net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38
  39 #define MGMT_VERSION    1
  40 #define MGMT_REVISION   9
  41
  42 static const u16 mgmt_commands[] = {
  43         MGMT_OP_READ_INDEX_LIST,
  44         MGMT_OP_READ_INFO,
  45         MGMT_OP_SET_POWERED,
  46         MGMT_OP_SET_DISCOVERABLE,
  47         MGMT_OP_SET_CONNECTABLE,
  48         MGMT_OP_SET_FAST_CONNECTABLE,
  49         MGMT_OP_SET_BONDABLE,
  50         MGMT_OP_SET_LINK_SECURITY,
  51         MGMT_OP_SET_SSP,
  52         MGMT_OP_SET_HS,
  53         MGMT_OP_SET_LE,
  54         MGMT_OP_SET_DEV_CLASS,
  55         MGMT_OP_SET_LOCAL_NAME,
  56         MGMT_OP_ADD_UUID,
  57         MGMT_OP_REMOVE_UUID,
  58         MGMT_OP_LOAD_LINK_KEYS,
  59         MGMT_OP_LOAD_LONG_TERM_KEYS,
  60         MGMT_OP_DISCONNECT,
  61         MGMT_OP_GET_CONNECTIONS,
  62         MGMT_OP_PIN_CODE_REPLY,
  63         MGMT_OP_PIN_CODE_NEG_REPLY,
  64         MGMT_OP_SET_IO_CAPABILITY,
  65         MGMT_OP_PAIR_DEVICE,
  66         MGMT_OP_CANCEL_PAIR_DEVICE,
  67         MGMT_OP_UNPAIR_DEVICE,
  68         MGMT_OP_USER_CONFIRM_REPLY,
  69         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  70         MGMT_OP_USER_PASSKEY_REPLY,
  71         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  72         MGMT_OP_READ_LOCAL_OOB_DATA,
  73         MGMT_OP_ADD_REMOTE_OOB_DATA,
  74         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  75         MGMT_OP_START_DISCOVERY,
  76         MGMT_OP_STOP_DISCOVERY,
  77         MGMT_OP_CONFIRM_NAME,
  78         MGMT_OP_BLOCK_DEVICE,
  79         MGMT_OP_UNBLOCK_DEVICE,
  80         MGMT_OP_SET_DEVICE_ID,
  81         MGMT_OP_SET_ADVERTISING,
  82         MGMT_OP_SET_BREDR,
  83         MGMT_OP_SET_STATIC_ADDRESS,
  84         MGMT_OP_SET_SCAN_PARAMS,
  85         MGMT_OP_SET_SECURE_CONN,
  86         MGMT_OP_SET_DEBUG_KEYS,
  87         MGMT_OP_SET_PRIVACY,
  88         MGMT_OP_LOAD_IRKS,
  89         MGMT_OP_GET_CONN_INFO,
  90         MGMT_OP_GET_CLOCK_INFO,
  91         MGMT_OP_ADD_DEVICE,
  92         MGMT_OP_REMOVE_DEVICE,
  93         MGMT_OP_LOAD_CONN_PARAM,
  94         MGMT_OP_READ_UNCONF_INDEX_LIST,
  95         MGMT_OP_READ_CONFIG_INFO,
  96         MGMT_OP_SET_EXTERNAL_CONFIG,
  97         MGMT_OP_SET_PUBLIC_ADDRESS,
  98         MGMT_OP_START_SERVICE_DISCOVERY,
  99 };
 100
 101 static const u16 mgmt_events[] = {
 102         MGMT_EV_CONTROLLER_ERROR,
 103         MGMT_EV_INDEX_ADDED,
 104         MGMT_EV_INDEX_REMOVED,
 105         MGMT_EV_NEW_SETTINGS,
 106         MGMT_EV_CLASS_OF_DEV_CHANGED,
 107         MGMT_EV_LOCAL_NAME_CHANGED,
 108         MGMT_EV_NEW_LINK_KEY,
 109         MGMT_EV_NEW_LONG_TERM_KEY,
 110         MGMT_EV_DEVICE_CONNECTED,
 111         MGMT_EV_DEVICE_DISCONNECTED,
 112         MGMT_EV_CONNECT_FAILED,
 113         MGMT_EV_PIN_CODE_REQUEST,
 114         MGMT_EV_USER_CONFIRM_REQUEST,
 115         MGMT_EV_USER_PASSKEY_REQUEST,
 116         MGMT_EV_AUTH_FAILED,
 117         MGMT_EV_DEVICE_FOUND,
 118         MGMT_EV_DISCOVERING,
 119         MGMT_EV_DEVICE_BLOCKED,
 120         MGMT_EV_DEVICE_UNBLOCKED,
 121         MGMT_EV_DEVICE_UNPAIRED,
 122         MGMT_EV_PASSKEY_NOTIFY,
 123         MGMT_EV_NEW_IRK,
 124         MGMT_EV_NEW_CSRK,
 125         MGMT_EV_DEVICE_ADDED,
 126         MGMT_EV_DEVICE_REMOVED,
 127         MGMT_EV_NEW_CONN_PARAM,
 128         MGMT_EV_UNCONF_INDEX_ADDED,
 129         MGMT_EV_UNCONF_INDEX_REMOVED,
 130         MGMT_EV_NEW_CONFIG_OPTIONS,
 131 };
 132
 133 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 134
 135 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 136                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 137
 138 struct mgmt_pending_cmd {
 139         struct list_head list;
 140         u16 opcode;
 141         int index;
 142         void *param;
 143         size_t param_len;
 144         struct sock *sk;
 145         void *user_data;
 146         int (*cmd_complete)(struct mgmt_pending_cmd *cmd, u8 status);
 147 };
 148
 149 /* HCI to MGMT error code conversion table */
 150 static u8 mgmt_status_table[] = {
 151         MGMT_STATUS_SUCCESS,
 152         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 153         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 154         MGMT_STATUS_FAILED,             /* Hardware Failure */
 155         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 156         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 157         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 158         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 159         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 160         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 161         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 162         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 163         MGMT_STATUS_BUSY,               /* Command Disallowed */
 164         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 165         MGMT_STATUS_REJECTED,           /* Rejected Security */
 166         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 167         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 168         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 170         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 171         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 172         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 173         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 174         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 175         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 176         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 178         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 179         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 180         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 182         MGMT_STATUS_FAILED,             /* Unspecified Error */
 183         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 184         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 185         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 186         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 187         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 188         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 189         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 190         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 191         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 193         MGMT_STATUS_FAILED,             /* Transaction Collision */
 194         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 195         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 197         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 198         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 199         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 200         MGMT_STATUS_FAILED,             /* Slot Violation */
 201         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 202         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 203         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 204         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 205         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 206         MGMT_STATUS_BUSY,               /* Controller Busy */
 207         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 208         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 209         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 210         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 211         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 212 };
 213
 214 static u8 mgmt_status(u8 hci_status)
 215 {
 216         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 217                 return mgmt_status_table[hci_status];
 218
 219         return MGMT_STATUS_FAILED;
 220 }
 221
 222 static int mgmt_send_event(u16 event, struct hci_dev *hdev,
 223                            unsigned short channel, void *data, u16 data_len,
 224                            struct sock *skip_sk)
 225 {
 226         struct sk_buff *skb;
 227         struct mgmt_hdr *hdr;
 228
 229         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 230         if (!skb)
 231                 return -ENOMEM;
 232
 233         hdr = (void *) skb_put(skb, sizeof(*hdr));
 234         hdr->opcode = cpu_to_le16(event);
 235         if (hdev)
 236                 hdr->index = cpu_to_le16(hdev->id);
 237         else
 238                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 239         hdr->len = cpu_to_le16(data_len);
 240
 241         if (data)
 242                 memcpy(skb_put(skb, data_len), data, data_len);
 243
 244         /* Time stamp */
 245         __net_timestamp(skb);
 246
 247         hci_send_to_channel(channel, skb, skip_sk);
 248         kfree_skb(skb);
 249
 250         return 0;
 251 }
 252
 253 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 254                       struct sock *skip_sk)
 255 {
 256         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 257                                skip_sk);
 258 }
 259
 260 static int mgmt_cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 261 {
 262         struct sk_buff *skb;
 263         struct mgmt_hdr *hdr;
 264         struct mgmt_ev_cmd_status *ev;
 265         int err;
 266
 267         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 268
 269         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 270         if (!skb)
 271                 return -ENOMEM;
 272
 273         hdr = (void *) skb_put(skb, sizeof(*hdr));
 274
 275         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 276         hdr->index = cpu_to_le16(index);
 277         hdr->len = cpu_to_le16(sizeof(*ev));
 278
 279         ev = (void *) skb_put(skb, sizeof(*ev));
 280         ev->status = status;
 281         ev->opcode = cpu_to_le16(cmd);
 282
 283         err = sock_queue_rcv_skb(sk, skb);
 284         if (err < 0)
 285                 kfree_skb(skb);
 286
 287         return err;
 288 }
 289
 290 static int mgmt_cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 291                              void *rp, size_t rp_len)
 292 {
 293         struct sk_buff *skb;
 294         struct mgmt_hdr *hdr;
 295         struct mgmt_ev_cmd_complete *ev;
 296         int err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 301         if (!skb)
 302                 return -ENOMEM;
 303
 304         hdr = (void *) skb_put(skb, sizeof(*hdr));
 305
 306         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 307         hdr->index = cpu_to_le16(index);
 308         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 309
 310         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 311         ev->opcode = cpu_to_le16(cmd);
 312         ev->status = status;
 313
 314         if (rp)
 315                 memcpy(ev->data, rp, rp_len);
 316
 317         err = sock_queue_rcv_skb(sk, skb);
 318         if (err < 0)
 319                 kfree_skb(skb);
 320
 321         return err;
 322 }
 323
 324 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 325                         u16 data_len)
 326 {
 327         struct mgmt_rp_read_version rp;
 328
 329         BT_DBG("sock %p", sk);
 330
 331         rp.version = MGMT_VERSION;
 332         rp.revision = cpu_to_le16(MGMT_REVISION);
 333
 334         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 335                                  &rp, sizeof(rp));
 336 }
 337
 338 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 339                          u16 data_len)
 340 {
 341         struct mgmt_rp_read_commands *rp;
 342         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 343         const u16 num_events = ARRAY_SIZE(mgmt_events);
 344         __le16 *opcode;
 345         size_t rp_size;
 346         int i, err;
 347
 348         BT_DBG("sock %p", sk);
 349
 350         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 351
 352         rp = kmalloc(rp_size, GFP_KERNEL);
 353         if (!rp)
 354                 return -ENOMEM;
 355
 356         rp->num_commands = cpu_to_le16(num_commands);
 357         rp->num_events = cpu_to_le16(num_events);
 358
 359         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 360                 put_unaligned_le16(mgmt_commands[i], opcode);
 361
 362         for (i = 0; i < num_events; i++, opcode++)
 363                 put_unaligned_le16(mgmt_events[i], opcode);
 364
 365         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 366                                 rp, rp_size);
 367         kfree(rp);
 368
 369         return err;
 370 }
 371
 372 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 373                            u16 data_len)
 374 {
 375         struct mgmt_rp_read_index_list *rp;
 376         struct hci_dev *d;
 377         size_t rp_len;
 378         u16 count;
 379         int err;
 380
 381         BT_DBG("sock %p", sk);
 382
 383         read_lock(&hci_dev_list_lock);
 384
 385         count = 0;
 386         list_for_each_entry(d, &hci_dev_list, list) {
 387                 if (d->dev_type == HCI_BREDR &&
 388                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 389                         count++;
 390         }
 391
 392         rp_len = sizeof(*rp) + (2 * count);
 393         rp = kmalloc(rp_len, GFP_ATOMIC);
 394         if (!rp) {
 395                 read_unlock(&hci_dev_list_lock);
 396                 return -ENOMEM;
 397         }
 398
 399         count = 0;
 400         list_for_each_entry(d, &hci_dev_list, list) {
 401                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 402                     hci_dev_test_flag(d, HCI_CONFIG) ||
 403                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 404                         continue;
 405
 406                 /* Devices marked as raw-only are neither configured
 407                  * nor unconfigured controllers.
 408                  */
 409                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 410                         continue;
 411
 412                 if (d->dev_type == HCI_BREDR &&
 413                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 414                         rp->index[count++] = cpu_to_le16(d->id);
 415                         BT_DBG("Added hci%u", d->id);
 416                 }
 417         }
 418
 419         rp->num_controllers = cpu_to_le16(count);
 420         rp_len = sizeof(*rp) + (2 * count);
 421
 422         read_unlock(&hci_dev_list_lock);
 423
 424         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 425                                 0, rp, rp_len);
 426
 427         kfree(rp);
 428
 429         return err;
 430 }
 431
 432 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 433                                   void *data, u16 data_len)
 434 {
 435         struct mgmt_rp_read_unconf_index_list *rp;
 436         struct hci_dev *d;
 437         size_t rp_len;
 438         u16 count;
 439         int err;
 440
 441         BT_DBG("sock %p", sk);
 442
 443         read_lock(&hci_dev_list_lock);
 444
 445         count = 0;
 446         list_for_each_entry(d, &hci_dev_list, list) {
 447                 if (d->dev_type == HCI_BREDR &&
 448                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 449                         count++;
 450         }
 451
 452         rp_len = sizeof(*rp) + (2 * count);
 453         rp = kmalloc(rp_len, GFP_ATOMIC);
 454         if (!rp) {
 455                 read_unlock(&hci_dev_list_lock);
 456                 return -ENOMEM;
 457         }
 458
 459         count = 0;
 460         list_for_each_entry(d, &hci_dev_list, list) {
 461                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 462                     hci_dev_test_flag(d, HCI_CONFIG) ||
 463                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 464                         continue;
 465
 466                 /* Devices marked as raw-only are neither configured
 467                  * nor unconfigured controllers.
