net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = cpu_to_le16(MGMT_REVISION);
 280
 281         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 282                                  &rp, sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         u16 num_commands, num_events;
 290         size_t rp_size;
 291         int i, err;
 292
 293         BT_DBG("sock %p", sk);
 294
 295         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 296                 num_commands = ARRAY_SIZE(mgmt_commands);
 297                 num_events = ARRAY_SIZE(mgmt_events);
 298         } else {
 299                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 300                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 301         }
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 313                 __le16 *opcode = rp->opcodes;
 314
 315                 for (i = 0; i < num_commands; i++, opcode++)
 316                         put_unaligned_le16(mgmt_commands[i], opcode);
 317
 318                 for (i = 0; i < num_events; i++, opcode++)
 319                         put_unaligned_le16(mgmt_events[i], opcode);
 320         } else {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 328         }
 329
 330         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 331                                 rp, rp_size);
 332         kfree(rp);
 333
 334         return err;
 335 }
 336
 337 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 338                            u16 data_len)
 339 {
 340         struct mgmt_rp_read_index_list *rp;
 341         struct hci_dev *d;
 342         size_t rp_len;
 343         u16 count;
 344         int err;
 345
 346         BT_DBG("sock %p", sk);
 347
 348         read_lock(&hci_dev_list_lock);
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (d->dev_type == HCI_BREDR &&
 353                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 354                         count++;
 355         }
 356
 357         rp_len = sizeof(*rp) + (2 * count);
 358         rp = kmalloc(rp_len, GFP_ATOMIC);
 359         if (!rp) {
 360                 read_unlock(&hci_dev_list_lock);
 361                 return -ENOMEM;
 362         }
 363
 364         count = 0;
 365         list_for_each_entry(d, &hci_dev_list, list) {
 366                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 367                     hci_dev_test_flag(d, HCI_CONFIG) ||
 368                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 369                         continue;
 370
 371                 /* Devices marked as raw-only are neither configured
 372                  * nor unconfigured controllers.
 373                  */
 374                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 375                         continue;
 376
 377                 if (d->dev_type == HCI_BREDR &&
 378                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 379                         rp->index[count++] = cpu_to_le16(d->id);
 380                         BT_DBG("Added hci%u", d->id);
 381                 }
 382         }
 383
 384         rp->num_controllers = cpu_to_le16(count);
 385         rp_len = sizeof(*rp) + (2 * count);
 386
 387         read_unlock(&hci_dev_list_lock);
 388
 389         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 390                                 0, rp, rp_len);
 391
 392         kfree(rp);
 393
 394         return err;
 395 }
 396
 397 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 398                                   void *data, u16 data_len)
 399 {
 400         struct mgmt_rp_read_unconf_index_list *rp;
 401         struct hci_dev *d;
 402         size_t rp_len;
 403         u16 count;
 404         int err;
 405
 406         BT_DBG("sock %p", sk);
 407
 408         read_lock(&hci_dev_list_lock);
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (d->dev_type == HCI_BREDR &&
 413                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 414                         count++;
 415         }
 416
 417         rp_len = sizeof(*rp) + (2 * count);
 418         rp = kmalloc(rp_len, GFP_ATOMIC);
 419         if (!rp) {
 420                 read_unlock(&hci_dev_list_lock);
 421                 return -ENOMEM;
 422         }
 423
 424         count = 0;
 425         list_for_each_entry(d, &hci_dev_list, list) {
 426                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 427                     hci_dev_test_flag(d, HCI_CONFIG) ||
 428                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 429                         continue;
 430
 431                 /* Devices marked as raw-only are neither configured
 432                  * nor unconfigured controllers.
 433                  */
 434                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 435                         continue;
 436
 437                 if (d->dev_type == HCI_BREDR &&
 438                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 439                         rp->index[count++] = cpu_to_le16(d->id);
 440                         BT_DBG("Added hci%u", d->id);
 441                 }
 442         }
 443
 444         rp->num_controllers = cpu_to_le16(count);
 445         rp_len = sizeof(*rp) + (2 * count);
 446
 447         read_unlock(&hci_dev_list_lock);
 448
 449         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 450                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 451
 452         kfree(rp);
 453
 454         return err;
 455 }
 456
 457 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 458                                void *data, u16 data_len)
 459 {
 460         struct mgmt_rp_read_ext_index_list *rp;
 461         struct hci_dev *d;
 462         size_t rp_len;
 463         u16 count;
 464         int err;
 465
 466         BT_DBG("sock %p", sk);
 467
 468         read_lock(&hci_dev_list_lock);
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 473                         count++;
 474         }
 475
 476         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 477         rp = kmalloc(rp_len, GFP_ATOMIC);
 478         if (!rp) {
 479                 read_unlock(&hci_dev_list_lock);
 480                 return -ENOMEM;
 481         }
 482
 483         count = 0;
 484         list_for_each_entry(d, &hci_dev_list, list) {
 485                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 486                     hci_dev_test_flag(d, HCI_CONFIG) ||
 487                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 488                         continue;
 489
 490                 /* Devices marked as raw-only are neither configured
 491                  * nor unconfigured controllers.
 492                  */
 493                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 494                         continue;
 495
 496                 if (d->dev_type == HCI_BREDR) {
 497                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 498                                 rp->entry[count].type = 0x01;
 499                         else
 500                                 rp->entry[count].type = 0x00;
 501                 } else if (d->dev_type == HCI_AMP) {
 502                         rp->entry[count].type = 0x02;
 503                 } else {
 504                         continue;
 505                 }
 506
 507                 rp->entry[count].bus = d->bus;
 508                 rp->entry[count++].index = cpu_to_le16(d->id);
 509                 BT_DBG("Added hci%u", d->id);
 510         }
 511
 512         rp->num_controllers = cpu_to_le16(count);
 513         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 514
 515         read_unlock(&hci_dev_list_lock);
 516
 517         /* If this command is called at least once, then all the
 518          * default index and unconfigured index events are disabled
 519          * and from now on only extended index events are used.
 520          */
 521         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 522         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 523         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 524
 525         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 526                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 527
 528         kfree(rp);
 529
 530         return err;
 531 }
 532
 533 static bool is_configured(struct hci_dev *hdev)
 534 {
 535         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 536             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 537                 return false;
 538
 539         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 540             !bacmp(&hdev->public_addr, BDADDR_ANY))
 541                 return false;
 542
 543         return true;
 544 }
 545
 546 static __le32 get_missing_options(struct hci_dev *hdev)
 547 {
 548         u32 options = 0;
 549
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 557
 558         return cpu_to_le32(options);
 559 }
 560
 561 static int new_options(struct hci_dev *hdev, struct sock *skip)
 562 {
 563         __le32 options = get_missing_options(hdev);
 564
 565         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 566                                   sizeof(options), skip);
 567 }
 568
 569 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 574                                  sizeof(options));
 575 }
 576
 577 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 578                             void *data, u16 data_len)
 579 {
 580         struct mgmt_rp_read_config_info rp;
 581         u32 options = 0;
 582
 583         BT_DBG("sock %p %s", sk, hdev->name);
 584
 585         hci_dev_lock(hdev);
 586
 587         memset(&rp, 0, sizeof(rp));
 588         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 589
 590         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 591                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 592
 593         if (hdev->set_bdaddr)
 594                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 595
 596         rp.supported_options = cpu_to_le32(options);
 597         rp.missing_options = get_missing_options(hdev);
 598
 599         hci_dev_unlock(hdev);
 600
 601         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 602                                  &rp, sizeof(rp));
 603 }
 604
 605 static u32 get_supported_settings(struct hci_dev *hdev)
 606 {
 607         u32 settings = 0;
 608
 609         settings |= MGMT_SETTING_POWERED;
 610         settings |= MGMT_SETTING_BONDABLE;
 611         settings |= MGMT_SETTING_DEBUG_KEYS;
 612         settings |= MGMT_SETTING_CONNECTABLE;
 613         settings |= MGMT_SETTING_DISCOVERABLE;
 614
 615         if (lmp_bredr_capable(hdev)) {
 616                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 617                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 618                 settings |= MGMT_SETTING_BREDR;
 619                 settings |= MGMT_SETTING_LINK_SECURITY;
 620
 621                 if (lmp_ssp_capable(hdev)) {
 622                         settings |= MGMT_SETTING_SSP;
 623                         settings |= MGMT_SETTING_HS;
 624                 }
 625
 626                 if (lmp_sc_capable(hdev))
 627                         settings |= MGMT_SETTING_SECURE_CONN;
 628         }
 629
 630         if (lmp_le_capable(hdev)) {
 631                 settings |= MGMT_SETTING_LE;
 632                 settings |= MGMT_SETTING_ADVERTISING;
 633                 settings |= MGMT_SETTING_SECURE_CONN;
 634                 settings |= MGMT_SETTING_PRIVACY;
 635                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 636         }
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 639             hdev->set_bdaddr)
 640                 settings |= MGMT_SETTING_CONFIGURATION;
 641
 642         return settings;
 643 }
 644
 645 static u32 get_current_settings(struct hci_dev *hdev)
 646 {
 647         u32 settings = 0;
 648
 649         if (hdev_is_powered(hdev))
 650                 settings |= MGMT_SETTING_POWERED;
 651
 652         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 653                 settings |= MGMT_SETTING_CONNECTABLE;
 654
 655         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 656                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 657
 658         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 659                 settings |= MGMT_SETTING_DISCOVERABLE;
 660
 661         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 662                 settings |= MGMT_SETTING_BONDABLE;
 663
 664         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 665                 settings |= MGMT_SETTING_BREDR;
 666
 667         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 668                 settings |= MGMT_SETTING_LE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 671                 settings |= MGMT_SETTING_LINK_SECURITY;
 672
 673         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 674                 settings |= MGMT_SETTING_SSP;
 675
 676         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 677                 settings |= MGMT_SETTING_HS;
 678
 679         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 680                 settings |= MGMT_SETTING_ADVERTISING;
 681
 682         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 683                 settings |= MGMT_SETTING_SECURE_CONN;
 684
 685         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 686                 settings |= MGMT_SETTING_DEBUG_KEYS;
 687
 688         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 689                 settings |= MGMT_SETTING_PRIVACY;
 690
 691         /* The current setting for static address has two purposes. The
 692          * first is to indicate if the static address will be used and
 693          * the second is to indicate if it is actually set.
 694          *
 695          * This means if the static address is not configured, this flag
 696          * will never be set. If the address is configured, then if the
 697          * address is actually used decides if the flag is set or not.
 698          *
 699          * For single mode LE only controllers and dual-mode controllers
 700          * with BR/EDR disabled, the existence of the static address will
 701          * be evaluated.
 702          */
 703         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 704             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 705             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 706                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 707                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 708         }
 709
 710         return settings;
 711 }
 712
 713 #define PNP_INFO_SVCLASS_ID             0x1200
 714
 715 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 716 {
 717         u8 *ptr = data, *uuids_start = NULL;
 718         struct bt_uuid *uuid;
 719
 720         if (len < 4)
 721                 return ptr;
 722
 723         list_for_each_entry(uuid, &hdev->uuids, list) {
 724                 u16 uuid16;
 725
 726                 if (uuid->size != 16)
 727                         continue;
 728
 729                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 730                 if (uuid16 < 0x1100)
 731                         continue;
 732
 733                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 734                         continue;
 735
 736                 if (!uuids_start) {
 737                         uuids_start = ptr;
 738                         uuids_start[0] = 1;
 739                         uuids_start[1] = EIR_UUID16_ALL;
 740                         ptr += 2;
 741                 }
 742
 743                 /* Stop if not enough space to put next UUID */
 744                 if ((ptr - data) + sizeof(u16) > len) {
 745                         uuids_start[1] = EIR_UUID16_SOME;
 746                         break;
 747                 }
 748
 749                 *ptr++ = (uuid16 & 0x00ff);
 750                 *ptr++ = (uuid16 & 0xff00) >> 8;
 751                 uuids_start[0] += sizeof(uuid16);
 752         }
 753
 754         return ptr;
 755 }
 756
 757 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 758 {
 759         u8 *ptr = data, *uuids_start = NULL;
 760         struct bt_uuid *uuid;
 761
 762         if (len < 6)
 763                 return ptr;
 764
 765         list_for_each_entry(uuid, &hdev->uuids, list) {
 766                 if (uuid->size != 32)
 767                         continue;
 768
 769                 if (!uuids_start) {
 770                         uuids_start = ptr;
 771                         uuids_start[0] = 1;
 772                         uuids_start[1] = EIR_UUID32_ALL;
 773                         ptr += 2;
 774                 }
 775
 776                 /* Stop if not enough space to put next UUID */
 777                 if ((ptr - data) + sizeof(u32) > len) {
 778                         uuids_start[1] = EIR_UUID32_SOME;
 779                         break;
 780                 }
 781
 782                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 783                 ptr += sizeof(u32);
 784                 uuids_start[0] += sizeof(u32);
 785         }
 786
 787         return ptr;
 788 }
 789
 790 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 791 {
 792         u8 *ptr = data, *uuids_start = NULL;
 793         struct bt_uuid *uuid;
 794
 795         if (len < 18)
 796                 return ptr;
 797
 798         list_for_each_entry(uuid, &hdev->uuids, list) {
 799                 if (uuid->size != 128)
 800                         continue;
 801
 802                 if (!uuids_start) {
 803                         uuids_start = ptr;
 804                         uuids_start[0] = 1;
 805                         uuids_start[1] = EIR_UUID128_ALL;
 806                         ptr += 2;
 807                 }
 808
 809                 /* Stop if not enough space to put next UUID */
 810                 if ((ptr - data) + 16 > len) {
 811                         uuids_start[1] = EIR_UUID128_SOME;
 812                         break;
 813                 }
 814
 815                 memcpy(ptr, uuid->uuid, 16);
 816                 ptr += 16;
 817                 uuids_start[0] += 16;
 818         }
 819
 820         return ptr;
 821 }
 822
 823 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 824 {
 825         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 826 }
 827
 828 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 829                                                   struct hci_dev *hdev,
 830                                                   const void *data)
 831 {
 832         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 833 }
 834
 835 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 836 {
 837         u8 ad_len = 0;
 838         size_t name_len;
 839
 840         name_len = strlen(hdev->dev_name);
 841         if (name_len > 0) {
 842                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 843
 844                 if (name_len > max_len) {
 845                         name_len = max_len;
 846                         ptr[1] = EIR_NAME_SHORT;
 847                 } else
 848                         ptr[1] = EIR_NAME_COMPLETE;
 849
 850                 ptr[0] = name_len + 1;
 851
 852                 memcpy(ptr + 2, hdev->dev_name, name_len);
 853
 854                 ad_len += (name_len + 2);
 855                 ptr += (name_len + 2);
 856         }
 857
 858         return ad_len;
 859 }
 860
 861 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 862 {
 863         /* TODO: Set the appropriate entries based on advertising instance flags
 864          * here once flags other than 0 are supported.
 865          */
 866         memcpy(ptr, hdev->adv_instance.scan_rsp_data,
 867                hdev->adv_instance.scan_rsp_len);
 868
 869         return hdev->adv_instance.scan_rsp_len;
 870 }
 871
 872 static void update_scan_rsp_data_for_instance(struct hci_request *req,
 873                                               u8 instance)
 874 {
 875         struct hci_dev *hdev = req->hdev;
 876         struct hci_cp_le_set_scan_rsp_data cp;
 877         u8 len;
 878
 879         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 return;
 881
 882         memset(&cp, 0, sizeof(cp));
 883
 884         if (instance)
 885                 len = create_instance_scan_rsp_data(hdev, cp.data);
 886         else
 887                 len = create_default_scan_rsp_data(hdev, cp.data);
 888
 889         if (hdev->scan_rsp_data_len == len &&
 890             !memcmp(cp.data, hdev->scan_rsp_data, len))
 891                 return;
 892
 893         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 894         hdev->scan_rsp_data_len = len;
 895
 896         cp.length = len;
 897
 898         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 899 }
 900
 901 static void update_scan_rsp_data(struct hci_request *req)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         u8 instance;
 905
 906         /* The "Set Advertising" setting supersedes the "Add Advertising"
 907          * setting. Here we set the scan response data based on which
 908          * setting was set. When neither apply, default to the global settings,
 909          * represented by instance "0".
 910          */
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 912             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 913                 instance = 0x01;
 914         else
 915                 instance = 0x00;
 916
 917         update_scan_rsp_data_for_instance(req, instance);
 918 }
 919
 920 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 921 {
 922         struct mgmt_pending_cmd *cmd;
 923
 924         /* If there's a pending mgmt command the flags will not yet have
 925          * their final values, so check for this first.
 926          */
 927         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 928         if (cmd) {
 929                 struct mgmt_mode *cp = cmd->param;
 930                 if (cp->val == 0x01)
 931                         return LE_AD_GENERAL;
 932                 else if (cp->val == 0x02)
 933                         return LE_AD_LIMITED;
 934         } else {
 935                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 936                         return LE_AD_LIMITED;
 937                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 938                         return LE_AD_GENERAL;
 939         }
 940
 941         return 0;
 942 }
 943
 944 static u8 create_default_adv_data(struct hci_dev *hdev, u8 *ptr)
 945 {
 946         u8 ad_len = 0, flags = 0;
 947
 948         flags |= get_adv_discov_flags(hdev);
 949
 950         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 951                 flags |= LE_AD_NO_BREDR;
 952
 953         if (flags) {
 954                 BT_DBG("adv flags 0x%02x", flags);
 955
 956                 ptr[0] = 2;
 957                 ptr[1] = EIR_FLAGS;
 958                 ptr[2] = flags;
 959
 960                 ad_len += 3;
 961                 ptr += 3;
 962         }
 963
 964         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 965                 ptr[0] = 2;
 966                 ptr[1] = EIR_TX_POWER;
 967                 ptr[2] = (u8) hdev->adv_tx_power;
 968
 969                 ad_len += 3;
 970                 ptr += 3;
 971         }
 972
 973         return ad_len;
 974 }
 975
 976 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 *ptr)
 977 {
 978         /* TODO: Set the appropriate entries based on advertising instance flags
 979          * here once flags other than 0 are supported.
 980          */
 981         memcpy(ptr, hdev->adv_instance.adv_data,
 982                hdev->adv_instance.adv_data_len);
 983
 984         return hdev->adv_instance.adv_data_len;
 985 }
 986
 987 static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
 988 {
 989         struct hci_dev *hdev = req->hdev;
 990         struct hci_cp_le_set_adv_data cp;
 991         u8 len;
 992
 993         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 994                 return;
 995
 996         memset(&cp, 0, sizeof(cp));
 997
 998         if (instance)
 999                 len = create_instance_adv_data(hdev, cp.data);
1000         else
1001                 len = create_default_adv_data(hdev, cp.data);
1002
1003         /* There's nothing to do if the data hasn't changed */
1004         if (hdev->adv_data_len == len &&
1005             memcmp(cp.data, hdev->adv_data, len) == 0)
1006                 return;
1007
1008         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1009         hdev->adv_data_len = len;
1010
1011         cp.length = len;
1012
1013         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1014 }
1015
1016 static void update_adv_data(struct hci_request *req)
1017 {
1018         struct hci_dev *hdev = req->hdev;
1019         u8 instance;
1020
1021         /* The "Set Advertising" setting supersedes the "Add Advertising"
1022          * setting. Here we set the advertising data based on which
1023          * setting was set. When neither apply, default to the global settings,
1024          * represented by instance "0".
1025          */
1026         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
1027             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
1028                 instance = 0x01;
1029         else
1030                 instance = 0x00;
1031
1032         update_adv_data_for_instance(req, instance);
1033 }
1034
1035 int mgmt_update_adv_data(struct hci_dev *hdev)
1036 {
1037         struct hci_request req;
1038
1039         hci_req_init(&req, hdev);
1040         update_adv_data(&req);
1041
1042         return hci_req_run(&req, NULL);
1043 }
1044
1045 static void create_eir(struct hci_dev *hdev, u8 *data)
1046 {
1047         u8 *ptr = data;
1048         size_t name_len;
1049
1050         name_len = strlen(hdev->dev_name);
1051
1052         if (name_len > 0) {
1053                 /* EIR Data type */
1054                 if (name_len > 48) {
1055                         name_len = 48;
1056                         ptr[1] = EIR_NAME_SHORT;
1057                 } else
1058                         ptr[1] = EIR_NAME_COMPLETE;
1059
1060                 /* EIR Data length */
1061                 ptr[0] = name_len + 1;
1062
1063                 memcpy(ptr + 2, hdev->dev_name, name_len);
1064
1065                 ptr += (name_len + 2);
1066         }
1067
1068         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1069                 ptr[0] = 2;
1070                 ptr[1] = EIR_TX_POWER;
1071                 ptr[2] = (u8) hdev->inq_tx_power;
1072
1073                 ptr += 3;
1074         }
1075
1076         if (hdev->devid_source > 0) {
1077                 ptr[0] = 9;
1078                 ptr[1] = EIR_DEVICE_ID;
1079
1080                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1081                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1082                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1083                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1084
1085                 ptr += 10;
1086         }
1087
1088         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1089         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1090         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1091 }
1092
1093 static void update_eir(struct hci_request *req)
1094 {
1095         struct hci_dev *hdev = req->hdev;
1096         struct hci_cp_write_eir cp;
1097
1098         if (!hdev_is_powered(hdev))
1099                 return;
1100
1101         if (!lmp_ext_inq_capable(hdev))
1102                 return;
1103
1104         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1105                 return;
1106
1107         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1108                 return;
1109
1110         memset(&cp, 0, sizeof(cp));
1111
1112         create_eir(hdev, cp.data);
1113
1114         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1115                 return;
1116
1117         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1118
1119         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1120 }
1121
1122 static u8 get_service_classes(struct hci_dev *hdev)
1123 {
1124         struct bt_uuid *uuid;
1125         u8 val = 0;
1126
1127         list_for_each_entry(uuid, &hdev->uuids, list)
1128                 val |= uuid->svc_hint;
1129
1130         return val;
1131 }
1132
1133 static void update_class(struct hci_request *req)
1134 {
1135         struct hci_dev *hdev = req->hdev;
1136         u8 cod[3];
1137
1138         BT_DBG("%s", hdev->name);
1139
1140         if (!hdev_is_powered(hdev))
1141                 return;
1142
1143         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1144                 return;
1145
1146         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1147                 return;
1148
1149         cod[0] = hdev->minor_class;
1150         cod[1] = hdev->major_class;
1151         cod[2] = get_service_classes(hdev);
1152
1153         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1154                 cod[1] |= 0x20;
1155
1156         if (memcmp(cod, hdev->dev_class, 3) == 0)
1157                 return;
1158
1159         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1160 }
1161
1162 static bool get_connectable(struct hci_dev *hdev)
1163 {
1164         struct mgmt_pending_cmd *cmd;
1165
1166         /* If there's a pending mgmt command the flag will not yet have
1167          * it's final value, so check for this first.
1168          */
1169         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1170         if (cmd) {
1171                 struct mgmt_mode *cp = cmd->param;
1172                 return cp->val;
1173         }
1174
1175         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1176 }
1177
1178 static void disable_advertising(struct hci_request *req)
1179 {
1180         u8 enable = 0x00;
1181
1182         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1183 }
1184
1185 static void enable_advertising(struct hci_request *req)
1186 {
1187         struct hci_dev *hdev = req->hdev;
1188         struct hci_cp_le_set_adv_param cp;
1189         u8 own_addr_type, enable = 0x01;
1190         bool connectable;
1191
1192         if (hci_conn_num(hdev, LE_LINK) > 0)
1193                 return;
1194
1195         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1196                 disable_advertising(req);
1197
1198         /* Clear the HCI_LE_ADV bit temporarily so that the
1199          * hci_update_random_address knows that it's safe to go ahead
1200          * and write a new random address. The flag will be set back on
1201          * as soon as the SET_ADV_ENABLE HCI command completes.
1202          */
1203         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1204
1205         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1206                 connectable = true;
1207         else
1208                 connectable = get_connectable(hdev);
1209
1210         /* Set require_privacy to true only when non-connectable
1211          * advertising is used. In that case it is fine to use a
1212          * non-resolvable private address.
1213          */
1214         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1215                 return;
1216
1217         memset(&cp, 0, sizeof(cp));
1218         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1219         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1220         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1221         cp.own_address_type = own_addr_type;
1222         cp.channel_map = hdev->le_adv_channel_map;
1223
1224         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1225
1226         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1227 }
1228
1229 static void service_cache_off(struct work_struct *work)
1230 {
1231         struct hci_dev *hdev = container_of(work, struct hci_dev,
1232                                             service_cache.work);
1233         struct hci_request req;
1234
1235         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1236                 return;
1237
1238         hci_req_init(&req, hdev);
1239
1240         hci_dev_lock(hdev);
1241
1242         update_eir(&req);
1243         update_class(&req);
1244
1245         hci_dev_unlock(hdev);
1246
1247         hci_req_run(&req, NULL);
1248 }
1249
1250 static void rpa_expired(struct work_struct *work)
1251 {
1252         struct hci_dev *hdev = container_of(work, struct hci_dev,
1253                                             rpa_expired.work);
1254         struct hci_request req;
1255
1256         BT_DBG("");
1257
1258         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1259
1260         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1261                 return;
1262
1263         /* The generation of a new RPA and programming it into the
1264          * controller happens in the enable_advertising() function.
