396                         err = mgmt_cmd_complete(sk, hdev->id,
5397                                                 MGMT_OP_REMOVE_DEVICE,
5398                                                 MGMT_STATUS_INVALID_PARAMS,
5399                                                 &cp->addr, sizeof(cp->addr));
5400                         goto unlock;
5401                 }
5402
5403                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5404                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5405                         err = mgmt_cmd_complete(sk, hdev->id,
5406                                                 MGMT_OP_REMOVE_DEVICE,
5407                                                 MGMT_STATUS_INVALID_PARAMS,
5408                                                 &cp->addr, sizeof(cp->addr));
5409                         goto unlock;
5410                 }
5411
5412                 list_del(&params->action);
5413                 list_del(&params->list);
5414                 kfree(params);
5415                 hci_update_background_scan(hdev);
5416
5417                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5418         } else {
5419                 struct hci_conn_params *p, *tmp;
5420                 struct bdaddr_list *b, *btmp;
5421
5422                 if (cp->addr.type) {
5423                         err = mgmt_cmd_complete(sk, hdev->id,
5424                                                 MGMT_OP_REMOVE_DEVICE,
5425                                                 MGMT_STATUS_INVALID_PARAMS,
5426                                                 &cp->addr, sizeof(cp->addr));
5427                         goto unlock;
5428                 }
5429
5430                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5431                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5432                         list_del(&b->list);
5433                         kfree(b);
5434                 }
5435
5436                 hci_req_update_scan(hdev);
5437
5438                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5439                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5440                                 continue;
5441                         device_removed(sk, hdev, &p->addr, p->addr_type);
5442                         if (p->explicit_connect) {
5443                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5444                                 continue;
5445                         }
5446                         list_del(&p->action);
5447                         list_del(&p->list);
5448                         kfree(p);
5449                 }
5450
5451                 BT_DBG("All LE connection parameters were removed");
5452
5453                 hci_update_background_scan(hdev);
5454         }
5455
5456 complete:
5457         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5458                                 MGMT_STATUS_SUCCESS, &cp->addr,
5459                                 sizeof(cp->addr));
5460 unlock:
5461         hci_dev_unlock(hdev);
5462         return err;
5463 }
5464
5465 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5466                            u16 len)
5467 {
5468         struct mgmt_cp_load_conn_param *cp = data;
5469         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5470                                      sizeof(struct mgmt_conn_param));
5471         u16 param_count, expected_len;
5472         int i;
5473
5474         if (!lmp_le_capable(hdev))
5475                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5476                                        MGMT_STATUS_NOT_SUPPORTED);
5477
5478         param_count = __le16_to_cpu(cp->param_count);
5479         if (param_count > max_param_count) {
5480                 BT_ERR("load_conn_param: too big param_count value %u",
5481                        param_count);
5482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5483                                        MGMT_STATUS_INVALID_PARAMS);
5484         }
5485
5486         expected_len = sizeof(*cp) + param_count *
5487                                         sizeof(struct mgmt_conn_param);
5488         if (expected_len != len) {
5489                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5490                        expected_len, len);
5491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5492                                        MGMT_STATUS_INVALID_PARAMS);
5493         }
5494
5495         BT_DBG("%s param_count %u", hdev->name, param_count);
5496
5497         hci_dev_lock(hdev);
5498
5499         hci_conn_params_clear_disabled(hdev);
5500
5501         for (i = 0; i < param_count; i++) {
5502                 struct mgmt_conn_param *param = &cp->params[i];
5503                 struct hci_conn_params *hci_param;
5504                 u16 min, max, latency, timeout;
5505                 u8 addr_type;
5506
5507                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5508                        param->addr.type);
5509
5510                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5511                         addr_type = ADDR_LE_DEV_PUBLIC;
5512                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5513                         addr_type = ADDR_LE_DEV_RANDOM;
5514                 } else {
5515                         BT_ERR("Ignoring invalid connection parameters");
5516                         continue;
5517                 }
5518
5519                 min = le16_to_cpu(param->min_interval);
5520                 max = le16_to_cpu(param->max_interval);
5521                 latency = le16_to_cpu(param->latency);
5522                 timeout = le16_to_cpu(param->timeout);
5523
5524                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5525                        min, max, latency, timeout);
5526
5527                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5528                         BT_ERR("Ignoring invalid connection parameters");
5529                         continue;
5530                 }
5531
5532                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5533                                                 addr_type);
5534                 if (!hci_param) {
5535                         BT_ERR("Failed to add connection parameters");
5536                         continue;
5537                 }
5538
5539                 hci_param->conn_min_interval = min;
5540                 hci_param->conn_max_interval = max;
5541                 hci_param->conn_latency = latency;
5542                 hci_param->supervision_timeout = timeout;
5543         }
5544
5545         hci_dev_unlock(hdev);
5546
5547         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5548                                  NULL, 0);
5549 }
5550
5551 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5552                                void *data, u16 len)
5553 {
5554         struct mgmt_cp_set_external_config *cp = data;
5555         bool changed;
5556         int err;
5557
5558         BT_DBG("%s", hdev->name);
5559
5560         if (hdev_is_powered(hdev))
5561                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5562                                        MGMT_STATUS_REJECTED);
5563
5564         if (cp->config != 0x00 && cp->config != 0x01)
5565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5566                                          MGMT_STATUS_INVALID_PARAMS);
5567
5568         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5570                                        MGMT_STATUS_NOT_SUPPORTED);
5571
5572         hci_dev_lock(hdev);
5573
5574         if (cp->config)
5575                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5576         else
5577                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5578
5579         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5580         if (err < 0)
5581                 goto unlock;
5582
5583         if (!changed)
5584                 goto unlock;
5585
5586         err = new_options(hdev, sk);
5587
5588         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5589                 mgmt_index_removed(hdev);
5590
5591                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5592                         hci_dev_set_flag(hdev, HCI_CONFIG);
5593                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5594
5595                         queue_work(hdev->req_workqueue, &hdev->power_on);
5596                 } else {
5597                         set_bit(HCI_RAW, &hdev->flags);
5598                         mgmt_index_added(hdev);
5599                 }
5600         }
5601
5602 unlock:
5603         hci_dev_unlock(hdev);
5604         return err;
5605 }
5606
5607 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5608                               void *data, u16 len)
5609 {
5610         struct mgmt_cp_set_public_address *cp = data;
5611         bool changed;
5612         int err;
5613
5614         BT_DBG("%s", hdev->name);
5615
5616         if (hdev_is_powered(hdev))
5617                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5618                                        MGMT_STATUS_REJECTED);
5619
5620         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5621                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5622                                        MGMT_STATUS_INVALID_PARAMS);
5623
5624         if (!hdev->set_bdaddr)
5625                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5626                                        MGMT_STATUS_NOT_SUPPORTED);
5627
5628         hci_dev_lock(hdev);
5629
5630         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5631         bacpy(&hdev->public_addr, &cp->bdaddr);