 468                  */
 469                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 470                         continue;
 471
 472                 if (d->dev_type == HCI_BREDR &&
 473                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 474                         rp->index[count++] = cpu_to_le16(d->id);
 475                         BT_DBG("Added hci%u", d->id);
 476                 }
 477         }
 478
 479         rp->num_controllers = cpu_to_le16(count);
 480         rp_len = sizeof(*rp) + (2 * count);
 481
 482         read_unlock(&hci_dev_list_lock);
 483
 484         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 485                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 486
 487         kfree(rp);
 488
 489         return err;
 490 }
 491
 492 static bool is_configured(struct hci_dev *hdev)
 493 {
 494         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 495             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 496                 return false;
 497
 498         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 499             !bacmp(&hdev->public_addr, BDADDR_ANY))
 500                 return false;
 501
 502         return true;
 503 }
 504
 505 static __le32 get_missing_options(struct hci_dev *hdev)
 506 {
 507         u32 options = 0;
 508
 509         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 510             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 511                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 512
 513         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 514             !bacmp(&hdev->public_addr, BDADDR_ANY))
 515                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 516
 517         return cpu_to_le32(options);
 518 }
 519
 520 static int new_options(struct hci_dev *hdev, struct sock *skip)
 521 {
 522         __le32 options = get_missing_options(hdev);
 523
 524         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 525                           sizeof(options), skip);
 526 }
 527
 528 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 529 {
 530         __le32 options = get_missing_options(hdev);
 531
 532         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 533                                  sizeof(options));
 534 }
 535
 536 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 537                             void *data, u16 data_len)
 538 {
 539         struct mgmt_rp_read_config_info rp;
 540         u32 options = 0;
 541
 542         BT_DBG("sock %p %s", sk, hdev->name);
 543
 544         hci_dev_lock(hdev);
 545
 546         memset(&rp, 0, sizeof(rp));
 547         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 548
 549         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 550                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 551
 552         if (hdev->set_bdaddr)
 553                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 554
 555         rp.supported_options = cpu_to_le32(options);
 556         rp.missing_options = get_missing_options(hdev);
 557
 558         hci_dev_unlock(hdev);
 559
 560         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 561                                  &rp, sizeof(rp));
 562 }
 563
 564 static u32 get_supported_settings(struct hci_dev *hdev)
 565 {
 566         u32 settings = 0;
 567
 568         settings |= MGMT_SETTING_POWERED;
 569         settings |= MGMT_SETTING_BONDABLE;
 570         settings |= MGMT_SETTING_DEBUG_KEYS;
 571         settings |= MGMT_SETTING_CONNECTABLE;
 572         settings |= MGMT_SETTING_DISCOVERABLE;
 573
 574         if (lmp_bredr_capable(hdev)) {
 575                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 576                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 577                 settings |= MGMT_SETTING_BREDR;
 578                 settings |= MGMT_SETTING_LINK_SECURITY;
 579
 580                 if (lmp_ssp_capable(hdev)) {
 581                         settings |= MGMT_SETTING_SSP;
 582                         settings |= MGMT_SETTING_HS;
 583                 }
 584
 585                 if (lmp_sc_capable(hdev))
 586                         settings |= MGMT_SETTING_SECURE_CONN;
 587         }
 588
 589         if (lmp_le_capable(hdev)) {
 590                 settings |= MGMT_SETTING_LE;
 591                 settings |= MGMT_SETTING_ADVERTISING;
 592                 settings |= MGMT_SETTING_SECURE_CONN;
 593                 settings |= MGMT_SETTING_PRIVACY;
 594                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 595         }
 596
 597         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 598             hdev->set_bdaddr)
 599                 settings |= MGMT_SETTING_CONFIGURATION;
 600
 601         return settings;
 602 }
 603
 604 static u32 get_current_settings(struct hci_dev *hdev)
 605 {
 606         u32 settings = 0;
 607
 608         if (hdev_is_powered(hdev))
 609                 settings |= MGMT_SETTING_POWERED;
 610
 611         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 612                 settings |= MGMT_SETTING_CONNECTABLE;
 613
 614         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 615                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 616
 617         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 618                 settings |= MGMT_SETTING_DISCOVERABLE;
 619
 620         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 621                 settings |= MGMT_SETTING_BONDABLE;
 622
 623         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 624                 settings |= MGMT_SETTING_BREDR;
 625
 626         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 627                 settings |= MGMT_SETTING_LE;
 628
 629         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 630                 settings |= MGMT_SETTING_LINK_SECURITY;
 631
 632         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 633                 settings |= MGMT_SETTING_SSP;
 634
 635         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 636                 settings |= MGMT_SETTING_HS;
 637
 638         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 639                 settings |= MGMT_SETTING_ADVERTISING;
 640
 641         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 642                 settings |= MGMT_SETTING_SECURE_CONN;
 643
 644         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 645                 settings |= MGMT_SETTING_DEBUG_KEYS;
 646
 647         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 648                 settings |= MGMT_SETTING_PRIVACY;
 649
 650         /* The current setting for static address has two purposes. The
 651          * first is to indicate if the static address will be used and
 652          * the second is to indicate if it is actually set.
 653          *
 654          * This means if the static address is not configured, this flag
 655          * will never bet set. If the address is configured, then if the
 656          * address is actually used decides if the flag is set or not.
 657          *
 658          * For single mode LE only controllers and dual-mode controllers
 659          * with BR/EDR disabled, the existence of the static address will
 660          * be evaluated.
 661          */
 662         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
 663             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 664             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 665                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 666                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 667         }
 668
 669         return settings;
 670 }
 671
 672 #define PNP_INFO_SVCLASS_ID             0x1200
 673
 674 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 675 {
 676         u8 *ptr = data, *uuids_start = NULL;
 677         struct bt_uuid *uuid;
 678
 679         if (len < 4)
 680                 return ptr;
 681
 682         list_for_each_entry(uuid, &hdev->uuids, list) {
 683                 u16 uuid16;
 684
 685                 if (uuid->size != 16)
 686                         continue;
 687
 688                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 689                 if (uuid16 < 0x1100)
 690                         continue;
 691
 692                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 693                         continue;
 694
 695                 if (!uuids_start) {
 696                         uuids_start = ptr;
 697                         uuids_start[0] = 1;
 698                         uuids_start[1] = EIR_UUID16_ALL;
 699                         ptr += 2;
 700                 }
 701
 702                 /* Stop if not enough space to put next UUID */
 703                 if ((ptr - data) + sizeof(u16) > len) {
 704                         uuids_start[1] = EIR_UUID16_SOME;
 705                         break;
 706                 }
 707
 708                 *ptr++ = (uuid16 & 0x00ff);
 709                 *ptr++ = (uuid16 & 0xff00) >> 8;
 710                 uuids_start[0] += sizeof(uuid16);
 711         }
 712
 713         return ptr;
 714 }
 715
 716 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 717 {
 718         u8 *ptr = data, *uuids_start = NULL;
 719         struct bt_uuid *uuid;
 720
 721         if (len < 6)
 722                 return ptr;
 723
 724         list_for_each_entry(uuid, &hdev->uuids, list) {
 725                 if (uuid->size != 32)
 726                         continue;
 727
 728                 if (!uuids_start) {
 729                         uuids_start = ptr;
 730                         uuids_start[0] = 1;
 731                         uuids_start[1] = EIR_UUID32_ALL;
 732                         ptr += 2;
 733                 }
 734
 735                 /* Stop if not enough space to put next UUID */
 736                 if ((ptr - data) + sizeof(u32) > len) {
 737                         uuids_start[1] = EIR_UUID32_SOME;
 738                         break;
 739                 }
 740
 741                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 742                 ptr += sizeof(u32);
 743                 uuids_start[0] += sizeof(u32);
 744         }
 745
 746         return ptr;
 747 }
 748
 749 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 750 {
 751         u8 *ptr = data, *uuids_start = NULL;
 752         struct bt_uuid *uuid;
 753
 754         if (len < 18)
 755                 return ptr;
 756
 757         list_for_each_entry(uuid, &hdev->uuids, list) {
 758                 if (uuid->size != 128)
 759                         continue;
 760
 761                 if (!uuids_start) {
 762                         uuids_start = ptr;
 763                         uuids_start[0] = 1;
 764                         uuids_start[1] = EIR_UUID128_ALL;
 765                         ptr += 2;
 766                 }
 767
 768                 /* Stop if not enough space to put next UUID */
 769                 if ((ptr - data) + 16 > len) {
 770                         uuids_start[1] = EIR_UUID128_SOME;
 771                         break;
 772                 }
 773
 774                 memcpy(ptr, uuid->uuid, 16);
 775                 ptr += 16;
 776                 uuids_start[0] += 16;
 777         }
 778
 779         return ptr;
 780 }
 781
 782 static struct mgmt_pending_cmd *mgmt_pending_find(u16 opcode,
 783                                                   struct hci_dev *hdev)
 784 {
 785         struct mgmt_pending_cmd *cmd;
 786
 787         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 788                 if (cmd->opcode == opcode)
 789                         return cmd;
 790         }
 791
 792         return NULL;
 793 }
 794
 795 static struct mgmt_pending_cmd *mgmt_pending_find_data(u16 opcode,
 796                                                        struct hci_dev *hdev,
 797                                                        const void *data)
 798 {
 799         struct mgmt_pending_cmd *cmd;
 800
 801         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 802                 if (cmd->user_data != data)
 803                         continue;
 804                 if (cmd->opcode == opcode)
 805                         return cmd;
 806         }
 807
 808         return NULL;
 809 }
 810
 811 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 812 {
 813         u8 ad_len = 0;
 814         size_t name_len;
 815
 816         name_len = strlen(hdev->dev_name);
 817         if (name_len > 0) {
 818                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 819
 820                 if (name_len > max_len) {
 821                         name_len = max_len;
 822                         ptr[1] = EIR_NAME_SHORT;
 823                 } else
 824                         ptr[1] = EIR_NAME_COMPLETE;
 825
 826                 ptr[0] = name_len + 1;
 827
 828                 memcpy(ptr + 2, hdev->dev_name, name_len);
 829
 830                 ad_len += (name_len + 2);
 831                 ptr += (name_len + 2);
 832         }
 833
 834         return ad_len;
 835 }
 836
 837 static void update_scan_rsp_data(struct hci_request *req)
 838 {
 839         struct hci_dev *hdev = req->hdev;
 840         struct hci_cp_le_set_scan_rsp_data cp;
 841         u8 len;
 842
 843         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 844                 return;
 845
 846         memset(&cp, 0, sizeof(cp));
 847
 848         len = create_scan_rsp_data(hdev, cp.data);
 849
 850         if (hdev->scan_rsp_data_len == len &&
 851             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 852                 return;
 853
 854         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 855         hdev->scan_rsp_data_len = len;
 856
 857         cp.length = len;
 858
 859         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 860 }
 861
 862 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 863 {
 864         struct mgmt_pending_cmd *cmd;
 865
 866         /* If there's a pending mgmt command the flags will not yet have
 867          * their final values, so check for this first.