1265          */
1266         hci_req_init(&req, hdev);
1267         enable_advertising(&req);
1268         hci_req_run(&req, NULL);
1269 }
1270
1271 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1272 {
1273         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1274                 return;
1275
1276         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1277         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1278
1279         /* Non-mgmt controlled devices get this bit set
1280          * implicitly so that pairing works for them, however
1281          * for mgmt we require user-space to explicitly enable
1282          * it
1283          */
1284         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1285 }
1286
1287 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1288                                 void *data, u16 data_len)
1289 {
1290         struct mgmt_rp_read_info rp;
1291
1292         BT_DBG("sock %p %s", sk, hdev->name);
1293
1294         hci_dev_lock(hdev);
1295
1296         memset(&rp, 0, sizeof(rp));
1297
1298         bacpy(&rp.bdaddr, &hdev->bdaddr);
1299
1300         rp.version = hdev->hci_ver;
1301         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1302
1303         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1304         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1305
1306         memcpy(rp.dev_class, hdev->dev_class, 3);
1307
1308         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1309         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1310
1311         hci_dev_unlock(hdev);
1312
1313         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1314                                  sizeof(rp));
1315 }
1316
1317 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1318 {
1319         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1320
1321         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1322                                  sizeof(settings));
1323 }
1324
1325 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1326 {
1327         BT_DBG("%s status 0x%02x", hdev->name, status);
1328
1329         if (hci_conn_count(hdev) == 0) {
1330                 cancel_delayed_work(&hdev->power_off);
1331                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1332         }
1333 }
1334
1335 static bool hci_stop_discovery(struct hci_request *req)
1336 {
1337         struct hci_dev *hdev = req->hdev;
1338         struct hci_cp_remote_name_req_cancel cp;
1339         struct inquiry_entry *e;
1340
1341         switch (hdev->discovery.state) {
1342         case DISCOVERY_FINDING:
1343                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1344                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1345
1346                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1347                         cancel_delayed_work(&hdev->le_scan_disable);
1348                         hci_req_add_le_scan_disable(req);
1349                 }
1350
1351                 return true;
1352
1353         case DISCOVERY_RESOLVING:
1354                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1355                                                      NAME_PENDING);
1356                 if (!e)
1357                         break;
1358
1359                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1360                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1361                             &cp);
1362
1363                 return true;
1364
1365         default:
1366                 /* Passive scanning */
1367                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1368                         hci_req_add_le_scan_disable(req);
1369                         return true;
1370                 }
1371
1372                 break;
1373         }
1374
1375         return false;
1376 }
1377
1378 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1379                               u8 instance)
1380 {
1381         struct mgmt_ev_advertising_added ev;
1382
1383         ev.instance = instance;
1384
1385         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1386 }
1387
1388 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1389                                 u8 instance)
1390 {
1391         struct mgmt_ev_advertising_removed ev;
1392
1393         ev.instance = instance;
1394
1395         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1396 }
1397
1398 static void clear_adv_instance(struct hci_dev *hdev)
1399 {
1400         struct hci_request req;
1401
1402         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1403                 return;
1404
1405         if (hdev->adv_instance.timeout)
1406                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1407
1408         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1409         advertising_removed(NULL, hdev, 1);
1410         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1411
1412         if (!hdev_is_powered(hdev) ||
1413             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1414                 return;
1415
1416         hci_req_init(&req, hdev);
1417         disable_advertising(&req);
1418         hci_req_run(&req, NULL);
1419 }
1420
1421 static int clean_up_hci_state(struct hci_dev *hdev)
1422 {
1423         struct hci_request req;
1424         struct hci_conn *conn;
1425         bool discov_stopped;
1426         int err;
1427
1428         hci_req_init(&req, hdev);
1429
1430         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1431             test_bit(HCI_PSCAN, &hdev->flags)) {
1432                 u8 scan = 0x00;
1433                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1434         }
1435
1436         if (hdev->adv_instance.timeout)
1437                 clear_adv_instance(hdev);
1438
1439         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1440                 disable_advertising(&req);
1441
1442         discov_stopped = hci_stop_discovery(&req);
1443
1444         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1445                 struct hci_cp_disconnect dc;
1446                 struct hci_cp_reject_conn_req rej;
1447
1448                 switch (conn->state) {
1449                 case BT_CONNECTED:
1450                 case BT_CONFIG:
1451                         dc.handle = cpu_to_le16(conn->handle);
1452                         dc.reason = 0x15; /* Terminated due to Power Off */
1453                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1454                         break;
1455                 case BT_CONNECT:
1456                         if (conn->type == LE_LINK)
1457                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1458                                             0, NULL);
1459                         else if (conn->type == ACL_LINK)
1460                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1461                                             6, &conn->dst);
1462                         break;
1463                 case BT_CONNECT2:
1464                         bacpy(&rej.bdaddr, &conn->dst);
1465                         rej.reason = 0x15; /* Terminated due to Power Off */
1466                         if (conn->type == ACL_LINK)
1467                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1468                                             sizeof(rej), &rej);
1469                         else if (conn->type == SCO_LINK)
1470                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1471                                             sizeof(rej), &rej);
1472                         break;
1473                 }
1474         }
1475
1476         err = hci_req_run(&req, clean_up_hci_complete);
1477         if (!err && discov_stopped)
1478                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1479
1480         return err;
1481 }
1482
1483 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1484                        u16 len)
1485 {
1486         struct mgmt_mode *cp = data;
1487         struct mgmt_pending_cmd *cmd;
1488         int err;
1489
1490         BT_DBG("request for %s", hdev->name);
1491
1492         if (cp->val != 0x00 && cp->val != 0x01)
1493                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1494                                        MGMT_STATUS_INVALID_PARAMS);
1495
1496         hci_dev_lock(hdev);
1497
1498         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1499                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1500                                       MGMT_STATUS_BUSY);
1501                 goto failed;
1502         }
1503
1504         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1505                 cancel_delayed_work(&hdev->power_off);
1506
1507                 if (cp->val) {
1508                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1509                                          data, len);
1510                         err = mgmt_powered(hdev, 1);
1511                         goto failed;
1512                 }
1513         }
1514
1515         if (!!cp->val == hdev_is_powered(hdev)) {
1516                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1517                 goto failed;
1518         }
1519
1520         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1521         if (!cmd) {
1522                 err = -ENOMEM;
1523                 goto failed;
1524         }
1525
1526         if (cp->val) {
1527                 queue_work(hdev->req_workqueue, &hdev->power_on);
1528                 err = 0;
1529         } else {
1530                 /* Disconnect connections, stop scans, etc */
1531                 err = clean_up_hci_state(hdev);
1532                 if (!err)
1533                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1534                                            HCI_POWER_OFF_TIMEOUT);
1535
1536                 /* ENODATA means there were no HCI commands queued */
1537                 if (err == -ENODATA) {
1538                         cancel_delayed_work(&hdev->power_off);
1539                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1540                         err = 0;
1541                 }
1542         }
1543
1544 failed:
1545         hci_dev_unlock(hdev);
1546         return err;
1547 }
1548
1549 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1550 {
1551         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1552
1553         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1554                                   sizeof(ev), skip);
1555 }
1556
1557 int mgmt_new_settings(struct hci_dev *hdev)
1558 {
1559         return new_settings(hdev, NULL);
1560 }
1561
1562 struct cmd_lookup {
1563         struct sock *sk;
1564         struct hci_dev *hdev;
1565         u8 mgmt_status;
1566 };
1567
1568 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1569 {
1570         struct cmd_lookup *match = data;
1571
1572         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1573
1574         list_del(&cmd->list);
1575
1576         if (match->sk == NULL) {
1577                 match->sk = cmd->sk;
1578                 sock_hold(match->sk);
1579         }
1580
1581         mgmt_pending_free(cmd);
1582 }
1583
1584 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1585 {
1586         u8 *status = data;
1587
1588         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1589         mgmt_pending_remove(cmd);
1590 }
1591
1592 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1593 {
1594         if (cmd->cmd_complete) {
1595                 u8 *status = data;
1596
1597                 cmd->cmd_complete(cmd, *status);
1598                 mgmt_pending_remove(cmd);
1599
1600                 return;
1601         }
1602
1603         cmd_status_rsp(cmd, data);
1604 }
1605
1606 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1607 {
1608         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1609                                  cmd->param, cmd->param_len);
1610 }
1611
1612 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1613 {
1614         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1615                                  cmd->param, sizeof(struct mgmt_addr_info));
1616 }
1617
1618 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1619 {
1620         if (!lmp_bredr_capable(hdev))
1621                 return MGMT_STATUS_NOT_SUPPORTED;
1622         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1623                 return MGMT_STATUS_REJECTED;
1624         else
1625                 return MGMT_STATUS_SUCCESS;
1626 }
1627
1628 static u8 mgmt_le_support(struct hci_dev *hdev)
1629 {
1630         if (!lmp_le_capable(hdev))
1631                 return MGMT_STATUS_NOT_SUPPORTED;
1632         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1633                 return MGMT_STATUS_REJECTED;
1634         else
1635                 return MGMT_STATUS_SUCCESS;
1636 }
1637
1638 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1639                                       u16 opcode)
1640 {
1641         struct mgmt_pending_cmd *cmd;
1642         struct mgmt_mode *cp;
1643         struct hci_request req;
1644         bool changed;
1645
1646         BT_DBG("status 0x%02x", status);
1647
1648         hci_dev_lock(hdev);
1649
1650         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1651         if (!cmd)
1652                 goto unlock;
1653
1654         if (status) {
1655                 u8 mgmt_err = mgmt_status(status);
1656                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1657                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1658                 goto remove_cmd;
1659         }
1660
1661         cp = cmd->param;
1662         if (cp->val) {
1663                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1664
1665                 if (hdev->discov_timeout > 0) {
1666                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1667                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1668                                            to);
1669                 }
1670         } else {
1671                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1672         }
1673
1674         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1675
1676         if (changed)
1677                 new_settings(hdev, cmd->sk);
1678
1679         /* When the discoverable mode gets changed, make sure
1680          * that class of device has the limited discoverable
1681          * bit correctly set. Also update page scan based on whitelist
1682          * entries.
1683          */
1684         hci_req_init(&req, hdev);
1685         __hci_update_page_scan(&req);
1686         update_class(&req);
1687         hci_req_run(&req, NULL);
1688
1689 remove_cmd:
1690         mgmt_pending_remove(cmd);
1691
1692 unlock:
1693         hci_dev_unlock(hdev);
1694 }
1695
1696 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1697                             u16 len)
1698 {
1699         struct mgmt_cp_set_discoverable *cp = data;
1700         struct mgmt_pending_cmd *cmd;
1701         struct hci_request req;
1702         u16 timeout;
1703         u8 scan;
1704         int err;
1705
1706         BT_DBG("request for %s", hdev->name);
1707
1708         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1709             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1710                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1711                                        MGMT_STATUS_REJECTED);
1712
1713         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1714                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1715                                        MGMT_STATUS_INVALID_PARAMS);
1716
1717         timeout = __le16_to_cpu(cp->timeout);
1718
1719         /* Disabling discoverable requires that no timeout is set,
1720          * and enabling limited discoverable requires a timeout.
1721          */
1722         if ((cp->val == 0x00 && timeout > 0) ||
1723             (cp->val == 0x02 && timeout == 0))
1724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1725                                        MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev) && timeout > 0) {
1730                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1731                                       MGMT_STATUS_NOT_POWERED);
1732                 goto failed;
1733         }
1734
1735         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1736             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1737                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1738                                       MGMT_STATUS_BUSY);
1739                 goto failed;
1740         }
1741
1742         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1744                                       MGMT_STATUS_REJECTED);
1745                 goto failed;
1746         }
1747
1748         if (!hdev_is_powered(hdev)) {
1749                 bool changed = false;
1750
1751                 /* Setting limited discoverable when powered off is
1752                  * not a valid operation since it requires a timeout
1753                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1754                  */
1755                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1756                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1757                         changed = true;
1758                 }
1759
1760                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1761                 if (err < 0)
1762                         goto failed;
1763
1764                 if (changed)
1765                         err = new_settings(hdev, sk);
1766
1767                 goto failed;
1768         }
1769
1770         /* If the current mode is the same, then just update the timeout
1771          * value with the new value. And if only the timeout gets updated,
1772          * then no need for any HCI transactions.
1773          */
1774         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1775             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1776                                                    HCI_LIMITED_DISCOVERABLE)) {
1777                 cancel_delayed_work(&hdev->discov_off);
1778                 hdev->discov_timeout = timeout;
1779
1780                 if (cp->val && hdev->discov_timeout > 0) {
1781                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1782                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1783                                            to);
1784                 }
1785
1786                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1787                 goto failed;
1788         }
1789
1790         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1791         if (!cmd) {
1792                 err = -ENOMEM;
1793                 goto failed;
1794         }
1795
1796         /* Cancel any potential discoverable timeout that might be
1797          * still active and store new timeout value. The arming of
1798          * the timeout happens in the complete handler.
1799          */
1800         cancel_delayed_work(&hdev->discov_off);
1801         hdev->discov_timeout = timeout;
1802
1803         /* Limited discoverable mode */
1804         if (cp->val == 0x02)
1805                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1806         else
1807                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1808
1809         hci_req_init(&req, hdev);
1810
1811         /* The procedure for LE-only controllers is much simpler - just
1812          * update the advertising data.
1813          */
1814         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1815                 goto update_ad;
1816
1817         scan = SCAN_PAGE;
1818
1819         if (cp->val) {
1820                 struct hci_cp_write_current_iac_lap hci_cp;
1821
1822                 if (cp->val == 0x02) {
1823                         /* Limited discoverable mode */
1824                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1825                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1826                         hci_cp.iac_lap[1] = 0x8b;
1827                         hci_cp.iac_lap[2] = 0x9e;
1828                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1829                         hci_cp.iac_lap[4] = 0x8b;
1830                         hci_cp.iac_lap[5] = 0x9e;
1831                 } else {
1832                         /* General discoverable mode */
1833                         hci_cp.num_iac = 1;
1834                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1835                         hci_cp.iac_lap[1] = 0x8b;
1836                         hci_cp.iac_lap[2] = 0x9e;
1837                 }
1838
1839                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1840                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1841
1842                 scan |= SCAN_INQUIRY;
1843         } else {
1844                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1845         }
1846
1847         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1848
1849 update_ad:
1850         update_adv_data(&req);
1851
1852         err = hci_req_run(&req, set_discoverable_complete);
1853         if (err < 0)
1854                 mgmt_pending_remove(cmd);
1855
1856 failed:
1857         hci_dev_unlock(hdev);
1858         return err;
1859 }
1860
1861 static void write_fast_connectable(struct hci_request *req, bool enable)
1862 {
1863         struct hci_dev *hdev = req->hdev;
1864         struct hci_cp_write_page_scan_activity acp;
1865         u8 type;
1866
1867         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1868                 return;
1869
1870         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1871                 return;
1872
1873         if (enable) {
1874                 type = PAGE_SCAN_TYPE_INTERLACED;
1875
1876                 /* 160 msec page scan interval */
1877                 acp.interval = cpu_to_le16(0x0100);
1878         } else {
1879                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1880
1881                 /* default 1.28 sec page scan */
1882                 acp.interval = cpu_to_le16(0x0800);
1883         }
1884
1885         acp.window = cpu_to_le16(0x0012);
1886
1887         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1888             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1889                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1890                             sizeof(acp), &acp);
1891
1892         if (hdev->page_scan_type != type)
1893                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1894 }
1895
1896 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1897                                      u16 opcode)
1898 {
1899         struct mgmt_pending_cmd *cmd;
1900         struct mgmt_mode *cp;
1901         bool conn_changed, discov_changed;
1902
1903         BT_DBG("status 0x%02x", status);
1904
1905         hci_dev_lock(hdev);
1906
1907         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1908         if (!cmd)
1909                 goto unlock;
1910
1911         if (status) {
1912                 u8 mgmt_err = mgmt_status(status);
1913                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1914                 goto remove_cmd;
1915         }
1916
1917         cp = cmd->param;
1918         if (cp->val) {
1919                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1920                                                           HCI_CONNECTABLE);
1921                 discov_changed = false;
1922         } else {
1923                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1924                                                            HCI_CONNECTABLE);
1925                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1926                                                              HCI_DISCOVERABLE);
1927         }
1928
1929         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1930
1931         if (conn_changed || discov_changed) {
1932                 new_settings(hdev, cmd->sk);
1933                 hci_update_page_scan(hdev);
1934                 if (discov_changed)
1935                         mgmt_update_adv_data(hdev);
1936                 hci_update_background_scan(hdev);
1937         }
1938
1939 remove_cmd:
1940         mgmt_pending_remove(cmd);
1941
1942 unlock:
1943         hci_dev_unlock(hdev);
1944 }
1945
1946 static int set_connectable_update_settings(struct hci_dev *hdev,
1947                                            struct sock *sk, u8 val)
1948 {
1949         bool changed = false;
1950         int err;
1951
1952         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1953                 changed = true;
1954
1955         if (val) {
1956                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1957         } else {
1958                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1959                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1960         }
1961
1962         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1963         if (err < 0)
1964                 return err;
1965
1966         if (changed) {
1967                 hci_update_page_scan(hdev);
1968                 hci_update_background_scan(hdev);
1969                 return new_settings(hdev, sk);
1970         }
1971
1972         return 0;
1973 }
1974
1975 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1976                            u16 len)
1977 {
1978         struct mgmt_mode *cp = data;
1979         struct mgmt_pending_cmd *cmd;
1980         struct hci_request req;
1981         u8 scan;
1982         int err;
1983
1984         BT_DBG("request for %s", hdev->name);
1985
1986         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1987             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1989                                        MGMT_STATUS_REJECTED);
1990
1991         if (cp->val != 0x00 && cp->val != 0x01)
1992                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1993                                        MGMT_STATUS_INVALID_PARAMS);
1994
1995         hci_dev_lock(hdev);
1996
1997         if (!hdev_is_powered(hdev)) {
1998                 err = set_connectable_update_settings(hdev, sk, cp->val);
1999                 goto failed;
2000         }
2001
2002         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2003             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2004                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2005                                       MGMT_STATUS_BUSY);
2006                 goto failed;
2007         }
2008
2009         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2010         if (!cmd) {
2011                 err = -ENOMEM;
2012                 goto failed;
2013         }
2014
2015         hci_req_init(&req, hdev);
2016
2017         /* If BR/EDR is not enabled and we disable advertising as a
2018          * by-product of disabling connectable, we need to update the
2019          * advertising flags.
2020          */
2021         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2022                 if (!cp->val) {
2023                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2024                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2025                 }
2026                 update_adv_data(&req);
2027         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2028                 if (cp->val) {
2029                         scan = SCAN_PAGE;
2030                 } else {
2031                         /* If we don't have any whitelist entries just
2032                          * disable all scanning. If there are entries
2033                          * and we had both page and inquiry scanning
2034                          * enabled then fall back to only page scanning.
2035                          * Otherwise no changes are needed.
2036                          */
2037                         if (list_empty(&hdev->whitelist))
2038                                 scan = SCAN_DISABLED;
2039                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2040                                 scan = SCAN_PAGE;
2041                         else
2042                                 goto no_scan_update;
2043
2044                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2045                             hdev->discov_timeout > 0)
2046                                 cancel_delayed_work(&hdev->discov_off);
2047                 }
2048
2049                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2050         }
2051
2052 no_scan_update:
2053         /* Update the advertising parameters if necessary */
2054         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2055                 enable_advertising(&req);
2056
2057         err = hci_req_run(&req, set_connectable_complete);
2058         if (err < 0) {
2059                 mgmt_pending_remove(cmd);
2060                 if (err == -ENODATA)
2061                         err = set_connectable_update_settings(hdev, sk,
2062                                                               cp->val);
2063                 goto failed;
2064         }
2065
2066 failed:
2067         hci_dev_unlock(hdev);
2068         return err;
2069 }
2070
2071 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2072                         u16 len)
2073 {
2074         struct mgmt_mode *cp = data;
2075         bool changed;
2076         int err;
2077
2078         BT_DBG("request for %s", hdev->name);
2079
2080         if (cp->val != 0x00 && cp->val != 0x01)
2081                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2082                                        MGMT_STATUS_INVALID_PARAMS);
2083
2084         hci_dev_lock(hdev);
2085
2086         if (cp->val)
2087                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2088         else
2089                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2090
2091         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2092         if (err < 0)
2093                 goto unlock;
2094
2095         if (changed)
2096                 err = new_settings(hdev, sk);
2097
2098 unlock:
2099         hci_dev_unlock(hdev);
2100         return err;
2101 }
2102
2103 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2104                              u16 len)
2105 {
2106         struct mgmt_mode *cp = data;
2107         struct mgmt_pending_cmd *cmd;
2108         u8 val, status;
2109         int err;
2110
2111         BT_DBG("request for %s", hdev->name);
2112
2113         status = mgmt_bredr_support(hdev);
2114         if (status)
2115                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2116                                        status);
2117
2118         if (cp->val != 0x00 && cp->val != 0x01)
2119                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2120                                        MGMT_STATUS_INVALID_PARAMS);
2121
2122         hci_dev_lock(hdev);
2123
2124         if (!hdev_is_powered(hdev)) {
2125                 bool changed = false;
2126
2127                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2128                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2129                         changed = true;
2130                 }
2131
2132                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2133                 if (err < 0)
2134                         goto failed;
2135
2136                 if (changed)
2137                         err = new_settings(hdev, sk);
2138
2139                 goto failed;
2140         }
2141
2142         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2143                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2144                                       MGMT_STATUS_BUSY);
2145                 goto failed;
2146         }
2147
2148         val = !!cp->val;
2149
2150         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2151                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2152                 goto failed;
2153         }
2154
2155         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2156         if (!cmd) {
2157                 err = -ENOMEM;
2158                 goto failed;
2159         }
2160
2161         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2162         if (err < 0) {
2163                 mgmt_pending_remove(cmd);
2164                 goto failed;
2165         }
2166
2167 failed:
2168         hci_dev_unlock(hdev);
2169         return err;
2170 }
2171
2172 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2173 {
2174         struct mgmt_mode *cp = data;
2175         struct mgmt_pending_cmd *cmd;
2176         u8 status;
2177         int err;
2178
2179         BT_DBG("request for %s", hdev->name);
2180
2181         status = mgmt_bredr_support(hdev);
2182         if (status)
2183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2184
2185         if (!lmp_ssp_capable(hdev))
2186                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2187                                        MGMT_STATUS_NOT_SUPPORTED);
2188
2189         if (cp->val != 0x00 && cp->val != 0x01)
2190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2191                                        MGMT_STATUS_INVALID_PARAMS);
2192
2193         hci_dev_lock(hdev);
2194
2195         if (!hdev_is_powered(hdev)) {
2196                 bool changed;
2197
2198                 if (cp->val) {
2199                         changed = !hci_dev_test_and_set_flag(hdev,
2200                                                              HCI_SSP_ENABLED);
2201                 } else {
2202                         changed = hci_dev_test_and_clear_flag(hdev,
2203                                                               HCI_SSP_ENABLED);
2204                         if (!changed)
2205                                 changed = hci_dev_test_and_clear_flag(hdev,
2206                                                                       HCI_HS_ENABLED);
2207                         else
2208                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2209                 }
2210
2211                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2212                 if (err < 0)
2213                         goto failed;
2214
2215                 if (changed)
2216                         err = new_settings(hdev, sk);
2217
2218                 goto failed;
2219         }
2220
2221         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2222                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2223                                       MGMT_STATUS_BUSY);
2224                 goto failed;
2225         }
2226
2227         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2228                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2229                 goto failed;
2230         }
2231
2232         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2233         if (!cmd) {
2234                 err = -ENOMEM;
2235                 goto failed;
2236         }
2237
2238         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2239                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2240                              sizeof(cp->val), &cp->val);
2241
2242         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2243         if (err < 0) {
2244                 mgmt_pending_remove(cmd);
2245                 goto failed;
2246         }
2247
2248 failed:
2249         hci_dev_unlock(hdev);
2250         return err;
2251 }
2252
2253 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2254 {
2255         struct mgmt_mode *cp = data;
2256         bool changed;
2257         u8 status;
2258         int err;
2259
2260         BT_DBG("request for %s", hdev->name);
2261
2262         status = mgmt_bredr_support(hdev);
2263         if (status)
2264                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2265
2266         if (!lmp_ssp_capable(hdev))
2267                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2268                                        MGMT_STATUS_NOT_SUPPORTED);
2269
2270         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2271                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2272                                        MGMT_STATUS_REJECTED);
2273
2274         if (cp->val != 0x00 && cp->val != 0x01)
2275                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2276                                        MGMT_STATUS_INVALID_PARAMS);
2277
2278         hci_dev_lock(hdev);
2279
2280         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2281                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2282                                       MGMT_STATUS_BUSY);
2283                 goto unlock;
2284         }
2285
2286         if (cp->val) {
2287                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2288         } else {
2289                 if (hdev_is_powered(hdev)) {
2290                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2291                                               MGMT_STATUS_REJECTED);
2292                         goto unlock;
2293                 }
2294
2295                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2296         }
2297
2298         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2299         if (err < 0)
2300                 goto unlock;
2301
2302         if (changed)
2303                 err = new_settings(hdev, sk);
2304
2305 unlock:
2306         hci_dev_unlock(hdev);
2307         return err;
2308 }
2309
2310 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2311 {
2312         struct cmd_lookup match = { NULL, hdev };
2313
2314         hci_dev_lock(hdev);
2315
2316         if (status) {
2317                 u8 mgmt_err = mgmt_status(status);
2318
2319                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2320                                      &mgmt_err);
2321                 goto unlock;
2322         }
2323
2324         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2325
2326         new_settings(hdev, match.sk);
2327
2328         if (match.sk)
2329                 sock_put(match.sk);
2330
2331         /* Make sure the controller has a good default for
2332          * advertising data. Restrict the update to when LE
2333          * has actually been enabled. During power on, the
2334          * update in powered_update_hci will take care of it.