5632
5633         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5634         if (err < 0)
5635                 goto unlock;
5636
5637         if (!changed)
5638                 goto unlock;
5639
5640         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5641                 err = new_options(hdev, sk);
5642
5643         if (is_configured(hdev)) {
5644                 mgmt_index_removed(hdev);
5645
5646                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
5647
5648                 hci_dev_set_flag(hdev, HCI_CONFIG);
5649                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5650
5651                 queue_work(hdev->req_workqueue, &hdev->power_on);
5652         }
5653
5654 unlock:
5655         hci_dev_unlock(hdev);
5656         return err;
5657 }
5658
5659 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
5660                                              u16 opcode, struct sk_buff *skb)
5661 {
5662         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
5663         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
5664         u8 *h192, *r192, *h256, *r256;
5665         struct mgmt_pending_cmd *cmd;
5666         u16 eir_len;
5667         int err;
5668
5669         BT_DBG("%s status %u", hdev->name, status);
5670
5671         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
5672         if (!cmd)
5673                 return;
5674
5675         mgmt_cp = cmd->param;
5676
5677         if (status) {
5678                 status = mgmt_status(status);
5679                 eir_len = 0;
5680
5681                 h192 = NULL;
5682                 r192 = NULL;
5683                 h256 = NULL;
5684                 r256 = NULL;
5685         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
5686                 struct hci_rp_read_local_oob_data *rp;
5687
5688                 if (skb->len != sizeof(*rp)) {
5689                         status = MGMT_STATUS_FAILED;
5690                         eir_len = 0;
5691                 } else {
5692                         status = MGMT_STATUS_SUCCESS;
5693                         rp = (void *)skb->data;
5694
5695                         eir_len = 5 + 18 + 18;
5696                         h192 = rp->hash;
5697                         r192 = rp->rand;
5698                         h256 = NULL;
5699                         r256 = NULL;
5700                 }
5701         } else {
5702                 struct hci_rp_read_local_oob_ext_data *rp;
5703
5704                 if (skb->len != sizeof(*rp)) {
5705                         status = MGMT_STATUS_FAILED;
5706                         eir_len = 0;
5707                 } else {
5708                         status = MGMT_STATUS_SUCCESS;
5709                         rp = (void *)skb->data;
5710
5711                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5712                                 eir_len = 5 + 18 + 18;
5713                                 h192 = NULL;
5714                                 r192 = NULL;
5715                         } else {
5716                                 eir_len = 5 + 18 + 18 + 18 + 18;
5717                                 h192 = rp->hash192;
5718                                 r192 = rp->rand192;
5719                         }
5720
5721                         h256 = rp->hash256;
5722                         r256 = rp->rand256;
5723                 }
5724         }
5725
5726         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
5727         if (!mgmt_rp)
5728                 goto done;
5729
5730         if (status)
5731                 goto send_rsp;
5732
5733         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
5734                                   hdev->dev_class, 3);
5735
5736         if (h192 && r192) {
5737                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5738                                           EIR_SSP_HASH_C192, h192, 16);
5739                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5740                                           EIR_SSP_RAND_R192, r192, 16);
5741         }
5742
5743         if (h256 && r256) {
5744                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5745                                           EIR_SSP_HASH_C256, h256, 16);
5746                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5747                                           EIR_SSP_RAND_R256, r256, 16);
5748         }
5749
5750 send_rsp:
5751         mgmt_rp->type = mgmt_cp->type;
5752         mgmt_rp->eir_len = cpu_to_le16(eir_len);
5753
5754         err = mgmt_cmd_complete(cmd->sk, hdev->id,
5755                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
5756                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
5757         if (err < 0 || status)
5758                 goto done;
5759
5760         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
5761
5762         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5763                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
5764                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
5765 done:
5766         kfree(mgmt_rp);
5767         mgmt_pending_remove(cmd);
5768 }
5769
5770 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
5771                                   struct mgmt_cp_read_local_oob_ext_data *cp)
5772 {
5773         struct mgmt_pending_cmd *cmd;
5774         struct hci_request req;
5775         int err;
5776
5777         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
5778                                cp, sizeof(*cp));
5779         if (!cmd)
5780                 return -ENOMEM;
5781
5782         hci_req_init(&req, hdev);
5783
5784         if (bredr_sc_enabled(hdev))
5785                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
5786         else
5787                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
5788
5789         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
5790         if (err < 0) {
5791                 mgmt_pending_remove(cmd);
5792                 return err;
5793         }
5794
5795         return 0;
5796 }
5797
5798 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
5799                                    void *data, u16 data_len)
5800 {
5801         struct mgmt_cp_read_local_oob_ext_data *cp = data;
5802         struct mgmt_rp_read_local_oob_ext_data *rp;
5803         size_t rp_len;
5804         u16 eir_len;
5805         u8 status, flags, role, addr[7], hash[16], rand[16];
5806         int err;
5807
5808         BT_DBG("%s", hdev->name);
5809
5810         if (hdev_is_powered(hdev)) {
5811                 switch (cp->type) {
5812                 case BIT(BDADDR_BREDR):
5813                         status = mgmt_bredr_support(hdev);
5814                         if (status)
5815                                 eir_len = 0;
5816                         else
5817                                 eir_len = 5;
5818                         break;
5819                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5820                         status = mgmt_le_support(hdev);
5821                         if (status)
5822                                 eir_len = 0;
5823                         else
5824                                 eir_len = 9 + 3 + 18 + 18 + 3;
5825                         break;
5826                 default:
5827                         status = MGMT_STATUS_INVALID_PARAMS;
5828                         eir_len = 0;
5829                         break;
5830                 }
5831         } else {
5832                 status = MGMT_STATUS_NOT_POWERED;
5833                 eir_len = 0;
5834         }
5835
5836         rp_len = sizeof(*rp) + eir_len;
5837         rp = kmalloc(rp_len, GFP_ATOMIC);
5838         if (!rp)
5839                 return -ENOMEM;
5840
5841         if (status)
5842                 goto complete;
5843
5844         hci_dev_lock(hdev);
5845
5846         eir_len = 0;
5847         switch (cp->type) {
5848         case BIT(BDADDR_BREDR):
5849                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5850                         err = read_local_ssp_oob_req(hdev, sk, cp);
5851                         hci_dev_unlock(hdev);
5852                         if (!err)
5853                                 goto done;
5854
5855                         status = MGMT_STATUS_FAILED;
5856                         goto complete;
5857                 } else {
5858                         eir_len = eir_append_data(rp->eir, eir_len,
5859                                                   EIR_CLASS_OF_DEV,
5860                                                   hdev->dev_class, 3);
5861                 }
5862                 break;
5863         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5864                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5865                     smp_generate_oob(hdev, hash, rand) < 0) {
5866                         hci_dev_unlock(hdev);
5867                         status = MGMT_STATUS_FAILED;
5868                         goto complete;
5869                 }
5870
5871                 /* This should return the active RPA, but since the RPA
5872                  * is only programmed on demand, it is really hard to fill
5873                  * this in at the moment. For now disallow retrieving
5874                  * local out-of-band data when privacy is in use.
5875                  *
5876                  * Returning the identity address will not help here since
5877                  * pairing happens before the identity resolving key is
5878                  * known and thus the connection establishment happens
5879                  * based on the RPA and not the identity address.