 868          */
 869         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 870         if (cmd) {
 871                 struct mgmt_mode *cp = cmd->param;
 872                 if (cp->val == 0x01)
 873                         return LE_AD_GENERAL;
 874                 else if (cp->val == 0x02)
 875                         return LE_AD_LIMITED;
 876         } else {
 877                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 878                         return LE_AD_LIMITED;
 879                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 880                         return LE_AD_GENERAL;
 881         }
 882
 883         return 0;
 884 }
 885
 886 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 887 {
 888         u8 ad_len = 0, flags = 0;
 889
 890         flags |= get_adv_discov_flags(hdev);
 891
 892         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 893                 flags |= LE_AD_NO_BREDR;
 894
 895         if (flags) {
 896                 BT_DBG("adv flags 0x%02x", flags);
 897
 898                 ptr[0] = 2;
 899                 ptr[1] = EIR_FLAGS;
 900                 ptr[2] = flags;
 901
 902                 ad_len += 3;
 903                 ptr += 3;
 904         }
 905
 906         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 907                 ptr[0] = 2;
 908                 ptr[1] = EIR_TX_POWER;
 909                 ptr[2] = (u8) hdev->adv_tx_power;
 910
 911                 ad_len += 3;
 912                 ptr += 3;
 913         }
 914
 915         return ad_len;
 916 }
 917
 918 static void update_adv_data(struct hci_request *req)
 919 {
 920         struct hci_dev *hdev = req->hdev;
 921         struct hci_cp_le_set_adv_data cp;
 922         u8 len;
 923
 924         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 925                 return;
 926
 927         memset(&cp, 0, sizeof(cp));
 928
 929         len = create_adv_data(hdev, cp.data);
 930
 931         if (hdev->adv_data_len == len &&
 932             memcmp(cp.data, hdev->adv_data, len) == 0)
 933                 return;
 934
 935         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 936         hdev->adv_data_len = len;
 937
 938         cp.length = len;
 939
 940         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 941 }
 942
 943 int mgmt_update_adv_data(struct hci_dev *hdev)
 944 {
 945         struct hci_request req;
 946
 947         hci_req_init(&req, hdev);
 948         update_adv_data(&req);
 949
 950         return hci_req_run(&req, NULL);
 951 }
 952
 953 static void create_eir(struct hci_dev *hdev, u8 *data)
 954 {
 955         u8 *ptr = data;
 956         size_t name_len;
 957
 958         name_len = strlen(hdev->dev_name);
 959
 960         if (name_len > 0) {
 961                 /* EIR Data type */
 962                 if (name_len > 48) {
 963                         name_len = 48;
 964                         ptr[1] = EIR_NAME_SHORT;
 965                 } else
 966                         ptr[1] = EIR_NAME_COMPLETE;
 967
 968                 /* EIR Data length */
 969                 ptr[0] = name_len + 1;
 970
 971                 memcpy(ptr + 2, hdev->dev_name, name_len);
 972
 973                 ptr += (name_len + 2);
 974         }
 975
 976         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 977                 ptr[0] = 2;
 978                 ptr[1] = EIR_TX_POWER;
 979                 ptr[2] = (u8) hdev->inq_tx_power;
 980
 981                 ptr += 3;
 982         }
 983
 984         if (hdev->devid_source > 0) {
 985                 ptr[0] = 9;
 986                 ptr[1] = EIR_DEVICE_ID;
 987
 988                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 989                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 990                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 991                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 992
 993                 ptr += 10;
 994         }
 995
 996         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 997         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 998         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 999 }
1000
1001 static void update_eir(struct hci_request *req)
1002 {
1003         struct hci_dev *hdev = req->hdev;
1004         struct hci_cp_write_eir cp;
1005
1006         if (!hdev_is_powered(hdev))
1007                 return;
1008
1009         if (!lmp_ext_inq_capable(hdev))
1010                 return;
1011
1012         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1013                 return;
1014
1015         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1016                 return;
1017
1018         memset(&cp, 0, sizeof(cp));
1019
1020         create_eir(hdev, cp.data);
1021
1022         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1023                 return;
1024
1025         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1026
1027         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1028 }
1029
1030 static u8 get_service_classes(struct hci_dev *hdev)
1031 {
1032         struct bt_uuid *uuid;
1033         u8 val = 0;
1034
1035         list_for_each_entry(uuid, &hdev->uuids, list)
1036                 val |= uuid->svc_hint;
1037
1038         return val;
1039 }
1040
1041 static void update_class(struct hci_request *req)
1042 {
1043         struct hci_dev *hdev = req->hdev;
1044         u8 cod[3];
1045
1046         BT_DBG("%s", hdev->name);
1047
1048         if (!hdev_is_powered(hdev))
1049                 return;
1050
1051         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1052                 return;
1053
1054         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1055                 return;
1056
1057         cod[0] = hdev->minor_class;
1058         cod[1] = hdev->major_class;
1059         cod[2] = get_service_classes(hdev);
1060
1061         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1062                 cod[1] |= 0x20;
1063
1064         if (memcmp(cod, hdev->dev_class, 3) == 0)
1065                 return;
1066
1067         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1068 }
1069
1070 static bool get_connectable(struct hci_dev *hdev)
1071 {
1072         struct mgmt_pending_cmd *cmd;
1073
1074         /* If there's a pending mgmt command the flag will not yet have
1075          * it's final value, so check for this first.
1076          */
1077         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1078         if (cmd) {
1079                 struct mgmt_mode *cp = cmd->param;
1080                 return cp->val;
1081         }
1082
1083         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1084 }
1085
1086 static void disable_advertising(struct hci_request *req)
1087 {
1088         u8 enable = 0x00;
1089
1090         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1091 }
1092
1093 static void enable_advertising(struct hci_request *req)
1094 {
1095         struct hci_dev *hdev = req->hdev;
1096         struct hci_cp_le_set_adv_param cp;
1097         u8 own_addr_type, enable = 0x01;
1098         bool connectable;
1099
1100         if (hci_conn_num(hdev, LE_LINK) > 0)
1101                 return;
1102
1103         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1104                 disable_advertising(req);
1105
1106         /* Clear the HCI_LE_ADV bit temporarily so that the
1107          * hci_update_random_address knows that it's safe to go ahead
1108          * and write a new random address. The flag will be set back on
1109          * as soon as the SET_ADV_ENABLE HCI command completes.
1110          */
1111         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1112
1113         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1114                 connectable = true;
1115         else
1116                 connectable = get_connectable(hdev);
1117
1118         /* Set require_privacy to true only when non-connectable
1119          * advertising is used. In that case it is fine to use a
1120          * non-resolvable private address.
1121          */
1122         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1123                 return;
1124
1125         memset(&cp, 0, sizeof(cp));
1126         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1127         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1128         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1129         cp.own_address_type = own_addr_type;
1130         cp.channel_map = hdev->le_adv_channel_map;
1131
1132         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1133
1134         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1135 }
1136
1137 static void service_cache_off(struct work_struct *work)
1138 {
1139         struct hci_dev *hdev = container_of(work, struct hci_dev,
1140                                             service_cache.work);
1141         struct hci_request req;
1142
1143         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1144                 return;
1145
1146         hci_req_init(&req, hdev);
1147
1148         hci_dev_lock(hdev);
1149
1150         update_eir(&req);
1151         update_class(&req);
1152
1153         hci_dev_unlock(hdev);
1154
1155         hci_req_run(&req, NULL);
1156 }
1157
1158 static void rpa_expired(struct work_struct *work)
1159 {
1160         struct hci_dev *hdev = container_of(work, struct hci_dev,
1161                                             rpa_expired.work);
1162         struct hci_request req;
1163
1164         BT_DBG("");
1165
1166         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1167
1168         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1169                 return;
1170
1171         /* The generation of a new RPA and programming it into the
1172          * controller happens in the enable_advertising() function.
1173          */
1174         hci_req_init(&req, hdev);
1175         enable_advertising(&req);
1176         hci_req_run(&req, NULL);
1177 }
1178
1179 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1180 {
1181         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1182                 return;
1183
1184         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1185         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1186
1187         /* Non-mgmt controlled devices get this bit set
1188          * implicitly so that pairing works for them, however
1189          * for mgmt we require user-space to explicitly enable
1190          * it
1191          */
1192         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1193 }
1194
1195 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1196                                 void *data, u16 data_len)
1197 {
1198         struct mgmt_rp_read_info rp;
1199
1200         BT_DBG("sock %p %s", sk, hdev->name);
1201
1202         hci_dev_lock(hdev);
1203
1204         memset(&rp, 0, sizeof(rp));
1205
1206         bacpy(&rp.bdaddr, &hdev->bdaddr);
1207
1208         rp.version = hdev->hci_ver;
1209         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1210
1211         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1212         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1213
1214         memcpy(rp.dev_class, hdev->dev_class, 3);
1215
1216         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1217         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1218
1219         hci_dev_unlock(hdev);
1220
1221         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1222                                  sizeof(rp));
1223 }
1224
1225 static void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
1226 {
1227         sock_put(cmd->sk);
1228         kfree(cmd->param);
1229         kfree(cmd);
1230 }
1231
1232 static struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1233                                                  struct hci_dev *hdev,
1234                                                  void *data, u16 len)
1235 {
1236         struct mgmt_pending_cmd *cmd;
1237
1238         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1239         if (!cmd)
1240                 return NULL;
1241
1242         cmd->opcode = opcode;
1243         cmd->index = hdev->id;
1244
1245         cmd->param = kmemdup(data, len, GFP_KERNEL);
1246         if (!cmd->param) {
1247                 kfree(cmd);
1248                 return NULL;
1249         }
1250
1251         cmd->param_len = len;
1252
1253         cmd->sk = sk;
1254         sock_hold(sk);
1255
1256         list_add(&cmd->list, &hdev->mgmt_pending);
1257
1258         return cmd;
1259 }
1260
1261 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1262                                  void (*cb)(struct mgmt_pending_cmd *cmd,
1263                                             void *data),
1264                                  void *data)
1265 {
1266         struct mgmt_pending_cmd *cmd, *tmp;
1267
1268         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1269                 if (opcode > 0 && cmd->opcode != opcode)
1270                         continue;
1271
1272                 cb(cmd, data);
1273         }
1274 }
1275
1276 static void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
1277 {
1278         list_del(&cmd->list);
1279         mgmt_pending_free(cmd);
1280 }
1281
1282 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1283 {
1284         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1285
1286         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1287                                  sizeof(settings));
1288 }
1289
1290 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1291 {
1292         BT_DBG("%s status 0x%02x", hdev->name, status);
1293
1294         if (hci_conn_count(hdev) == 0) {
1295                 cancel_delayed_work(&hdev->power_off);
1296                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1297         }
1298 }
1299
1300 static bool hci_stop_discovery(struct hci_request *req)
1301 {
1302         struct hci_dev *hdev = req->hdev;
1303         struct hci_cp_remote_name_req_cancel cp;
1304         struct inquiry_entry *e;
1305
1306         switch (hdev->discovery.state) {
1307         case DISCOVERY_FINDING:
1308                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1309                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1310                 } else {
1311                         cancel_delayed_work(&hdev->le_scan_disable);
1312                         hci_req_add_le_scan_disable(req);
1313                 }
1314
1315                 return true;
1316
1317         case DISCOVERY_RESOLVING:
1318                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1319                                                      NAME_PENDING);
1320                 if (!e)
1321                         break;
1322
1323                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1324                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1325                             &cp);
1326
1327                 return true;
1328
1329         default:
1330                 /* Passive scanning */
1331                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1332                         hci_req_add_le_scan_disable(req);
1333                         return true;
1334                 }
1335
1336                 break;
1337         }
1338
1339         return false;
1340 }
1341
1342 static int clean_up_hci_state(struct hci_dev *hdev)
1343 {
1344         struct hci_request req;
1345         struct hci_conn *conn;
1346         bool discov_stopped;
1347         int err;
1348
1349         hci_req_init(&req, hdev);
1350
1351         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1352             test_bit(HCI_PSCAN, &hdev->flags)) {
1353                 u8 scan = 0x00;
1354                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1355         }
1356
1357         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1358                 disable_advertising(&req);
1359
1360         discov_stopped = hci_stop_discovery(&req);
1361
1362         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1363                 struct hci_cp_disconnect dc;
1364                 struct hci_cp_reject_conn_req rej;
1365
1366                 switch (conn->state) {
1367                 case BT_CONNECTED:
1368                 case BT_CONFIG:
1369                         dc.handle = cpu_to_le16(conn->handle);
1370                         dc.reason = 0x15; /* Terminated due to Power Off */
1371                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1372                         break;
1373                 case BT_CONNECT:
1374                         if (conn->type == LE_LINK)
1375                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1376                                             0, NULL);
1377                         else if (conn->type == ACL_LINK)
1378                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1379                                             6, &conn->dst);
1380                         break;
1381                 case BT_CONNECT2:
1382                         bacpy(&rej.bdaddr, &conn->dst);
1383                         rej.reason = 0x15; /* Terminated due to Power Off */
1384                         if (conn->type == ACL_LINK)
1385                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1386                                             sizeof(rej), &rej);
1387                         else if (conn->type == SCO_LINK)
1388                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1389                                             sizeof(rej), &rej);
1390                         break;
1391                 }
1392         }
1393
1394         err = hci_req_run(&req, clean_up_hci_complete);
1395         if (!err && discov_stopped)
1396                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1397
1398         return err;
1399 }
1400
1401 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1402                        u16 len)
1403 {
1404         struct mgmt_mode *cp = data;
1405         struct mgmt_pending_cmd *cmd;
1406         int err;
1407
1408         BT_DBG("request for %s", hdev->name);
1409
1410         if (cp->val != 0x00 && cp->val != 0x01)
1411                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1412                                        MGMT_STATUS_INVALID_PARAMS);
1413
1414         hci_dev_lock(hdev);
1415
1416         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1417                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1418                                       MGMT_STATUS_BUSY);
1419                 goto failed;
1420         }
1421
1422         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1423                 cancel_delayed_work(&hdev->power_off);
1424
1425                 if (cp->val) {
1426                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1427                                          data, len);
1428                         err = mgmt_powered(hdev, 1);
1429                         goto failed;
1430                 }
1431         }
1432
1433         if (!!cp->val == hdev_is_powered(hdev)) {
1434                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1435                 goto failed;
1436         }
1437
1438         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1439         if (!cmd) {
1440                 err = -ENOMEM;
1441                 goto failed;
1442         }
1443
1444         if (cp->val) {
1445                 queue_work(hdev->req_workqueue, &hdev->power_on);
1446                 err = 0;
1447         } else {
1448                 /* Disconnect connections, stop scans, etc */
1449                 err = clean_up_hci_state(hdev);
1450                 if (!err)
1451                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1452                                            HCI_POWER_OFF_TIMEOUT);
1453
1454                 /* ENODATA means there were no HCI commands queued */
1455                 if (err == -ENODATA) {
1456                         cancel_delayed_work(&hdev->power_off);
1457                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1458                         err = 0;
1459                 }
1460         }
1461
1462 failed:
1463         hci_dev_unlock(hdev);
1464         return err;
1465 }
1466
1467 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1468 {
1469         __le32 ev;
1470
1471         ev = cpu_to_le32(get_current_settings(hdev));
1472
1473         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1474 }
1475
1476 int mgmt_new_settings(struct hci_dev *hdev)
1477 {
1478         return new_settings(hdev, NULL);
1479 }
1480
1481 struct cmd_lookup {
1482         struct sock *sk;
1483         struct hci_dev *hdev;
1484         u8 mgmt_status;
1485 };
1486
1487 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1488 {
1489         struct cmd_lookup *match = data;
1490
1491         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1492
1493         list_del(&cmd->list);
1494
1495         if (match->sk == NULL) {
1496                 match->sk = cmd->sk;
1497                 sock_hold(match->sk);
1498         }
1499
1500         mgmt_pending_free(cmd);
1501 }
1502
1503 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1504 {
1505         u8 *status = data;
1506
1507         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1508         mgmt_pending_remove(cmd);
1509 }
1510
1511 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1512 {
1513         if (cmd->cmd_complete) {
1514                 u8 *status = data;
1515
1516                 cmd->cmd_complete(cmd, *status);
1517                 mgmt_pending_remove(cmd);
1518
1519                 return;
1520         }
1521
1522         cmd_status_rsp(cmd, data);
1523 }
1524
1525 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1526 {
1527         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1528                                  cmd->param, cmd->param_len);
1529 }
1530
1531 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1532 {
1533         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1534                                  cmd->param, sizeof(struct mgmt_addr_info));
1535 }
1536
1537 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1538 {
1539         if (!lmp_bredr_capable(hdev))
1540                 return MGMT_STATUS_NOT_SUPPORTED;
1541         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1542                 return MGMT_STATUS_REJECTED;
1543         else
1544                 return MGMT_STATUS_SUCCESS;
1545 }
1546
1547 static u8 mgmt_le_support(struct hci_dev *hdev)
1548 {
1549         if (!lmp_le_capable(hdev))
1550                 return MGMT_STATUS_NOT_SUPPORTED;
1551         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1552                 return MGMT_STATUS_REJECTED;
1553         else
1554                 return MGMT_STATUS_SUCCESS;
1555 }
1556
1557 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1558                                       u16 opcode)
1559 {
1560         struct mgmt_pending_cmd *cmd;
1561         struct mgmt_mode *cp;
1562         struct hci_request req;
1563         bool changed;
1564
1565         BT_DBG("status 0x%02x", status);
1566
1567         hci_dev_lock(hdev);
1568
1569         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1570         if (!cmd)
1571                 goto unlock;
1572
1573         if (status) {
1574                 u8 mgmt_err = mgmt_status(status);
1575                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1576                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1577                 goto remove_cmd;
1578         }
1579
1580         cp = cmd->param;
1581         if (cp->val) {
1582                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1583
1584                 if (hdev->discov_timeout > 0) {
1585                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1586                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1587                                            to);
1588                 }
1589         } else {
1590                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1591         }
1592
1593         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1594
1595         if (changed)
1596                 new_settings(hdev, cmd->sk);
1597
1598         /* When the discoverable mode gets changed, make sure
1599          * that class of device has the limited discoverable
1600          * bit correctly set. Also update page scan based on whitelist
1601          * entries.