2335          */
2336         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2337                 struct hci_request req;
2338
2339                 hci_req_init(&req, hdev);
2340                 update_adv_data(&req);
2341                 update_scan_rsp_data(&req);
2342                 __hci_update_background_scan(&req);
2343                 hci_req_run(&req, NULL);
2344         }
2345
2346 unlock:
2347         hci_dev_unlock(hdev);
2348 }
2349
2350 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2351 {
2352         struct mgmt_mode *cp = data;
2353         struct hci_cp_write_le_host_supported hci_cp;
2354         struct mgmt_pending_cmd *cmd;
2355         struct hci_request req;
2356         int err;
2357         u8 val, enabled;
2358
2359         BT_DBG("request for %s", hdev->name);
2360
2361         if (!lmp_le_capable(hdev))
2362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2363                                        MGMT_STATUS_NOT_SUPPORTED);
2364
2365         if (cp->val != 0x00 && cp->val != 0x01)
2366                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2367                                        MGMT_STATUS_INVALID_PARAMS);
2368
2369         /* Bluetooth single mode LE only controllers or dual-mode
2370          * controllers configured as LE only devices, do not allow
2371          * switching LE off. These have either LE enabled explicitly
2372          * or BR/EDR has been previously switched off.
2373          *
2374          * When trying to enable an already enabled LE, then gracefully
2375          * send a positive response. Trying to disable it however will
2376          * result into rejection.
2377          */
2378         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2379                 if (cp->val == 0x01)
2380                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2381
2382                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2383                                        MGMT_STATUS_REJECTED);
2384         }
2385
2386         hci_dev_lock(hdev);
2387
2388         val = !!cp->val;
2389         enabled = lmp_host_le_capable(hdev);
2390
2391         if (!hdev_is_powered(hdev) || val == enabled) {
2392                 bool changed = false;
2393
2394                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2395                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2396                         changed = true;
2397                 }
2398
2399                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2400                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2401                         changed = true;
2402                 }
2403
2404                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2405                 if (err < 0)
2406                         goto unlock;
2407
2408                 if (changed)
2409                         err = new_settings(hdev, sk);
2410
2411                 goto unlock;
2412         }
2413
2414         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2415             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2417                                       MGMT_STATUS_BUSY);
2418                 goto unlock;
2419         }
2420
2421         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2422         if (!cmd) {
2423                 err = -ENOMEM;
2424                 goto unlock;
2425         }
2426
2427         hci_req_init(&req, hdev);
2428
2429         memset(&hci_cp, 0, sizeof(hci_cp));
2430
2431         if (val) {
2432                 hci_cp.le = val;
2433                 hci_cp.simul = 0x00;
2434         } else {
2435                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2436                         disable_advertising(&req);
2437         }
2438
2439         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2440                     &hci_cp);
2441
2442         err = hci_req_run(&req, le_enable_complete);
2443         if (err < 0)
2444                 mgmt_pending_remove(cmd);
2445
2446 unlock:
2447         hci_dev_unlock(hdev);
2448         return err;
2449 }
2450
2451 /* This is a helper function to test for pending mgmt commands that can
2452  * cause CoD or EIR HCI commands. We can only allow one such pending
2453  * mgmt command at a time since otherwise we cannot easily track what
2454  * the current values are, will be, and based on that calculate if a new
2455  * HCI command needs to be sent and if yes with what value.
2456  */
2457 static bool pending_eir_or_class(struct hci_dev *hdev)
2458 {
2459         struct mgmt_pending_cmd *cmd;
2460
2461         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2462                 switch (cmd->opcode) {
2463                 case MGMT_OP_ADD_UUID:
2464                 case MGMT_OP_REMOVE_UUID:
2465                 case MGMT_OP_SET_DEV_CLASS:
2466                 case MGMT_OP_SET_POWERED:
2467                         return true;
2468                 }
2469         }
2470
2471         return false;
2472 }
2473
2474 static const u8 bluetooth_base_uuid[] = {
2475                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2476                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2477 };
2478
2479 static u8 get_uuid_size(const u8 *uuid)
2480 {
2481         u32 val;
2482
2483         if (memcmp(uuid, bluetooth_base_uuid, 12))
2484                 return 128;
2485
2486         val = get_unaligned_le32(&uuid[12]);
2487         if (val > 0xffff)
2488                 return 32;
2489
2490         return 16;
2491 }
2492
2493 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2494 {
2495         struct mgmt_pending_cmd *cmd;
2496
2497         hci_dev_lock(hdev);
2498
2499         cmd = pending_find(mgmt_op, hdev);
2500         if (!cmd)
2501                 goto unlock;
2502
2503         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2504                           mgmt_status(status), hdev->dev_class, 3);
2505
2506         mgmt_pending_remove(cmd);
2507
2508 unlock:
2509         hci_dev_unlock(hdev);
2510 }
2511
2512 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2513 {
2514         BT_DBG("status 0x%02x", status);
2515
2516         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2517 }
2518
2519 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2520 {
2521         struct mgmt_cp_add_uuid *cp = data;
2522         struct mgmt_pending_cmd *cmd;
2523         struct hci_request req;
2524         struct bt_uuid *uuid;
2525         int err;
2526
2527         BT_DBG("request for %s", hdev->name);
2528
2529         hci_dev_lock(hdev);
2530
2531         if (pending_eir_or_class(hdev)) {
2532                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2533                                       MGMT_STATUS_BUSY);
2534                 goto failed;
2535         }
2536
2537         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2538         if (!uuid) {
2539                 err = -ENOMEM;
2540                 goto failed;
2541         }
2542
2543         memcpy(uuid->uuid, cp->uuid, 16);
2544         uuid->svc_hint = cp->svc_hint;
2545         uuid->size = get_uuid_size(cp->uuid);
2546
2547         list_add_tail(&uuid->list, &hdev->uuids);
2548
2549         hci_req_init(&req, hdev);
2550
2551         update_class(&req);
2552         update_eir(&req);
2553
2554         err = hci_req_run(&req, add_uuid_complete);
2555         if (err < 0) {
2556                 if (err != -ENODATA)
2557                         goto failed;
2558
2559                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2560                                         hdev->dev_class, 3);
2561                 goto failed;
2562         }
2563
2564         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2565         if (!cmd) {
2566                 err = -ENOMEM;
2567                 goto failed;
2568         }
2569
2570         err = 0;
2571
2572 failed:
2573         hci_dev_unlock(hdev);
2574         return err;
2575 }
2576
2577 static bool enable_service_cache(struct hci_dev *hdev)
2578 {
2579         if (!hdev_is_powered(hdev))
2580                 return false;
2581
2582         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2583                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2584                                    CACHE_TIMEOUT);
2585                 return true;
2586         }
2587
2588         return false;
2589 }
2590
2591 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2592 {
2593         BT_DBG("status 0x%02x", status);
2594
2595         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2596 }
2597
2598 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2599                        u16 len)
2600 {
2601         struct mgmt_cp_remove_uuid *cp = data;
2602         struct mgmt_pending_cmd *cmd;
2603         struct bt_uuid *match, *tmp;
2604         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2605         struct hci_request req;
2606         int err, found;
2607
2608         BT_DBG("request for %s", hdev->name);
2609
2610         hci_dev_lock(hdev);
2611
2612         if (pending_eir_or_class(hdev)) {
2613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2614                                       MGMT_STATUS_BUSY);
2615                 goto unlock;
2616         }
2617
2618         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2619                 hci_uuids_clear(hdev);
2620
2621                 if (enable_service_cache(hdev)) {
2622                         err = mgmt_cmd_complete(sk, hdev->id,
2623                                                 MGMT_OP_REMOVE_UUID,
2624                                                 0, hdev->dev_class, 3);
2625                         goto unlock;
2626                 }
2627
2628                 goto update_class;
2629         }
2630
2631         found = 0;
2632
2633         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2634                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2635                         continue;
2636
2637                 list_del(&match->list);
2638                 kfree(match);
2639                 found++;
2640         }
2641
2642         if (found == 0) {
2643                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2644                                       MGMT_STATUS_INVALID_PARAMS);
2645                 goto unlock;
2646         }
2647
2648 update_class:
2649         hci_req_init(&req, hdev);
2650
2651         update_class(&req);
2652         update_eir(&req);
2653
2654         err = hci_req_run(&req, remove_uuid_complete);
2655         if (err < 0) {
2656                 if (err != -ENODATA)
2657                         goto unlock;
2658
2659                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2660                                         hdev->dev_class, 3);
2661                 goto unlock;
2662         }
2663
2664         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2665         if (!cmd) {
2666                 err = -ENOMEM;
2667                 goto unlock;
2668         }
2669
2670         err = 0;
2671
2672 unlock:
2673         hci_dev_unlock(hdev);
2674         return err;
2675 }
2676
2677 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2678 {
2679         BT_DBG("status 0x%02x", status);
2680
2681         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2682 }
2683
2684 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2685                          u16 len)
2686 {
2687         struct mgmt_cp_set_dev_class *cp = data;
2688         struct mgmt_pending_cmd *cmd;
2689         struct hci_request req;
2690         int err;
2691
2692         BT_DBG("request for %s", hdev->name);
2693
2694         if (!lmp_bredr_capable(hdev))
2695                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2696                                        MGMT_STATUS_NOT_SUPPORTED);
2697
2698         hci_dev_lock(hdev);
2699
2700         if (pending_eir_or_class(hdev)) {
2701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2702                                       MGMT_STATUS_BUSY);
2703                 goto unlock;
2704         }
2705
2706         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2708                                       MGMT_STATUS_INVALID_PARAMS);
2709                 goto unlock;
2710         }
2711
2712         hdev->major_class = cp->major;
2713         hdev->minor_class = cp->minor;
2714
2715         if (!hdev_is_powered(hdev)) {
2716                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2717                                         hdev->dev_class, 3);
2718                 goto unlock;
2719         }
2720
2721         hci_req_init(&req, hdev);
2722
2723         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2724                 hci_dev_unlock(hdev);
2725                 cancel_delayed_work_sync(&hdev->service_cache);
2726                 hci_dev_lock(hdev);
2727                 update_eir(&req);
2728         }
2729
2730         update_class(&req);
2731
2732         err = hci_req_run(&req, set_class_complete);
2733         if (err < 0) {
2734                 if (err != -ENODATA)
2735                         goto unlock;
2736
2737                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2738                                         hdev->dev_class, 3);
2739                 goto unlock;
2740         }
2741
2742         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2743         if (!cmd) {
2744                 err = -ENOMEM;
2745                 goto unlock;
2746         }
2747
2748         err = 0;
2749
2750 unlock:
2751         hci_dev_unlock(hdev);
2752         return err;
2753 }
2754
2755 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2756                           u16 len)
2757 {
2758         struct mgmt_cp_load_link_keys *cp = data;
2759         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2760                                    sizeof(struct mgmt_link_key_info));
2761         u16 key_count, expected_len;
2762         bool changed;
2763         int i;
2764
2765         BT_DBG("request for %s", hdev->name);
2766
2767         if (!lmp_bredr_capable(hdev))
2768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2769                                        MGMT_STATUS_NOT_SUPPORTED);
2770
2771         key_count = __le16_to_cpu(cp->key_count);
2772         if (key_count > max_key_count) {
2773                 BT_ERR("load_link_keys: too big key_count value %u",
2774                        key_count);
2775                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2776                                        MGMT_STATUS_INVALID_PARAMS);
2777         }
2778
2779         expected_len = sizeof(*cp) + key_count *
2780                                         sizeof(struct mgmt_link_key_info);
2781         if (expected_len != len) {
2782                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2783                        expected_len, len);
2784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2785                                        MGMT_STATUS_INVALID_PARAMS);
2786         }
2787
2788         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2789                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2790                                        MGMT_STATUS_INVALID_PARAMS);
2791
2792         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2793                key_count);
2794
2795         for (i = 0; i < key_count; i++) {
2796                 struct mgmt_link_key_info *key = &cp->keys[i];
2797
2798                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2799                         return mgmt_cmd_status(sk, hdev->id,
2800                                                MGMT_OP_LOAD_LINK_KEYS,
2801                                                MGMT_STATUS_INVALID_PARAMS);
2802         }
2803
2804         hci_dev_lock(hdev);
2805
2806         hci_link_keys_clear(hdev);
2807
2808         if (cp->debug_keys)
2809                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2810         else
2811                 changed = hci_dev_test_and_clear_flag(hdev,
2812                                                       HCI_KEEP_DEBUG_KEYS);
2813
2814         if (changed)
2815                 new_settings(hdev, NULL);
2816
2817         for (i = 0; i < key_count; i++) {
2818                 struct mgmt_link_key_info *key = &cp->keys[i];
2819
2820                 /* Always ignore debug keys and require a new pairing if
2821                  * the user wants to use them.
2822                  */
2823                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2824                         continue;
2825
2826                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2827                                  key->type, key->pin_len, NULL);
2828         }
2829
2830         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2831
2832         hci_dev_unlock(hdev);
2833
2834         return 0;
2835 }
2836
2837 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2838                            u8 addr_type, struct sock *skip_sk)
2839 {
2840         struct mgmt_ev_device_unpaired ev;
2841
2842         bacpy(&ev.addr.bdaddr, bdaddr);
2843         ev.addr.type = addr_type;
2844
2845         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2846                           skip_sk);
2847 }
2848
2849 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2850                          u16 len)
2851 {
2852         struct mgmt_cp_unpair_device *cp = data;
2853         struct mgmt_rp_unpair_device rp;
2854         struct hci_cp_disconnect dc;
2855         struct mgmt_pending_cmd *cmd;
2856         struct hci_conn *conn;
2857         int err;
2858
2859         memset(&rp, 0, sizeof(rp));
2860         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2861         rp.addr.type = cp->addr.type;
2862
2863         if (!bdaddr_type_is_valid(cp->addr.type))
2864                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2865                                          MGMT_STATUS_INVALID_PARAMS,
2866                                          &rp, sizeof(rp));
2867
2868         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2869                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2870                                          MGMT_STATUS_INVALID_PARAMS,
2871                                          &rp, sizeof(rp));
2872
2873         hci_dev_lock(hdev);
2874
2875         if (!hdev_is_powered(hdev)) {
2876                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2877                                         MGMT_STATUS_NOT_POWERED, &rp,
2878                                         sizeof(rp));
2879                 goto unlock;
2880         }
2881
2882         if (cp->addr.type == BDADDR_BREDR) {
2883                 /* If disconnection is requested, then look up the
2884                  * connection. If the remote device is connected, it
2885                  * will be later used to terminate the link.
2886                  *
2887                  * Setting it to NULL explicitly will cause no
2888                  * termination of the link.
2889                  */
2890                 if (cp->disconnect)
2891                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2892                                                        &cp->addr.bdaddr);
2893                 else
2894                         conn = NULL;
2895
2896                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2897         } else {
2898                 u8 addr_type;
2899
2900                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2901                                                &cp->addr.bdaddr);
2902                 if (conn) {
2903                         /* Defer clearing up the connection parameters
2904                          * until closing to give a chance of keeping
2905                          * them if a repairing happens.
2906                          */
2907                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2908
2909                         /* If disconnection is not requested, then
2910                          * clear the connection variable so that the
2911                          * link is not terminated.
2912                          */
2913                         if (!cp->disconnect)
2914                                 conn = NULL;
2915                 }
2916
2917                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2918                         addr_type = ADDR_LE_DEV_PUBLIC;
2919                 else
2920                         addr_type = ADDR_LE_DEV_RANDOM;
2921
2922                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2923
2924                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2925         }
2926
2927         if (err < 0) {
2928                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2929                                         MGMT_STATUS_NOT_PAIRED, &rp,
2930                                         sizeof(rp));
2931                 goto unlock;
2932         }
2933
2934         /* If the connection variable is set, then termination of the
2935          * link is requested.
2936          */
2937         if (!conn) {
2938                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2939                                         &rp, sizeof(rp));
2940                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2941                 goto unlock;
2942         }
2943
2944         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2945                                sizeof(*cp));
2946         if (!cmd) {
2947                 err = -ENOMEM;
2948                 goto unlock;
2949         }
2950
2951         cmd->cmd_complete = addr_cmd_complete;
2952
2953         dc.handle = cpu_to_le16(conn->handle);
2954         dc.reason = 0x13; /* Remote User Terminated Connection */
2955         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2956         if (err < 0)
2957                 mgmt_pending_remove(cmd);
2958
2959 unlock:
2960         hci_dev_unlock(hdev);
2961         return err;
2962 }
2963
2964 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2965                       u16 len)
2966 {
2967         struct mgmt_cp_disconnect *cp = data;
2968         struct mgmt_rp_disconnect rp;
2969         struct mgmt_pending_cmd *cmd;
2970         struct hci_conn *conn;
2971         int err;
2972
2973         BT_DBG("");
2974
2975         memset(&rp, 0, sizeof(rp));
2976         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2977         rp.addr.type = cp->addr.type;
2978
2979         if (!bdaddr_type_is_valid(cp->addr.type))
2980                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2981                                          MGMT_STATUS_INVALID_PARAMS,
2982                                          &rp, sizeof(rp));
2983
2984         hci_dev_lock(hdev);
2985
2986         if (!test_bit(HCI_UP, &hdev->flags)) {
2987                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2988                                         MGMT_STATUS_NOT_POWERED, &rp,
2989                                         sizeof(rp));
2990                 goto failed;
2991         }
2992
2993         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2995                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2996                 goto failed;
2997         }
2998
2999         if (cp->addr.type == BDADDR_BREDR)
3000                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3001                                                &cp->addr.bdaddr);
3002         else
3003                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
3004
3005         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3006                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3007                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3008                                         sizeof(rp));
3009                 goto failed;
3010         }
3011
3012         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3013         if (!cmd) {
3014                 err = -ENOMEM;
3015                 goto failed;
3016         }
3017
3018         cmd->cmd_complete = generic_cmd_complete;
3019
3020         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3021         if (err < 0)
3022                 mgmt_pending_remove(cmd);
3023
3024 failed:
3025         hci_dev_unlock(hdev);
3026         return err;
3027 }
3028
3029 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3030 {
3031         switch (link_type) {
3032         case LE_LINK:
3033                 switch (addr_type) {
3034                 case ADDR_LE_DEV_PUBLIC:
3035                         return BDADDR_LE_PUBLIC;
3036
3037                 default:
3038                         /* Fallback to LE Random address type */
3039                         return BDADDR_LE_RANDOM;
3040                 }
3041
3042         default:
3043                 /* Fallback to BR/EDR type */
3044                 return BDADDR_BREDR;
3045         }
3046 }
3047
3048 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3049                            u16 data_len)
3050 {
3051         struct mgmt_rp_get_connections *rp;
3052         struct hci_conn *c;
3053         size_t rp_len;
3054         int err;
3055         u16 i;
3056
3057         BT_DBG("");
3058
3059         hci_dev_lock(hdev);
3060
3061         if (!hdev_is_powered(hdev)) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3063                                       MGMT_STATUS_NOT_POWERED);
3064                 goto unlock;
3065         }
3066
3067         i = 0;
3068         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3069                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3070                         i++;
3071         }
3072
3073         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3074         rp = kmalloc(rp_len, GFP_KERNEL);
3075         if (!rp) {
3076                 err = -ENOMEM;
3077                 goto unlock;
3078         }
3079
3080         i = 0;
3081         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3082                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3083                         continue;
3084                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3085                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3086                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3087                         continue;
3088                 i++;
3089         }
3090
3091         rp->conn_count = cpu_to_le16(i);
3092
3093         /* Recalculate length in case of filtered SCO connections, etc */
3094         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3095
3096         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3097                                 rp_len);
3098
3099         kfree(rp);
3100
3101 unlock:
3102         hci_dev_unlock(hdev);
3103         return err;
3104 }
3105
3106 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3107                                    struct mgmt_cp_pin_code_neg_reply *cp)
3108 {
3109         struct mgmt_pending_cmd *cmd;
3110         int err;
3111
3112         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3113                                sizeof(*cp));
3114         if (!cmd)
3115                 return -ENOMEM;
3116
3117         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3118                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3119         if (err < 0)
3120                 mgmt_pending_remove(cmd);
3121
3122         return err;
3123 }
3124
3125 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3126                           u16 len)
3127 {
3128         struct hci_conn *conn;
3129         struct mgmt_cp_pin_code_reply *cp = data;
3130         struct hci_cp_pin_code_reply reply;
3131         struct mgmt_pending_cmd *cmd;
3132         int err;
3133
3134         BT_DBG("");
3135
3136         hci_dev_lock(hdev);
3137
3138         if (!hdev_is_powered(hdev)) {
3139                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3140                                       MGMT_STATUS_NOT_POWERED);
3141                 goto failed;
3142         }
3143
3144         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3145         if (!conn) {
3146                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3147                                       MGMT_STATUS_NOT_CONNECTED);
3148                 goto failed;
3149         }
3150
3151         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3152                 struct mgmt_cp_pin_code_neg_reply ncp;
3153
3154                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3155
3156                 BT_ERR("PIN code is not 16 bytes long");
3157
3158                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3159                 if (err >= 0)
3160                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3161                                               MGMT_STATUS_INVALID_PARAMS);
3162
3163                 goto failed;
3164         }
3165
3166         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3167         if (!cmd) {
3168                 err = -ENOMEM;
3169                 goto failed;
3170         }
3171
3172         cmd->cmd_complete = addr_cmd_complete;
3173
3174         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3175         reply.pin_len = cp->pin_len;
3176         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3177
3178         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3179         if (err < 0)
3180                 mgmt_pending_remove(cmd);
3181
3182 failed:
3183         hci_dev_unlock(hdev);
3184         return err;
3185 }
3186
3187 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3188                              u16 len)
3189 {
3190         struct mgmt_cp_set_io_capability *cp = data;
3191
3192         BT_DBG("");
3193
3194         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3195                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3196                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3197
3198         hci_dev_lock(hdev);
3199
3200         hdev->io_capability = cp->io_capability;
3201
3202         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3203                hdev->io_capability);
3204
3205         hci_dev_unlock(hdev);
3206
3207         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3208                                  NULL, 0);
3209 }
3210
3211 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3212 {
3213         struct hci_dev *hdev = conn->hdev;
3214         struct mgmt_pending_cmd *cmd;
3215
3216         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3217                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3218                         continue;
3219
3220                 if (cmd->user_data != conn)
3221                         continue;
3222
3223                 return cmd;
3224         }
3225
3226         return NULL;
3227 }
3228
3229 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3230 {
3231         struct mgmt_rp_pair_device rp;
3232         struct hci_conn *conn = cmd->user_data;
3233         int err;
3234
3235         bacpy(&rp.addr.bdaddr, &conn->dst);
3236         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3237
3238         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3239                                 status, &rp, sizeof(rp));
3240
3241         /* So we don't get further callbacks for this connection */
3242         conn->connect_cfm_cb = NULL;
3243         conn->security_cfm_cb = NULL;
3244         conn->disconn_cfm_cb = NULL;
3245
3246         hci_conn_drop(conn);
3247
3248         /* The device is paired so there is no need to remove
3249          * its connection parameters anymore.
3250          */
3251         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3252
3253         hci_conn_put(conn);
3254
3255         return err;
3256 }
3257
3258 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3259 {
3260         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3261         struct mgmt_pending_cmd *cmd;
3262
3263         cmd = find_pairing(conn);
3264         if (cmd) {
3265                 cmd->cmd_complete(cmd, status);
3266                 mgmt_pending_remove(cmd);
3267         }
3268 }
3269
3270 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3271 {
3272         struct mgmt_pending_cmd *cmd;
3273
3274         BT_DBG("status %u", status);
3275
3276         cmd = find_pairing(conn);
3277         if (!cmd) {
3278                 BT_DBG("Unable to find a pending command");
3279                 return;
3280         }
3281
3282         cmd->cmd_complete(cmd, mgmt_status(status));
3283         mgmt_pending_remove(cmd);
3284 }
3285
3286 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3287 {
3288         struct mgmt_pending_cmd *cmd;
3289
3290         BT_DBG("status %u", status);
3291
3292         if (!status)
3293                 return;
3294
3295         cmd = find_pairing(conn);
3296         if (!cmd) {
3297                 BT_DBG("Unable to find a pending command");
3298                 return;
3299         }
3300
3301         cmd->cmd_complete(cmd, mgmt_status(status));
3302         mgmt_pending_remove(cmd);
3303 }
3304
3305 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3306                        u16 len)
3307 {
3308         struct mgmt_cp_pair_device *cp = data;
3309         struct mgmt_rp_pair_device rp;
3310         struct mgmt_pending_cmd *cmd;
3311         u8 sec_level, auth_type;
3312         struct hci_conn *conn;
3313         int err;
3314
3315         BT_DBG("");
3316
3317         memset(&rp, 0, sizeof(rp));
3318         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3319         rp.addr.type = cp->addr.type;
3320
3321         if (!bdaddr_type_is_valid(cp->addr.type))
3322                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3323                                          MGMT_STATUS_INVALID_PARAMS,
3324                                          &rp, sizeof(rp));
3325
3326         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3327                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3328                                          MGMT_STATUS_INVALID_PARAMS,
3329                                          &rp, sizeof(rp));
3330
3331         hci_dev_lock(hdev);
3332
3333         if (!hdev_is_powered(hdev)) {
3334                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3335                                         MGMT_STATUS_NOT_POWERED, &rp,
3336                                         sizeof(rp));
3337                 goto unlock;
3338         }
3339
3340         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3341                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3342                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3343                                         sizeof(rp));
3344                 goto unlock;
3345         }
3346
3347         sec_level = BT_SECURITY_MEDIUM;
3348         auth_type = HCI_AT_DEDICATED_BONDING;
3349
3350         if (cp->addr.type == BDADDR_BREDR) {
3351                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3352                                        auth_type);
3353         } else {
3354                 u8 addr_type;
3355
3356                 /* Convert from L2CAP channel address type to HCI address type
3357                  */
3358                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3359                         addr_type = ADDR_LE_DEV_PUBLIC;
3360                 else
3361                         addr_type = ADDR_LE_DEV_RANDOM;
3362
3363                 /* When pairing a new device, it is expected to remember
3364                  * this device for future connections. Adding the connection
3365                  * parameter information ahead of time allows tracking
3366                  * of the slave preferred values and will speed up any
3367                  * further connection establishment.