5880                  */
5881                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5882                         hci_dev_unlock(hdev);
5883                         status = MGMT_STATUS_REJECTED;
5884                         goto complete;
5885                 }
5886
5887                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
5888                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
5889                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5890                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
5891                         memcpy(addr, &hdev->static_addr, 6);
5892                         addr[6] = 0x01;
5893                 } else {
5894                         memcpy(addr, &hdev->bdaddr, 6);
5895                         addr[6] = 0x00;
5896                 }
5897
5898                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
5899                                           addr, sizeof(addr));
5900
5901                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5902                         role = 0x02;
5903                 else
5904                         role = 0x01;
5905
5906                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
5907                                           &role, sizeof(role));
5908
5909                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
5910                         eir_len = eir_append_data(rp->eir, eir_len,
5911                                                   EIR_LE_SC_CONFIRM,
5912                                                   hash, sizeof(hash));
5913
5914                         eir_len = eir_append_data(rp->eir, eir_len,
5915                                                   EIR_LE_SC_RANDOM,
5916                                                   rand, sizeof(rand));
5917                 }
5918
5919                 flags = mgmt_get_adv_discov_flags(hdev);
5920
5921                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5922                         flags |= LE_AD_NO_BREDR;
5923
5924                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
5925                                           &flags, sizeof(flags));
5926                 break;
5927         }
5928
5929         hci_dev_unlock(hdev);
5930
5931         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
5932
5933         status = MGMT_STATUS_SUCCESS;
5934
5935 complete:
5936         rp->type = cp->type;
5937         rp->eir_len = cpu_to_le16(eir_len);
5938
5939         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5940                                 status, rp, sizeof(*rp) + eir_len);
5941         if (err < 0 || status)
5942                 goto done;
5943
5944         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5945                                  rp, sizeof(*rp) + eir_len,
5946                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
5947
5948 done:
5949         kfree(rp);
5950
5951         return err;
5952 }
5953
5954 static u32 get_supported_adv_flags(struct hci_dev *hdev)
5955 {
5956         u32 flags = 0;
5957
5958         flags |= MGMT_ADV_FLAG_CONNECTABLE;
5959         flags |= MGMT_ADV_FLAG_DISCOV;
5960         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
5961         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
5962         flags |= MGMT_ADV_FLAG_APPEARANCE;
5963         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
5964
5965         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
5966                 flags |= MGMT_ADV_FLAG_TX_POWER;
5967
5968         return flags;
5969 }
5970
5971 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
5972                              void *data, u16 data_len)
5973 {
5974         struct mgmt_rp_read_adv_features *rp;
5975         size_t rp_len;
5976         int err;
5977         struct adv_info *adv_instance;
5978         u32 supported_flags;
5979         u8 *instance;
5980
5981         BT_DBG("%s", hdev->name);
5982
5983         if (!lmp_le_capable(hdev))
5984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5985                                        MGMT_STATUS_REJECTED);
5986
5987         hci_dev_lock(hdev);
5988
5989         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
5990         rp = kmalloc(rp_len, GFP_ATOMIC);
5991         if (!rp) {
5992                 hci_dev_unlock(hdev);
5993                 return -ENOMEM;
5994         }
5995
5996         supported_flags = get_supported_adv_flags(hdev);
5997
5998         rp->supported_flags = cpu_to_le32(supported_flags);
5999         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6000         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6001         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6002         rp->num_instances = hdev->adv_instance_cnt;
6003
6004         instance = rp->instance;
6005         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6006                 *instance = adv_instance->instance;
6007                 instance++;
6008         }
6009
6010         hci_dev_unlock(hdev);
6011
6012         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6013                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6014
6015         kfree(rp);
6016
6017         return err;
6018 }
6019
6020 static u8 calculate_name_len(struct hci_dev *hdev)
6021 {
6022         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6023
6024         return append_local_name(hdev, buf, 0);
6025 }
6026
6027 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6028                            bool is_adv_data)
6029 {
6030         u8 max_len = HCI_MAX_AD_LENGTH;
6031
6032         if (is_adv_data) {
6033                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6034                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6035                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6036                         max_len -= 3;
6037
6038                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6039                         max_len -= 3;
6040         } else {
6041                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6042                         max_len -= calculate_name_len(hdev);
6043
6044                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6045                         max_len -= 4;
6046         }
6047
6048         return max_len;
6049 }
6050
6051 static bool flags_managed(u32 adv_flags)
6052 {
6053         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6054                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6055                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6056 }
6057
6058 static bool tx_power_managed(u32 adv_flags)
6059 {
6060         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6061 }
6062
6063 static bool name_managed(u32 adv_flags)
6064 {
6065         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6066 }
6067
6068 static bool appearance_managed(u32 adv_flags)
6069 {
6070         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6071 }
6072
6073 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6074                               u8 len, bool is_adv_data)
6075 {
6076         int i, cur_len;
6077         u8 max_len;
6078
6079         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6080
6081         if (len > max_len)
6082                 return false;
6083
6084         /* Make sure that the data is correctly formatted. */
6085         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6086                 cur_len = data[i];
6087
6088                 if (data[i + 1] == EIR_FLAGS &&
6089                     (!is_adv_data || flags_managed(adv_flags)))
6090                         return false;
6091
6092                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6093                         return false;
6094
6095                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6096                         return false;
6097
6098                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6099                         return false;
6100
6101                 if (data[i + 1] == EIR_APPEARANCE &&
6102                     appearance_managed(adv_flags))
6103                         return false;
6104
6105                 /* If the current field length would exceed the total data
6106                  * length, then it's invalid.
6107                  */
6108                 if (i + cur_len >= len)
6109                         return false;
6110         }
6111
6112         return true;
6113 }
6114
6115 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6116                                      u16 opcode)
6117 {
6118         struct mgmt_pending_cmd *cmd;
6119         struct mgmt_cp_add_advertising *cp;
6120         struct mgmt_rp_add_advertising rp;
6121         struct adv_info *adv_instance, *n;
6122         u8 instance;
6123
6124         BT_DBG("status %d", status);
6125
6126         hci_dev_lock(hdev);
6127
6128         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6129
6130         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6131                 if (!adv_instance->pending)
6132                         continue;
6133
6134                 if (!status) {
6135                         adv_instance->pending = false;
6136                         continue;
6137                 }
6138
6139                 instance = adv_instance->instance;
6140
6141                 if (hdev->cur_adv_instance == instance)
6142                         cancel_adv_timeout(hdev);
6143
6144                 hci_remove_adv_instance(hdev, instance);
6145                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6146         }
6147
6148         if (!cmd)
6149                 goto unlock;
6150
6151         cp = cmd->param;
6152         rp.instance = cp->instance;
6153
6154         if (status)
6155                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6156                                 mgmt_status(status));
6157         else
6158                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6159                                   mgmt_status(status), &rp, sizeof(rp));
6160
6161         mgmt_pending_remove(cmd);
6162
6163 unlock:
6164         hci_dev_unlock(hdev);
6165 }
6166
6167 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6168                            void *data, u16 data_len)
6169 {
6170         struct mgmt_cp_add_advertising *cp = data;
6171         struct mgmt_rp_add_advertising rp;
6172         u32 flags;
6173         u32 supported_flags;
6174         u8 status;
6175         u16 timeout, duration;
6176         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6177         u8 schedule_instance = 0;
6178         struct adv_info *next_instance;
6179         int err;
6180         struct mgmt_pending_cmd *cmd;
6181         struct hci_request req;
6182
6183         BT_DBG("%s", hdev->name);
6184
6185         status = mgmt_le_support(hdev);
6186         if (status)
6187                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6188                                        status);
6189
6190         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6191                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6192                                        MGMT_STATUS_INVALID_PARAMS);
6193
6194         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6195                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6196                                        MGMT_STATUS_INVALID_PARAMS);
6197
6198         flags = __le32_to_cpu(cp->flags);
6199         timeout = __le16_to_cpu(cp->timeout);
6200         duration = __le16_to_cpu(cp->duration);
6201
6202         /* The current implementation only supports a subset of the specified
6203          * flags.