1602          */
1603         hci_req_init(&req, hdev);
1604         __hci_update_page_scan(&req);
1605         update_class(&req);
1606         hci_req_run(&req, NULL);
1607
1608 remove_cmd:
1609         mgmt_pending_remove(cmd);
1610
1611 unlock:
1612         hci_dev_unlock(hdev);
1613 }
1614
1615 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1616                             u16 len)
1617 {
1618         struct mgmt_cp_set_discoverable *cp = data;
1619         struct mgmt_pending_cmd *cmd;
1620         struct hci_request req;
1621         u16 timeout;
1622         u8 scan;
1623         int err;
1624
1625         BT_DBG("request for %s", hdev->name);
1626
1627         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1628             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1629                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1630                                        MGMT_STATUS_REJECTED);
1631
1632         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1634                                        MGMT_STATUS_INVALID_PARAMS);
1635
1636         timeout = __le16_to_cpu(cp->timeout);
1637
1638         /* Disabling discoverable requires that no timeout is set,
1639          * and enabling limited discoverable requires a timeout.
1640          */
1641         if ((cp->val == 0x00 && timeout > 0) ||
1642             (cp->val == 0x02 && timeout == 0))
1643                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1644                                        MGMT_STATUS_INVALID_PARAMS);
1645
1646         hci_dev_lock(hdev);
1647
1648         if (!hdev_is_powered(hdev) && timeout > 0) {
1649                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1650                                       MGMT_STATUS_NOT_POWERED);
1651                 goto failed;
1652         }
1653
1654         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1655             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1656                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1657                                       MGMT_STATUS_BUSY);
1658                 goto failed;
1659         }
1660
1661         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1662                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1663                                       MGMT_STATUS_REJECTED);
1664                 goto failed;
1665         }
1666
1667         if (!hdev_is_powered(hdev)) {
1668                 bool changed = false;
1669
1670                 /* Setting limited discoverable when powered off is
1671                  * not a valid operation since it requires a timeout
1672                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1673                  */
1674                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1675                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1676                         changed = true;
1677                 }
1678
1679                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1680                 if (err < 0)
1681                         goto failed;
1682
1683                 if (changed)
1684                         err = new_settings(hdev, sk);
1685
1686                 goto failed;
1687         }
1688
1689         /* If the current mode is the same, then just update the timeout
1690          * value with the new value. And if only the timeout gets updated,
1691          * then no need for any HCI transactions.
1692          */
1693         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1694             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1695                                                    HCI_LIMITED_DISCOVERABLE)) {
1696                 cancel_delayed_work(&hdev->discov_off);
1697                 hdev->discov_timeout = timeout;
1698
1699                 if (cp->val && hdev->discov_timeout > 0) {
1700                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1701                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1702                                            to);
1703                 }
1704
1705                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1706                 goto failed;
1707         }
1708
1709         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1710         if (!cmd) {
1711                 err = -ENOMEM;
1712                 goto failed;
1713         }
1714
1715         /* Cancel any potential discoverable timeout that might be
1716          * still active and store new timeout value. The arming of
1717          * the timeout happens in the complete handler.
1718          */
1719         cancel_delayed_work(&hdev->discov_off);
1720         hdev->discov_timeout = timeout;
1721
1722         /* Limited discoverable mode */
1723         if (cp->val == 0x02)
1724                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1725         else
1726                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1727
1728         hci_req_init(&req, hdev);
1729
1730         /* The procedure for LE-only controllers is much simpler - just
1731          * update the advertising data.
1732          */
1733         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1734                 goto update_ad;
1735
1736         scan = SCAN_PAGE;
1737
1738         if (cp->val) {
1739                 struct hci_cp_write_current_iac_lap hci_cp;
1740
1741                 if (cp->val == 0x02) {
1742                         /* Limited discoverable mode */
1743                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1744                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1745                         hci_cp.iac_lap[1] = 0x8b;
1746                         hci_cp.iac_lap[2] = 0x9e;
1747                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1748                         hci_cp.iac_lap[4] = 0x8b;
1749                         hci_cp.iac_lap[5] = 0x9e;
1750                 } else {
1751                         /* General discoverable mode */
1752                         hci_cp.num_iac = 1;
1753                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1754                         hci_cp.iac_lap[1] = 0x8b;
1755                         hci_cp.iac_lap[2] = 0x9e;
1756                 }
1757
1758                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1759                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1760
1761                 scan |= SCAN_INQUIRY;
1762         } else {
1763                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1764         }
1765
1766         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1767
1768 update_ad:
1769         update_adv_data(&req);
1770
1771         err = hci_req_run(&req, set_discoverable_complete);
1772         if (err < 0)
1773                 mgmt_pending_remove(cmd);
1774
1775 failed:
1776         hci_dev_unlock(hdev);
1777         return err;
1778 }
1779
1780 static void write_fast_connectable(struct hci_request *req, bool enable)
1781 {
1782         struct hci_dev *hdev = req->hdev;
1783         struct hci_cp_write_page_scan_activity acp;
1784         u8 type;
1785
1786         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1787                 return;
1788
1789         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1790                 return;
1791
1792         if (enable) {
1793                 type = PAGE_SCAN_TYPE_INTERLACED;
1794
1795                 /* 160 msec page scan interval */
1796                 acp.interval = cpu_to_le16(0x0100);
1797         } else {
1798                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1799
1800                 /* default 1.28 sec page scan */
1801                 acp.interval = cpu_to_le16(0x0800);
1802         }
1803
1804         acp.window = cpu_to_le16(0x0012);
1805
1806         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1807             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1808                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1809                             sizeof(acp), &acp);
1810
1811         if (hdev->page_scan_type != type)
1812                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1813 }
1814
1815 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1816                                      u16 opcode)
1817 {
1818         struct mgmt_pending_cmd *cmd;
1819         struct mgmt_mode *cp;
1820         bool conn_changed, discov_changed;
1821
1822         BT_DBG("status 0x%02x", status);
1823
1824         hci_dev_lock(hdev);
1825
1826         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1827         if (!cmd)
1828                 goto unlock;
1829
1830         if (status) {
1831                 u8 mgmt_err = mgmt_status(status);
1832                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1833                 goto remove_cmd;
1834         }
1835
1836         cp = cmd->param;
1837         if (cp->val) {
1838                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1839                                                           HCI_CONNECTABLE);
1840                 discov_changed = false;
1841         } else {
1842                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1843                                                            HCI_CONNECTABLE);
1844                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1845                                                              HCI_DISCOVERABLE);
1846         }
1847
1848         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1849
1850         if (conn_changed || discov_changed) {
1851                 new_settings(hdev, cmd->sk);
1852                 hci_update_page_scan(hdev);
1853                 if (discov_changed)
1854                         mgmt_update_adv_data(hdev);
1855                 hci_update_background_scan(hdev);
1856         }
1857
1858 remove_cmd:
1859         mgmt_pending_remove(cmd);
1860
1861 unlock:
1862         hci_dev_unlock(hdev);
1863 }
1864
1865 static int set_connectable_update_settings(struct hci_dev *hdev,
1866                                            struct sock *sk, u8 val)
1867 {
1868         bool changed = false;
1869         int err;
1870
1871         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1872                 changed = true;
1873
1874         if (val) {
1875                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1876         } else {
1877                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1878                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1879         }
1880
1881         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1882         if (err < 0)
1883                 return err;
1884
1885         if (changed) {
1886                 hci_update_page_scan(hdev);
1887                 hci_update_background_scan(hdev);
1888                 return new_settings(hdev, sk);
1889         }
1890
1891         return 0;
1892 }
1893
1894 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1895                            u16 len)
1896 {
1897         struct mgmt_mode *cp = data;
1898         struct mgmt_pending_cmd *cmd;
1899         struct hci_request req;
1900         u8 scan;
1901         int err;
1902
1903         BT_DBG("request for %s", hdev->name);
1904
1905         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1906             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1907                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1908                                        MGMT_STATUS_REJECTED);
1909
1910         if (cp->val != 0x00 && cp->val != 0x01)
1911                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1912                                        MGMT_STATUS_INVALID_PARAMS);
1913
1914         hci_dev_lock(hdev);
1915
1916         if (!hdev_is_powered(hdev)) {
1917                 err = set_connectable_update_settings(hdev, sk, cp->val);
1918                 goto failed;
1919         }
1920
1921         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1922             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1923                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1924                                       MGMT_STATUS_BUSY);
1925                 goto failed;
1926         }
1927
1928         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1929         if (!cmd) {
1930                 err = -ENOMEM;
1931                 goto failed;
1932         }
1933
1934         hci_req_init(&req, hdev);
1935
1936         /* If BR/EDR is not enabled and we disable advertising as a
1937          * by-product of disabling connectable, we need to update the
1938          * advertising flags.
1939          */
1940         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1941                 if (!cp->val) {
1942                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1943                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1944                 }
1945                 update_adv_data(&req);
1946         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1947                 if (cp->val) {
1948                         scan = SCAN_PAGE;
1949                 } else {
1950                         /* If we don't have any whitelist entries just
1951                          * disable all scanning. If there are entries
1952                          * and we had both page and inquiry scanning
1953                          * enabled then fall back to only page scanning.
1954                          * Otherwise no changes are needed.