3368                  *
3369                  * If connection parameters already exist, then they
3370                  * will be kept and this function does nothing.
3371                  */
3372                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3373
3374                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3375                                       sec_level, HCI_LE_CONN_TIMEOUT,
3376                                       HCI_ROLE_MASTER);
3377         }
3378
3379         if (IS_ERR(conn)) {
3380                 int status;
3381
3382                 if (PTR_ERR(conn) == -EBUSY)
3383                         status = MGMT_STATUS_BUSY;
3384                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3385                         status = MGMT_STATUS_NOT_SUPPORTED;
3386                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3387                         status = MGMT_STATUS_REJECTED;
3388                 else
3389                         status = MGMT_STATUS_CONNECT_FAILED;
3390
3391                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3392                                         status, &rp, sizeof(rp));
3393                 goto unlock;
3394         }
3395
3396         if (conn->connect_cfm_cb) {
3397                 hci_conn_drop(conn);
3398                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3399                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3400                 goto unlock;
3401         }
3402
3403         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3404         if (!cmd) {
3405                 err = -ENOMEM;
3406                 hci_conn_drop(conn);
3407                 goto unlock;
3408         }
3409
3410         cmd->cmd_complete = pairing_complete;
3411
3412         /* For LE, just connecting isn't a proof that the pairing finished */
3413         if (cp->addr.type == BDADDR_BREDR) {
3414                 conn->connect_cfm_cb = pairing_complete_cb;
3415                 conn->security_cfm_cb = pairing_complete_cb;
3416                 conn->disconn_cfm_cb = pairing_complete_cb;
3417         } else {
3418                 conn->connect_cfm_cb = le_pairing_complete_cb;
3419                 conn->security_cfm_cb = le_pairing_complete_cb;
3420                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3421         }
3422
3423         conn->io_capability = cp->io_cap;
3424         cmd->user_data = hci_conn_get(conn);
3425
3426         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3427             hci_conn_security(conn, sec_level, auth_type, true)) {
3428                 cmd->cmd_complete(cmd, 0);
3429                 mgmt_pending_remove(cmd);
3430         }
3431
3432         err = 0;
3433
3434 unlock:
3435         hci_dev_unlock(hdev);
3436         return err;
3437 }
3438
3439 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3440                               u16 len)
3441 {
3442         struct mgmt_addr_info *addr = data;
3443         struct mgmt_pending_cmd *cmd;
3444         struct hci_conn *conn;
3445         int err;
3446
3447         BT_DBG("");
3448
3449         hci_dev_lock(hdev);
3450
3451         if (!hdev_is_powered(hdev)) {
3452                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3453                                       MGMT_STATUS_NOT_POWERED);
3454                 goto unlock;
3455         }
3456
3457         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3458         if (!cmd) {
3459                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3460                                       MGMT_STATUS_INVALID_PARAMS);
3461                 goto unlock;
3462         }
3463
3464         conn = cmd->user_data;
3465
3466         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3467                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3468                                       MGMT_STATUS_INVALID_PARAMS);
3469                 goto unlock;
3470         }
3471
3472         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3473         mgmt_pending_remove(cmd);
3474
3475         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3476                                 addr, sizeof(*addr));
3477 unlock:
3478         hci_dev_unlock(hdev);
3479         return err;
3480 }
3481
3482 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3483                              struct mgmt_addr_info *addr, u16 mgmt_op,
3484                              u16 hci_op, __le32 passkey)
3485 {
3486         struct mgmt_pending_cmd *cmd;
3487         struct hci_conn *conn;
3488         int err;
3489
3490         hci_dev_lock(hdev);
3491
3492         if (!hdev_is_powered(hdev)) {
3493                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3494                                         MGMT_STATUS_NOT_POWERED, addr,
3495                                         sizeof(*addr));
3496                 goto done;
3497         }
3498
3499         if (addr->type == BDADDR_BREDR)
3500                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3501         else
3502                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3503
3504         if (!conn) {
3505                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3506                                         MGMT_STATUS_NOT_CONNECTED, addr,
3507                                         sizeof(*addr));
3508                 goto done;
3509         }
3510
3511         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3512                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3513                 if (!err)
3514                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3515                                                 MGMT_STATUS_SUCCESS, addr,
3516                                                 sizeof(*addr));
3517                 else
3518                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3519                                                 MGMT_STATUS_FAILED, addr,
3520                                                 sizeof(*addr));
3521
3522                 goto done;
3523         }
3524
3525         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3526         if (!cmd) {
3527                 err = -ENOMEM;
3528                 goto done;
3529         }
3530
3531         cmd->cmd_complete = addr_cmd_complete;
3532
3533         /* Continue with pairing via HCI */
3534         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3535                 struct hci_cp_user_passkey_reply cp;
3536
3537                 bacpy(&cp.bdaddr, &addr->bdaddr);
3538                 cp.passkey = passkey;
3539                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3540         } else
3541                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3542                                    &addr->bdaddr);
3543
3544         if (err < 0)
3545                 mgmt_pending_remove(cmd);
3546
3547 done:
3548         hci_dev_unlock(hdev);
3549         return err;
3550 }
3551
3552 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3553                               void *data, u16 len)
3554 {
3555         struct mgmt_cp_pin_code_neg_reply *cp = data;
3556
3557         BT_DBG("");
3558
3559         return user_pairing_resp(sk, hdev, &cp->addr,
3560                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3561                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3562 }
3563
3564 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3565                               u16 len)
3566 {
3567         struct mgmt_cp_user_confirm_reply *cp = data;
3568
3569         BT_DBG("");
3570
3571         if (len != sizeof(*cp))
3572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3573                                        MGMT_STATUS_INVALID_PARAMS);
3574
3575         return user_pairing_resp(sk, hdev, &cp->addr,
3576                                  MGMT_OP_USER_CONFIRM_REPLY,
3577                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3578 }
3579
3580 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3581                                   void *data, u16 len)
3582 {
3583         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3584
3585         BT_DBG("");
3586
3587         return user_pairing_resp(sk, hdev, &cp->addr,
3588                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3589                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3590 }
3591
3592 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3593                               u16 len)
3594 {
3595         struct mgmt_cp_user_passkey_reply *cp = data;
3596
3597         BT_DBG("");
3598
3599         return user_pairing_resp(sk, hdev, &cp->addr,
3600                                  MGMT_OP_USER_PASSKEY_REPLY,
3601                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3602 }
3603
3604 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3605                                   void *data, u16 len)
3606 {
3607         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3608
3609         BT_DBG("");
3610
3611         return user_pairing_resp(sk, hdev, &cp->addr,
3612                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3613                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3614 }
3615
3616 static void update_name(struct hci_request *req)
3617 {
3618         struct hci_dev *hdev = req->hdev;
3619         struct hci_cp_write_local_name cp;
3620
3621         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3622
3623         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3624 }
3625
3626 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3627 {
3628         struct mgmt_cp_set_local_name *cp;
3629         struct mgmt_pending_cmd *cmd;
3630
3631         BT_DBG("status 0x%02x", status);
3632
3633         hci_dev_lock(hdev);
3634
3635         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3636         if (!cmd)
3637                 goto unlock;
3638
3639         cp = cmd->param;
3640
3641         if (status)
3642                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3643                                 mgmt_status(status));
3644         else
3645                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3646                                   cp, sizeof(*cp));
3647
3648         mgmt_pending_remove(cmd);
3649
3650 unlock:
3651         hci_dev_unlock(hdev);
3652 }
3653
3654 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3655                           u16 len)
3656 {
3657         struct mgmt_cp_set_local_name *cp = data;
3658         struct mgmt_pending_cmd *cmd;
3659         struct hci_request req;
3660         int err;
3661
3662         BT_DBG("");
3663
3664         hci_dev_lock(hdev);
3665
3666         /* If the old values are the same as the new ones just return a
3667          * direct command complete event.
3668          */
3669         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3670             !memcmp(hdev->short_name, cp->short_name,
3671                     sizeof(hdev->short_name))) {
3672                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3673                                         data, len);
3674                 goto failed;
3675         }
3676
3677         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3678
3679         if (!hdev_is_powered(hdev)) {
3680                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3681
3682                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3683                                         data, len);
3684                 if (err < 0)
3685                         goto failed;
3686
3687                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3688                                          data, len, sk);
3689
3690                 goto failed;
3691         }
3692
3693         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3694         if (!cmd) {
3695                 err = -ENOMEM;
3696                 goto failed;
3697         }
3698
3699         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3700
3701         hci_req_init(&req, hdev);
3702
3703         if (lmp_bredr_capable(hdev)) {
3704                 update_name(&req);
3705                 update_eir(&req);
3706         }
3707
3708         /* The name is stored in the scan response data and so
3709          * no need to udpate the advertising data here.
3710          */
3711         if (lmp_le_capable(hdev))
3712                 update_scan_rsp_data(&req);
3713
3714         err = hci_req_run(&req, set_name_complete);
3715         if (err < 0)
3716                 mgmt_pending_remove(cmd);
3717
3718 failed:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         struct mgmt_pending_cmd *cmd;
3727         int err;
3728
3729         BT_DBG("%s", hdev->name);
3730
3731         hci_dev_lock(hdev);
3732
3733         if (!hdev_is_powered(hdev)) {
3734                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3735                                       MGMT_STATUS_NOT_POWERED);
3736                 goto unlock;
3737         }
3738
3739         if (!lmp_ssp_capable(hdev)) {
3740                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3741                                       MGMT_STATUS_NOT_SUPPORTED);
3742                 goto unlock;
3743         }
3744
3745         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3747                                       MGMT_STATUS_BUSY);
3748                 goto unlock;
3749         }
3750
3751         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3752         if (!cmd) {
3753                 err = -ENOMEM;
3754                 goto unlock;
3755         }
3756
3757         if (bredr_sc_enabled(hdev))
3758                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3759                                    0, NULL);
3760         else
3761                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3762
3763         if (err < 0)
3764                 mgmt_pending_remove(cmd);
3765
3766 unlock:
3767         hci_dev_unlock(hdev);
3768         return err;
3769 }
3770
3771 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3772                                void *data, u16 len)
3773 {
3774         struct mgmt_addr_info *addr = data;
3775         int err;
3776
3777         BT_DBG("%s ", hdev->name);
3778
3779         if (!bdaddr_type_is_valid(addr->type))
3780                 return mgmt_cmd_complete(sk, hdev->id,
3781                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3782                                          MGMT_STATUS_INVALID_PARAMS,
3783                                          addr, sizeof(*addr));
3784
3785         hci_dev_lock(hdev);
3786
3787         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3788                 struct mgmt_cp_add_remote_oob_data *cp = data;
3789                 u8 status;
3790
3791                 if (cp->addr.type != BDADDR_BREDR) {
3792                         err = mgmt_cmd_complete(sk, hdev->id,
3793                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3794                                                 MGMT_STATUS_INVALID_PARAMS,
3795                                                 &cp->addr, sizeof(cp->addr));
3796                         goto unlock;
3797                 }
3798
3799                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3800                                               cp->addr.type, cp->hash,
3801                                               cp->rand, NULL, NULL);
3802                 if (err < 0)
3803                         status = MGMT_STATUS_FAILED;
3804                 else
3805                         status = MGMT_STATUS_SUCCESS;
3806
3807                 err = mgmt_cmd_complete(sk, hdev->id,
3808                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3809                                         &cp->addr, sizeof(cp->addr));
3810         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3811                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3812                 u8 *rand192, *hash192, *rand256, *hash256;
3813                 u8 status;
3814
3815                 if (bdaddr_type_is_le(cp->addr.type)) {
3816                         /* Enforce zero-valued 192-bit parameters as
3817                          * long as legacy SMP OOB isn't implemented.
3818                          */
3819                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3820                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3821                                 err = mgmt_cmd_complete(sk, hdev->id,
3822                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3823                                                         MGMT_STATUS_INVALID_PARAMS,
3824                                                         addr, sizeof(*addr));
3825                                 goto unlock;
3826                         }
3827
3828                         rand192 = NULL;
3829                         hash192 = NULL;
3830                 } else {
3831                         /* In case one of the P-192 values is set to zero,
3832                          * then just disable OOB data for P-192.
3833                          */
3834                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3835                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3836                                 rand192 = NULL;
3837                                 hash192 = NULL;
3838                         } else {
3839                                 rand192 = cp->rand192;
3840                                 hash192 = cp->hash192;
3841                         }
3842                 }
3843
3844                 /* In case one of the P-256 values is set to zero, then just
3845                  * disable OOB data for P-256.
3846                  */
3847                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3848                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3849                         rand256 = NULL;
3850                         hash256 = NULL;
3851                 } else {
3852                         rand256 = cp->rand256;
3853                         hash256 = cp->hash256;
3854                 }
3855
3856                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3857                                               cp->addr.type, hash192, rand192,
3858                                               hash256, rand256);
3859                 if (err < 0)
3860                         status = MGMT_STATUS_FAILED;
3861                 else
3862                         status = MGMT_STATUS_SUCCESS;
3863
3864                 err = mgmt_cmd_complete(sk, hdev->id,
3865                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3866                                         status, &cp->addr, sizeof(cp->addr));
3867         } else {
3868                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3869                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3870                                       MGMT_STATUS_INVALID_PARAMS);
3871         }
3872
3873 unlock:
3874         hci_dev_unlock(hdev);
3875         return err;
3876 }
3877
3878 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3879                                   void *data, u16 len)
3880 {
3881         struct mgmt_cp_remove_remote_oob_data *cp = data;
3882         u8 status;
3883         int err;
3884
3885         BT_DBG("%s", hdev->name);
3886
3887         if (cp->addr.type != BDADDR_BREDR)
3888                 return mgmt_cmd_complete(sk, hdev->id,
3889                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3890                                          MGMT_STATUS_INVALID_PARAMS,
3891                                          &cp->addr, sizeof(cp->addr));
3892
3893         hci_dev_lock(hdev);
3894
3895         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3896                 hci_remote_oob_data_clear(hdev);
3897                 status = MGMT_STATUS_SUCCESS;
3898                 goto done;
3899         }
3900
3901         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3902         if (err < 0)
3903                 status = MGMT_STATUS_INVALID_PARAMS;
3904         else
3905                 status = MGMT_STATUS_SUCCESS;
3906
3907 done:
3908         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3909                                 status, &cp->addr, sizeof(cp->addr));
3910
3911         hci_dev_unlock(hdev);
3912         return err;
3913 }
3914
3915 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
3916 {
3917         struct hci_dev *hdev = req->hdev;
3918         struct hci_cp_inquiry cp;
3919         /* General inquiry access code (GIAC) */
3920         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3921
3922         *status = mgmt_bredr_support(hdev);
3923         if (*status)
3924                 return false;
3925
3926         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3927                 *status = MGMT_STATUS_BUSY;
3928                 return false;
3929         }
3930
3931         hci_inquiry_cache_flush(hdev);
3932
3933         memset(&cp, 0, sizeof(cp));
3934         memcpy(&cp.lap, lap, sizeof(cp.lap));
3935         cp.length = DISCOV_BREDR_INQUIRY_LEN;
3936
3937         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3938
3939         return true;
3940 }
3941
3942 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
3943 {
3944         struct hci_dev *hdev = req->hdev;
3945         struct hci_cp_le_set_scan_param param_cp;
3946         struct hci_cp_le_set_scan_enable enable_cp;
3947         u8 own_addr_type;
3948         int err;
3949
3950         *status = mgmt_le_support(hdev);
3951         if (*status)
3952                 return false;
3953
3954         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
3955                 /* Don't let discovery abort an outgoing connection attempt
3956                  * that's using directed advertising.
3957                  */
3958                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3959                         *status = MGMT_STATUS_REJECTED;
3960                         return false;
3961                 }
3962
3963                 disable_advertising(req);
3964         }
3965
3966         /* If controller is scanning, it means the background scanning is
3967          * running. Thus, we should temporarily stop it in order to set the
3968          * discovery scanning parameters.
3969          */
3970         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
3971                 hci_req_add_le_scan_disable(req);
3972
3973         /* All active scans will be done with either a resolvable private
3974          * address (when privacy feature has been enabled) or non-resolvable
3975          * private address.
3976          */
3977         err = hci_update_random_address(req, true, &own_addr_type);
3978         if (err < 0) {
3979                 *status = MGMT_STATUS_FAILED;
3980                 return false;
3981         }
3982
3983         memset(&param_cp, 0, sizeof(param_cp));
3984         param_cp.type = LE_SCAN_ACTIVE;
3985         param_cp.interval = cpu_to_le16(interval);
3986         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3987         param_cp.own_address_type = own_addr_type;
3988
3989         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3990                     &param_cp);
3991
3992         memset(&enable_cp, 0, sizeof(enable_cp));
3993         enable_cp.enable = LE_SCAN_ENABLE;
3994         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3995
3996         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3997                     &enable_cp);
3998
3999         return true;
4000 }
4001
4002 static bool trigger_discovery(struct hci_request *req, u8 *status)
4003 {
4004         struct hci_dev *hdev = req->hdev;
4005
4006         switch (hdev->discovery.type) {
4007         case DISCOV_TYPE_BREDR:
4008                 if (!trigger_bredr_inquiry(req, status))
4009                         return false;
4010                 break;
4011
4012         case DISCOV_TYPE_INTERLEAVED:
4013                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4014                              &hdev->quirks)) {
4015                         /* During simultaneous discovery, we double LE scan
4016                          * interval. We must leave some time for the controller
4017                          * to do BR/EDR inquiry.
4018                          */
4019                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4020                                              status))
4021                                 return false;
4022
4023                         if (!trigger_bredr_inquiry(req, status))
4024                                 return false;
4025
4026                         return true;
4027                 }
4028
4029                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4030                         *status = MGMT_STATUS_NOT_SUPPORTED;
4031                         return false;
4032                 }
4033                 /* fall through */
4034
4035         case DISCOV_TYPE_LE:
4036                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4037                         return false;
4038                 break;
4039
4040         default:
4041                 *status = MGMT_STATUS_INVALID_PARAMS;
4042                 return false;
4043         }
4044
4045         return true;
4046 }
4047
4048 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4049                                      u16 opcode)
4050 {
4051         struct mgmt_pending_cmd *cmd;
4052         unsigned long timeout;
4053
4054         BT_DBG("status %d", status);
4055
4056         hci_dev_lock(hdev);
4057
4058         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4059         if (!cmd)
4060                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4061
4062         if (cmd) {
4063                 cmd->cmd_complete(cmd, mgmt_status(status));
4064                 mgmt_pending_remove(cmd);
4065         }
4066
4067         if (status) {
4068                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4069                 goto unlock;
4070         }
4071
4072         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4073
4074         /* If the scan involves LE scan, pick proper timeout to schedule
4075          * hdev->le_scan_disable that will stop it.
4076          */
4077         switch (hdev->discovery.type) {
4078         case DISCOV_TYPE_LE:
4079                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4080                 break;
4081         case DISCOV_TYPE_INTERLEAVED:
4082                  /* When running simultaneous discovery, the LE scanning time
4083                  * should occupy the whole discovery time sine BR/EDR inquiry
4084                  * and LE scanning are scheduled by the controller.
4085                  *
4086                  * For interleaving discovery in comparison, BR/EDR inquiry
4087                  * and LE scanning are done sequentially with separate
4088                  * timeouts.
4089                  */
4090                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4091                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4092                 else
4093                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4094                 break;
4095         case DISCOV_TYPE_BREDR:
4096                 timeout = 0;
4097                 break;
4098         default:
4099                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4100                 timeout = 0;
4101                 break;
4102         }
4103
4104         if (timeout) {
4105                 /* When service discovery is used and the controller has
4106                  * a strict duplicate filter, it is important to remember
4107                  * the start and duration of the scan. This is required
4108                  * for restarting scanning during the discovery phase.
4109                  */
4110                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4111                              &hdev->quirks) &&
4112                     hdev->discovery.result_filtering) {
4113                         hdev->discovery.scan_start = jiffies;
4114                         hdev->discovery.scan_duration = timeout;
4115                 }
4116
4117                 queue_delayed_work(hdev->workqueue,
4118                                    &hdev->le_scan_disable, timeout);
4119         }
4120
4121 unlock:
4122         hci_dev_unlock(hdev);
4123 }
4124
4125 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4126                            void *data, u16 len)
4127 {
4128         struct mgmt_cp_start_discovery *cp = data;
4129         struct mgmt_pending_cmd *cmd;
4130         struct hci_request req;
4131         u8 status;
4132         int err;
4133
4134         BT_DBG("%s", hdev->name);
4135
4136         hci_dev_lock(hdev);
4137
4138         if (!hdev_is_powered(hdev)) {
4139                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4140                                         MGMT_STATUS_NOT_POWERED,
4141                                         &cp->type, sizeof(cp->type));
4142                 goto failed;
4143         }
4144
4145         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4146             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4148                                         MGMT_STATUS_BUSY, &cp->type,
4149                                         sizeof(cp->type));
4150                 goto failed;
4151         }
4152
4153         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4154         if (!cmd) {
4155                 err = -ENOMEM;
4156                 goto failed;
4157         }
4158
4159         cmd->cmd_complete = generic_cmd_complete;
4160
4161         /* Clear the discovery filter first to free any previously
4162          * allocated memory for the UUID list.
4163          */
4164         hci_discovery_filter_clear(hdev);
4165
4166         hdev->discovery.type = cp->type;
4167         hdev->discovery.report_invalid_rssi = false;
4168
4169         hci_req_init(&req, hdev);
4170
4171         if (!trigger_discovery(&req, &status)) {
4172                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4173                                         status, &cp->type, sizeof(cp->type));
4174                 mgmt_pending_remove(cmd);
4175                 goto failed;
4176         }
4177
4178         err = hci_req_run(&req, start_discovery_complete);
4179         if (err < 0) {
4180                 mgmt_pending_remove(cmd);
4181                 goto failed;
4182         }
4183
4184         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4185
4186 failed:
4187         hci_dev_unlock(hdev);
4188         return err;
4189 }
4190
4191 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4192                                           u8 status)
4193 {
4194         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4195                                  cmd->param, 1);
4196 }
4197
4198 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4199                                    void *data, u16 len)
4200 {
4201         struct mgmt_cp_start_service_discovery *cp = data;
4202         struct mgmt_pending_cmd *cmd;
4203         struct hci_request req;
4204         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4205         u16 uuid_count, expected_len;
4206         u8 status;
4207         int err;
4208
4209         BT_DBG("%s", hdev->name);
4210
4211         hci_dev_lock(hdev);
4212
4213         if (!hdev_is_powered(hdev)) {
4214                 err = mgmt_cmd_complete(sk, hdev->id,
4215                                         MGMT_OP_START_SERVICE_DISCOVERY,
4216                                         MGMT_STATUS_NOT_POWERED,
4217                                         &cp->type, sizeof(cp->type));
4218                 goto failed;
4219         }
4220
4221         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4222             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4223                 err = mgmt_cmd_complete(sk, hdev->id,
4224                                         MGMT_OP_START_SERVICE_DISCOVERY,
4225                                         MGMT_STATUS_BUSY, &cp->type,
4226                                         sizeof(cp->type));
4227                 goto failed;
4228         }
4229
4230         uuid_count = __le16_to_cpu(cp->uuid_count);
4231         if (uuid_count > max_uuid_count) {
4232                 BT_ERR("service_discovery: too big uuid_count value %u",
4233                        uuid_count);
4234                 err = mgmt_cmd_complete(sk, hdev->id,
4235                                         MGMT_OP_START_SERVICE_DISCOVERY,
4236                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4237                                         sizeof(cp->type));
4238                 goto failed;
4239         }
4240
4241         expected_len = sizeof(*cp) + uuid_count * 16;
4242         if (expected_len != len) {
4243                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4244                        expected_len, len);
4245                 err = mgmt_cmd_complete(sk, hdev->id,
4246                                         MGMT_OP_START_SERVICE_DISCOVERY,
4247                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4248                                         sizeof(cp->type));
4249                 goto failed;
4250         }
4251
4252         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4253                                hdev, data, len);
4254         if (!cmd) {
4255                 err = -ENOMEM;
4256                 goto failed;
4257         }
4258
4259         cmd->cmd_complete = service_discovery_cmd_complete;
4260
4261         /* Clear the discovery filter first to free any previously
4262          * allocated memory for the UUID list.