6204          */
6205         supported_flags = get_supported_adv_flags(hdev);
6206         if (flags & ~supported_flags)
6207                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6208                                        MGMT_STATUS_INVALID_PARAMS);
6209
6210         hci_dev_lock(hdev);
6211
6212         if (timeout && !hdev_is_powered(hdev)) {
6213                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6214                                       MGMT_STATUS_REJECTED);
6215                 goto unlock;
6216         }
6217
6218         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6219             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6220             pending_find(MGMT_OP_SET_LE, hdev)) {
6221                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6222                                       MGMT_STATUS_BUSY);
6223                 goto unlock;
6224         }
6225
6226         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6227             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6228                                cp->scan_rsp_len, false)) {
6229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6230                                       MGMT_STATUS_INVALID_PARAMS);
6231                 goto unlock;
6232         }
6233
6234         err = hci_add_adv_instance(hdev, cp->instance, flags,
6235                                    cp->adv_data_len, cp->data,
6236                                    cp->scan_rsp_len,
6237                                    cp->data + cp->adv_data_len,
6238                                    timeout, duration);
6239         if (err < 0) {
6240                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6241                                       MGMT_STATUS_FAILED);
6242                 goto unlock;
6243         }
6244
6245         /* Only trigger an advertising added event if a new instance was
6246          * actually added.
6247          */
6248         if (hdev->adv_instance_cnt > prev_instance_cnt)
6249                 mgmt_advertising_added(sk, hdev, cp->instance);
6250
6251         if (hdev->cur_adv_instance == cp->instance) {
6252                 /* If the currently advertised instance is being changed then
6253                  * cancel the current advertising and schedule the next
6254                  * instance. If there is only one instance then the overridden
6255                  * advertising data will be visible right away.
6256                  */
6257                 cancel_adv_timeout(hdev);
6258
6259                 next_instance = hci_get_next_instance(hdev, cp->instance);
6260                 if (next_instance)
6261                         schedule_instance = next_instance->instance;
6262         } else if (!hdev->adv_instance_timeout) {
6263                 /* Immediately advertise the new instance if no other
6264                  * instance is currently being advertised.
6265                  */
6266                 schedule_instance = cp->instance;
6267         }
6268
6269         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6270          * there is no instance to be advertised then we have no HCI
6271          * communication to make. Simply return.
6272          */
6273         if (!hdev_is_powered(hdev) ||
6274             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6275             !schedule_instance) {
6276                 rp.instance = cp->instance;
6277                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6278                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6279                 goto unlock;
6280         }
6281
6282         /* We're good to go, update advertising data, parameters, and start
6283          * advertising.
6284          */
6285         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6286                                data_len);
6287         if (!cmd) {
6288                 err = -ENOMEM;
6289                 goto unlock;
6290         }
6291
6292         hci_req_init(&req, hdev);
6293
6294         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6295
6296         if (!err)
6297                 err = hci_req_run(&req, add_advertising_complete);
6298
6299         if (err < 0)
6300                 mgmt_pending_remove(cmd);
6301
6302 unlock:
6303         hci_dev_unlock(hdev);
6304
6305         return err;
6306 }
6307
6308 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6309                                         u16 opcode)
6310 {
6311         struct mgmt_pending_cmd *cmd;
6312         struct mgmt_cp_remove_advertising *cp;
6313         struct mgmt_rp_remove_advertising rp;
6314
6315         BT_DBG("status %d", status);
6316
6317         hci_dev_lock(hdev);
6318
6319         /* A failure status here only means that we failed to disable
6320          * advertising. Otherwise, the advertising instance has been removed,
6321          * so report success.
6322          */
6323         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6324         if (!cmd)
6325                 goto unlock;
6326
6327         cp = cmd->param;
6328         rp.instance = cp->instance;
6329
6330         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6331                           &rp, sizeof(rp));
6332         mgmt_pending_remove(cmd);
6333
6334 unlock:
6335         hci_dev_unlock(hdev);
6336 }
6337
6338 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6339                               void *data, u16 data_len)
6340 {
6341         struct mgmt_cp_remove_advertising *cp = data;
6342         struct mgmt_rp_remove_advertising rp;
6343         struct mgmt_pending_cmd *cmd;
6344         struct hci_request req;
6345         int err;
6346
6347         BT_DBG("%s", hdev->name);
6348
6349         hci_dev_lock(hdev);
6350
6351         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6352                 err = mgmt_cmd_status(sk, hdev->id,
6353                                       MGMT_OP_REMOVE_ADVERTISING,
6354                                       MGMT_STATUS_INVALID_PARAMS);
6355                 goto unlock;
6356         }
6357
6358         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6359             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6360             pending_find(MGMT_OP_SET_LE, hdev)) {
6361                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6362                                       MGMT_STATUS_BUSY);
6363                 goto unlock;
6364         }
6365
6366         if (list_empty(&hdev->adv_instances)) {
6367                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6368                                       MGMT_STATUS_INVALID_PARAMS);
6369                 goto unlock;
6370         }
6371
6372         hci_req_init(&req, hdev);
6373
6374         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6375
6376         if (list_empty(&hdev->adv_instances))
6377                 __hci_req_disable_advertising(&req);
6378
6379         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6380          * flag is set or the device isn't powered then we have no HCI
6381          * communication to make. Simply return.
6382          */
6383         if (skb_queue_empty(&req.cmd_q) ||
6384             !hdev_is_powered(hdev) ||
6385             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6386                 rp.instance = cp->instance;
6387                 err = mgmt_cmd_complete(sk, hdev->id,
6388                                         MGMT_OP_REMOVE_ADVERTISING,
6389                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6390                 goto unlock;
6391         }
6392
6393         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6394                                data_len);
6395         if (!cmd) {
6396                 err = -ENOMEM;
6397                 goto unlock;
6398         }
6399
6400         err = hci_req_run(&req, remove_advertising_complete);
6401         if (err < 0)
6402                 mgmt_pending_remove(cmd);
6403
6404 unlock:
6405         hci_dev_unlock(hdev);
6406
6407         return err;
6408 }
6409
6410 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6411                              void *data, u16 data_len)
6412 {
6413         struct mgmt_cp_get_adv_size_info *cp = data;
6414         struct mgmt_rp_get_adv_size_info rp;
6415         u32 flags, supported_flags;
6416         int err;
6417
6418         BT_DBG("%s", hdev->name);
6419
6420         if (!lmp_le_capable(hdev))
6421                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6422                                        MGMT_STATUS_REJECTED);
6423
6424         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6425                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6426                                        MGMT_STATUS_INVALID_PARAMS);
6427
6428         flags = __le32_to_cpu(cp->flags);
6429
6430         /* The current implementation only supports a subset of the specified
6431          * flags.