1955                          */
1956                         if (list_empty(&hdev->whitelist))
1957                                 scan = SCAN_DISABLED;
1958                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1959                                 scan = SCAN_PAGE;
1960                         else
1961                                 goto no_scan_update;
1962
1963                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1964                             hdev->discov_timeout > 0)
1965                                 cancel_delayed_work(&hdev->discov_off);
1966                 }
1967
1968                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1969         }
1970
1971 no_scan_update:
1972         /* Update the advertising parameters if necessary */
1973         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
1974                 enable_advertising(&req);
1975
1976         err = hci_req_run(&req, set_connectable_complete);
1977         if (err < 0) {
1978                 mgmt_pending_remove(cmd);
1979                 if (err == -ENODATA)
1980                         err = set_connectable_update_settings(hdev, sk,
1981                                                               cp->val);
1982                 goto failed;
1983         }
1984
1985 failed:
1986         hci_dev_unlock(hdev);
1987         return err;
1988 }
1989
1990 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1991                         u16 len)
1992 {
1993         struct mgmt_mode *cp = data;
1994         bool changed;
1995         int err;
1996
1997         BT_DBG("request for %s", hdev->name);
1998
1999         if (cp->val != 0x00 && cp->val != 0x01)
2000                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2001                                        MGMT_STATUS_INVALID_PARAMS);
2002
2003         hci_dev_lock(hdev);
2004
2005         if (cp->val)
2006                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2007         else
2008                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2009
2010         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2011         if (err < 0)
2012                 goto unlock;
2013
2014         if (changed)
2015                 err = new_settings(hdev, sk);
2016
2017 unlock:
2018         hci_dev_unlock(hdev);
2019         return err;
2020 }
2021
2022 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2023                              u16 len)
2024 {
2025         struct mgmt_mode *cp = data;
2026         struct mgmt_pending_cmd *cmd;
2027         u8 val, status;
2028         int err;
2029
2030         BT_DBG("request for %s", hdev->name);
2031
2032         status = mgmt_bredr_support(hdev);
2033         if (status)
2034                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2035                                        status);
2036
2037         if (cp->val != 0x00 && cp->val != 0x01)
2038                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2039                                        MGMT_STATUS_INVALID_PARAMS);
2040
2041         hci_dev_lock(hdev);
2042
2043         if (!hdev_is_powered(hdev)) {
2044                 bool changed = false;
2045
2046                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2047                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2048                         changed = true;
2049                 }
2050
2051                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2052                 if (err < 0)
2053                         goto failed;
2054
2055                 if (changed)
2056                         err = new_settings(hdev, sk);
2057
2058                 goto failed;
2059         }
2060
2061         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2063                                       MGMT_STATUS_BUSY);
2064                 goto failed;
2065         }
2066
2067         val = !!cp->val;
2068
2069         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2070                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2071                 goto failed;
2072         }
2073
2074         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2075         if (!cmd) {
2076                 err = -ENOMEM;
2077                 goto failed;
2078         }
2079
2080         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2081         if (err < 0) {
2082                 mgmt_pending_remove(cmd);
2083                 goto failed;
2084         }
2085
2086 failed:
2087         hci_dev_unlock(hdev);
2088         return err;
2089 }
2090
2091 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2092 {
2093         struct mgmt_mode *cp = data;
2094         struct mgmt_pending_cmd *cmd;
2095         u8 status;
2096         int err;
2097
2098         BT_DBG("request for %s", hdev->name);
2099
2100         status = mgmt_bredr_support(hdev);
2101         if (status)
2102                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2103
2104         if (!lmp_ssp_capable(hdev))
2105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2106                                        MGMT_STATUS_NOT_SUPPORTED);
2107
2108         if (cp->val != 0x00 && cp->val != 0x01)
2109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2110                                        MGMT_STATUS_INVALID_PARAMS);
2111
2112         hci_dev_lock(hdev);
2113
2114         if (!hdev_is_powered(hdev)) {
2115                 bool changed;
2116
2117                 if (cp->val) {
2118                         changed = !hci_dev_test_and_set_flag(hdev,
2119                                                              HCI_SSP_ENABLED);
2120                 } else {
2121                         changed = hci_dev_test_and_clear_flag(hdev,
2122                                                               HCI_SSP_ENABLED);
2123                         if (!changed)
2124                                 changed = hci_dev_test_and_clear_flag(hdev,
2125                                                                       HCI_HS_ENABLED);
2126                         else
2127                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2128                 }
2129
2130                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2131                 if (err < 0)
2132                         goto failed;
2133
2134                 if (changed)
2135                         err = new_settings(hdev, sk);
2136
2137                 goto failed;
2138         }
2139
2140         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
2141                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2142                                       MGMT_STATUS_BUSY);
2143                 goto failed;
2144         }
2145
2146         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2147                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2148                 goto failed;
2149         }
2150
2151         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2152         if (!cmd) {
2153                 err = -ENOMEM;
2154                 goto failed;
2155         }
2156
2157         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2158                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2159                              sizeof(cp->val), &cp->val);
2160
2161         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2162         if (err < 0) {
2163                 mgmt_pending_remove(cmd);
2164                 goto failed;
2165         }
2166
2167 failed:
2168         hci_dev_unlock(hdev);
2169         return err;
2170 }
2171
2172 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2173 {
2174         struct mgmt_mode *cp = data;
2175         bool changed;
2176         u8 status;
2177         int err;
2178
2179         BT_DBG("request for %s", hdev->name);
2180
2181         status = mgmt_bredr_support(hdev);
2182         if (status)
2183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2184
2185         if (!lmp_ssp_capable(hdev))
2186                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2187                                        MGMT_STATUS_NOT_SUPPORTED);
2188
2189         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2191                                        MGMT_STATUS_REJECTED);
2192
2193         if (cp->val != 0x00 && cp->val != 0x01)
2194                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2195                                        MGMT_STATUS_INVALID_PARAMS);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
2200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2201                                       MGMT_STATUS_BUSY);
2202                 goto unlock;
2203         }
2204
2205         if (cp->val) {
2206                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2207         } else {
2208                 if (hdev_is_powered(hdev)) {
2209                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2210                                               MGMT_STATUS_REJECTED);
2211                         goto unlock;
2212                 }
2213
2214                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2215         }
2216
2217         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2218         if (err < 0)
2219                 goto unlock;
2220
2221         if (changed)
2222                 err = new_settings(hdev, sk);
2223
2224 unlock:
2225         hci_dev_unlock(hdev);
2226         return err;
2227 }
2228
2229 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2230 {
2231         struct cmd_lookup match = { NULL, hdev };
2232
2233         hci_dev_lock(hdev);
2234
2235         if (status) {
2236                 u8 mgmt_err = mgmt_status(status);
2237
2238                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2239                                      &mgmt_err);
2240                 goto unlock;
2241         }
2242
2243         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2244
2245         new_settings(hdev, match.sk);
2246
2247         if (match.sk)
2248                 sock_put(match.sk);
2249
2250         /* Make sure the controller has a good default for
2251          * advertising data. Restrict the update to when LE
2252          * has actually been enabled. During power on, the
2253          * update in powered_update_hci will take care of it.
2254          */
2255         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2256                 struct hci_request req;
2257
2258                 hci_req_init(&req, hdev);
2259                 update_adv_data(&req);
2260                 update_scan_rsp_data(&req);
2261                 __hci_update_background_scan(&req);
2262                 hci_req_run(&req, NULL);
2263         }
2264
2265 unlock:
2266         hci_dev_unlock(hdev);
2267 }
2268
2269 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2270 {
2271         struct mgmt_mode *cp = data;
2272         struct hci_cp_write_le_host_supported hci_cp;
2273         struct mgmt_pending_cmd *cmd;
2274         struct hci_request req;
2275         int err;
2276         u8 val, enabled;
2277
2278         BT_DBG("request for %s", hdev->name);
2279
2280         if (!lmp_le_capable(hdev))
2281                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2282                                        MGMT_STATUS_NOT_SUPPORTED);
2283
2284         if (cp->val != 0x00 && cp->val != 0x01)
2285                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2286                                        MGMT_STATUS_INVALID_PARAMS);
2287
2288         /* LE-only devices do not allow toggling LE on/off */
2289         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2290                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2291                                        MGMT_STATUS_REJECTED);
2292
2293         hci_dev_lock(hdev);
2294
2295         val = !!cp->val;
2296         enabled = lmp_host_le_capable(hdev);
2297
2298         if (!hdev_is_powered(hdev) || val == enabled) {
2299                 bool changed = false;
2300
2301                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2302                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2303                         changed = true;
2304                 }
2305
2306                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2307                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2308                         changed = true;
2309                 }
2310
2311                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2312                 if (err < 0)
2313                         goto unlock;
2314
2315                 if (changed)
2316                         err = new_settings(hdev, sk);
2317
2318                 goto unlock;
2319         }
2320
2321         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2322             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2323                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2324                                       MGMT_STATUS_BUSY);
2325                 goto unlock;
2326         }
2327
2328         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2329         if (!cmd) {
2330                 err = -ENOMEM;
2331                 goto unlock;
2332         }
2333
2334         hci_req_init(&req, hdev);
2335
2336         memset(&hci_cp, 0, sizeof(hci_cp));
2337
2338         if (val) {
2339                 hci_cp.le = val;
2340                 hci_cp.simul = 0x00;
2341         } else {
2342                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2343                         disable_advertising(&req);
2344         }
2345
2346         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2347                     &hci_cp);
2348
2349         err = hci_req_run(&req, le_enable_complete);
2350         if (err < 0)
2351                 mgmt_pending_remove(cmd);
2352
2353 unlock:
2354         hci_dev_unlock(hdev);
2355         return err;
2356 }
2357
2358 /* This is a helper function to test for pending mgmt commands that can
2359  * cause CoD or EIR HCI commands. We can only allow one such pending
2360  * mgmt command at a time since otherwise we cannot easily track what
2361  * the current values are, will be, and based on that calculate if a new
2362  * HCI command needs to be sent and if yes with what value.