4263          */
4264         hci_discovery_filter_clear(hdev);
4265
4266         hdev->discovery.result_filtering = true;
4267         hdev->discovery.type = cp->type;
4268         hdev->discovery.rssi = cp->rssi;
4269         hdev->discovery.uuid_count = uuid_count;
4270
4271         if (uuid_count > 0) {
4272                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4273                                                 GFP_KERNEL);
4274                 if (!hdev->discovery.uuids) {
4275                         err = mgmt_cmd_complete(sk, hdev->id,
4276                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4277                                                 MGMT_STATUS_FAILED,
4278                                                 &cp->type, sizeof(cp->type));
4279                         mgmt_pending_remove(cmd);
4280                         goto failed;
4281                 }
4282         }
4283
4284         hci_req_init(&req, hdev);
4285
4286         if (!trigger_discovery(&req, &status)) {
4287                 err = mgmt_cmd_complete(sk, hdev->id,
4288                                         MGMT_OP_START_SERVICE_DISCOVERY,
4289                                         status, &cp->type, sizeof(cp->type));
4290                 mgmt_pending_remove(cmd);
4291                 goto failed;
4292         }
4293
4294         err = hci_req_run(&req, start_discovery_complete);
4295         if (err < 0) {
4296                 mgmt_pending_remove(cmd);
4297                 goto failed;
4298         }
4299
4300         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4301
4302 failed:
4303         hci_dev_unlock(hdev);
4304         return err;
4305 }
4306
4307 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4308 {
4309         struct mgmt_pending_cmd *cmd;
4310
4311         BT_DBG("status %d", status);
4312
4313         hci_dev_lock(hdev);
4314
4315         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4316         if (cmd) {
4317                 cmd->cmd_complete(cmd, mgmt_status(status));
4318                 mgmt_pending_remove(cmd);
4319         }
4320
4321         if (!status)
4322                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4323
4324         hci_dev_unlock(hdev);
4325 }
4326
4327 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4328                           u16 len)
4329 {
4330         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4331         struct mgmt_pending_cmd *cmd;
4332         struct hci_request req;
4333         int err;
4334
4335         BT_DBG("%s", hdev->name);
4336
4337         hci_dev_lock(hdev);
4338
4339         if (!hci_discovery_active(hdev)) {
4340                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4341                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4342                                         sizeof(mgmt_cp->type));
4343                 goto unlock;
4344         }
4345
4346         if (hdev->discovery.type != mgmt_cp->type) {
4347                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4348                                         MGMT_STATUS_INVALID_PARAMS,
4349                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4350                 goto unlock;
4351         }
4352
4353         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4354         if (!cmd) {
4355                 err = -ENOMEM;
4356                 goto unlock;
4357         }
4358
4359         cmd->cmd_complete = generic_cmd_complete;
4360
4361         hci_req_init(&req, hdev);
4362
4363         hci_stop_discovery(&req);
4364
4365         err = hci_req_run(&req, stop_discovery_complete);
4366         if (!err) {
4367                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4368                 goto unlock;
4369         }
4370
4371         mgmt_pending_remove(cmd);
4372
4373         /* If no HCI commands were sent we're done */
4374         if (err == -ENODATA) {
4375                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4376                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4377                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4378         }
4379
4380 unlock:
4381         hci_dev_unlock(hdev);
4382         return err;
4383 }
4384
4385 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4386                         u16 len)
4387 {
4388         struct mgmt_cp_confirm_name *cp = data;
4389         struct inquiry_entry *e;
4390         int err;
4391
4392         BT_DBG("%s", hdev->name);
4393
4394         hci_dev_lock(hdev);
4395
4396         if (!hci_discovery_active(hdev)) {
4397                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4398                                         MGMT_STATUS_FAILED, &cp->addr,
4399                                         sizeof(cp->addr));
4400                 goto failed;
4401         }
4402
4403         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4404         if (!e) {
4405                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4406                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4407                                         sizeof(cp->addr));
4408                 goto failed;
4409         }
4410
4411         if (cp->name_known) {
4412                 e->name_state = NAME_KNOWN;
4413                 list_del(&e->list);
4414         } else {
4415                 e->name_state = NAME_NEEDED;
4416                 hci_inquiry_cache_update_resolve(hdev, e);
4417         }
4418
4419         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4420                                 &cp->addr, sizeof(cp->addr));
4421
4422 failed:
4423         hci_dev_unlock(hdev);
4424         return err;
4425 }
4426
4427 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4428                         u16 len)
4429 {
4430         struct mgmt_cp_block_device *cp = data;
4431         u8 status;
4432         int err;
4433
4434         BT_DBG("%s", hdev->name);
4435
4436         if (!bdaddr_type_is_valid(cp->addr.type))
4437                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4438                                          MGMT_STATUS_INVALID_PARAMS,
4439                                          &cp->addr, sizeof(cp->addr));
4440
4441         hci_dev_lock(hdev);
4442
4443         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4444                                   cp->addr.type);
4445         if (err < 0) {
4446                 status = MGMT_STATUS_FAILED;
4447                 goto done;
4448         }
4449
4450         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4451                    sk);
4452         status = MGMT_STATUS_SUCCESS;
4453
4454 done:
4455         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4456                                 &cp->addr, sizeof(cp->addr));
4457
4458         hci_dev_unlock(hdev);
4459
4460         return err;
4461 }
4462
4463 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4464                           u16 len)
4465 {
4466         struct mgmt_cp_unblock_device *cp = data;
4467         u8 status;
4468         int err;
4469
4470         BT_DBG("%s", hdev->name);
4471
4472         if (!bdaddr_type_is_valid(cp->addr.type))
4473                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4474                                          MGMT_STATUS_INVALID_PARAMS,
4475                                          &cp->addr, sizeof(cp->addr));
4476
4477         hci_dev_lock(hdev);
4478
4479         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4480                                   cp->addr.type);
4481         if (err < 0) {
4482                 status = MGMT_STATUS_INVALID_PARAMS;
4483                 goto done;
4484         }
4485
4486         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4487                    sk);
4488         status = MGMT_STATUS_SUCCESS;
4489
4490 done:
4491         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4492                                 &cp->addr, sizeof(cp->addr));
4493
4494         hci_dev_unlock(hdev);
4495
4496         return err;
4497 }
4498
4499 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4500                          u16 len)
4501 {
4502         struct mgmt_cp_set_device_id *cp = data;
4503         struct hci_request req;
4504         int err;
4505         __u16 source;
4506
4507         BT_DBG("%s", hdev->name);
4508
4509         source = __le16_to_cpu(cp->source);
4510
4511         if (source > 0x0002)
4512                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4513                                        MGMT_STATUS_INVALID_PARAMS);
4514
4515         hci_dev_lock(hdev);
4516
4517         hdev->devid_source = source;
4518         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4519         hdev->devid_product = __le16_to_cpu(cp->product);
4520         hdev->devid_version = __le16_to_cpu(cp->version);
4521
4522         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4523                                 NULL, 0);
4524
4525         hci_req_init(&req, hdev);
4526         update_eir(&req);
4527         hci_req_run(&req, NULL);
4528
4529         hci_dev_unlock(hdev);
4530
4531         return err;
4532 }
4533
4534 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4535                                         u16 opcode)
4536 {
4537         BT_DBG("status %d", status);
4538 }
4539
4540 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4541                                      u16 opcode)
4542 {
4543         struct cmd_lookup match = { NULL, hdev };
4544         struct hci_request req;
4545
4546         hci_dev_lock(hdev);
4547
4548         if (status) {
4549                 u8 mgmt_err = mgmt_status(status);
4550
4551                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4552                                      cmd_status_rsp, &mgmt_err);
4553                 goto unlock;
4554         }
4555
4556         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4557                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4558         else
4559                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4560
4561         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4562                              &match);
4563
4564         new_settings(hdev, match.sk);
4565
4566         if (match.sk)
4567                 sock_put(match.sk);
4568
4569         /* If "Set Advertising" was just disabled and instance advertising was
4570          * set up earlier, then enable the advertising instance.
4571          */
4572         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4573             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4574                 goto unlock;
4575
4576         hci_req_init(&req, hdev);
4577
4578         update_adv_data(&req);
4579         enable_advertising(&req);
4580
4581         if (hci_req_run(&req, enable_advertising_instance) < 0)
4582                 BT_ERR("Failed to re-configure advertising");
4583
4584 unlock:
4585         hci_dev_unlock(hdev);
4586 }
4587
4588 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4589                            u16 len)
4590 {
4591         struct mgmt_mode *cp = data;
4592         struct mgmt_pending_cmd *cmd;
4593         struct hci_request req;
4594         u8 val, status;
4595         int err;
4596
4597         BT_DBG("request for %s", hdev->name);
4598
4599         status = mgmt_le_support(hdev);
4600         if (status)
4601                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4602                                        status);
4603
4604         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4605                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4606                                        MGMT_STATUS_INVALID_PARAMS);
4607
4608         hci_dev_lock(hdev);
4609
4610         val = !!cp->val;
4611
4612         /* The following conditions are ones which mean that we should
4613          * not do any HCI communication but directly send a mgmt
4614          * response to user space (after toggling the flag if
4615          * necessary).
4616          */
4617         if (!hdev_is_powered(hdev) ||
4618             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4619              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4620             hci_conn_num(hdev, LE_LINK) > 0 ||
4621             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4622              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4623                 bool changed;
4624
4625                 if (cp->val) {
4626                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4627                         if (cp->val == 0x02)
4628                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4629                         else
4630                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4631                 } else {
4632                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4633                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4634                 }
4635
4636                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4637                 if (err < 0)
4638                         goto unlock;
4639
4640                 if (changed)
4641                         err = new_settings(hdev, sk);
4642
4643                 goto unlock;
4644         }
4645
4646         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4647             pending_find(MGMT_OP_SET_LE, hdev)) {
4648                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4649                                       MGMT_STATUS_BUSY);
4650                 goto unlock;
4651         }
4652
4653         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4654         if (!cmd) {
4655                 err = -ENOMEM;
4656                 goto unlock;
4657         }
4658
4659         hci_req_init(&req, hdev);
4660
4661         if (cp->val == 0x02)
4662                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4663         else
4664                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4665
4666         if (val) {
4667                 /* Switch to instance "0" for the Set Advertising setting. */
4668                 update_adv_data_for_instance(&req, 0);
4669                 update_scan_rsp_data_for_instance(&req, 0);
4670                 enable_advertising(&req);
4671         } else {
4672                 disable_advertising(&req);
4673         }
4674
4675         err = hci_req_run(&req, set_advertising_complete);
4676         if (err < 0)
4677                 mgmt_pending_remove(cmd);
4678
4679 unlock:
4680         hci_dev_unlock(hdev);
4681         return err;
4682 }
4683
4684 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4685                               void *data, u16 len)
4686 {
4687         struct mgmt_cp_set_static_address *cp = data;
4688         int err;
4689
4690         BT_DBG("%s", hdev->name);
4691
4692         if (!lmp_le_capable(hdev))
4693                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4694                                        MGMT_STATUS_NOT_SUPPORTED);
4695
4696         if (hdev_is_powered(hdev))
4697                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4698                                        MGMT_STATUS_REJECTED);
4699
4700         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4701                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4702                         return mgmt_cmd_status(sk, hdev->id,
4703                                                MGMT_OP_SET_STATIC_ADDRESS,
4704                                                MGMT_STATUS_INVALID_PARAMS);
4705
4706                 /* Two most significant bits shall be set */
4707                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4708                         return mgmt_cmd_status(sk, hdev->id,
4709                                                MGMT_OP_SET_STATIC_ADDRESS,
4710                                                MGMT_STATUS_INVALID_PARAMS);
4711         }
4712
4713         hci_dev_lock(hdev);
4714
4715         bacpy(&hdev->static_addr, &cp->bdaddr);
4716
4717         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4718         if (err < 0)
4719                 goto unlock;
4720
4721         err = new_settings(hdev, sk);
4722
4723 unlock:
4724         hci_dev_unlock(hdev);
4725         return err;
4726 }
4727
4728 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4729                            void *data, u16 len)
4730 {
4731         struct mgmt_cp_set_scan_params *cp = data;
4732         __u16 interval, window;
4733         int err;
4734
4735         BT_DBG("%s", hdev->name);
4736
4737         if (!lmp_le_capable(hdev))
4738                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4739                                        MGMT_STATUS_NOT_SUPPORTED);
4740
4741         interval = __le16_to_cpu(cp->interval);
4742
4743         if (interval < 0x0004 || interval > 0x4000)
4744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4745                                        MGMT_STATUS_INVALID_PARAMS);
4746
4747         window = __le16_to_cpu(cp->window);
4748
4749         if (window < 0x0004 || window > 0x4000)
4750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4751                                        MGMT_STATUS_INVALID_PARAMS);
4752
4753         if (window > interval)
4754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4755                                        MGMT_STATUS_INVALID_PARAMS);
4756
4757         hci_dev_lock(hdev);
4758
4759         hdev->le_scan_interval = interval;
4760         hdev->le_scan_window = window;
4761
4762         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4763                                 NULL, 0);
4764
4765         /* If background scan is running, restart it so new parameters are
4766          * loaded.
4767          */
4768         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4769             hdev->discovery.state == DISCOVERY_STOPPED) {
4770                 struct hci_request req;
4771
4772                 hci_req_init(&req, hdev);
4773
4774                 hci_req_add_le_scan_disable(&req);
4775                 hci_req_add_le_passive_scan(&req);
4776
4777                 hci_req_run(&req, NULL);
4778         }
4779
4780         hci_dev_unlock(hdev);
4781
4782         return err;
4783 }
4784
4785 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4786                                       u16 opcode)
4787 {
4788         struct mgmt_pending_cmd *cmd;
4789
4790         BT_DBG("status 0x%02x", status);
4791
4792         hci_dev_lock(hdev);
4793
4794         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4795         if (!cmd)
4796                 goto unlock;
4797
4798         if (status) {
4799                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4800                                 mgmt_status(status));
4801         } else {
4802                 struct mgmt_mode *cp = cmd->param;
4803
4804                 if (cp->val)
4805                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4806                 else
4807                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4808
4809                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4810                 new_settings(hdev, cmd->sk);
4811         }
4812
4813         mgmt_pending_remove(cmd);
4814
4815 unlock:
4816         hci_dev_unlock(hdev);
4817 }
4818
4819 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4820                                 void *data, u16 len)
4821 {
4822         struct mgmt_mode *cp = data;
4823         struct mgmt_pending_cmd *cmd;
4824         struct hci_request req;
4825         int err;
4826
4827         BT_DBG("%s", hdev->name);
4828
4829         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4830             hdev->hci_ver < BLUETOOTH_VER_1_2)
4831                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4832                                        MGMT_STATUS_NOT_SUPPORTED);
4833
4834         if (cp->val != 0x00 && cp->val != 0x01)
4835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4836                                        MGMT_STATUS_INVALID_PARAMS);
4837
4838         hci_dev_lock(hdev);
4839
4840         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4841                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4842                                       MGMT_STATUS_BUSY);
4843                 goto unlock;
4844         }
4845
4846         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4847                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4848                                         hdev);
4849                 goto unlock;
4850         }
4851
4852         if (!hdev_is_powered(hdev)) {
4853                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4854                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4855                                         hdev);
4856                 new_settings(hdev, sk);
4857                 goto unlock;
4858         }
4859
4860         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4861                                data, len);
4862         if (!cmd) {
4863                 err = -ENOMEM;
4864                 goto unlock;
4865         }
4866
4867         hci_req_init(&req, hdev);
4868
4869         write_fast_connectable(&req, cp->val);
4870
4871         err = hci_req_run(&req, fast_connectable_complete);
4872         if (err < 0) {
4873                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4874                                       MGMT_STATUS_FAILED);
4875                 mgmt_pending_remove(cmd);
4876         }
4877
4878 unlock:
4879         hci_dev_unlock(hdev);
4880
4881         return err;
4882 }
4883
4884 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4885 {
4886         struct mgmt_pending_cmd *cmd;
4887
4888         BT_DBG("status 0x%02x", status);
4889
4890         hci_dev_lock(hdev);
4891
4892         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4893         if (!cmd)
4894                 goto unlock;
4895
4896         if (status) {
4897                 u8 mgmt_err = mgmt_status(status);
4898
4899                 /* We need to restore the flag if related HCI commands
4900                  * failed.
4901                  */
4902                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4903
4904                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4905         } else {
4906                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4907                 new_settings(hdev, cmd->sk);
4908         }
4909
4910         mgmt_pending_remove(cmd);
4911
4912 unlock:
4913         hci_dev_unlock(hdev);
4914 }
4915
4916 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4917 {
4918         struct mgmt_mode *cp = data;
4919         struct mgmt_pending_cmd *cmd;
4920         struct hci_request req;
4921         int err;
4922
4923         BT_DBG("request for %s", hdev->name);
4924
4925         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4927                                        MGMT_STATUS_NOT_SUPPORTED);
4928
4929         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4931                                        MGMT_STATUS_REJECTED);
4932
4933         if (cp->val != 0x00 && cp->val != 0x01)
4934                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4935                                        MGMT_STATUS_INVALID_PARAMS);
4936
4937         hci_dev_lock(hdev);
4938
4939         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4940                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4941                 goto unlock;
4942         }
4943
4944         if (!hdev_is_powered(hdev)) {
4945                 if (!cp->val) {
4946                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4947                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4948                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4949                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4950                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4951                 }
4952
4953                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4954
4955                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4956                 if (err < 0)
4957                         goto unlock;
4958
4959                 err = new_settings(hdev, sk);
4960                 goto unlock;
4961         }
4962
4963         /* Reject disabling when powered on */
4964         if (!cp->val) {
4965                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4966                                       MGMT_STATUS_REJECTED);
4967                 goto unlock;
4968         } else {
4969                 /* When configuring a dual-mode controller to operate
4970                  * with LE only and using a static address, then switching
4971                  * BR/EDR back on is not allowed.
4972                  *
4973                  * Dual-mode controllers shall operate with the public
4974                  * address as its identity address for BR/EDR and LE. So
4975                  * reject the attempt to create an invalid configuration.
4976                  *
4977                  * The same restrictions applies when secure connections
4978                  * has been enabled. For BR/EDR this is a controller feature
4979                  * while for LE it is a host stack feature. This means that
4980                  * switching BR/EDR back on when secure connections has been
4981                  * enabled is not a supported transaction.
4982                  */
4983                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4984                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4985                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4986                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4987                                               MGMT_STATUS_REJECTED);
4988                         goto unlock;
4989                 }
4990         }
4991
4992         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4994                                       MGMT_STATUS_BUSY);
4995                 goto unlock;
4996         }
4997
4998         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4999         if (!cmd) {
5000                 err = -ENOMEM;
5001                 goto unlock;
5002         }
5003
5004         /* We need to flip the bit already here so that update_adv_data
5005          * generates the correct flags.
5006          */
5007         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5008
5009         hci_req_init(&req, hdev);
5010
5011         write_fast_connectable(&req, false);
5012         __hci_update_page_scan(&req);
5013
5014         /* Since only the advertising data flags will change, there
5015          * is no need to update the scan response data.
5016          */
5017         update_adv_data(&req);
5018
5019         err = hci_req_run(&req, set_bredr_complete);
5020         if (err < 0)
5021                 mgmt_pending_remove(cmd);
5022
5023 unlock:
5024         hci_dev_unlock(hdev);
5025         return err;
5026 }
5027
5028 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5029 {
5030         struct mgmt_pending_cmd *cmd;
5031         struct mgmt_mode *cp;
5032
5033         BT_DBG("%s status %u", hdev->name, status);
5034
5035         hci_dev_lock(hdev);
5036
5037         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5038         if (!cmd)
5039                 goto unlock;
5040
5041         if (status) {
5042                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5043                                 mgmt_status(status));
5044                 goto remove;
5045         }
5046
5047         cp = cmd->param;
5048
5049         switch (cp->val) {
5050         case 0x00:
5051                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5052                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5053                 break;
5054         case 0x01:
5055                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5056                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5057                 break;
5058         case 0x02:
5059                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5060                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5061                 break;
5062         }
5063
5064         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5065         new_settings(hdev, cmd->sk);
5066
5067 remove:
5068         mgmt_pending_remove(cmd);
5069 unlock:
5070         hci_dev_unlock(hdev);
5071 }
5072
5073 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5074                            void *data, u16 len)
5075 {
5076         struct mgmt_mode *cp = data;
5077         struct mgmt_pending_cmd *cmd;
5078         struct hci_request req;
5079         u8 val;
5080         int err;
5081
5082         BT_DBG("request for %s", hdev->name);
5083
5084         if (!lmp_sc_capable(hdev) &&
5085             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5086                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5087                                        MGMT_STATUS_NOT_SUPPORTED);
5088
5089         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5090             lmp_sc_capable(hdev) &&
5091             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5092                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5093                                        MGMT_STATUS_REJECTED);
5094
5095         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5096                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5097                                   MGMT_STATUS_INVALID_PARAMS);
5098
5099         hci_dev_lock(hdev);
5100
5101         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5102             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5103                 bool changed;
5104
5105                 if (cp->val) {
5106                         changed = !hci_dev_test_and_set_flag(hdev,
5107                                                              HCI_SC_ENABLED);
5108                         if (cp->val == 0x02)
5109                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5110                         else
5111                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5112                 } else {
5113                         changed = hci_dev_test_and_clear_flag(hdev,
5114                                                               HCI_SC_ENABLED);
5115                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5116                 }
5117
5118                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5119                 if (err < 0)
5120                         goto failed;
5121
5122                 if (changed)
5123                         err = new_settings(hdev, sk);
5124
5125                 goto failed;
5126         }
5127
5128         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5129                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5130                                       MGMT_STATUS_BUSY);
5131                 goto failed;
5132         }
5133
5134         val = !!cp->val;
5135
5136         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5137             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5138                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5139                 goto failed;
5140         }
5141
5142         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5143         if (!cmd) {
5144                 err = -ENOMEM;
5145                 goto failed;
5146         }
5147
5148         hci_req_init(&req, hdev);
5149         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5150         err = hci_req_run(&req, sc_enable_complete);
5151         if (err < 0) {
5152                 mgmt_pending_remove(cmd);
5153                 goto failed;
5154         }
5155
5156 failed:
5157         hci_dev_unlock(hdev);
5158         return err;
5159 }
5160
5161 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5162                           void *data, u16 len)
5163 {
5164         struct mgmt_mode *cp = data;
5165         bool changed, use_changed;
5166         int err;
5167
5168         BT_DBG("request for %s", hdev->name);
5169
5170         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5171                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5172                                        MGMT_STATUS_INVALID_PARAMS);
5173
5174         hci_dev_lock(hdev);
5175
5176         if (cp->val)
5177                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5178         else
5179                 changed = hci_dev_test_and_clear_flag(hdev,
5180                                                       HCI_KEEP_DEBUG_KEYS);
5181
5182         if (cp->val == 0x02)
5183                 use_changed = !hci_dev_test_and_set_flag(hdev,
5184                                                          HCI_USE_DEBUG_KEYS);
5185         else
5186                 use_changed = hci_dev_test_and_clear_flag(hdev,
5187                                                           HCI_USE_DEBUG_KEYS);
5188
5189         if (hdev_is_powered(hdev) && use_changed &&
5190             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5191                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5192                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5193                              sizeof(mode), &mode);
5194         }
5195
5196         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5197         if (err < 0)
5198                 goto unlock;
5199
5200         if (changed)
5201                 err = new_settings(hdev, sk);
5202
5203 unlock:
5204         hci_dev_unlock(hdev);
5205         return err;
5206 }
5207
5208 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5209                        u16 len)
5210 {
5211         struct mgmt_cp_set_privacy *cp = cp_data;
5212         bool changed;
5213         int err;
5214
5215         BT_DBG("request for %s", hdev->name);
5216
5217         if (!lmp_le_capable(hdev))
5218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5219                                        MGMT_STATUS_NOT_SUPPORTED);
5220
5221         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5222                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5223                                        MGMT_STATUS_INVALID_PARAMS);
5224
5225         if (hdev_is_powered(hdev))
5226                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5227                                        MGMT_STATUS_REJECTED);
5228
5229         hci_dev_lock(hdev);
5230
5231         /* If user space supports this command it is also expected to
5232          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5233          */
5234         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5235
5236         if (cp->privacy) {
5237                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5238                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5239                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5240         } else {
5241                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5242                 memset(hdev->irk, 0, sizeof(hdev->irk));
5243                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5244         }
5245
5246         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5247         if (err < 0)
5248                 goto unlock;
5249
5250         if (changed)
5251                 err = new_settings(hdev, sk);
5252
5253 unlock:
5254         hci_dev_unlock(hdev);
5255         return err;
5256 }
5257
5258 static bool irk_is_valid(struct mgmt_irk_info *irk)
5259 {
5260         switch (irk->addr.type) {
5261         case BDADDR_LE_PUBLIC:
5262                 return true;
5263
5264         case BDADDR_LE_RANDOM:
5265                 /* Two most significant bits shall be set */
5266                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5267                         return false;
5268                 return true;
5269         }
5270
5271         return false;
5272 }
5273
5274 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5275                      u16 len)
5276 {
5277         struct mgmt_cp_load_irks *cp = cp_data;
5278         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5279                                    sizeof(struct mgmt_irk_info));
5280         u16 irk_count, expected_len;
5281         int i, err;
5282
5283         BT_DBG("request for %s", hdev->name);
5284
5285         if (!lmp_le_capable(hdev))
5286                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5287                                        MGMT_STATUS_NOT_SUPPORTED);
5288
5289         irk_count = __le16_to_cpu(cp->irk_count);
5290         if (irk_count > max_irk_count) {
5291                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5292                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5293                                        MGMT_STATUS_INVALID_PARAMS);
5294         }
5295
5296         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5297         if (expected_len != len) {
5298                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5299                        expected_len, len);
5300                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5301                                        MGMT_STATUS_INVALID_PARAMS);
5302         }
5303
5304         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5305
5306         for (i = 0; i < irk_count; i++) {
5307                 struct mgmt_irk_info *key = &cp->irks[i];
5308
5309                 if (!irk_is_valid(key))
5310                         return mgmt_cmd_status(sk, hdev->id,
5311                                                MGMT_OP_LOAD_IRKS,
5312                                                MGMT_STATUS_INVALID_PARAMS);
5313         }
5314
5315         hci_dev_lock(hdev);
5316
5317         hci_smp_irks_clear(hdev);
5318
5319         for (i = 0; i < irk_count; i++) {
5320                 struct mgmt_irk_info *irk = &cp->irks[i];
5321                 u8 addr_type;
5322
5323                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5324                         addr_type = ADDR_LE_DEV_PUBLIC;
5325                 else
5326                         addr_type = ADDR_LE_DEV_RANDOM;
5327
5328                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5329                             BDADDR_ANY);
5330         }
5331
5332         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5333
5334         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5335
5336         hci_dev_unlock(hdev);
5337
5338         return err;
5339 }
5340
5341 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5342 {
5343         if (key->master != 0x00 && key->master != 0x01)
5344                 return false;
5345
5346         switch (key->addr.type) {
5347         case BDADDR_LE_PUBLIC:
5348                 return true;
5349
5350         case BDADDR_LE_RANDOM:
5351                 /* Two most significant bits shall be set */
5352                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5353                         return false;
5354                 return true;
5355         }
5356
5357         return false;
5358 }
5359
5360 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5361                                void *cp_data, u16 len)
5362 {
5363         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5364         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5365                                    sizeof(struct mgmt_ltk_info));
5366         u16 key_count, expected_len;
5367         int i, err;
5368
5369         BT_DBG("request for %s", hdev->name);
5370
5371         if (!lmp_le_capable(hdev))
5372                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5373                                        MGMT_STATUS_NOT_SUPPORTED);
5374
5375         key_count = __le16_to_cpu(cp->key_count);
5376         if (key_count > max_key_count) {
5377                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5378                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5379                                        MGMT_STATUS_INVALID_PARAMS);
5380         }
5381
5382         expected_len = sizeof(*cp) + key_count *
5383                                         sizeof(struct mgmt_ltk_info);
5384         if (expected_len != len) {
5385                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5386                        expected_len, len);
5387                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5388                                        MGMT_STATUS_INVALID_PARAMS);
5389         }
5390
5391         BT_DBG("%s key_count %u", hdev->name, key_count);
5392
5393         for (i = 0; i < key_count; i++) {
5394                 struct mgmt_ltk_info *key = &cp->keys[i];
5395
5396                 if (!ltk_is_valid(key))
5397                         return mgmt_cmd_status(sk, hdev->id,
5398                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5399                                                MGMT_STATUS_INVALID_PARAMS);
5400         }
5401
5402         hci_dev_lock(hdev);
5403
5404         hci_smp_ltks_clear(hdev);
5405
5406         for (i = 0; i < key_count; i++) {
5407                 struct mgmt_ltk_info *key = &cp->keys[i];
5408                 u8 type, addr_type, authenticated;
5409
5410                 if (key->addr.type == BDADDR_LE_PUBLIC)
5411                         addr_type = ADDR_LE_DEV_PUBLIC;
5412                 else
5413                         addr_type = ADDR_LE_DEV_RANDOM;
5414
5415                 switch (key->type) {
5416                 case MGMT_LTK_UNAUTHENTICATED:
5417                         authenticated = 0x00;
5418                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5419                         break;
5420                 case MGMT_LTK_AUTHENTICATED:
5421                         authenticated = 0x01;
5422                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5423                         break;
5424                 case MGMT_LTK_P256_UNAUTH:
5425                         authenticated = 0x00;
5426                         type = SMP_LTK_P256;
5427                         break;
5428                 case MGMT_LTK_P256_AUTH:
5429                         authenticated = 0x01;
5430                         type = SMP_LTK_P256;
5431                         break;
5432                 case MGMT_LTK_P256_DEBUG:
5433                         authenticated = 0x00;
5434                         type = SMP_LTK_P256_DEBUG;
5435                 default:
5436                         continue;
5437                 }
5438
5439                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5440                             authenticated, key->val, key->enc_size, key->ediv,
5441                             key->rand);
5442         }
5443
5444         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5445                            NULL, 0);
5446
5447         hci_dev_unlock(hdev);
5448
5449         return err;
5450 }
5451
5452 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5453 {
5454         struct hci_conn *conn = cmd->user_data;
5455         struct mgmt_rp_get_conn_info rp;
5456         int err;
5457
5458         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5459
5460         if (status == MGMT_STATUS_SUCCESS) {
5461                 rp.rssi = conn->rssi;
5462                 rp.tx_power = conn->tx_power;
5463                 rp.max_tx_power = conn->max_tx_power;
5464         } else {
5465                 rp.rssi = HCI_RSSI_INVALID;
5466                 rp.tx_power = HCI_TX_POWER_INVALID;
5467                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5468         }
5469
5470         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5471                                 status, &rp, sizeof(rp));
5472
5473         hci_conn_drop(conn);
5474         hci_conn_put(conn);
5475
5476         return err;
5477 }
5478
5479 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5480                                        u16 opcode)
5481 {
5482         struct hci_cp_read_rssi *cp;
5483         struct mgmt_pending_cmd *cmd;
5484         struct hci_conn *conn;
5485         u16 handle;
5486         u8 status;
5487
5488         BT_DBG("status 0x%02x", hci_status);
5489
5490         hci_dev_lock(hdev);
5491
5492         /* Commands sent in request are either Read RSSI or Read Transmit Power
5493          * Level so we check which one was last sent to retrieve connection
5494          * handle.  Both commands have handle as first parameter so it's safe to
5495          * cast data on the same command struct.