6432          */
6433         supported_flags = get_supported_adv_flags(hdev);
6434         if (flags & ~supported_flags)
6435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6436                                        MGMT_STATUS_INVALID_PARAMS);
6437
6438         rp.instance = cp->instance;
6439         rp.flags = cp->flags;
6440         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6441         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6442
6443         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6444                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6445
6446         return err;
6447 }
6448
6449 static const struct hci_mgmt_handler mgmt_handlers[] = {
6450         { NULL }, /* 0x0000 (no command) */
6451         { read_version,            MGMT_READ_VERSION_SIZE,
6452                                                 HCI_MGMT_NO_HDEV |
6453                                                 HCI_MGMT_UNTRUSTED },
6454         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6455                                                 HCI_MGMT_NO_HDEV |
6456                                                 HCI_MGMT_UNTRUSTED },
6457         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6458                                                 HCI_MGMT_NO_HDEV |
6459                                                 HCI_MGMT_UNTRUSTED },
6460         { read_controller_info,    MGMT_READ_INFO_SIZE,
6461                                                 HCI_MGMT_UNTRUSTED },
6462         { set_powered,             MGMT_SETTING_SIZE },
6463         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6464         { set_connectable,         MGMT_SETTING_SIZE },
6465         { set_fast_connectable,    MGMT_SETTING_SIZE },
6466         { set_bondable,            MGMT_SETTING_SIZE },
6467         { set_link_security,       MGMT_SETTING_SIZE },
6468         { set_ssp,                 MGMT_SETTING_SIZE },
6469         { set_hs,                  MGMT_SETTING_SIZE },
6470         { set_le,                  MGMT_SETTING_SIZE },
6471         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6472         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6473         { add_uuid,                MGMT_ADD_UUID_SIZE },
6474         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6475         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6476                                                 HCI_MGMT_VAR_LEN },
6477         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6478                                                 HCI_MGMT_VAR_LEN },
6479         { disconnect,              MGMT_DISCONNECT_SIZE },
6480         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6481         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6482         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6483         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6484         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6485         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6486         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6487         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6488         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6489         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6490         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6491         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6492         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6493                                                 HCI_MGMT_VAR_LEN },
6494         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6495         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6496         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6497         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6498         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6499         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6500         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6501         { set_advertising,         MGMT_SETTING_SIZE },
6502         { set_bredr,               MGMT_SETTING_SIZE },
6503         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6504         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6505         { set_secure_conn,         MGMT_SETTING_SIZE },
6506         { set_debug_keys,          MGMT_SETTING_SIZE },
6507         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6508         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6509                                                 HCI_MGMT_VAR_LEN },
6510         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6511         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6512         { add_device,              MGMT_ADD_DEVICE_SIZE },
6513         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6514         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6515                                                 HCI_MGMT_VAR_LEN },
6516         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6517                                                 HCI_MGMT_NO_HDEV |
6518                                                 HCI_MGMT_UNTRUSTED },
6519         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6520                                                 HCI_MGMT_UNCONFIGURED |
6521                                                 HCI_MGMT_UNTRUSTED },
6522         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6523                                                 HCI_MGMT_UNCONFIGURED },
6524         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6525                                                 HCI_MGMT_UNCONFIGURED },
6526         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6527                                                 HCI_MGMT_VAR_LEN },
6528         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6529         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6530                                                 HCI_MGMT_NO_HDEV |
6531                                                 HCI_MGMT_UNTRUSTED },
6532         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6533         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6534                                                 HCI_MGMT_VAR_LEN },
6535         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6536         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6537         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6538         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6539                                                 HCI_MGMT_UNTRUSTED },
6540         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6541 };
6542
6543 void mgmt_index_added(struct hci_dev *hdev)
6544 {
6545         struct mgmt_ev_ext_index ev;
6546
6547         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6548                 return;
6549
6550         switch (hdev->dev_type) {
6551         case HCI_PRIMARY:
6552                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6553                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6554                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6555                         ev.type = 0x01;
6556                 } else {
6557                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6558                                          HCI_MGMT_INDEX_EVENTS);
6559                         ev.type = 0x00;
6560                 }
6561                 break;
6562         case HCI_AMP:
6563                 ev.type = 0x02;
6564                 break;
6565         default:
6566                 return;
6567         }
6568
6569         ev.bus = hdev->bus;
6570
6571         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6572                          HCI_MGMT_EXT_INDEX_EVENTS);
6573 }
6574
6575 void mgmt_index_removed(struct hci_dev *hdev)
6576 {
6577         struct mgmt_ev_ext_index ev;
6578         u8 status = MGMT_STATUS_INVALID_INDEX;
6579
6580         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6581                 return;
6582
6583         switch (hdev->dev_type) {
6584         case HCI_PRIMARY:
6585                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6586
6587                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6588                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6589                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6590                         ev.type = 0x01;
6591                 } else {
6592                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6593                                          HCI_MGMT_INDEX_EVENTS);
6594                         ev.type = 0x00;
6595                 }
6596                 break;
6597         case HCI_AMP:
6598                 ev.type = 0x02;
6599                 break;
6600         default:
6601                 return;
6602         }
6603
6604         ev.bus = hdev->bus;
6605
6606         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6607                          HCI_MGMT_EXT_INDEX_EVENTS);
6608 }
6609
6610 /* This function requires the caller holds hdev->lock */
6611 static void restart_le_actions(struct hci_dev *hdev)
6612 {
6613         struct hci_conn_params *p;
6614
6615         list_for_each_entry(p, &hdev->le_conn_params, list) {
6616                 /* Needed for AUTO_OFF case where might not "really"
6617                  * have been powered off.
6618                  */
6619                 list_del_init(&p->action);
6620
6621                 switch (p->auto_connect) {
6622                 case HCI_AUTO_CONN_DIRECT:
6623                 case HCI_AUTO_CONN_ALWAYS:
6624                         list_add(&p->action, &hdev->pend_le_conns);
6625                         break;
6626                 case HCI_AUTO_CONN_REPORT:
6627                         list_add(&p->action, &hdev->pend_le_reports);
6628                         break;
6629                 default:
6630                         break;
6631                 }
6632         }
6633 }
6634
6635 void mgmt_power_on(struct hci_dev *hdev, int err)
6636 {
6637         struct cmd_lookup match = { NULL, hdev };
6638
6639         BT_DBG("err %d", err);
6640
6641         hci_dev_lock(hdev);
6642
6643         if (!err) {
6644                 restart_le_actions(hdev);
6645                 hci_update_background_scan(hdev);
6646         }
6647
6648         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6649
6650         new_settings(hdev, match.sk);
6651
6652         if (match.sk)
6653                 sock_put(match.sk);
6654
6655         hci_dev_unlock(hdev);
6656 }
6657
6658 void __mgmt_power_off(struct hci_dev *hdev)
6659 {
6660         struct cmd_lookup match = { NULL, hdev };
6661         u8 status, zero_cod[] = { 0, 0, 0 };
6662
6663         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6664
6665         /* If the power off is because of hdev unregistration let
6666          * use the appropriate INVALID_INDEX status. Otherwise use
6667          * NOT_POWERED. We cover both scenarios here since later in
6668          * mgmt_index_removed() any hci_conn callbacks will have already
6669          * been triggered, potentially causing misleading DISCONNECTED
6670          * status responses.
6671          */
6672         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6673                 status = MGMT_STATUS_INVALID_INDEX;
6674         else
6675                 status = MGMT_STATUS_NOT_POWERED;
6676
6677         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6678
6679         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
6680                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6681                                    zero_cod, sizeof(zero_cod),
6682                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
6683                 ext_info_changed(hdev, NULL);
6684         }
6685
6686         new_settings(hdev, match.sk);
6687
6688         if (match.sk)
6689                 sock_put(match.sk);
6690 }
6691
6692 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6693 {
6694         struct mgmt_pending_cmd *cmd;
6695         u8 status;
6696
6697         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6698         if (!cmd)
6699                 return;
6700
6701         if (err == -ERFKILL)
6702                 status = MGMT_STATUS_RFKILLED;
6703         else
6704                 status = MGMT_STATUS_FAILED;
6705
6706         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6707
6708         mgmt_pending_remove(cmd);
6709 }
6710
6711 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6712                        bool persistent)
6713 {
6714         struct mgmt_ev_new_link_key ev;
6715
6716         memset(&ev, 0, sizeof(ev));
6717
6718         ev.store_hint = persistent;
6719         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6720         ev.key.addr.type = BDADDR_BREDR;
6721         ev.key.type = key->type;
6722         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6723         ev.key.pin_len = key->pin_len;
6724
6725         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6726 }
6727
6728 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6729 {
6730         switch (ltk->type) {
6731         case SMP_LTK:
6732         case SMP_LTK_SLAVE:
6733                 if (ltk->authenticated)
6734                         return MGMT_LTK_AUTHENTICATED;
6735                 return MGMT_LTK_UNAUTHENTICATED;
6736         case SMP_LTK_P256:
6737                 if (ltk->authenticated)
6738                         return MGMT_LTK_P256_AUTH;
6739                 return MGMT_LTK_P256_UNAUTH;
6740         case SMP_LTK_P256_DEBUG:
6741                 return MGMT_LTK_P256_DEBUG;
6742         }
6743
6744         return MGMT_LTK_UNAUTHENTICATED;
6745 }
6746
6747 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6748 {
6749         struct mgmt_ev_new_long_term_key ev;
6750
6751         memset(&ev, 0, sizeof(ev));
6752
6753         /* Devices using resolvable or non-resolvable random addresses
6754          * without providing an identity resolving key don't require
6755          * to store long term keys. Their addresses will change the
6756          * next time around.