2363  */
2364 static bool pending_eir_or_class(struct hci_dev *hdev)
2365 {
2366         struct mgmt_pending_cmd *cmd;
2367
2368         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2369                 switch (cmd->opcode) {
2370                 case MGMT_OP_ADD_UUID:
2371                 case MGMT_OP_REMOVE_UUID:
2372                 case MGMT_OP_SET_DEV_CLASS:
2373                 case MGMT_OP_SET_POWERED:
2374                         return true;
2375                 }
2376         }
2377
2378         return false;
2379 }
2380
2381 static const u8 bluetooth_base_uuid[] = {
2382                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2383                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2384 };
2385
2386 static u8 get_uuid_size(const u8 *uuid)
2387 {
2388         u32 val;
2389
2390         if (memcmp(uuid, bluetooth_base_uuid, 12))
2391                 return 128;
2392
2393         val = get_unaligned_le32(&uuid[12]);
2394         if (val > 0xffff)
2395                 return 32;
2396
2397         return 16;
2398 }
2399
2400 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2401 {
2402         struct mgmt_pending_cmd *cmd;
2403
2404         hci_dev_lock(hdev);
2405
2406         cmd = mgmt_pending_find(mgmt_op, hdev);
2407         if (!cmd)
2408                 goto unlock;
2409
2410         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2411                           mgmt_status(status), hdev->dev_class, 3);
2412
2413         mgmt_pending_remove(cmd);
2414
2415 unlock:
2416         hci_dev_unlock(hdev);
2417 }
2418
2419 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2420 {
2421         BT_DBG("status 0x%02x", status);
2422
2423         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2424 }
2425
2426 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2427 {
2428         struct mgmt_cp_add_uuid *cp = data;
2429         struct mgmt_pending_cmd *cmd;
2430         struct hci_request req;
2431         struct bt_uuid *uuid;
2432         int err;
2433
2434         BT_DBG("request for %s", hdev->name);
2435
2436         hci_dev_lock(hdev);
2437
2438         if (pending_eir_or_class(hdev)) {
2439                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2440                                       MGMT_STATUS_BUSY);
2441                 goto failed;
2442         }
2443
2444         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2445         if (!uuid) {
2446                 err = -ENOMEM;
2447                 goto failed;
2448         }
2449
2450         memcpy(uuid->uuid, cp->uuid, 16);
2451         uuid->svc_hint = cp->svc_hint;
2452         uuid->size = get_uuid_size(cp->uuid);
2453
2454         list_add_tail(&uuid->list, &hdev->uuids);
2455
2456         hci_req_init(&req, hdev);
2457
2458         update_class(&req);
2459         update_eir(&req);
2460
2461         err = hci_req_run(&req, add_uuid_complete);
2462         if (err < 0) {
2463                 if (err != -ENODATA)
2464                         goto failed;
2465
2466                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2467                                         hdev->dev_class, 3);
2468                 goto failed;
2469         }
2470
2471         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2472         if (!cmd) {
2473                 err = -ENOMEM;
2474                 goto failed;
2475         }
2476
2477         err = 0;
2478
2479 failed:
2480         hci_dev_unlock(hdev);
2481         return err;
2482 }
2483
2484 static bool enable_service_cache(struct hci_dev *hdev)
2485 {
2486         if (!hdev_is_powered(hdev))
2487                 return false;
2488
2489         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2490                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2491                                    CACHE_TIMEOUT);
2492                 return true;
2493         }
2494
2495         return false;
2496 }
2497
2498 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2499 {
2500         BT_DBG("status 0x%02x", status);
2501
2502         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2503 }
2504
2505 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2506                        u16 len)
2507 {
2508         struct mgmt_cp_remove_uuid *cp = data;
2509         struct mgmt_pending_cmd *cmd;
2510         struct bt_uuid *match, *tmp;
2511         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2512         struct hci_request req;
2513         int err, found;
2514
2515         BT_DBG("request for %s", hdev->name);
2516
2517         hci_dev_lock(hdev);
2518
2519         if (pending_eir_or_class(hdev)) {
2520                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2521                                       MGMT_STATUS_BUSY);
2522                 goto unlock;
2523         }
2524
2525         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2526                 hci_uuids_clear(hdev);
2527
2528                 if (enable_service_cache(hdev)) {
2529                         err = mgmt_cmd_complete(sk, hdev->id,
2530                                                 MGMT_OP_REMOVE_UUID,
2531                                                 0, hdev->dev_class, 3);
2532                         goto unlock;
2533                 }
2534
2535                 goto update_class;
2536         }
2537
2538         found = 0;
2539
2540         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2541                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2542                         continue;
2543
2544                 list_del(&match->list);
2545                 kfree(match);
2546                 found++;
2547         }
2548
2549         if (found == 0) {
2550                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2551                                       MGMT_STATUS_INVALID_PARAMS);
2552                 goto unlock;
2553         }
2554
2555 update_class:
2556         hci_req_init(&req, hdev);
2557
2558         update_class(&req);
2559         update_eir(&req);
2560
2561         err = hci_req_run(&req, remove_uuid_complete);
2562         if (err < 0) {
2563                 if (err != -ENODATA)
2564                         goto unlock;
2565
2566                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2567                                         hdev->dev_class, 3);
2568                 goto unlock;
2569         }
2570
2571         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2572         if (!cmd) {
2573                 err = -ENOMEM;
2574                 goto unlock;
2575         }
2576
2577         err = 0;
2578
2579 unlock:
2580         hci_dev_unlock(hdev);
2581         return err;
2582 }
2583
2584 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2585 {
2586         BT_DBG("status 0x%02x", status);
2587
2588         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2589 }
2590
2591 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2592                          u16 len)
2593 {
2594         struct mgmt_cp_set_dev_class *cp = data;
2595         struct mgmt_pending_cmd *cmd;
2596         struct hci_request req;
2597         int err;
2598
2599         BT_DBG("request for %s", hdev->name);
2600
2601         if (!lmp_bredr_capable(hdev))
2602                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2603                                        MGMT_STATUS_NOT_SUPPORTED);
2604
2605         hci_dev_lock(hdev);
2606
2607         if (pending_eir_or_class(hdev)) {
2608                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2609                                       MGMT_STATUS_BUSY);
2610                 goto unlock;
2611         }
2612
2613         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2614                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2615                                       MGMT_STATUS_INVALID_PARAMS);
2616                 goto unlock;
2617         }
2618
2619         hdev->major_class = cp->major;
2620         hdev->minor_class = cp->minor;
2621
2622         if (!hdev_is_powered(hdev)) {
2623                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2624                                         hdev->dev_class, 3);
2625                 goto unlock;
2626         }
2627
2628         hci_req_init(&req, hdev);
2629
2630         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2631                 hci_dev_unlock(hdev);
2632                 cancel_delayed_work_sync(&hdev->service_cache);
2633                 hci_dev_lock(hdev);
2634                 update_eir(&req);
2635         }
2636
2637         update_class(&req);
2638
2639         err = hci_req_run(&req, set_class_complete);
2640         if (err < 0) {
2641                 if (err != -ENODATA)
2642                         goto unlock;
2643
2644                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2645                                         hdev->dev_class, 3);
2646                 goto unlock;
2647         }
2648
2649         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2650         if (!cmd) {
2651                 err = -ENOMEM;
2652                 goto unlock;
2653         }
2654
2655         err = 0;
2656
2657 unlock:
2658         hci_dev_unlock(hdev);
2659         return err;
2660 }
2661
2662 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2663                           u16 len)
2664 {
2665         struct mgmt_cp_load_link_keys *cp = data;
2666         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2667                                    sizeof(struct mgmt_link_key_info));
2668         u16 key_count, expected_len;
2669         bool changed;
2670         int i;
2671
2672         BT_DBG("request for %s", hdev->name);
2673
2674         if (!lmp_bredr_capable(hdev))
2675                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2676                                        MGMT_STATUS_NOT_SUPPORTED);
2677
2678         key_count = __le16_to_cpu(cp->key_count);
2679         if (key_count > max_key_count) {
2680                 BT_ERR("load_link_keys: too big key_count value %u",
2681                        key_count);
2682                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2683                                        MGMT_STATUS_INVALID_PARAMS);
2684         }
2685
2686         expected_len = sizeof(*cp) + key_count *
2687                                         sizeof(struct mgmt_link_key_info);
2688         if (expected_len != len) {
2689                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2690                        expected_len, len);
2691                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2692                                        MGMT_STATUS_INVALID_PARAMS);
2693         }
2694
2695         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2696                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2697                                        MGMT_STATUS_INVALID_PARAMS);
2698
2699         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2700                key_count);
2701
2702         for (i = 0; i < key_count; i++) {
2703                 struct mgmt_link_key_info *key = &cp->keys[i];
2704
2705                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2706                         return mgmt_cmd_status(sk, hdev->id,
2707                                                MGMT_OP_LOAD_LINK_KEYS,
2708                                                MGMT_STATUS_INVALID_PARAMS);
2709         }
2710
2711         hci_dev_lock(hdev);
2712
2713         hci_link_keys_clear(hdev);
2714
2715         if (cp->debug_keys)
2716                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2717         else
2718                 changed = hci_dev_test_and_clear_flag(hdev,
2719                                                       HCI_KEEP_DEBUG_KEYS);
2720
2721         if (changed)
2722                 new_settings(hdev, NULL);
2723
2724         for (i = 0; i < key_count; i++) {
2725                 struct mgmt_link_key_info *key = &cp->keys[i];
2726
2727                 /* Always ignore debug keys and require a new pairing if
2728                  * the user wants to use them.
2729                  */
2730                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2731                         continue;
2732
2733                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2734                                  key->type, key->pin_len, NULL);
2735         }
2736
2737         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2738
2739         hci_dev_unlock(hdev);
2740
2741         return 0;
2742 }
2743
2744 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2745                            u8 addr_type, struct sock *skip_sk)
2746 {
2747         struct mgmt_ev_device_unpaired ev;
2748
2749         bacpy(&ev.addr.bdaddr, bdaddr);
2750         ev.addr.type = addr_type;
2751
2752         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2753                           skip_sk);
2754 }
2755
2756 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2757                          u16 len)
2758 {
2759         struct mgmt_cp_unpair_device *cp = data;
2760         struct mgmt_rp_unpair_device rp;
2761         struct hci_cp_disconnect dc;
2762         struct mgmt_pending_cmd *cmd;
2763         struct hci_conn *conn;
2764         int err;
2765
2766         memset(&rp, 0, sizeof(rp));
2767         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2768         rp.addr.type = cp->addr.type;
2769
2770         if (!bdaddr_type_is_valid(cp->addr.type))
2771                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2772                                          MGMT_STATUS_INVALID_PARAMS,
2773                                          &rp, sizeof(rp));
2774
2775         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2776                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2777                                          MGMT_STATUS_INVALID_PARAMS,
2778                                          &rp, sizeof(rp));
2779
2780         hci_dev_lock(hdev);
2781
2782         if (!hdev_is_powered(hdev)) {
2783                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2784                                         MGMT_STATUS_NOT_POWERED, &rp,
2785                                         sizeof(rp));
2786                 goto unlock;
2787         }
2788
2789         if (cp->addr.type == BDADDR_BREDR) {
2790                 /* If disconnection is requested, then look up the
2791                  * connection. If the remote device is connected, it
2792                  * will be later used to terminate the link.
2793                  *
2794                  * Setting it to NULL explicitly will cause no
2795                  * termination of the link.
2796                  */
2797                 if (cp->disconnect)
2798                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2799                                                        &cp->addr.bdaddr);
2800                 else
2801                         conn = NULL;
2802
2803                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2804         } else {
2805                 u8 addr_type;
2806
2807                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2808                                                &cp->addr.bdaddr);
2809                 if (conn) {
2810                         /* Defer clearing up the connection parameters
2811                          * until closing to give a chance of keeping
2812                          * them if a repairing happens.
2813                          */
2814                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2815
2816                         /* If disconnection is not requested, then
2817                          * clear the connection variable so that the
2818                          * link is not terminated.
2819                          */
2820                         if (!cp->disconnect)
2821                                 conn = NULL;
2822                 }
2823
2824                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2825                         addr_type = ADDR_LE_DEV_PUBLIC;
2826                 else
2827                         addr_type = ADDR_LE_DEV_RANDOM;
2828
2829                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2830
2831                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2832         }
2833
2834         if (err < 0) {
2835                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2836                                         MGMT_STATUS_NOT_PAIRED, &rp,
2837                                         sizeof(rp));
2838                 goto unlock;
2839         }
2840
2841         /* If the connection variable is set, then termination of the
2842          * link is requested.
2843          */
2844         if (!conn) {
2845                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2846                                         &rp, sizeof(rp));
2847                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2848                 goto unlock;
2849         }
2850
2851         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2852                                sizeof(*cp));
2853         if (!cmd) {
2854                 err = -ENOMEM;
2855                 goto unlock;
2856         }
2857
2858         cmd->cmd_complete = addr_cmd_complete;
2859
2860         dc.handle = cpu_to_le16(conn->handle);
2861         dc.reason = 0x13; /* Remote User Terminated Connection */
2862         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2863         if (err < 0)
2864                 mgmt_pending_remove(cmd);
2865
2866 unlock:
2867         hci_dev_unlock(hdev);
2868         return err;
2869 }
2870
2871 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2872                       u16 len)
2873 {
2874         struct mgmt_cp_disconnect *cp = data;
2875         struct mgmt_rp_disconnect rp;
2876         struct mgmt_pending_cmd *cmd;
2877         struct hci_conn *conn;
2878         int err;
2879
2880         BT_DBG("");
2881
2882         memset(&rp, 0, sizeof(rp));
2883         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2884         rp.addr.type = cp->addr.type;
2885
2886         if (!bdaddr_type_is_valid(cp->addr.type))
2887                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2888                                          MGMT_STATUS_INVALID_PARAMS,
2889                                          &rp, sizeof(rp));
2890
2891         hci_dev_lock(hdev);
2892
2893         if (!test_bit(HCI_UP, &hdev->flags)) {
2894                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2895                                         MGMT_STATUS_NOT_POWERED, &rp,
2896                                         sizeof(rp));
2897                 goto failed;
2898         }
2899
2900         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2901                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2902                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2903                 goto failed;
2904         }
2905
2906         if (cp->addr.type == BDADDR_BREDR)
2907                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2908                                                &cp->addr.bdaddr);
2909         else
2910                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2911
2912         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2913                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2914                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2915                                         sizeof(rp));
2916                 goto failed;
2917         }
2918
2919         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2920         if (!cmd) {
2921                 err = -ENOMEM;
2922                 goto failed;
2923         }
2924
2925         cmd->cmd_complete = generic_cmd_complete;
2926
2927         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2928         if (err < 0)
2929                 mgmt_pending_remove(cmd);
2930
2931 failed:
2932         hci_dev_unlock(hdev);
2933         return err;
2934 }
2935
2936 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2937 {
2938         switch (link_type) {
2939         case LE_LINK:
2940                 switch (addr_type) {
2941                 case ADDR_LE_DEV_PUBLIC:
2942                         return BDADDR_LE_PUBLIC;
2943
2944                 default:
2945                         /* Fallback to LE Random address type */
2946                         return BDADDR_LE_RANDOM;
2947                 }
2948
2949         default:
2950                 /* Fallback to BR/EDR type */
2951                 return BDADDR_BREDR;
2952         }
2953 }
2954
2955 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2956                            u16 data_len)
2957 {
2958         struct mgmt_rp_get_connections *rp;
2959         struct hci_conn *c;
2960         size_t rp_len;
2961         int err;
2962         u16 i;
2963
2964         BT_DBG("");
2965
2966         hci_dev_lock(hdev);
2967
2968         if (!hdev_is_powered(hdev)) {
2969                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2970                                       MGMT_STATUS_NOT_POWERED);
2971                 goto unlock;
2972         }
2973
2974         i = 0;
2975         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2976                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2977                         i++;
2978         }
2979
2980         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2981         rp = kmalloc(rp_len, GFP_KERNEL);
2982         if (!rp) {
2983                 err = -ENOMEM;
2984                 goto unlock;
2985         }
2986
2987         i = 0;
2988         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2989                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2990                         continue;
2991                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2992                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2993                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2994                         continue;
2995                 i++;
2996         }
2997
2998         rp->conn_count = cpu_to_le16(i);
2999
3000         /* Recalculate length in case of filtered SCO connections, etc */
3001         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3002
3003         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3004                                 rp_len);
3005
3006         kfree(rp);
3007
3008 unlock:
3009         hci_dev_unlock(hdev);
3010         return err;
3011 }
3012
3013 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3014                                    struct mgmt_cp_pin_code_neg_reply *cp)
3015 {
3016         struct mgmt_pending_cmd *cmd;
3017         int err;
3018
3019         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3020                                sizeof(*cp));
3021         if (!cmd)
3022                 return -ENOMEM;
3023
3024         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3025                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3026         if (err < 0)
3027                 mgmt_pending_remove(cmd);
3028
3029         return err;
3030 }
3031
3032 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3033                           u16 len)
3034 {
3035         struct hci_conn *conn;
3036         struct mgmt_cp_pin_code_reply *cp = data;
3037         struct hci_cp_pin_code_reply reply;
3038         struct mgmt_pending_cmd *cmd;
3039         int err;
3040
3041         BT_DBG("");
3042
3043         hci_dev_lock(hdev);
3044
3045         if (!hdev_is_powered(hdev)) {
3046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3047                                       MGMT_STATUS_NOT_POWERED);
3048                 goto failed;
3049         }
3050
3051         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3052         if (!conn) {
3053                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3054                                       MGMT_STATUS_NOT_CONNECTED);
3055                 goto failed;
3056         }
3057
3058         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3059                 struct mgmt_cp_pin_code_neg_reply ncp;
3060
3061                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3062
3063                 BT_ERR("PIN code is not 16 bytes long");
3064
3065                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3066                 if (err >= 0)
3067                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3068                                               MGMT_STATUS_INVALID_PARAMS);
3069
3070                 goto failed;
3071         }
3072
3073         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3074         if (!cmd) {
3075                 err = -ENOMEM;
3076                 goto failed;
3077         }
3078
3079         cmd->cmd_complete = addr_cmd_complete;
3080
3081         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3082         reply.pin_len = cp->pin_len;
3083         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3084
3085         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3086         if (err < 0)
3087                 mgmt_pending_remove(cmd);
3088
3089 failed:
3090         hci_dev_unlock(hdev);
3091         return err;
3092 }
3093
3094 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3095                              u16 len)
3096 {
3097         struct mgmt_cp_set_io_capability *cp = data;
3098
3099         BT_DBG("");
3100
3101         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3102                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3103                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3104
3105         hci_dev_lock(hdev);
3106
3107         hdev->io_capability = cp->io_capability;
3108
3109         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3110                hdev->io_capability);
3111
3112         hci_dev_unlock(hdev);
3113
3114         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3115                                  NULL, 0);
3116 }
3117
3118 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3119 {
3120         struct hci_dev *hdev = conn->hdev;
3121         struct mgmt_pending_cmd *cmd;
3122
3123         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3124                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3125                         continue;
3126
3127                 if (cmd->user_data != conn)
3128                         continue;
3129
3130                 return cmd;
3131         }
3132
3133         return NULL;
3134 }
3135
3136 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3137 {
3138         struct mgmt_rp_pair_device rp;
3139         struct hci_conn *conn = cmd->user_data;
3140         int err;
3141
3142         bacpy(&rp.addr.bdaddr, &conn->dst);
3143         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3144
3145         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3146                                 status, &rp, sizeof(rp));
3147
3148         /* So we don't get further callbacks for this connection */
3149         conn->connect_cfm_cb = NULL;
3150         conn->security_cfm_cb = NULL;
3151         conn->disconn_cfm_cb = NULL;
3152
3153         hci_conn_drop(conn);
3154
3155         /* The device is paired so there is no need to remove
3156          * its connection parameters anymore.