5496          *
5497          * First command sent is always Read RSSI and we fail only if it fails.
5498          * In other case we simply override error to indicate success as we
5499          * already remembered if TX power value is actually valid.
5500          */
5501         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5502         if (!cp) {
5503                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5504                 status = MGMT_STATUS_SUCCESS;
5505         } else {
5506                 status = mgmt_status(hci_status);
5507         }
5508
5509         if (!cp) {
5510                 BT_ERR("invalid sent_cmd in conn_info response");
5511                 goto unlock;
5512         }
5513
5514         handle = __le16_to_cpu(cp->handle);
5515         conn = hci_conn_hash_lookup_handle(hdev, handle);
5516         if (!conn) {
5517                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5518                 goto unlock;
5519         }
5520
5521         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5522         if (!cmd)
5523                 goto unlock;
5524
5525         cmd->cmd_complete(cmd, status);
5526         mgmt_pending_remove(cmd);
5527
5528 unlock:
5529         hci_dev_unlock(hdev);
5530 }
5531
5532 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5533                          u16 len)
5534 {
5535         struct mgmt_cp_get_conn_info *cp = data;
5536         struct mgmt_rp_get_conn_info rp;
5537         struct hci_conn *conn;
5538         unsigned long conn_info_age;
5539         int err = 0;
5540
5541         BT_DBG("%s", hdev->name);
5542
5543         memset(&rp, 0, sizeof(rp));
5544         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5545         rp.addr.type = cp->addr.type;
5546
5547         if (!bdaddr_type_is_valid(cp->addr.type))
5548                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5549                                          MGMT_STATUS_INVALID_PARAMS,
5550                                          &rp, sizeof(rp));
5551
5552         hci_dev_lock(hdev);
5553
5554         if (!hdev_is_powered(hdev)) {
5555                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5556                                         MGMT_STATUS_NOT_POWERED, &rp,
5557                                         sizeof(rp));
5558                 goto unlock;
5559         }
5560
5561         if (cp->addr.type == BDADDR_BREDR)
5562                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5563                                                &cp->addr.bdaddr);
5564         else
5565                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5566
5567         if (!conn || conn->state != BT_CONNECTED) {
5568                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5569                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5570                                         sizeof(rp));
5571                 goto unlock;
5572         }
5573
5574         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5575                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5576                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5577                 goto unlock;
5578         }
5579
5580         /* To avoid client trying to guess when to poll again for information we
5581          * calculate conn info age as random value between min/max set in hdev.
5582          */
5583         conn_info_age = hdev->conn_info_min_age +
5584                         prandom_u32_max(hdev->conn_info_max_age -
5585                                         hdev->conn_info_min_age);
5586
5587         /* Query controller to refresh cached values if they are too old or were
5588          * never read.
5589          */
5590         if (time_after(jiffies, conn->conn_info_timestamp +
5591                        msecs_to_jiffies(conn_info_age)) ||
5592             !conn->conn_info_timestamp) {
5593                 struct hci_request req;
5594                 struct hci_cp_read_tx_power req_txp_cp;
5595                 struct hci_cp_read_rssi req_rssi_cp;
5596                 struct mgmt_pending_cmd *cmd;
5597
5598                 hci_req_init(&req, hdev);
5599                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5600                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5601                             &req_rssi_cp);
5602
5603                 /* For LE links TX power does not change thus we don't need to
5604                  * query for it once value is known.
5605                  */
5606                 if (!bdaddr_type_is_le(cp->addr.type) ||
5607                     conn->tx_power == HCI_TX_POWER_INVALID) {
5608                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5609                         req_txp_cp.type = 0x00;
5610                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5611                                     sizeof(req_txp_cp), &req_txp_cp);
5612                 }
5613
5614                 /* Max TX power needs to be read only once per connection */
5615                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5616                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5617                         req_txp_cp.type = 0x01;
5618                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5619                                     sizeof(req_txp_cp), &req_txp_cp);
5620                 }
5621
5622                 err = hci_req_run(&req, conn_info_refresh_complete);
5623                 if (err < 0)
5624                         goto unlock;
5625
5626                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5627                                        data, len);
5628                 if (!cmd) {
5629                         err = -ENOMEM;
5630                         goto unlock;
5631                 }
5632
5633                 hci_conn_hold(conn);
5634                 cmd->user_data = hci_conn_get(conn);
5635                 cmd->cmd_complete = conn_info_cmd_complete;
5636
5637                 conn->conn_info_timestamp = jiffies;
5638         } else {
5639                 /* Cache is valid, just reply with values cached in hci_conn */
5640                 rp.rssi = conn->rssi;
5641                 rp.tx_power = conn->tx_power;
5642                 rp.max_tx_power = conn->max_tx_power;
5643
5644                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5645                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5646         }
5647
5648 unlock:
5649         hci_dev_unlock(hdev);
5650         return err;
5651 }
5652
5653 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5654 {
5655         struct hci_conn *conn = cmd->user_data;
5656         struct mgmt_rp_get_clock_info rp;
5657         struct hci_dev *hdev;
5658         int err;
5659
5660         memset(&rp, 0, sizeof(rp));
5661         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5662
5663         if (status)
5664                 goto complete;
5665
5666         hdev = hci_dev_get(cmd->index);
5667         if (hdev) {
5668                 rp.local_clock = cpu_to_le32(hdev->clock);
5669                 hci_dev_put(hdev);
5670         }
5671
5672         if (conn) {
5673                 rp.piconet_clock = cpu_to_le32(conn->clock);
5674                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5675         }
5676
5677 complete:
5678         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5679                                 sizeof(rp));
5680
5681         if (conn) {
5682                 hci_conn_drop(conn);
5683                 hci_conn_put(conn);
5684         }
5685
5686         return err;
5687 }
5688
5689 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5690 {
5691         struct hci_cp_read_clock *hci_cp;
5692         struct mgmt_pending_cmd *cmd;
5693         struct hci_conn *conn;
5694
5695         BT_DBG("%s status %u", hdev->name, status);
5696
5697         hci_dev_lock(hdev);
5698
5699         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5700         if (!hci_cp)
5701                 goto unlock;
5702
5703         if (hci_cp->which) {
5704                 u16 handle = __le16_to_cpu(hci_cp->handle);
5705                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5706         } else {
5707                 conn = NULL;
5708         }
5709
5710         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5711         if (!cmd)
5712                 goto unlock;
5713
5714         cmd->cmd_complete(cmd, mgmt_status(status));
5715         mgmt_pending_remove(cmd);
5716
5717 unlock:
5718         hci_dev_unlock(hdev);
5719 }
5720
5721 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5722                          u16 len)
5723 {
5724         struct mgmt_cp_get_clock_info *cp = data;
5725         struct mgmt_rp_get_clock_info rp;
5726         struct hci_cp_read_clock hci_cp;
5727         struct mgmt_pending_cmd *cmd;
5728         struct hci_request req;
5729         struct hci_conn *conn;
5730         int err;
5731
5732         BT_DBG("%s", hdev->name);
5733
5734         memset(&rp, 0, sizeof(rp));
5735         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5736         rp.addr.type = cp->addr.type;
5737
5738         if (cp->addr.type != BDADDR_BREDR)
5739                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5740                                          MGMT_STATUS_INVALID_PARAMS,
5741                                          &rp, sizeof(rp));
5742
5743         hci_dev_lock(hdev);
5744
5745         if (!hdev_is_powered(hdev)) {
5746                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5747                                         MGMT_STATUS_NOT_POWERED, &rp,
5748                                         sizeof(rp));
5749                 goto unlock;
5750         }
5751
5752         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5753                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5754                                                &cp->addr.bdaddr);
5755                 if (!conn || conn->state != BT_CONNECTED) {
5756                         err = mgmt_cmd_complete(sk, hdev->id,
5757                                                 MGMT_OP_GET_CLOCK_INFO,
5758                                                 MGMT_STATUS_NOT_CONNECTED,
5759                                                 &rp, sizeof(rp));
5760                         goto unlock;
5761                 }
5762         } else {
5763                 conn = NULL;
5764         }
5765
5766         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5767         if (!cmd) {
5768                 err = -ENOMEM;
5769                 goto unlock;
5770         }
5771
5772         cmd->cmd_complete = clock_info_cmd_complete;
5773
5774         hci_req_init(&req, hdev);
5775
5776         memset(&hci_cp, 0, sizeof(hci_cp));
5777         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5778
5779         if (conn) {
5780                 hci_conn_hold(conn);
5781                 cmd->user_data = hci_conn_get(conn);
5782
5783                 hci_cp.handle = cpu_to_le16(conn->handle);
5784                 hci_cp.which = 0x01; /* Piconet clock */
5785                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5786         }
5787
5788         err = hci_req_run(&req, get_clock_info_complete);
5789         if (err < 0)
5790                 mgmt_pending_remove(cmd);
5791
5792 unlock:
5793         hci_dev_unlock(hdev);
5794         return err;
5795 }
5796
5797 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5798 {
5799         struct hci_conn *conn;
5800
5801         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5802         if (!conn)
5803                 return false;
5804
5805         if (conn->dst_type != type)
5806                 return false;
5807
5808         if (conn->state != BT_CONNECTED)
5809                 return false;
5810
5811         return true;
5812 }
5813
5814 /* This function requires the caller holds hdev->lock */
5815 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5816                                u8 addr_type, u8 auto_connect)
5817 {
5818         struct hci_dev *hdev = req->hdev;
5819         struct hci_conn_params *params;
5820
5821         params = hci_conn_params_add(hdev, addr, addr_type);
5822         if (!params)
5823                 return -EIO;
5824
5825         if (params->auto_connect == auto_connect)
5826                 return 0;
5827
5828         list_del_init(&params->action);
5829
5830         switch (auto_connect) {
5831         case HCI_AUTO_CONN_DISABLED:
5832         case HCI_AUTO_CONN_LINK_LOSS:
5833                 __hci_update_background_scan(req);
5834                 break;
5835         case HCI_AUTO_CONN_REPORT:
5836                 list_add(&params->action, &hdev->pend_le_reports);
5837                 __hci_update_background_scan(req);
5838                 break;
5839         case HCI_AUTO_CONN_DIRECT:
5840         case HCI_AUTO_CONN_ALWAYS:
5841                 if (!is_connected(hdev, addr, addr_type)) {
5842                         list_add(&params->action, &hdev->pend_le_conns);
5843                         __hci_update_background_scan(req);
5844                 }
5845                 break;
5846         }
5847
5848         params->auto_connect = auto_connect;
5849
5850         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5851                auto_connect);
5852
5853         return 0;
5854 }
5855
5856 static void device_added(struct sock *sk, struct hci_dev *hdev,
5857                          bdaddr_t *bdaddr, u8 type, u8 action)
5858 {
5859         struct mgmt_ev_device_added ev;
5860
5861         bacpy(&ev.addr.bdaddr, bdaddr);
5862         ev.addr.type = type;
5863         ev.action = action;
5864
5865         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5866 }
5867
5868 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5869 {
5870         struct mgmt_pending_cmd *cmd;
5871
5872         BT_DBG("status 0x%02x", status);
5873
5874         hci_dev_lock(hdev);
5875
5876         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5877         if (!cmd)
5878                 goto unlock;
5879
5880         cmd->cmd_complete(cmd, mgmt_status(status));
5881         mgmt_pending_remove(cmd);
5882
5883 unlock:
5884         hci_dev_unlock(hdev);
5885 }
5886
5887 static int add_device(struct sock *sk, struct hci_dev *hdev,
5888                       void *data, u16 len)
5889 {
5890         struct mgmt_cp_add_device *cp = data;
5891         struct mgmt_pending_cmd *cmd;
5892         struct hci_request req;
5893         u8 auto_conn, addr_type;
5894         int err;
5895
5896         BT_DBG("%s", hdev->name);
5897
5898         if (!bdaddr_type_is_valid(cp->addr.type) ||
5899             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5900                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5901                                          MGMT_STATUS_INVALID_PARAMS,
5902                                          &cp->addr, sizeof(cp->addr));
5903
5904         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5905                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5906                                          MGMT_STATUS_INVALID_PARAMS,
5907                                          &cp->addr, sizeof(cp->addr));
5908
5909         hci_req_init(&req, hdev);
5910
5911         hci_dev_lock(hdev);
5912
5913         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5914         if (!cmd) {
5915                 err = -ENOMEM;
5916                 goto unlock;
5917         }
5918
5919         cmd->cmd_complete = addr_cmd_complete;
5920
5921         if (cp->addr.type == BDADDR_BREDR) {
5922                 /* Only incoming connections action is supported for now */
5923                 if (cp->action != 0x01) {
5924                         err = cmd->cmd_complete(cmd,
5925                                                 MGMT_STATUS_INVALID_PARAMS);
5926                         mgmt_pending_remove(cmd);
5927                         goto unlock;
5928                 }
5929
5930                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5931                                           cp->addr.type);
5932                 if (err)
5933                         goto unlock;
5934
5935                 __hci_update_page_scan(&req);
5936
5937                 goto added;
5938         }
5939
5940         if (cp->addr.type == BDADDR_LE_PUBLIC)
5941                 addr_type = ADDR_LE_DEV_PUBLIC;
5942         else
5943                 addr_type = ADDR_LE_DEV_RANDOM;
5944
5945         if (cp->action == 0x02)
5946                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5947         else if (cp->action == 0x01)
5948                 auto_conn = HCI_AUTO_CONN_DIRECT;
5949         else
5950                 auto_conn = HCI_AUTO_CONN_REPORT;
5951
5952         /* If the connection parameters don't exist for this device,
5953          * they will be created and configured with defaults.
5954          */
5955         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5956                                 auto_conn) < 0) {
5957                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5958                 mgmt_pending_remove(cmd);
5959                 goto unlock;
5960         }
5961
5962 added:
5963         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5964
5965         err = hci_req_run(&req, add_device_complete);
5966         if (err < 0) {
5967                 /* ENODATA means no HCI commands were needed (e.g. if
5968                  * the adapter is powered off).
5969                  */
5970                 if (err == -ENODATA)
5971                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5972                 mgmt_pending_remove(cmd);
5973         }
5974
5975 unlock:
5976         hci_dev_unlock(hdev);
5977         return err;
5978 }
5979
5980 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5981                            bdaddr_t *bdaddr, u8 type)
5982 {
5983         struct mgmt_ev_device_removed ev;
5984
5985         bacpy(&ev.addr.bdaddr, bdaddr);
5986         ev.addr.type = type;
5987
5988         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5989 }
5990
5991 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5992 {
5993         struct mgmt_pending_cmd *cmd;
5994
5995         BT_DBG("status 0x%02x", status);
5996
5997         hci_dev_lock(hdev);
5998
5999         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6000         if (!cmd)
6001                 goto unlock;
6002
6003         cmd->cmd_complete(cmd, mgmt_status(status));
6004         mgmt_pending_remove(cmd);
6005
6006 unlock:
6007         hci_dev_unlock(hdev);
6008 }
6009
6010 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6011                          void *data, u16 len)
6012 {
6013         struct mgmt_cp_remove_device *cp = data;
6014         struct mgmt_pending_cmd *cmd;
6015         struct hci_request req;
6016         int err;
6017
6018         BT_DBG("%s", hdev->name);
6019
6020         hci_req_init(&req, hdev);
6021
6022         hci_dev_lock(hdev);
6023
6024         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6025         if (!cmd) {
6026                 err = -ENOMEM;
6027                 goto unlock;
6028         }
6029
6030         cmd->cmd_complete = addr_cmd_complete;
6031
6032         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6033                 struct hci_conn_params *params;
6034                 u8 addr_type;
6035
6036                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6037                         err = cmd->cmd_complete(cmd,
6038                                                 MGMT_STATUS_INVALID_PARAMS);
6039                         mgmt_pending_remove(cmd);
6040                         goto unlock;
6041                 }
6042
6043                 if (cp->addr.type == BDADDR_BREDR) {
6044                         err = hci_bdaddr_list_del(&hdev->whitelist,
6045                                                   &cp->addr.bdaddr,
6046                                                   cp->addr.type);
6047                         if (err) {
6048                                 err = cmd->cmd_complete(cmd,
6049                                                         MGMT_STATUS_INVALID_PARAMS);
6050                                 mgmt_pending_remove(cmd);
6051                                 goto unlock;
6052                         }
6053
6054                         __hci_update_page_scan(&req);
6055
6056                         device_removed(sk, hdev, &cp->addr.bdaddr,
6057                                        cp->addr.type);
6058                         goto complete;
6059                 }
6060
6061                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6062                         addr_type = ADDR_LE_DEV_PUBLIC;
6063                 else
6064                         addr_type = ADDR_LE_DEV_RANDOM;
6065
6066                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6067                                                 addr_type);
6068                 if (!params) {
6069                         err = cmd->cmd_complete(cmd,
6070                                                 MGMT_STATUS_INVALID_PARAMS);
6071                         mgmt_pending_remove(cmd);
6072                         goto unlock;
6073                 }
6074
6075                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
6076                         err = cmd->cmd_complete(cmd,
6077                                                 MGMT_STATUS_INVALID_PARAMS);
6078                         mgmt_pending_remove(cmd);
6079                         goto unlock;
6080                 }
6081
6082                 list_del(&params->action);
6083                 list_del(&params->list);
6084                 kfree(params);
6085                 __hci_update_background_scan(&req);
6086
6087                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6088         } else {
6089                 struct hci_conn_params *p, *tmp;
6090                 struct bdaddr_list *b, *btmp;
6091
6092                 if (cp->addr.type) {
6093                         err = cmd->cmd_complete(cmd,
6094                                                 MGMT_STATUS_INVALID_PARAMS);
6095                         mgmt_pending_remove(cmd);
6096                         goto unlock;
6097                 }
6098
6099                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6100                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6101                         list_del(&b->list);
6102                         kfree(b);
6103                 }
6104
6105                 __hci_update_page_scan(&req);
6106
6107                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6108                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6109                                 continue;
6110                         device_removed(sk, hdev, &p->addr, p->addr_type);
6111                         list_del(&p->action);
6112                         list_del(&p->list);
6113                         kfree(p);
6114                 }
6115
6116                 BT_DBG("All LE connection parameters were removed");
6117
6118                 __hci_update_background_scan(&req);
6119         }
6120
6121 complete:
6122         err = hci_req_run(&req, remove_device_complete);
6123         if (err < 0) {
6124                 /* ENODATA means no HCI commands were needed (e.g. if
6125                  * the adapter is powered off).