6757          *
6758          * Only when a remote device provides an identity address
6759          * make sure the long term key is stored. If the remote
6760          * identity is known, the long term keys are internally
6761          * mapped to the identity address. So allow static random
6762          * and public addresses here.
6763          */
6764         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6765             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6766                 ev.store_hint = 0x00;
6767         else
6768                 ev.store_hint = persistent;
6769
6770         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6771         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6772         ev.key.type = mgmt_ltk_type(key);
6773         ev.key.enc_size = key->enc_size;
6774         ev.key.ediv = key->ediv;
6775         ev.key.rand = key->rand;
6776
6777         if (key->type == SMP_LTK)
6778                 ev.key.master = 1;
6779
6780         /* Make sure we copy only the significant bytes based on the
6781          * encryption key size, and set the rest of the value to zeroes.
6782          */
6783         memcpy(ev.key.val, key->val, key->enc_size);
6784         memset(ev.key.val + key->enc_size, 0,
6785                sizeof(ev.key.val) - key->enc_size);
6786
6787         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6788 }
6789
6790 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
6791 {
6792         struct mgmt_ev_new_irk ev;
6793
6794         memset(&ev, 0, sizeof(ev));
6795
6796         ev.store_hint = persistent;
6797
6798         bacpy(&ev.rpa, &irk->rpa);
6799         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6800         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6801         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6802
6803         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6804 }
6805
6806 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6807                    bool persistent)
6808 {
6809         struct mgmt_ev_new_csrk ev;
6810
6811         memset(&ev, 0, sizeof(ev));
6812
6813         /* Devices using resolvable or non-resolvable random addresses
6814          * without providing an identity resolving key don't require
6815          * to store signature resolving keys. Their addresses will change
6816          * the next time around.
6817          *
6818          * Only when a remote device provides an identity address
6819          * make sure the signature resolving key is stored. So allow
6820          * static random and public addresses here.
6821          */
6822         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6823             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6824                 ev.store_hint = 0x00;
6825         else
6826                 ev.store_hint = persistent;
6827
6828         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6829         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6830         ev.key.type = csrk->type;
6831         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6832
6833         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6834 }
6835
6836 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6837                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6838                          u16 max_interval, u16 latency, u16 timeout)
6839 {
6840         struct mgmt_ev_new_conn_param ev;
6841
6842         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6843                 return;
6844
6845         memset(&ev, 0, sizeof(ev));
6846         bacpy(&ev.addr.bdaddr, bdaddr);
6847         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6848         ev.store_hint = store_hint;
6849         ev.min_interval = cpu_to_le16(min_interval);
6850         ev.max_interval = cpu_to_le16(max_interval);
6851         ev.latency = cpu_to_le16(latency);
6852         ev.timeout = cpu_to_le16(timeout);
6853
6854         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6855 }
6856
6857 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6858                            u32 flags, u8 *name, u8 name_len)
6859 {
6860         char buf[512];
6861         struct mgmt_ev_device_connected *ev = (void *) buf;
6862         u16 eir_len = 0;
6863
6864         bacpy(&ev->addr.bdaddr, &conn->dst);
6865         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6866
6867         ev->flags = __cpu_to_le32(flags);
6868
6869         /* We must ensure that the EIR Data fields are ordered and
6870          * unique. Keep it simple for now and avoid the problem by not
6871          * adding any BR/EDR data to the LE adv.
6872          */
6873         if (conn->le_adv_data_len > 0) {
6874                 memcpy(&ev->eir[eir_len],
6875                        conn->le_adv_data, conn->le_adv_data_len);
6876                 eir_len = conn->le_adv_data_len;
6877         } else {
6878                 if (name_len > 0)
6879                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6880                                                   name, name_len);
6881
6882                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6883                         eir_len = eir_append_data(ev->eir, eir_len,
6884                                                   EIR_CLASS_OF_DEV,
6885                                                   conn->dev_class, 3);
6886         }
6887
6888         ev->eir_len = cpu_to_le16(eir_len);
6889
6890         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6891                     sizeof(*ev) + eir_len, NULL);
6892 }
6893
6894 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6895 {
6896         struct sock **sk = data;
6897
6898         cmd->cmd_complete(cmd, 0);
6899
6900         *sk = cmd->sk;
6901         sock_hold(*sk);
6902
6903         mgmt_pending_remove(cmd);
6904 }
6905
6906 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6907 {
6908         struct hci_dev *hdev = data;
6909         struct mgmt_cp_unpair_device *cp = cmd->param;
6910
6911         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6912
6913         cmd->cmd_complete(cmd, 0);
6914         mgmt_pending_remove(cmd);
6915 }
6916
6917 bool mgmt_powering_down(struct hci_dev *hdev)
6918 {
6919         struct mgmt_pending_cmd *cmd;
6920         struct mgmt_mode *cp;
6921
6922         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6923         if (!cmd)
6924                 return false;
6925
6926         cp = cmd->param;
6927         if (!cp->val)
6928                 return true;
6929
6930         return false;
6931 }
6932
6933 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6934                               u8 link_type, u8 addr_type, u8 reason,
6935                               bool mgmt_connected)
6936 {
6937         struct mgmt_ev_device_disconnected ev;
6938         struct sock *sk = NULL;
6939
6940         /* The connection is still in hci_conn_hash so test for 1
6941          * instead of 0 to know if this is the last one.
6942          */
6943         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6944                 cancel_delayed_work(&hdev->power_off);
6945                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6946         }
6947
6948         if (!mgmt_connected)
6949                 return;
6950
6951         if (link_type != ACL_LINK && link_type != LE_LINK)
6952                 return;
6953
6954         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6955
6956         bacpy(&ev.addr.bdaddr, bdaddr);
6957         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6958         ev.reason = reason;
6959
6960         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6961
6962         if (sk)
6963                 sock_put(sk);
6964
6965         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6966                              hdev);
6967 }
6968
6969 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6970                             u8 link_type, u8 addr_type, u8 status)
6971 {
6972         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6973         struct mgmt_cp_disconnect *cp;
6974         struct mgmt_pending_cmd *cmd;
6975
6976         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6977                              hdev);
6978
6979         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6980         if (!cmd)
6981                 return;
6982
6983         cp = cmd->param;
6984
6985         if (bacmp(bdaddr, &cp->addr.bdaddr))
6986                 return;
6987
6988         if (cp->addr.type != bdaddr_type)
6989                 return;
6990
6991         cmd->cmd_complete(cmd, mgmt_status(status));
6992         mgmt_pending_remove(cmd);
6993 }
6994
6995 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6996                          u8 addr_type, u8 status)
6997 {
6998         struct mgmt_ev_connect_failed ev;
6999
7000         /* The connection is still in hci_conn_hash so test for 1
7001          * instead of 0 to know if this is the last one.