3157          */
3158         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3159
3160         hci_conn_put(conn);
3161
3162         return err;
3163 }
3164
3165 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3166 {
3167         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3168         struct mgmt_pending_cmd *cmd;
3169
3170         cmd = find_pairing(conn);
3171         if (cmd) {
3172                 cmd->cmd_complete(cmd, status);
3173                 mgmt_pending_remove(cmd);
3174         }
3175 }
3176
3177 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3178 {
3179         struct mgmt_pending_cmd *cmd;
3180
3181         BT_DBG("status %u", status);
3182
3183         cmd = find_pairing(conn);
3184         if (!cmd) {
3185                 BT_DBG("Unable to find a pending command");
3186                 return;
3187         }
3188
3189         cmd->cmd_complete(cmd, mgmt_status(status));
3190         mgmt_pending_remove(cmd);
3191 }
3192
3193 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3194 {
3195         struct mgmt_pending_cmd *cmd;
3196
3197         BT_DBG("status %u", status);
3198
3199         if (!status)
3200                 return;
3201
3202         cmd = find_pairing(conn);
3203         if (!cmd) {
3204                 BT_DBG("Unable to find a pending command");
3205                 return;
3206         }
3207
3208         cmd->cmd_complete(cmd, mgmt_status(status));
3209         mgmt_pending_remove(cmd);
3210 }
3211
3212 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3213                        u16 len)
3214 {
3215         struct mgmt_cp_pair_device *cp = data;
3216         struct mgmt_rp_pair_device rp;
3217         struct mgmt_pending_cmd *cmd;
3218         u8 sec_level, auth_type;
3219         struct hci_conn *conn;
3220         int err;
3221
3222         BT_DBG("");
3223
3224         memset(&rp, 0, sizeof(rp));
3225         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3226         rp.addr.type = cp->addr.type;
3227
3228         if (!bdaddr_type_is_valid(cp->addr.type))
3229                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3230                                          MGMT_STATUS_INVALID_PARAMS,
3231                                          &rp, sizeof(rp));
3232
3233         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3234                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3235                                          MGMT_STATUS_INVALID_PARAMS,
3236                                          &rp, sizeof(rp));
3237
3238         hci_dev_lock(hdev);
3239
3240         if (!hdev_is_powered(hdev)) {
3241                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3242                                         MGMT_STATUS_NOT_POWERED, &rp,
3243                                         sizeof(rp));
3244                 goto unlock;
3245         }
3246
3247         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3248                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3249                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3250                                         sizeof(rp));
3251                 goto unlock;
3252         }
3253
3254         sec_level = BT_SECURITY_MEDIUM;
3255         auth_type = HCI_AT_DEDICATED_BONDING;
3256
3257         if (cp->addr.type == BDADDR_BREDR) {
3258                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3259                                        auth_type);
3260         } else {
3261                 u8 addr_type;
3262
3263                 /* Convert from L2CAP channel address type to HCI address type
3264                  */
3265                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3266                         addr_type = ADDR_LE_DEV_PUBLIC;
3267                 else
3268                         addr_type = ADDR_LE_DEV_RANDOM;
3269
3270                 /* When pairing a new device, it is expected to remember
3271                  * this device for future connections. Adding the connection
3272                  * parameter information ahead of time allows tracking
3273                  * of the slave preferred values and will speed up any
3274                  * further connection establishment.
3275                  *
3276                  * If connection parameters already exist, then they
3277                  * will be kept and this function does nothing.
3278                  */
3279                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3280
3281                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3282                                       sec_level, HCI_LE_CONN_TIMEOUT,
3283                                       HCI_ROLE_MASTER);
3284         }
3285
3286         if (IS_ERR(conn)) {
3287                 int status;
3288
3289                 if (PTR_ERR(conn) == -EBUSY)
3290                         status = MGMT_STATUS_BUSY;
3291                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3292                         status = MGMT_STATUS_NOT_SUPPORTED;
3293                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3294                         status = MGMT_STATUS_REJECTED;
3295                 else
3296                         status = MGMT_STATUS_CONNECT_FAILED;
3297
3298                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3299                                         status, &rp, sizeof(rp));
3300                 goto unlock;
3301         }
3302
3303         if (conn->connect_cfm_cb) {
3304                 hci_conn_drop(conn);
3305                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3306                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3307                 goto unlock;
3308         }
3309
3310         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3311         if (!cmd) {
3312                 err = -ENOMEM;
3313                 hci_conn_drop(conn);
3314                 goto unlock;
3315         }
3316
3317         cmd->cmd_complete = pairing_complete;
3318
3319         /* For LE, just connecting isn't a proof that the pairing finished */
3320         if (cp->addr.type == BDADDR_BREDR) {
3321                 conn->connect_cfm_cb = pairing_complete_cb;
3322                 conn->security_cfm_cb = pairing_complete_cb;
3323                 conn->disconn_cfm_cb = pairing_complete_cb;
3324         } else {
3325                 conn->connect_cfm_cb = le_pairing_complete_cb;
3326                 conn->security_cfm_cb = le_pairing_complete_cb;
3327                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3328         }
3329
3330         conn->io_capability = cp->io_cap;
3331         cmd->user_data = hci_conn_get(conn);
3332
3333         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3334             hci_conn_security(conn, sec_level, auth_type, true)) {
3335                 cmd->cmd_complete(cmd, 0);
3336                 mgmt_pending_remove(cmd);
3337         }
3338
3339         err = 0;
3340
3341 unlock:
3342         hci_dev_unlock(hdev);
3343         return err;
3344 }
3345
3346 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3347                               u16 len)
3348 {
3349         struct mgmt_addr_info *addr = data;
3350         struct mgmt_pending_cmd *cmd;
3351         struct hci_conn *conn;
3352         int err;
3353
3354         BT_DBG("");
3355
3356         hci_dev_lock(hdev);
3357
3358         if (!hdev_is_powered(hdev)) {
3359                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3360                                       MGMT_STATUS_NOT_POWERED);
3361                 goto unlock;
3362         }
3363
3364         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3365         if (!cmd) {
3366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3367                                       MGMT_STATUS_INVALID_PARAMS);
3368                 goto unlock;
3369         }
3370
3371         conn = cmd->user_data;
3372
3373         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3374                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3375                                       MGMT_STATUS_INVALID_PARAMS);
3376                 goto unlock;
3377         }
3378
3379         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3380         mgmt_pending_remove(cmd);
3381
3382         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3383                                 addr, sizeof(*addr));
3384 unlock:
3385         hci_dev_unlock(hdev);
3386         return err;
3387 }
3388
3389 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3390                              struct mgmt_addr_info *addr, u16 mgmt_op,
3391                              u16 hci_op, __le32 passkey)
3392 {
3393         struct mgmt_pending_cmd *cmd;
3394         struct hci_conn *conn;
3395         int err;
3396
3397         hci_dev_lock(hdev);
3398
3399         if (!hdev_is_powered(hdev)) {
3400                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3401                                         MGMT_STATUS_NOT_POWERED, addr,
3402                                         sizeof(*addr));
3403                 goto done;
3404         }
3405
3406         if (addr->type == BDADDR_BREDR)
3407                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3408         else
3409                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3410
3411         if (!conn) {
3412                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3413                                         MGMT_STATUS_NOT_CONNECTED, addr,
3414                                         sizeof(*addr));
3415                 goto done;
3416         }
3417
3418         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3419                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3420                 if (!err)
3421                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3422                                                 MGMT_STATUS_SUCCESS, addr,
3423                                                 sizeof(*addr));
3424                 else
3425                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3426                                                 MGMT_STATUS_FAILED, addr,
3427                                                 sizeof(*addr));
3428
3429                 goto done;
3430         }
3431
3432         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3433         if (!cmd) {
3434                 err = -ENOMEM;
3435                 goto done;
3436         }
3437
3438         cmd->cmd_complete = addr_cmd_complete;
3439
3440         /* Continue with pairing via HCI */
3441         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3442                 struct hci_cp_user_passkey_reply cp;
3443
3444                 bacpy(&cp.bdaddr, &addr->bdaddr);
3445                 cp.passkey = passkey;
3446                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3447         } else
3448                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3449                                    &addr->bdaddr);
3450
3451         if (err < 0)
3452                 mgmt_pending_remove(cmd);
3453
3454 done:
3455         hci_dev_unlock(hdev);
3456         return err;
3457 }
3458
3459 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3460                               void *data, u16 len)
3461 {
3462         struct mgmt_cp_pin_code_neg_reply *cp = data;
3463
3464         BT_DBG("");
3465
3466         return user_pairing_resp(sk, hdev, &cp->addr,
3467                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3468                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3469 }
3470
3471 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3472                               u16 len)
3473 {
3474         struct mgmt_cp_user_confirm_reply *cp = data;
3475
3476         BT_DBG("");
3477
3478         if (len != sizeof(*cp))
3479                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3480                                        MGMT_STATUS_INVALID_PARAMS);
3481
3482         return user_pairing_resp(sk, hdev, &cp->addr,
3483                                  MGMT_OP_USER_CONFIRM_REPLY,
3484                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3485 }
3486
3487 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3488                                   void *data, u16 len)
3489 {
3490         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3491
3492         BT_DBG("");
3493
3494         return user_pairing_resp(sk, hdev, &cp->addr,
3495                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3496                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3497 }
3498
3499 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3500                               u16 len)
3501 {
3502         struct mgmt_cp_user_passkey_reply *cp = data;
3503
3504         BT_DBG("");
3505
3506         return user_pairing_resp(sk, hdev, &cp->addr,
3507                                  MGMT_OP_USER_PASSKEY_REPLY,
3508                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3509 }
3510
3511 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3512                                   void *data, u16 len)
3513 {
3514         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3515
3516         BT_DBG("");
3517
3518         return user_pairing_resp(sk, hdev, &cp->addr,
3519                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3520                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3521 }
3522
3523 static void update_name(struct hci_request *req)
3524 {
3525         struct hci_dev *hdev = req->hdev;
3526         struct hci_cp_write_local_name cp;
3527
3528         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3529
3530         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3531 }
3532
3533 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3534 {
3535         struct mgmt_cp_set_local_name *cp;
3536         struct mgmt_pending_cmd *cmd;
3537
3538         BT_DBG("status 0x%02x", status);
3539
3540         hci_dev_lock(hdev);
3541
3542         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3543         if (!cmd)
3544                 goto unlock;
3545
3546         cp = cmd->param;
3547
3548         if (status)
3549                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3550                                 mgmt_status(status));
3551         else
3552                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3553                                   cp, sizeof(*cp));
3554
3555         mgmt_pending_remove(cmd);
3556
3557 unlock:
3558         hci_dev_unlock(hdev);
3559 }
3560
3561 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3562                           u16 len)
3563 {
3564         struct mgmt_cp_set_local_name *cp = data;
3565         struct mgmt_pending_cmd *cmd;
3566         struct hci_request req;
3567         int err;
3568
3569         BT_DBG("");
3570
3571         hci_dev_lock(hdev);
3572
3573         /* If the old values are the same as the new ones just return a
3574          * direct command complete event.