6126                  */
6127                 if (err == -ENODATA)
6128                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6129                 mgmt_pending_remove(cmd);
6130         }
6131
6132 unlock:
6133         hci_dev_unlock(hdev);
6134         return err;
6135 }
6136
6137 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6138                            u16 len)
6139 {
6140         struct mgmt_cp_load_conn_param *cp = data;
6141         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6142                                      sizeof(struct mgmt_conn_param));
6143         u16 param_count, expected_len;
6144         int i;
6145
6146         if (!lmp_le_capable(hdev))
6147                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6148                                        MGMT_STATUS_NOT_SUPPORTED);
6149
6150         param_count = __le16_to_cpu(cp->param_count);
6151         if (param_count > max_param_count) {
6152                 BT_ERR("load_conn_param: too big param_count value %u",
6153                        param_count);
6154                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6155                                        MGMT_STATUS_INVALID_PARAMS);
6156         }
6157
6158         expected_len = sizeof(*cp) + param_count *
6159                                         sizeof(struct mgmt_conn_param);
6160         if (expected_len != len) {
6161                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6162                        expected_len, len);
6163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6164                                        MGMT_STATUS_INVALID_PARAMS);
6165         }
6166
6167         BT_DBG("%s param_count %u", hdev->name, param_count);
6168
6169         hci_dev_lock(hdev);
6170
6171         hci_conn_params_clear_disabled(hdev);
6172
6173         for (i = 0; i < param_count; i++) {
6174                 struct mgmt_conn_param *param = &cp->params[i];
6175                 struct hci_conn_params *hci_param;
6176                 u16 min, max, latency, timeout;
6177                 u8 addr_type;
6178
6179                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6180                        param->addr.type);
6181
6182                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6183                         addr_type = ADDR_LE_DEV_PUBLIC;
6184                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6185                         addr_type = ADDR_LE_DEV_RANDOM;
6186                 } else {
6187                         BT_ERR("Ignoring invalid connection parameters");
6188                         continue;
6189                 }
6190
6191                 min = le16_to_cpu(param->min_interval);
6192                 max = le16_to_cpu(param->max_interval);
6193                 latency = le16_to_cpu(param->latency);
6194                 timeout = le16_to_cpu(param->timeout);
6195
6196                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6197                        min, max, latency, timeout);
6198
6199                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6200                         BT_ERR("Ignoring invalid connection parameters");
6201                         continue;
6202                 }
6203
6204                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6205                                                 addr_type);
6206                 if (!hci_param) {
6207                         BT_ERR("Failed to add connection parameters");
6208                         continue;
6209                 }
6210
6211                 hci_param->conn_min_interval = min;
6212                 hci_param->conn_max_interval = max;
6213                 hci_param->conn_latency = latency;
6214                 hci_param->supervision_timeout = timeout;
6215         }
6216
6217         hci_dev_unlock(hdev);
6218
6219         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6220                                  NULL, 0);
6221 }
6222
6223 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6224                                void *data, u16 len)
6225 {
6226         struct mgmt_cp_set_external_config *cp = data;
6227         bool changed;
6228         int err;
6229
6230         BT_DBG("%s", hdev->name);
6231
6232         if (hdev_is_powered(hdev))
6233                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6234                                        MGMT_STATUS_REJECTED);
6235
6236         if (cp->config != 0x00 && cp->config != 0x01)
6237                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6238                                          MGMT_STATUS_INVALID_PARAMS);
6239
6240         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6241                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6242                                        MGMT_STATUS_NOT_SUPPORTED);
6243
6244         hci_dev_lock(hdev);
6245
6246         if (cp->config)
6247                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6248         else
6249                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6250
6251         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6252         if (err < 0)
6253                 goto unlock;
6254
6255         if (!changed)
6256                 goto unlock;
6257
6258         err = new_options(hdev, sk);
6259
6260         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6261                 mgmt_index_removed(hdev);
6262
6263                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6264                         hci_dev_set_flag(hdev, HCI_CONFIG);
6265                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6266
6267                         queue_work(hdev->req_workqueue, &hdev->power_on);
6268                 } else {
6269                         set_bit(HCI_RAW, &hdev->flags);
6270                         mgmt_index_added(hdev);
6271                 }
6272         }
6273
6274 unlock:
6275         hci_dev_unlock(hdev);
6276         return err;
6277 }
6278
6279 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6280                               void *data, u16 len)
6281 {
6282         struct mgmt_cp_set_public_address *cp = data;
6283         bool changed;
6284         int err;
6285
6286         BT_DBG("%s", hdev->name);
6287
6288         if (hdev_is_powered(hdev))
6289                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6290                                        MGMT_STATUS_REJECTED);
6291
6292         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6293                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6294                                        MGMT_STATUS_INVALID_PARAMS);
6295
6296         if (!hdev->set_bdaddr)
6297                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6298                                        MGMT_STATUS_NOT_SUPPORTED);
6299
6300         hci_dev_lock(hdev);
6301
6302         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6303         bacpy(&hdev->public_addr, &cp->bdaddr);
6304
6305         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6306         if (err < 0)
6307                 goto unlock;
6308
6309         if (!changed)
6310                 goto unlock;
6311
6312         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6313                 err = new_options(hdev, sk);
6314
6315         if (is_configured(hdev)) {
6316                 mgmt_index_removed(hdev);
6317
6318                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6319
6320                 hci_dev_set_flag(hdev, HCI_CONFIG);
6321                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6322
6323                 queue_work(hdev->req_workqueue, &hdev->power_on);
6324         }
6325
6326 unlock:
6327         hci_dev_unlock(hdev);
6328         return err;
6329 }
6330
6331 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6332                                   u8 data_len)
6333 {
6334         eir[eir_len++] = sizeof(type) + data_len;
6335         eir[eir_len++] = type;
6336         memcpy(&eir[eir_len], data, data_len);
6337         eir_len += data_len;
6338
6339         return eir_len;
6340 }
6341
6342 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6343                                    void *data, u16 data_len)
6344 {
6345         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6346         struct mgmt_rp_read_local_oob_ext_data *rp;
6347         size_t rp_len;
6348         u16 eir_len;
6349         u8 status, flags, role, addr[7], hash[16], rand[16];
6350         int err;
6351
6352         BT_DBG("%s", hdev->name);
6353
6354         if (!hdev_is_powered(hdev))
6355                 return mgmt_cmd_complete(sk, hdev->id,
6356                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6357                                          MGMT_STATUS_NOT_POWERED,
6358                                          &cp->type, sizeof(cp->type));
6359
6360         switch (cp->type) {
6361         case BIT(BDADDR_BREDR):
6362                 status = mgmt_bredr_support(hdev);
6363                 if (status)
6364                         return mgmt_cmd_complete(sk, hdev->id,
6365                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6366                                                  status, &cp->type,
6367                                                  sizeof(cp->type));
6368                 eir_len = 5;
6369                 break;
6370         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6371                 status = mgmt_le_support(hdev);
6372                 if (status)
6373                         return mgmt_cmd_complete(sk, hdev->id,
6374                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6375                                                  status, &cp->type,
6376                                                  sizeof(cp->type));
6377                 eir_len = 9 + 3 + 18 + 18 + 3;
6378                 break;
6379         default:
6380                 return mgmt_cmd_complete(sk, hdev->id,
6381                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6382                                          MGMT_STATUS_INVALID_PARAMS,
6383                                          &cp->type, sizeof(cp->type));
6384         }
6385
6386         hci_dev_lock(hdev);
6387
6388         rp_len = sizeof(*rp) + eir_len;
6389         rp = kmalloc(rp_len, GFP_ATOMIC);
6390         if (!rp) {
6391                 hci_dev_unlock(hdev);
6392                 return -ENOMEM;
6393         }
6394
6395         eir_len = 0;
6396         switch (cp->type) {
6397         case BIT(BDADDR_BREDR):
6398                 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6399                                           hdev->dev_class, 3);
6400                 break;
6401         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6402                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6403                     smp_generate_oob(hdev, hash, rand) < 0) {
6404                         hci_dev_unlock(hdev);
6405                         err = mgmt_cmd_complete(sk, hdev->id,
6406                                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6407                                                 MGMT_STATUS_FAILED,
6408                                                 &cp->type, sizeof(cp->type));
6409                         goto done;
6410                 }
6411
6412                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6413                         memcpy(addr, &hdev->rpa, 6);
6414                         addr[6] = 0x01;
6415                 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6416                            !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6417                            (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6418                             bacmp(&hdev->static_addr, BDADDR_ANY))) {
6419                         memcpy(addr, &hdev->static_addr, 6);
6420                         addr[6] = 0x01;
6421                 } else {
6422                         memcpy(addr, &hdev->bdaddr, 6);
6423                         addr[6] = 0x00;
6424                 }
6425
6426                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6427                                           addr, sizeof(addr));
6428
6429                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6430                         role = 0x02;
6431                 else
6432                         role = 0x01;
6433
6434                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6435                                           &role, sizeof(role));
6436
6437                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6438                         eir_len = eir_append_data(rp->eir, eir_len,
6439                                                   EIR_LE_SC_CONFIRM,
6440                                                   hash, sizeof(hash));
6441
6442                         eir_len = eir_append_data(rp->eir, eir_len,
6443                                                   EIR_LE_SC_RANDOM,
6444                                                   rand, sizeof(rand));
6445                 }
6446
6447                 flags = get_adv_discov_flags(hdev);
6448
6449                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6450                         flags |= LE_AD_NO_BREDR;
6451
6452                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6453                                           &flags, sizeof(flags));
6454                 break;
6455         }
6456
6457         rp->type = cp->type;
6458         rp->eir_len = cpu_to_le16(eir_len);
6459
6460         hci_dev_unlock(hdev);
6461
6462         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6463
6464         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6465                                 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
6466         if (err < 0)
6467                 goto done;
6468
6469         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6470                                  rp, sizeof(*rp) + eir_len,
6471                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6472
6473 done:
6474         kfree(rp);
6475
6476         return err;
6477 }
6478
6479 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6480                              void *data, u16 data_len)
6481 {
6482         struct mgmt_rp_read_adv_features *rp;
6483         size_t rp_len;
6484         int err;
6485         bool instance;
6486
6487         BT_DBG("%s", hdev->name);
6488
6489         hci_dev_lock(hdev);
6490
6491         rp_len = sizeof(*rp);
6492
6493         /* Currently only one instance is supported, so just add 1 to the
6494          * response length.
6495          */
6496         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6497         if (instance)
6498                 rp_len++;
6499
6500         rp = kmalloc(rp_len, GFP_ATOMIC);
6501         if (!rp) {
6502                 hci_dev_unlock(hdev);
6503                 return -ENOMEM;
6504         }
6505
6506         rp->supported_flags = cpu_to_le32(0);
6507         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6508         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6509         rp->max_instances = 1;
6510
6511         /* Currently only one instance is supported, so simply return the
6512          * current instance number.
6513          */
6514         if (instance) {
6515                 rp->num_instances = 1;
6516                 rp->instance[0] = 1;
6517         } else {
6518                 rp->num_instances = 0;
6519         }
6520
6521         hci_dev_unlock(hdev);
6522
6523         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6524                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6525
6526         kfree(rp);
6527
6528         return err;
6529 }
6530
6531 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6532                               u8 len)
6533 {
6534         u8 max_len = HCI_MAX_AD_LENGTH;
6535         int i, cur_len;
6536
6537         /* TODO: Correctly reduce len based on adv_flags. */
6538
6539         if (len > max_len)
6540                 return false;
6541
6542         /* Make sure that the data is correctly formatted. */
6543         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6544                 cur_len = data[i];
6545
6546                 /* If the current field length would exceed the total data
6547                  * length, then it's invalid.
6548                  */
6549                 if (i + cur_len >= len)
6550                         return false;
6551         }
6552
6553         return true;
6554 }
6555
6556 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6557                                      u16 opcode)
6558 {
6559         struct mgmt_pending_cmd *cmd;
6560         struct mgmt_rp_add_advertising rp;
6561
6562         BT_DBG("status %d", status);
6563
6564         hci_dev_lock(hdev);
6565
6566         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6567
6568         if (status) {
6569                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6570                 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6571                 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6572         }
6573
6574         if (!cmd)
6575                 goto unlock;
6576
6577         rp.instance = 0x01;
6578
6579         if (status)
6580                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6581                                 mgmt_status(status));
6582         else
6583                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6584                                   mgmt_status(status), &rp, sizeof(rp));
6585
6586         mgmt_pending_remove(cmd);
6587
6588 unlock:
6589         hci_dev_unlock(hdev);
6590 }
6591
6592 static void adv_timeout_expired(struct work_struct *work)
6593 {
6594         struct hci_dev *hdev = container_of(work, struct hci_dev,
6595                                             adv_instance.timeout_exp.work);
6596
6597         hdev->adv_instance.timeout = 0;
6598
6599         hci_dev_lock(hdev);
6600         clear_adv_instance(hdev);
6601         hci_dev_unlock(hdev);
6602 }
6603
6604 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6605                            void *data, u16 data_len)
6606 {
6607         struct mgmt_cp_add_advertising *cp = data;
6608         struct mgmt_rp_add_advertising rp;
6609         u32 flags;
6610         u8 status;
6611         u16 timeout;
6612         int err;
6613         struct mgmt_pending_cmd *cmd;
6614         struct hci_request req;
6615
6616         BT_DBG("%s", hdev->name);
6617
6618         status = mgmt_le_support(hdev);
6619         if (status)
6620                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6621                                        status);
6622
6623         flags = __le32_to_cpu(cp->flags);
6624         timeout = __le16_to_cpu(cp->timeout);
6625
6626         /* The current implementation only supports adding one instance and
6627          * doesn't support flags.
6628          */
6629         if (cp->instance != 0x01 || flags)
6630                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6631                                        MGMT_STATUS_INVALID_PARAMS);
6632
6633         hci_dev_lock(hdev);
6634
6635         if (timeout && !hdev_is_powered(hdev)) {
6636                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6637                                       MGMT_STATUS_REJECTED);
6638                 goto unlock;
6639         }
6640
6641         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6642             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6643             pending_find(MGMT_OP_SET_LE, hdev)) {
6644                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6645                                       MGMT_STATUS_BUSY);
6646                 goto unlock;
6647         }
6648
6649         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len) ||
6650             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6651                                cp->scan_rsp_len)) {
6652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6653                                       MGMT_STATUS_INVALID_PARAMS);
6654                 goto unlock;
6655         }
6656
6657         INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6658
6659         hdev->adv_instance.flags = flags;
6660         hdev->adv_instance.adv_data_len = cp->adv_data_len;
6661         hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6662
6663         if (cp->adv_data_len)
6664                 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6665
6666         if (cp->scan_rsp_len)
6667                 memcpy(hdev->adv_instance.scan_rsp_data,
6668                        cp->data + cp->adv_data_len, cp->scan_rsp_len);
6669
6670         if (hdev->adv_instance.timeout)
6671                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6672
6673         hdev->adv_instance.timeout = timeout;
6674
6675         if (timeout)
6676                 queue_delayed_work(hdev->workqueue,
6677                                    &hdev->adv_instance.timeout_exp,
6678                                    msecs_to_jiffies(timeout * 1000));
6679
6680         if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6681                 advertising_added(sk, hdev, 1);
6682
6683         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6684          * we have no HCI communication to make. Simply return.
6685          */
6686         if (!hdev_is_powered(hdev) ||
6687             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6688                 rp.instance = 0x01;
6689                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6690                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6691                 goto unlock;
6692         }
6693
6694         /* We're good to go, update advertising data, parameters, and start
6695          * advertising.
6696          */
6697         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6698                                data_len);
6699         if (!cmd) {
6700                 err = -ENOMEM;
6701                 goto unlock;
6702         }
6703
6704         hci_req_init(&req, hdev);
6705
6706         update_adv_data(&req);
6707         update_scan_rsp_data(&req);
6708         enable_advertising(&req);
6709
6710         err = hci_req_run(&req, add_advertising_complete);
6711         if (err < 0)
6712                 mgmt_pending_remove(cmd);
6713
6714 unlock:
6715         hci_dev_unlock(hdev);
6716
6717         return err;
6718 }
6719
6720 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6721                                         u16 opcode)
6722 {
6723         struct mgmt_pending_cmd *cmd;
6724         struct mgmt_rp_remove_advertising rp;
6725
6726         BT_DBG("status %d", status);
6727
6728         hci_dev_lock(hdev);
6729
6730         /* A failure status here only means that we failed to disable
6731          * advertising. Otherwise, the advertising instance has been removed,
6732          * so report success.
6733          */
6734         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6735         if (!cmd)
6736                 goto unlock;
6737
6738         rp.instance = 1;
6739
6740         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6741                           &rp, sizeof(rp));
6742         mgmt_pending_remove(cmd);
6743
6744 unlock:
6745         hci_dev_unlock(hdev);
6746 }
6747
6748 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6749                               void *data, u16 data_len)
6750 {
6751         struct mgmt_cp_remove_advertising *cp = data;
6752         struct mgmt_rp_remove_advertising rp;
6753         int err;
6754         struct mgmt_pending_cmd *cmd;
6755         struct hci_request req;
6756
6757         BT_DBG("%s", hdev->name);
6758
6759         /* The current implementation only allows modifying instance no 1. A
6760          * value of 0 indicates that all instances should be cleared.
6761          */
6762         if (cp->instance > 1)
6763                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6764                                        MGMT_STATUS_INVALID_PARAMS);
6765
6766         hci_dev_lock(hdev);
6767
6768         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6769             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6770             pending_find(MGMT_OP_SET_LE, hdev)) {
6771                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6772                                       MGMT_STATUS_BUSY);
6773                 goto unlock;
6774         }
6775
6776         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6777                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6778                                       MGMT_STATUS_INVALID_PARAMS);
6779                 goto unlock;
6780         }
6781
6782         if (hdev->adv_instance.timeout)
6783                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6784
6785         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6786
6787         advertising_removed(sk, hdev, 1);
6788
6789         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6790
6791         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6792          * we have no HCI communication to make. Simply return.
6793          */
6794         if (!hdev_is_powered(hdev) ||
6795             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6796                 rp.instance = 1;
6797                 err = mgmt_cmd_complete(sk, hdev->id,
6798                                         MGMT_OP_REMOVE_ADVERTISING,
6799                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6800                 goto unlock;
6801         }
6802
6803         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6804                                data_len);
6805         if (!cmd) {
6806                 err = -ENOMEM;
6807                 goto unlock;
6808         }
6809
6810         hci_req_init(&req, hdev);
6811         disable_advertising(&req);
6812
6813         err = hci_req_run(&req, remove_advertising_complete);
6814         if (err < 0)
6815                 mgmt_pending_remove(cmd);
6816
6817 unlock:
6818         hci_dev_unlock(hdev);
6819
6820         return err;
6821 }
6822
6823 static const struct hci_mgmt_handler mgmt_handlers[] = {
6824         { NULL }, /* 0x0000 (no command) */
6825         { read_version,            MGMT_READ_VERSION_SIZE,
6826                                                 HCI_MGMT_NO_HDEV |
6827                                                 HCI_MGMT_UNTRUSTED },
6828         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6829                                                 HCI_MGMT_NO_HDEV |
6830                                                 HCI_MGMT_UNTRUSTED },
6831         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6832                                                 HCI_MGMT_NO_HDEV |
6833                                                 HCI_MGMT_UNTRUSTED },
6834         { read_controller_info,    MGMT_READ_INFO_SIZE,
6835                                                 HCI_MGMT_UNTRUSTED },
6836         { set_powered,             MGMT_SETTING_SIZE },
6837         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6838         { set_connectable,         MGMT_SETTING_SIZE },
6839         { set_fast_connectable,    MGMT_SETTING_SIZE },
6840         { set_bondable,            MGMT_SETTING_SIZE },
6841         { set_link_security,       MGMT_SETTING_SIZE },
6842         { set_ssp,                 MGMT_SETTING_SIZE },
6843         { set_hs,                  MGMT_SETTING_SIZE },
6844         { set_le,                  MGMT_SETTING_SIZE },
6845         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6846         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6847         { add_uuid,                MGMT_ADD_UUID_SIZE },
6848         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6849         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6850                                                 HCI_MGMT_VAR_LEN },
6851         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6852                                                 HCI_MGMT_VAR_LEN },
6853         { disconnect,              MGMT_DISCONNECT_SIZE },
6854         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6855         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6856         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6857         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6858         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6859         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6860         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6861         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6862         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6863         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6864         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6865         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6866         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6867                                                 HCI_MGMT_VAR_LEN },
6868         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6869         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6870         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6871         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6872         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6873         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6874         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6875         { set_advertising,         MGMT_SETTING_SIZE },
6876         { set_bredr,               MGMT_SETTING_SIZE },
6877         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6878         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6879         { set_secure_conn,         MGMT_SETTING_SIZE },
6880         { set_debug_keys,          MGMT_SETTING_SIZE },
6881         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6882         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6883                                                 HCI_MGMT_VAR_LEN },
6884         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6885         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6886         { add_device,              MGMT_ADD_DEVICE_SIZE },
6887         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6888         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6889                                                 HCI_MGMT_VAR_LEN },
6890         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6891                                                 HCI_MGMT_NO_HDEV |
6892                                                 HCI_MGMT_UNTRUSTED },
6893         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6894                                                 HCI_MGMT_UNCONFIGURED |
6895                                                 HCI_MGMT_UNTRUSTED },
6896         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6897                                                 HCI_MGMT_UNCONFIGURED },
6898         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6899                                                 HCI_MGMT_UNCONFIGURED },
6900         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6901                                                 HCI_MGMT_VAR_LEN },
6902         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6903         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6904                                                 HCI_MGMT_NO_HDEV |
6905                                                 HCI_MGMT_UNTRUSTED },
6906         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6907         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6908                                                 HCI_MGMT_VAR_LEN },
6909         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6910 };
6911
6912 void mgmt_index_added(struct hci_dev *hdev)
6913 {
6914         struct mgmt_ev_ext_index ev;
6915
6916         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6917                 return;
6918
6919         switch (hdev->dev_type) {
6920         case HCI_BREDR:
6921                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6922                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6923                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6924                         ev.type = 0x01;
6925                 } else {
6926                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6927                                          HCI_MGMT_INDEX_EVENTS);
6928                         ev.type = 0x00;
6929                 }
6930                 break;
6931         case HCI_AMP:
6932                 ev.type = 0x02;
6933                 break;
6934         default:
6935                 return;
6936         }
6937
6938         ev.bus = hdev->bus;
6939
6940         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6941                          HCI_MGMT_EXT_INDEX_EVENTS);
6942 }
6943
6944 void mgmt_index_removed(struct hci_dev *hdev)
6945 {
6946         struct mgmt_ev_ext_index ev;
6947         u8 status = MGMT_STATUS_INVALID_INDEX;
6948
6949         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6950                 return;
6951
6952         switch (hdev->dev_type) {
6953         case HCI_BREDR:
6954                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6955
6956                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6957                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6958                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6959                         ev.type = 0x01;
6960                 } else {
6961                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6962                                          HCI_MGMT_INDEX_EVENTS);
6963                         ev.type = 0x00;
6964                 }
6965                 break;
6966         case HCI_AMP:
6967                 ev.type = 0x02;
6968                 break;
6969         default:
6970                 return;
6971         }
6972
6973         ev.bus = hdev->bus;
6974
6975         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6976                          HCI_MGMT_EXT_INDEX_EVENTS);
6977 }
6978
6979 /* This function requires the caller holds hdev->lock */
6980 static void restart_le_actions(struct hci_request *req)
6981 {
6982         struct hci_dev *hdev = req->hdev;
6983         struct hci_conn_params *p;
6984
6985         list_for_each_entry(p, &hdev->le_conn_params, list) {
6986                 /* Needed for AUTO_OFF case where might not "really"
6987                  * have been powered off.
6988                  */
6989                 list_del_init(&p->action);
6990
6991                 switch (p->auto_connect) {
6992                 case HCI_AUTO_CONN_DIRECT:
6993                 case HCI_AUTO_CONN_ALWAYS:
6994                         list_add(&p->action, &hdev->pend_le_conns);
6995                         break;
6996                 case HCI_AUTO_CONN_REPORT:
6997                         list_add(&p->action, &hdev->pend_le_reports);
6998                         break;
6999                 default:
7000                         break;
7001                 }
7002         }
7003
7004         __hci_update_background_scan(req);
7005 }
7006
7007 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7008 {
7009         struct cmd_lookup match = { NULL, hdev };
7010
7011         BT_DBG("status 0x%02x", status);
7012
7013         if (!status) {
7014                 /* Register the available SMP channels (BR/EDR and LE) only
7015                  * when successfully powering on the controller. This late
7016                  * registration is required so that LE SMP can clearly
7017                  * decide if the public address or static address is used.
7018                  */
7019                 smp_register(hdev);
7020         }
7021
7022         hci_dev_lock(hdev);
7023
7024         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7025
7026         new_settings(hdev, match.sk);
7027
7028         hci_dev_unlock(hdev);
7029
7030         if (match.sk)
7031                 sock_put(match.sk);
7032 }
7033
7034 static int powered_update_hci(struct hci_dev *hdev)
7035 {
7036         struct hci_request req;
7037         u8 link_sec;
7038
7039         hci_req_init(&req, hdev);
7040
7041         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7042             !lmp_host_ssp_capable(hdev)) {
7043                 u8 mode = 0x01;
7044
7045                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7046
7047                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7048                         u8 support = 0x01;
7049
7050                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7051                                     sizeof(support), &support);
7052                 }
7053         }
7054
7055         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7056             lmp_bredr_capable(hdev)) {
7057                 struct hci_cp_write_le_host_supported cp;
7058
7059                 cp.le = 0x01;
7060                 cp.simul = 0x00;
7061
7062                 /* Check first if we already have the right
7063                  * host state (host features set)
7064                  */
7065                 if (cp.le != lmp_host_le_capable(hdev) ||
7066                     cp.simul != lmp_host_le_br_capable(hdev))
7067                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7068                                     sizeof(cp), &cp);
7069         }
7070
7071         if (lmp_le_capable(hdev)) {
7072                 /* Make sure the controller has a good default for
7073                  * advertising data. This also applies to the case
7074                  * where BR/EDR was toggled during the AUTO_OFF phase.
7075                  */
7076                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
7077                         update_adv_data(&req);
7078                         update_scan_rsp_data(&req);
7079                 }
7080
7081                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7082                     hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
7083                         enable_advertising(&req);
7084
7085                 restart_le_actions(&req);
7086         }
7087
7088         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7089         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7090                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7091                             sizeof(link_sec), &link_sec);
7092
7093         if (lmp_bredr_capable(hdev)) {
7094                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7095                         write_fast_connectable(&req, true);
7096                 else
7097                         write_fast_connectable(&req, false);
7098                 __hci_update_page_scan(&req);
7099                 update_class(&req);
7100                 update_name(&req);
7101                 update_eir(&req);
7102         }
7103
7104         return hci_req_run(&req, powered_complete);
7105 }
7106
7107 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7108 {
7109         struct cmd_lookup match = { NULL, hdev };
7110         u8 status, zero_cod[] = { 0, 0, 0 };
7111         int err;
7112
7113         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7114                 return 0;
7115
7116         if (powered) {
7117                 if (powered_update_hci(hdev) == 0)
7118                         return 0;
7119
7120                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7121                                      &match);
7122                 goto new_settings;
7123         }
7124
7125         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7126
7127         /* If the power off is because of hdev unregistration let
7128          * use the appropriate INVALID_INDEX status. Otherwise use
7129          * NOT_POWERED. We cover both scenarios here since later in
7130          * mgmt_index_removed() any hci_conn callbacks will have already
7131          * been triggered, potentially causing misleading DISCONNECTED
7132          * status responses.