7002          */
7003         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7004                 cancel_delayed_work(&hdev->power_off);
7005                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7006         }
7007
7008         bacpy(&ev.addr.bdaddr, bdaddr);
7009         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7010         ev.status = mgmt_status(status);
7011
7012         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7013 }
7014
7015 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7016 {
7017         struct mgmt_ev_pin_code_request ev;
7018
7019         bacpy(&ev.addr.bdaddr, bdaddr);
7020         ev.addr.type = BDADDR_BREDR;
7021         ev.secure = secure;
7022
7023         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7024 }
7025
7026 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7027                                   u8 status)
7028 {
7029         struct mgmt_pending_cmd *cmd;
7030
7031         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7032         if (!cmd)
7033                 return;
7034
7035         cmd->cmd_complete(cmd, mgmt_status(status));
7036         mgmt_pending_remove(cmd);
7037 }
7038
7039 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7040                                       u8 status)
7041 {
7042         struct mgmt_pending_cmd *cmd;
7043
7044         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7045         if (!cmd)
7046                 return;
7047
7048         cmd->cmd_complete(cmd, mgmt_status(status));
7049         mgmt_pending_remove(cmd);
7050 }
7051
7052 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7053                               u8 link_type, u8 addr_type, u32 value,
7054                               u8 confirm_hint)
7055 {
7056         struct mgmt_ev_user_confirm_request ev;
7057
7058         BT_DBG("%s", hdev->name);
7059
7060         bacpy(&ev.addr.bdaddr, bdaddr);
7061         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7062         ev.confirm_hint = confirm_hint;
7063         ev.value = cpu_to_le32(value);
7064
7065         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7066                           NULL);
7067 }
7068
7069 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7070                               u8 link_type, u8 addr_type)
7071 {
7072         struct mgmt_ev_user_passkey_request ev;
7073
7074         BT_DBG("%s", hdev->name);
7075
7076         bacpy(&ev.addr.bdaddr, bdaddr);
7077         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7078
7079         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7080                           NULL);
7081 }
7082
7083 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7084                                       u8 link_type, u8 addr_type, u8 status,
7085                                       u8 opcode)
7086 {
7087         struct mgmt_pending_cmd *cmd;
7088
7089         cmd = pending_find(opcode, hdev);
7090         if (!cmd)
7091                 return -ENOENT;
7092
7093         cmd->cmd_complete(cmd, mgmt_status(status));
7094         mgmt_pending_remove(cmd);
7095
7096         return 0;
7097 }
7098
7099 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7100                                      u8 link_type, u8 addr_type, u8 status)
7101 {
7102         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7103                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7104 }
7105
7106 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7107                                          u8 link_type, u8 addr_type, u8 status)
7108 {
7109         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7110                                           status,
7111                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7112 }
7113
7114 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7115                                      u8 link_type, u8 addr_type, u8 status)
7116 {
7117         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7118                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7119 }
7120
7121 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7122                                          u8 link_type, u8 addr_type, u8 status)
7123 {
7124         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7125                                           status,
7126                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7127 }
7128
7129 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7130                              u8 link_type, u8 addr_type, u32 passkey,
7131                              u8 entered)
7132 {
7133         struct mgmt_ev_passkey_notify ev;
7134
7135         BT_DBG("%s", hdev->name);
7136
7137         bacpy(&ev.addr.bdaddr, bdaddr);
7138         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7139         ev.passkey = __cpu_to_le32(passkey);
7140         ev.entered = entered;
7141
7142         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7143 }
7144
7145 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7146 {
7147         struct mgmt_ev_auth_failed ev;
7148         struct mgmt_pending_cmd *cmd;
7149         u8 status = mgmt_status(hci_status);
7150
7151         bacpy(&ev.addr.bdaddr, &conn->dst);
7152         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7153         ev.status = status;
7154
7155         cmd = find_pairing(conn);
7156
7157         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7158                     cmd ? cmd->sk : NULL);
7159
7160         if (cmd) {
7161                 cmd->cmd_complete(cmd, status);
7162                 mgmt_pending_remove(cmd);
7163         }
7164 }
7165
7166 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7167 {
7168         struct cmd_lookup match = { NULL, hdev };
7169         bool changed;
7170
7171         if (status) {
7172                 u8 mgmt_err = mgmt_status(status);
7173                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7174                                      cmd_status_rsp, &mgmt_err);
7175                 return;
7176         }
7177
7178         if (test_bit(HCI_AUTH, &hdev->flags))
7179                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7180         else
7181                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7182
7183         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7184                              &match);
7185
7186         if (changed)
7187                 new_settings(hdev, match.sk);
7188
7189         if (match.sk)
7190                 sock_put(match.sk);
7191 }
7192
7193 static void clear_eir(struct hci_request *req)
7194 {
7195         struct hci_dev *hdev = req->hdev;
7196         struct hci_cp_write_eir cp;
7197
7198         if (!lmp_ext_inq_capable(hdev))
7199                 return;
7200
7201         memset(hdev->eir, 0, sizeof(hdev->eir));
7202
7203         memset(&cp, 0, sizeof(cp));
7204
7205         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7206 }
7207
7208 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7209 {
7210         struct cmd_lookup match = { NULL, hdev };
7211         struct hci_request req;
7212         bool changed = false;
7213
7214         if (status) {
7215                 u8 mgmt_err = mgmt_status(status);
7216
7217                 if (enable && hci_dev_test_and_clear_flag(hdev,
7218                                                           HCI_SSP_ENABLED)) {
7219                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7220                         new_settings(hdev, NULL);
7221                 }
7222
7223                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7224                                      &mgmt_err);
7225                 return;
7226         }
7227
7228         if (enable) {
7229                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7230         } else {
7231                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7232                 if (!changed)
7233                         changed = hci_dev_test_and_clear_flag(hdev,
7234                                                               HCI_HS_ENABLED);
7235                 else
7236                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7237         }
7238
7239         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7240
7241         if (changed)
7242                 new_settings(hdev, match.sk);
7243
7244         if (match.sk)
7245                 sock_put(match.sk);
7246
7247         hci_req_init(&req, hdev);
7248
7249         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7250                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7251                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7252                                     sizeof(enable), &enable);
7253                 __hci_req_update_eir(&req);
7254         } else {
7255                 clear_eir(&req);
7256         }
7257
7258         hci_req_run(&req, NULL);
7259 }
7260
7261 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7262 {
7263         struct cmd_lookup *match = data;
7264
7265         if (match->sk == NULL) {
7266                 match->sk = cmd->sk;
7267                 sock_hold(match->sk);
7268         }
7269 }
7270
7271 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7272                                     u8 status)
7273 {
7274         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7275
7276         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7277         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7278         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7279
7280         if (!status) {
7281                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7282                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7283                 ext_info_changed(hdev, NULL);
7284         }
7285
7286         if (match.sk)
7287                 sock_put(match.sk);
7288 }
7289
7290 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7291 {
7292         struct mgmt_cp_set_local_name ev;
7293         struct mgmt_pending_cmd *cmd;
7294
7295         if (status)
7296                 return;
7297
7298         memset(&ev, 0, sizeof(ev));
7299         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7300         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7301
7302         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7303         if (!cmd) {
7304                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7305
7306                 /* If this is a HCI command related to powering on the
7307                  * HCI dev don't send any mgmt signals.
7308                  */
7309                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7310                         return;
7311         }
7312
7313         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7314                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7315         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7316 }
7317
7318 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7319 {
7320         int i;
7321
7322         for (i = 0; i < uuid_count; i++) {
7323                 if (!memcmp(uuid, uuids[i], 16))
7324                         return true;
7325         }
7326
7327         return false;
7328 }
7329
7330 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7331 {
7332         u16 parsed = 0;
7333
7334         while (parsed < eir_len) {
7335                 u8 field_len = eir[0];
7336                 u8 uuid[16];
7337                 int i;
7338
7339                 if (field_len == 0)
7340                         break;
7341
7342                 if (eir_len - parsed < field_len + 1)
7343                         break;
7344
7345                 switch (eir[1]) {
7346                 case EIR_UUID16_ALL:
7347                 case EIR_UUID16_SOME:
7348                         for (i = 0; i + 3 <= field_len; i += 2) {
7349                                 memcpy(uuid, bluetooth_base_uuid, 16);
7350                                 uuid[13] = eir[i + 3];
7351                                 uuid[12] = eir[i + 2];
7352                                 if (has_uuid(uuid, uuid_count, uuids))
7353                                         return true;
7354                         }
7355                         break;
7356                 case EIR_UUID32_ALL:
7357                 case EIR_UUID32_SOME:
7358                         for (i = 0; i + 5 <= field_len; i += 4) {
7359                                 memcpy(uuid, bluetooth_base_uuid, 16);
7360                                 uuid[15] = eir[i + 5];
7361                                 uuid[14] = eir[i + 4];
7362                                 uuid[13] = eir[i + 3];
7363                                 uuid[12] = eir[i + 2];
7364                                 if (has_uuid(uuid, uuid_count, uuids))
7365                                         return true;
7366                         }
7367                         break;
7368                 case EIR_UUID128_ALL:
7369                 case EIR_UUID128_SOME:
7370                         for (i = 0; i + 17 <= field_len; i += 16) {
7371                                 memcpy(uuid, eir + i + 2, 16);
7372                                 if (has_uuid(uuid, uuid_count, uuids))
7373                                         return true;
7374                         }
7375                         break;
7376                 }
7377
7378                 parsed += field_len + 1;
7379                 eir += field_len + 1;
7380         }
7381
7382         return false;
7383 }
7384
7385 static void restart_le_scan(struct hci_dev *hdev)
7386 {
7387         /* If controller is not scanning we are done. */
7388         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7389                 return;
7390
7391         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7392                        hdev->discovery.scan_start +
7393                        hdev->discovery.scan_duration))
7394                 return;
7395
7396         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7397                            DISCOV_LE_RESTART_DELAY);
7398 }
7399
7400 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7401                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7402 {
7403         /* If a RSSI threshold has been specified, and
7404          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7405          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7406          * is set, let it through for further processing, as we might need to
7407          * restart the scan.
7408          *
7409          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7410          * the results are also dropped.
7411          */
7412         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7413             (rssi == HCI_RSSI_INVALID ||
7414             (rssi < hdev->discovery.rssi &&
7415              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7416                 return  false;
7417
7418         if (hdev->discovery.uuid_count != 0) {
7419                 /* If a list of UUIDs is provided in filter, results with no
7420                  * matching UUID should be dropped.
7421                  */
7422                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7423                                    hdev->discovery.uuids) &&
7424                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7425                                    hdev->discovery.uuid_count,
7426                                    hdev->discovery.uuids))
7427                         return false;
7428         }
7429
7430         /* If duplicate filtering does not report RSSI changes, then restart
7431          * scanning to ensure updated result with updated RSSI values.
7432          */
7433         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7434                 restart_le_scan(hdev);
7435
7436                 /* Validate RSSI value against the RSSI threshold once more. */
7437                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7438                     rssi < hdev->discovery.rssi)
7439                         return false;
7440         }
7441
7442         return true;
7443 }
7444
7445 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7446                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7447                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7448 {
7449         char buf[512];
7450         struct mgmt_ev_device_found *ev = (void *)buf;
7451         size_t ev_size;
7452
7453         /* Don't send events for a non-kernel initiated discovery. With
7454          * LE one exception is if we have pend_le_reports > 0 in which
7455          * case we're doing passive scanning and want these events.
7456          */
7457         if (!hci_discovery_active(hdev)) {
7458                 if (link_type == ACL_LINK)
7459                         return;
7460                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7461                         return;
7462         }
7463
7464         if (hdev->discovery.result_filtering) {
7465                 /* We are using service discovery */
7466                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7467                                      scan_rsp_len))
7468                         return;
7469         }
7470
7471         if (hdev->discovery.limited) {
7472                 /* Check for limited discoverable bit */
7473                 if (dev_class) {
7474                         if (!(dev_class[1] & 0x20))
7475                                 return;
7476                 } else {
7477                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7478                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7479                                 return;
7480                 }
7481         }
7482
7483         /* Make sure that the buffer is big enough. The 5 extra bytes
7484          * are for the potential CoD field.
7485          */
7486         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7487                 return;
7488
7489         memset(buf, 0, sizeof(buf));
7490
7491         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7492          * RSSI value was reported as 0 when not available. This behavior
7493          * is kept when using device discovery. This is required for full
7494          * backwards compatibility with the API.
7495          *
7496          * However when using service discovery, the value 127 will be
7497          * returned when the RSSI is not available.
7498          */
7499         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7500             link_type == ACL_LINK)
7501                 rssi = 0;
7502
7503         bacpy(&ev->addr.bdaddr, bdaddr);
7504         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7505         ev->rssi = rssi;
7506         ev->flags = cpu_to_le32(flags);
7507
7508         if (eir_len > 0)
7509                 /* Copy EIR or advertising data into event */
7510                 memcpy(ev->eir, eir, eir_len);
7511
7512         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7513                                        NULL))
7514                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7515                                           dev_class, 3);
7516
7517         if (scan_rsp_len > 0)
7518                 /* Append scan response data to event */
7519                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7520
7521         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7522         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7523
7524         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7525 }
7526
7527 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7528                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7529 {
7530         struct mgmt_ev_device_found *ev;
7531         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7532         u16 eir_len;
7533
7534         ev = (struct mgmt_ev_device_found *) buf;
7535
7536         memset(buf, 0, sizeof(buf));
7537
7538         bacpy(&ev->addr.bdaddr, bdaddr);
7539         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7540         ev->rssi = rssi;
7541
7542         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7543                                   name_len);
7544
7545         ev->eir_len = cpu_to_le16(eir_len);
7546
7547         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7548 }
7549
7550 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7551 {
7552         struct mgmt_ev_discovering ev;
7553
7554         BT_DBG("%s discovering %u", hdev->name, discovering);
7555
7556         memset(&ev, 0, sizeof(ev));
7557         ev.type = hdev->discovery.type;
7558         ev.discovering = discovering;
7559
7560         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7561 }
7562
7563 static struct hci_mgmt_chan chan = {
7564         .channel        = HCI_CHANNEL_CONTROL,
7565         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7566         .handlers       = mgmt_handlers,
7567         .hdev_init      = mgmt_init_hdev,
7568 };
7569
7570 int mgmt_init(void)
7571 {
7572         return hci_mgmt_chan_register(&chan);
7573 }
7574
7575 void mgmt_exit(void)
7576 {
7577         hci_mgmt_chan_unregister(&chan);
7578 }