7133          */
7134         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7135                 status = MGMT_STATUS_INVALID_INDEX;
7136         else
7137                 status = MGMT_STATUS_NOT_POWERED;
7138
7139         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7140
7141         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7142                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7143                                    zero_cod, sizeof(zero_cod), NULL);
7144
7145 new_settings:
7146         err = new_settings(hdev, match.sk);
7147
7148         if (match.sk)
7149                 sock_put(match.sk);
7150
7151         return err;
7152 }
7153
7154 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7155 {
7156         struct mgmt_pending_cmd *cmd;
7157         u8 status;
7158
7159         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7160         if (!cmd)
7161                 return;
7162
7163         if (err == -ERFKILL)
7164                 status = MGMT_STATUS_RFKILLED;
7165         else
7166                 status = MGMT_STATUS_FAILED;
7167
7168         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7169
7170         mgmt_pending_remove(cmd);
7171 }
7172
7173 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7174 {
7175         struct hci_request req;
7176
7177         hci_dev_lock(hdev);
7178
7179         /* When discoverable timeout triggers, then just make sure
7180          * the limited discoverable flag is cleared. Even in the case
7181          * of a timeout triggered from general discoverable, it is
7182          * safe to unconditionally clear the flag.
7183          */
7184         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7185         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7186
7187         hci_req_init(&req, hdev);
7188         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7189                 u8 scan = SCAN_PAGE;
7190                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7191                             sizeof(scan), &scan);
7192         }
7193         update_class(&req);
7194
7195         /* Advertising instances don't use the global discoverable setting, so
7196          * only update AD if advertising was enabled using Set Advertising.
7197          */
7198         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7199                 update_adv_data(&req);
7200
7201         hci_req_run(&req, NULL);
7202
7203         hdev->discov_timeout = 0;
7204
7205         new_settings(hdev, NULL);
7206
7207         hci_dev_unlock(hdev);
7208 }
7209
7210 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7211                        bool persistent)
7212 {
7213         struct mgmt_ev_new_link_key ev;
7214
7215         memset(&ev, 0, sizeof(ev));
7216
7217         ev.store_hint = persistent;
7218         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7219         ev.key.addr.type = BDADDR_BREDR;
7220         ev.key.type = key->type;
7221         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7222         ev.key.pin_len = key->pin_len;
7223
7224         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7225 }
7226
7227 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7228 {
7229         switch (ltk->type) {
7230         case SMP_LTK:
7231         case SMP_LTK_SLAVE:
7232                 if (ltk->authenticated)
7233                         return MGMT_LTK_AUTHENTICATED;
7234                 return MGMT_LTK_UNAUTHENTICATED;
7235         case SMP_LTK_P256:
7236                 if (ltk->authenticated)
7237                         return MGMT_LTK_P256_AUTH;
7238                 return MGMT_LTK_P256_UNAUTH;
7239         case SMP_LTK_P256_DEBUG:
7240                 return MGMT_LTK_P256_DEBUG;
7241         }
7242
7243         return MGMT_LTK_UNAUTHENTICATED;
7244 }
7245
7246 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7247 {
7248         struct mgmt_ev_new_long_term_key ev;
7249
7250         memset(&ev, 0, sizeof(ev));
7251
7252         /* Devices using resolvable or non-resolvable random addresses
7253          * without providing an indentity resolving key don't require
7254          * to store long term keys. Their addresses will change the
7255          * next time around.
7256          *
7257          * Only when a remote device provides an identity address
7258          * make sure the long term key is stored. If the remote
7259          * identity is known, the long term keys are internally
7260          * mapped to the identity address. So allow static random
7261          * and public addresses here.
7262          */
7263         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7264             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7265                 ev.store_hint = 0x00;
7266         else
7267                 ev.store_hint = persistent;
7268
7269         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7270         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7271         ev.key.type = mgmt_ltk_type(key);
7272         ev.key.enc_size = key->enc_size;
7273         ev.key.ediv = key->ediv;
7274         ev.key.rand = key->rand;
7275
7276         if (key->type == SMP_LTK)
7277                 ev.key.master = 1;
7278
7279         memcpy(ev.key.val, key->val, sizeof(key->val));
7280
7281         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7282 }
7283
7284 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7285 {
7286         struct mgmt_ev_new_irk ev;
7287
7288         memset(&ev, 0, sizeof(ev));
7289
7290         /* For identity resolving keys from devices that are already
7291          * using a public address or static random address, do not
7292          * ask for storing this key. The identity resolving key really
7293          * is only mandatory for devices using resovlable random
7294          * addresses.
7295          *
7296          * Storing all identity resolving keys has the downside that
7297          * they will be also loaded on next boot of they system. More
7298          * identity resolving keys, means more time during scanning is
7299          * needed to actually resolve these addresses.
7300          */
7301         if (bacmp(&irk->rpa, BDADDR_ANY))
7302                 ev.store_hint = 0x01;
7303         else
7304                 ev.store_hint = 0x00;
7305
7306         bacpy(&ev.rpa, &irk->rpa);
7307         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7308         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7309         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7310
7311         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7312 }
7313
7314 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7315                    bool persistent)
7316 {
7317         struct mgmt_ev_new_csrk ev;
7318
7319         memset(&ev, 0, sizeof(ev));
7320
7321         /* Devices using resolvable or non-resolvable random addresses
7322          * without providing an indentity resolving key don't require
7323          * to store signature resolving keys. Their addresses will change
7324          * the next time around.
7325          *
7326          * Only when a remote device provides an identity address
7327          * make sure the signature resolving key is stored. So allow
7328          * static random and public addresses here.
7329          */
7330         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7331             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7332                 ev.store_hint = 0x00;
7333         else
7334                 ev.store_hint = persistent;
7335
7336         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7337         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7338         ev.key.type = csrk->type;
7339         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7340
7341         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7342 }
7343
7344 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7345                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7346                          u16 max_interval, u16 latency, u16 timeout)
7347 {
7348         struct mgmt_ev_new_conn_param ev;
7349
7350         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7351                 return;
7352
7353         memset(&ev, 0, sizeof(ev));
7354         bacpy(&ev.addr.bdaddr, bdaddr);
7355         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7356         ev.store_hint = store_hint;
7357         ev.min_interval = cpu_to_le16(min_interval);
7358         ev.max_interval = cpu_to_le16(max_interval);
7359         ev.latency = cpu_to_le16(latency);
7360         ev.timeout = cpu_to_le16(timeout);
7361
7362         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7363 }
7364
7365 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7366                            u32 flags, u8 *name, u8 name_len)
7367 {
7368         char buf[512];
7369         struct mgmt_ev_device_connected *ev = (void *) buf;
7370         u16 eir_len = 0;
7371
7372         bacpy(&ev->addr.bdaddr, &conn->dst);
7373         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7374
7375         ev->flags = __cpu_to_le32(flags);
7376
7377         /* We must ensure that the EIR Data fields are ordered and
7378          * unique. Keep it simple for now and avoid the problem by not
7379          * adding any BR/EDR data to the LE adv.
7380          */
7381         if (conn->le_adv_data_len > 0) {
7382                 memcpy(&ev->eir[eir_len],
7383                        conn->le_adv_data, conn->le_adv_data_len);
7384                 eir_len = conn->le_adv_data_len;
7385         } else {
7386                 if (name_len > 0)
7387                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7388                                                   name, name_len);
7389
7390                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7391                         eir_len = eir_append_data(ev->eir, eir_len,
7392                                                   EIR_CLASS_OF_DEV,
7393                                                   conn->dev_class, 3);
7394         }
7395
7396         ev->eir_len = cpu_to_le16(eir_len);
7397
7398         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7399                     sizeof(*ev) + eir_len, NULL);
7400 }
7401
7402 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7403 {
7404         struct sock **sk = data;
7405
7406         cmd->cmd_complete(cmd, 0);
7407
7408         *sk = cmd->sk;
7409         sock_hold(*sk);
7410
7411         mgmt_pending_remove(cmd);
7412 }
7413
7414 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7415 {
7416         struct hci_dev *hdev = data;
7417         struct mgmt_cp_unpair_device *cp = cmd->param;
7418
7419         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7420
7421         cmd->cmd_complete(cmd, 0);
7422         mgmt_pending_remove(cmd);
7423 }
7424
7425 bool mgmt_powering_down(struct hci_dev *hdev)
7426 {
7427         struct mgmt_pending_cmd *cmd;
7428         struct mgmt_mode *cp;
7429
7430         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7431         if (!cmd)
7432                 return false;
7433
7434         cp = cmd->param;
7435         if (!cp->val)
7436                 return true;
7437
7438         return false;
7439 }
7440
7441 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7442                               u8 link_type, u8 addr_type, u8 reason,
7443                               bool mgmt_connected)
7444 {
7445         struct mgmt_ev_device_disconnected ev;
7446         struct sock *sk = NULL;
7447
7448         /* The connection is still in hci_conn_hash so test for 1
7449          * instead of 0 to know if this is the last one.
7450          */
7451         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7452                 cancel_delayed_work(&hdev->power_off);
7453                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7454         }
7455
7456         if (!mgmt_connected)
7457                 return;
7458
7459         if (link_type != ACL_LINK && link_type != LE_LINK)
7460                 return;
7461
7462         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7463
7464         bacpy(&ev.addr.bdaddr, bdaddr);
7465         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7466         ev.reason = reason;
7467
7468         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7469
7470         if (sk)
7471                 sock_put(sk);
7472
7473         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7474                              hdev);
7475 }
7476
7477 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7478                             u8 link_type, u8 addr_type, u8 status)
7479 {
7480         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7481         struct mgmt_cp_disconnect *cp;
7482         struct mgmt_pending_cmd *cmd;
7483
7484         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7485                              hdev);
7486
7487         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7488         if (!cmd)
7489                 return;
7490
7491         cp = cmd->param;
7492
7493         if (bacmp(bdaddr, &cp->addr.bdaddr))
7494                 return;
7495
7496         if (cp->addr.type != bdaddr_type)
7497                 return;
7498
7499         cmd->cmd_complete(cmd, mgmt_status(status));
7500         mgmt_pending_remove(cmd);
7501 }
7502
7503 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7504                          u8 addr_type, u8 status)
7505 {
7506         struct mgmt_ev_connect_failed ev;
7507
7508         /* The connection is still in hci_conn_hash so test for 1
7509          * instead of 0 to know if this is the last one.
7510          */
7511         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7512                 cancel_delayed_work(&hdev->power_off);
7513                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7514         }
7515
7516         bacpy(&ev.addr.bdaddr, bdaddr);
7517         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7518         ev.status = mgmt_status(status);
7519
7520         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7521 }
7522
7523 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7524 {
7525         struct mgmt_ev_pin_code_request ev;
7526
7527         bacpy(&ev.addr.bdaddr, bdaddr);
7528         ev.addr.type = BDADDR_BREDR;
7529         ev.secure = secure;
7530
7531         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7532 }
7533
7534 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7535                                   u8 status)
7536 {
7537         struct mgmt_pending_cmd *cmd;
7538
7539         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7540         if (!cmd)
7541                 return;
7542
7543         cmd->cmd_complete(cmd, mgmt_status(status));
7544         mgmt_pending_remove(cmd);
7545 }
7546
7547 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7548                                       u8 status)
7549 {
7550         struct mgmt_pending_cmd *cmd;
7551
7552         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7553         if (!cmd)
7554                 return;
7555
7556         cmd->cmd_complete(cmd, mgmt_status(status));
7557         mgmt_pending_remove(cmd);
7558 }
7559
7560 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7561                               u8 link_type, u8 addr_type, u32 value,
7562                               u8 confirm_hint)
7563 {
7564         struct mgmt_ev_user_confirm_request ev;
7565
7566         BT_DBG("%s", hdev->name);
7567
7568         bacpy(&ev.addr.bdaddr, bdaddr);
7569         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7570         ev.confirm_hint = confirm_hint;
7571         ev.value = cpu_to_le32(value);
7572
7573         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7574                           NULL);
7575 }
7576
7577 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7578                               u8 link_type, u8 addr_type)
7579 {
7580         struct mgmt_ev_user_passkey_request ev;
7581
7582         BT_DBG("%s", hdev->name);
7583
7584         bacpy(&ev.addr.bdaddr, bdaddr);
7585         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7586
7587         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7588                           NULL);
7589 }
7590
7591 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7592                                       u8 link_type, u8 addr_type, u8 status,
7593                                       u8 opcode)
7594 {
7595         struct mgmt_pending_cmd *cmd;
7596
7597         cmd = pending_find(opcode, hdev);
7598         if (!cmd)
7599                 return -ENOENT;
7600
7601         cmd->cmd_complete(cmd, mgmt_status(status));
7602         mgmt_pending_remove(cmd);
7603
7604         return 0;
7605 }
7606
7607 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7608                                      u8 link_type, u8 addr_type, u8 status)
7609 {
7610         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7611                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7612 }
7613
7614 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7615                                          u8 link_type, u8 addr_type, u8 status)
7616 {
7617         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7618                                           status,
7619                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7620 }
7621
7622 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7623                                      u8 link_type, u8 addr_type, u8 status)
7624 {
7625         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7626                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7627 }
7628
7629 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7630                                          u8 link_type, u8 addr_type, u8 status)
7631 {
7632         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7633                                           status,
7634                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7635 }
7636
7637 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7638                              u8 link_type, u8 addr_type, u32 passkey,
7639                              u8 entered)
7640 {
7641         struct mgmt_ev_passkey_notify ev;
7642
7643         BT_DBG("%s", hdev->name);
7644
7645         bacpy(&ev.addr.bdaddr, bdaddr);
7646         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7647         ev.passkey = __cpu_to_le32(passkey);
7648         ev.entered = entered;
7649
7650         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7651 }
7652
7653 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7654 {
7655         struct mgmt_ev_auth_failed ev;
7656         struct mgmt_pending_cmd *cmd;
7657         u8 status = mgmt_status(hci_status);
7658
7659         bacpy(&ev.addr.bdaddr, &conn->dst);
7660         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7661         ev.status = status;
7662
7663         cmd = find_pairing(conn);
7664
7665         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7666                     cmd ? cmd->sk : NULL);
7667
7668         if (cmd) {
7669                 cmd->cmd_complete(cmd, status);
7670                 mgmt_pending_remove(cmd);
7671         }
7672 }
7673
7674 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7675 {
7676         struct cmd_lookup match = { NULL, hdev };
7677         bool changed;
7678
7679         if (status) {
7680                 u8 mgmt_err = mgmt_status(status);
7681                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7682                                      cmd_status_rsp, &mgmt_err);
7683                 return;
7684         }
7685
7686         if (test_bit(HCI_AUTH, &hdev->flags))
7687                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7688         else
7689                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7690
7691         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7692                              &match);
7693
7694         if (changed)
7695                 new_settings(hdev, match.sk);
7696
7697         if (match.sk)
7698                 sock_put(match.sk);
7699 }
7700
7701 static void clear_eir(struct hci_request *req)
7702 {
7703         struct hci_dev *hdev = req->hdev;
7704         struct hci_cp_write_eir cp;
7705
7706         if (!lmp_ext_inq_capable(hdev))
7707                 return;
7708
7709         memset(hdev->eir, 0, sizeof(hdev->eir));
7710
7711         memset(&cp, 0, sizeof(cp));
7712
7713         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7714 }
7715
7716 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7717 {
7718         struct cmd_lookup match = { NULL, hdev };
7719         struct hci_request req;
7720         bool changed = false;
7721
7722         if (status) {
7723                 u8 mgmt_err = mgmt_status(status);
7724
7725                 if (enable && hci_dev_test_and_clear_flag(hdev,
7726                                                           HCI_SSP_ENABLED)) {
7727                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7728                         new_settings(hdev, NULL);
7729                 }
7730
7731                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7732                                      &mgmt_err);
7733                 return;
7734         }
7735
7736         if (enable) {
7737                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7738         } else {
7739                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7740                 if (!changed)
7741                         changed = hci_dev_test_and_clear_flag(hdev,
7742                                                               HCI_HS_ENABLED);
7743                 else
7744                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7745         }
7746
7747         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7748
7749         if (changed)
7750                 new_settings(hdev, match.sk);
7751
7752         if (match.sk)
7753                 sock_put(match.sk);
7754
7755         hci_req_init(&req, hdev);
7756
7757         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7758                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7759                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7760                                     sizeof(enable), &enable);
7761                 update_eir(&req);
7762         } else {
7763                 clear_eir(&req);
7764         }
7765
7766         hci_req_run(&req, NULL);
7767 }
7768
7769 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7770 {
7771         struct cmd_lookup *match = data;
7772
7773         if (match->sk == NULL) {
7774                 match->sk = cmd->sk;
7775                 sock_hold(match->sk);
7776         }
7777 }
7778
7779 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7780                                     u8 status)
7781 {
7782         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7783
7784         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7785         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7786         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7787
7788         if (!status)
7789                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7790                                    dev_class, 3, NULL);
7791
7792         if (match.sk)
7793                 sock_put(match.sk);
7794 }
7795
7796 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7797 {
7798         struct mgmt_cp_set_local_name ev;
7799         struct mgmt_pending_cmd *cmd;
7800
7801         if (status)
7802                 return;
7803
7804         memset(&ev, 0, sizeof(ev));
7805         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7806         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7807
7808         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7809         if (!cmd) {
7810                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7811
7812                 /* If this is a HCI command related to powering on the
7813                  * HCI dev don't send any mgmt signals.
7814                  */
7815                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7816                         return;
7817         }
7818
7819         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7820                            cmd ? cmd->sk : NULL);
7821 }
7822
7823 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7824                                        u8 *rand192, u8 *hash256, u8 *rand256,
7825                                        u8 status)
7826 {
7827         struct mgmt_pending_cmd *cmd;
7828
7829         BT_DBG("%s status %u", hdev->name, status);
7830
7831         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7832         if (!cmd)
7833                 return;
7834
7835         if (status) {
7836                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7837                                 mgmt_status(status));
7838         } else {
7839                 struct mgmt_rp_read_local_oob_data rp;
7840                 size_t rp_size = sizeof(rp);
7841
7842                 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7843                 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7844
7845                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7846                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7847                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7848                 } else {
7849                         rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
7850                 }
7851
7852                 mgmt_cmd_complete(cmd->sk, hdev->id,
7853                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7854                                   &rp, rp_size);
7855         }
7856
7857         mgmt_pending_remove(cmd);
7858 }
7859
7860 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7861 {
7862         int i;
7863
7864         for (i = 0; i < uuid_count; i++) {
7865                 if (!memcmp(uuid, uuids[i], 16))
7866                         return true;
7867         }
7868
7869         return false;
7870 }
7871
7872 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7873 {
7874         u16 parsed = 0;
7875
7876         while (parsed < eir_len) {
7877                 u8 field_len = eir[0];
7878                 u8 uuid[16];
7879                 int i;
7880
7881                 if (field_len == 0)
7882                         break;
7883
7884                 if (eir_len - parsed < field_len + 1)
7885                         break;
7886
7887                 switch (eir[1]) {
7888                 case EIR_UUID16_ALL:
7889                 case EIR_UUID16_SOME:
7890                         for (i = 0; i + 3 <= field_len; i += 2) {
7891                                 memcpy(uuid, bluetooth_base_uuid, 16);
7892                                 uuid[13] = eir[i + 3];
7893                                 uuid[12] = eir[i + 2];
7894                                 if (has_uuid(uuid, uuid_count, uuids))
7895                                         return true;
7896                         }
7897                         break;
7898                 case EIR_UUID32_ALL:
7899                 case EIR_UUID32_SOME:
7900                         for (i = 0; i + 5 <= field_len; i += 4) {
7901                                 memcpy(uuid, bluetooth_base_uuid, 16);
7902                                 uuid[15] = eir[i + 5];
7903                                 uuid[14] = eir[i + 4];
7904                                 uuid[13] = eir[i + 3];
7905                                 uuid[12] = eir[i + 2];
7906                                 if (has_uuid(uuid, uuid_count, uuids))
7907                                         return true;
7908                         }
7909                         break;
7910                 case EIR_UUID128_ALL:
7911                 case EIR_UUID128_SOME:
7912                         for (i = 0; i + 17 <= field_len; i += 16) {
7913                                 memcpy(uuid, eir + i + 2, 16);
7914                                 if (has_uuid(uuid, uuid_count, uuids))
7915                                         return true;
7916                         }
7917                         break;
7918                 }
7919
7920                 parsed += field_len + 1;
7921                 eir += field_len + 1;
7922         }
7923
7924         return false;
7925 }
7926
7927 static void restart_le_scan(struct hci_dev *hdev)
7928 {
7929         /* If controller is not scanning we are done. */
7930         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7931                 return;
7932
7933         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7934                        hdev->discovery.scan_start +
7935                        hdev->discovery.scan_duration))
7936                 return;
7937
7938         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7939                            DISCOV_LE_RESTART_DELAY);
7940 }
7941
7942 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7943                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7944 {
7945         /* If a RSSI threshold has been specified, and
7946          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7947          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7948          * is set, let it through for further processing, as we might need to
7949          * restart the scan.
7950          *
7951          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7952          * the results are also dropped.
7953          */
7954         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7955             (rssi == HCI_RSSI_INVALID ||
7956             (rssi < hdev->discovery.rssi &&
7957              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7958                 return  false;
7959
7960         if (hdev->discovery.uuid_count != 0) {
7961                 /* If a list of UUIDs is provided in filter, results with no
7962                  * matching UUID should be dropped.
7963                  */
7964                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7965                                    hdev->discovery.uuids) &&
7966                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7967                                    hdev->discovery.uuid_count,
7968                                    hdev->discovery.uuids))
7969                         return false;
7970         }
7971
7972         /* If duplicate filtering does not report RSSI changes, then restart
7973          * scanning to ensure updated result with updated RSSI values.
7974          */
7975         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7976                 restart_le_scan(hdev);
7977
7978                 /* Validate RSSI value against the RSSI threshold once more. */
7979                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7980                     rssi < hdev->discovery.rssi)
7981                         return false;
7982         }
7983
7984         return true;
7985 }
7986
7987 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7988                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7989                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7990 {
7991         char buf[512];
7992         struct mgmt_ev_device_found *ev = (void *)buf;
7993         size_t ev_size;
7994
7995         /* Don't send events for a non-kernel initiated discovery. With
7996          * LE one exception is if we have pend_le_reports > 0 in which
7997          * case we're doing passive scanning and want these events.
7998          */
7999         if (!hci_discovery_active(hdev)) {
8000                 if (link_type == ACL_LINK)
8001                         return;
8002                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8003                         return;
8004         }
8005
8006         if (hdev->discovery.result_filtering) {
8007                 /* We are using service discovery */
8008                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8009                                      scan_rsp_len))
8010                         return;
8011         }
8012
8013         /* Make sure that the buffer is big enough. The 5 extra bytes
8014          * are for the potential CoD field.
8015          */
8016         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8017                 return;
8018
8019         memset(buf, 0, sizeof(buf));
8020
8021         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8022          * RSSI value was reported as 0 when not available. This behavior
8023          * is kept when using device discovery. This is required for full
8024          * backwards compatibility with the API.
8025          *
8026          * However when using service discovery, the value 127 will be
8027          * returned when the RSSI is not available.
8028          */
8029         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8030             link_type == ACL_LINK)
8031                 rssi = 0;
8032
8033         bacpy(&ev->addr.bdaddr, bdaddr);
8034         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8035         ev->rssi = rssi;
8036         ev->flags = cpu_to_le32(flags);
8037
8038         if (eir_len > 0)
8039                 /* Copy EIR or advertising data into event */
8040                 memcpy(ev->eir, eir, eir_len);
8041
8042         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8043                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8044                                           dev_class, 3);
8045
8046         if (scan_rsp_len > 0)
8047                 /* Append scan response data to event */
8048                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8049
8050         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8051         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8052
8053         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8054 }
8055
8056 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8057                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8058 {
8059         struct mgmt_ev_device_found *ev;
8060         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8061         u16 eir_len;
8062
8063         ev = (struct mgmt_ev_device_found *) buf;
8064
8065         memset(buf, 0, sizeof(buf));
8066
8067         bacpy(&ev->addr.bdaddr, bdaddr);
8068         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8069         ev->rssi = rssi;
8070
8071         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8072                                   name_len);
8073
8074         ev->eir_len = cpu_to_le16(eir_len);
8075
8076         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8077 }
8078
8079 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8080 {
8081         struct mgmt_ev_discovering ev;
8082
8083         BT_DBG("%s discovering %u", hdev->name, discovering);
8084
8085         memset(&ev, 0, sizeof(ev));
8086         ev.type = hdev->discovery.type;
8087         ev.discovering = discovering;
8088
8089         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8090 }
8091
8092 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8093 {
8094         BT_DBG("%s status %u", hdev->name, status);
8095 }
8096
8097 void mgmt_reenable_advertising(struct hci_dev *hdev)
8098 {
8099         struct hci_request req;
8100
8101         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8102             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8103                 return;
8104
8105         hci_req_init(&req, hdev);
8106         enable_advertising(&req);
8107         hci_req_run(&req, adv_enable_complete);
8108 }
8109
8110 static struct hci_mgmt_chan chan = {
8111         .channel        = HCI_CHANNEL_CONTROL,
8112         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8113         .handlers       = mgmt_handlers,
8114         .hdev_init      = mgmt_init_hdev,
8115 };
8116
8117 int mgmt_init(void)
8118 {
8119         return hci_mgmt_chan_register(&chan);
8120 }
8121
8122 void mgmt_exit(void)
8123 {
8124         hci_mgmt_chan_unregister(&chan);
8125 }