3575          */
3576         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3577             !memcmp(hdev->short_name, cp->short_name,
3578                     sizeof(hdev->short_name))) {
3579                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3580                                         data, len);
3581                 goto failed;
3582         }
3583
3584         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3585
3586         if (!hdev_is_powered(hdev)) {
3587                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3588
3589                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3590                                         data, len);
3591                 if (err < 0)
3592                         goto failed;
3593
3594                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3595                                  sk);
3596
3597                 goto failed;
3598         }
3599
3600         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3601         if (!cmd) {
3602                 err = -ENOMEM;
3603                 goto failed;
3604         }
3605
3606         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3607
3608         hci_req_init(&req, hdev);
3609
3610         if (lmp_bredr_capable(hdev)) {
3611                 update_name(&req);
3612                 update_eir(&req);
3613         }
3614
3615         /* The name is stored in the scan response data and so
3616          * no need to udpate the advertising data here.
3617          */
3618         if (lmp_le_capable(hdev))
3619                 update_scan_rsp_data(&req);
3620
3621         err = hci_req_run(&req, set_name_complete);
3622         if (err < 0)
3623                 mgmt_pending_remove(cmd);
3624
3625 failed:
3626         hci_dev_unlock(hdev);
3627         return err;
3628 }
3629
3630 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3631                                void *data, u16 data_len)
3632 {
3633         struct mgmt_pending_cmd *cmd;
3634         int err;
3635
3636         BT_DBG("%s", hdev->name);
3637
3638         hci_dev_lock(hdev);
3639
3640         if (!hdev_is_powered(hdev)) {
3641                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3642                                       MGMT_STATUS_NOT_POWERED);
3643                 goto unlock;
3644         }
3645
3646         if (!lmp_ssp_capable(hdev)) {
3647                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3648                                       MGMT_STATUS_NOT_SUPPORTED);
3649                 goto unlock;
3650         }
3651
3652         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3654                                       MGMT_STATUS_BUSY);
3655                 goto unlock;
3656         }
3657
3658         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3659         if (!cmd) {
3660                 err = -ENOMEM;
3661                 goto unlock;
3662         }
3663
3664         if (bredr_sc_enabled(hdev))
3665                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3666                                    0, NULL);
3667         else
3668                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3669
3670         if (err < 0)
3671                 mgmt_pending_remove(cmd);
3672
3673 unlock:
3674         hci_dev_unlock(hdev);
3675         return err;
3676 }
3677
3678 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3679                                void *data, u16 len)
3680 {
3681         struct mgmt_addr_info *addr = data;
3682         int err;
3683
3684         BT_DBG("%s ", hdev->name);
3685
3686         if (!bdaddr_type_is_valid(addr->type))
3687                 return mgmt_cmd_complete(sk, hdev->id,
3688                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3689                                          MGMT_STATUS_INVALID_PARAMS,
3690                                          addr, sizeof(*addr));
3691
3692         hci_dev_lock(hdev);
3693
3694         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3695                 struct mgmt_cp_add_remote_oob_data *cp = data;
3696                 u8 status;
3697
3698                 if (cp->addr.type != BDADDR_BREDR) {
3699                         err = mgmt_cmd_complete(sk, hdev->id,
3700                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3701                                                 MGMT_STATUS_INVALID_PARAMS,
3702                                                 &cp->addr, sizeof(cp->addr));
3703                         goto unlock;
3704                 }
3705
3706                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3707                                               cp->addr.type, cp->hash,
3708                                               cp->rand, NULL, NULL);
3709                 if (err < 0)
3710                         status = MGMT_STATUS_FAILED;
3711                 else
3712                         status = MGMT_STATUS_SUCCESS;
3713
3714                 err = mgmt_cmd_complete(sk, hdev->id,
3715                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3716                                         &cp->addr, sizeof(cp->addr));
3717         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3718                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3719                 u8 *rand192, *hash192, *rand256, *hash256;
3720                 u8 status;
3721
3722                 if (bdaddr_type_is_le(cp->addr.type)) {
3723                         /* Enforce zero-valued 192-bit parameters as
3724                          * long as legacy SMP OOB isn't implemented.
3725                          */
3726                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3727                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3728                                 err = mgmt_cmd_complete(sk, hdev->id,
3729                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3730                                                         MGMT_STATUS_INVALID_PARAMS,
3731                                                         addr, sizeof(*addr));
3732                                 goto unlock;
3733                         }
3734
3735                         rand192 = NULL;
3736                         hash192 = NULL;
3737                 } else {
3738                         /* In case one of the P-192 values is set to zero,
3739                          * then just disable OOB data for P-192.
3740                          */
3741                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3742                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3743                                 rand192 = NULL;
3744                                 hash192 = NULL;
3745                         } else {
3746                                 rand192 = cp->rand192;
3747                                 hash192 = cp->hash192;
3748                         }
3749                 }
3750
3751                 /* In case one of the P-256 values is set to zero, then just
3752                  * disable OOB data for P-256.
3753                  */
3754                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3755                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3756                         rand256 = NULL;
3757                         hash256 = NULL;
3758                 } else {
3759                         rand256 = cp->rand256;
3760                         hash256 = cp->hash256;
3761                 }
3762
3763                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3764                                               cp->addr.type, hash192, rand192,
3765                                               hash256, rand256);
3766                 if (err < 0)
3767                         status = MGMT_STATUS_FAILED;
3768                 else
3769                         status = MGMT_STATUS_SUCCESS;
3770
3771                 err = mgmt_cmd_complete(sk, hdev->id,
3772                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3773                                         status, &cp->addr, sizeof(cp->addr));
3774         } else {
3775                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3776                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3777                                       MGMT_STATUS_INVALID_PARAMS);
3778         }
3779
3780 unlock:
3781         hci_dev_unlock(hdev);
3782         return err;
3783 }
3784
3785 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3786                                   void *data, u16 len)
3787 {
3788         struct mgmt_cp_remove_remote_oob_data *cp = data;
3789         u8 status;
3790         int err;
3791
3792         BT_DBG("%s", hdev->name);
3793
3794         if (cp->addr.type != BDADDR_BREDR)
3795                 return mgmt_cmd_complete(sk, hdev->id,
3796                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3797                                          MGMT_STATUS_INVALID_PARAMS,
3798                                          &cp->addr, sizeof(cp->addr));
3799
3800         hci_dev_lock(hdev);
3801
3802         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3803                 hci_remote_oob_data_clear(hdev);
3804                 status = MGMT_STATUS_SUCCESS;
3805                 goto done;
3806         }
3807
3808         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3809         if (err < 0)
3810                 status = MGMT_STATUS_INVALID_PARAMS;
3811         else
3812                 status = MGMT_STATUS_SUCCESS;
3813
3814 done:
3815         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3816                                 status, &cp->addr, sizeof(cp->addr));
3817
3818         hci_dev_unlock(hdev);
3819         return err;
3820 }
3821
3822 static bool trigger_discovery(struct hci_request *req, u8 *status)
3823 {
3824         struct hci_dev *hdev = req->hdev;
3825         struct hci_cp_le_set_scan_param param_cp;
3826         struct hci_cp_le_set_scan_enable enable_cp;
3827         struct hci_cp_inquiry inq_cp;
3828         /* General inquiry access code (GIAC) */
3829         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3830         u8 own_addr_type;
3831         int err;
3832
3833         switch (hdev->discovery.type) {
3834         case DISCOV_TYPE_BREDR:
3835                 *status = mgmt_bredr_support(hdev);
3836                 if (*status)
3837                         return false;
3838
3839                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3840                         *status = MGMT_STATUS_BUSY;
3841                         return false;
3842                 }
3843
3844                 hci_inquiry_cache_flush(hdev);
3845
3846                 memset(&inq_cp, 0, sizeof(inq_cp));
3847                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3848                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3849                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3850                 break;
3851
3852         case DISCOV_TYPE_LE:
3853         case DISCOV_TYPE_INTERLEAVED:
3854                 *status = mgmt_le_support(hdev);
3855                 if (*status)
3856                         return false;
3857
3858                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3859                     !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
3860                         *status = MGMT_STATUS_NOT_SUPPORTED;
3861                         return false;
3862                 }
3863
3864                 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
3865                         /* Don't let discovery abort an outgoing
3866                          * connection attempt that's using directed
3867                          * advertising.
3868                          */
3869                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3870                                                        BT_CONNECT)) {
3871                                 *status = MGMT_STATUS_REJECTED;
3872                                 return false;
3873                         }
3874
3875                         disable_advertising(req);
3876                 }
3877
3878                 /* If controller is scanning, it means the background scanning
3879                  * is running. Thus, we should temporarily stop it in order to
3880                  * set the discovery scanning parameters.
3881                  */
3882                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
3883                         hci_req_add_le_scan_disable(req);
3884
3885                 memset(&param_cp, 0, sizeof(param_cp));
3886
3887                 /* All active scans will be done with either a resolvable
3888                  * private address (when privacy feature has been enabled)
3889                  * or non-resolvable private address.
3890                  */
3891                 err = hci_update_random_address(req, true, &own_addr_type);
3892                 if (err < 0) {
3893                         *status = MGMT_STATUS_FAILED;
3894                         return false;
3895                 }
3896
3897                 param_cp.type = LE_SCAN_ACTIVE;
3898                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3899                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3900                 param_cp.own_address_type = own_addr_type;
3901                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3902                             &param_cp);
3903
3904                 memset(&enable_cp, 0, sizeof(enable_cp));
3905                 enable_cp.enable = LE_SCAN_ENABLE;
3906                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3907                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3908                             &enable_cp);
3909                 break;
3910
3911         default:
3912                 *status = MGMT_STATUS_INVALID_PARAMS;
3913                 return false;
3914         }
3915
3916         return true;
3917 }
3918
3919 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3920                                      u16 opcode)
3921 {
3922         struct mgmt_pending_cmd *cmd;
3923         unsigned long timeout;
3924
3925         BT_DBG("status %d", status);
3926
3927         hci_dev_lock(hdev);
3928
3929         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3930         if (!cmd)
3931                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3932
3933         if (cmd) {
3934                 cmd->cmd_complete(cmd, mgmt_status(status));
3935                 mgmt_pending_remove(cmd);
3936         }
3937
3938         if (status) {
3939                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3940                 goto unlock;
3941         }
3942
3943         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3944
3945         /* If the scan involves LE scan, pick proper timeout to schedule
3946          * hdev->le_scan_disable that will stop it.
3947          */
3948         switch (hdev->discovery.type) {
3949         case DISCOV_TYPE_LE:
3950                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3951                 break;
3952         case DISCOV_TYPE_INTERLEAVED:
3953                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3954                 break;
3955         case DISCOV_TYPE_BREDR:
3956                 timeout = 0;
3957                 break;
3958         default:
3959                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3960                 timeout = 0;
3961                 break;
3962         }
3963
3964         if (timeout) {
3965                 /* When service discovery is used and the controller has
3966                  * a strict duplicate filter, it is important to remember
3967                  * the start and duration of the scan. This is required
3968                  * for restarting scanning during the discovery phase.
3969                  */
3970                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3971                              &hdev->quirks) &&
3972                     hdev->discovery.result_filtering) {
3973                         hdev->discovery.scan_start = jiffies;
3974                         hdev->discovery.scan_duration = timeout;
3975                 }
3976
3977                 queue_delayed_work(hdev->workqueue,
3978                                    &hdev->le_scan_disable, timeout);
3979         }
3980
3981 unlock:
3982         hci_dev_unlock(hdev);
3983 }
3984
3985 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3986                            void *data, u16 len)
3987 {
3988         struct mgmt_cp_start_discovery *cp = data;
3989         struct mgmt_pending_cmd *cmd;
3990         struct hci_request req;
3991         u8 status;
3992         int err;
3993
3994         BT_DBG("%s", hdev->name);
3995
3996         hci_dev_lock(hdev);
3997
3998         if (!hdev_is_powered(hdev)) {
3999                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4000                                         MGMT_STATUS_NOT_POWERED,
4001                                         &cp->type, sizeof(cp->type));
4002                 goto failed;
4003         }
4004
4005         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4006             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4007                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4008                                         MGMT_STATUS_BUSY, &cp->type,
4009                                         sizeof(cp->type));
4010                 goto failed;
4011         }
4012
4013         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4014         if (!cmd) {
4015                 err = -ENOMEM;
4016                 goto failed;
4017         }
4018
4019         cmd->cmd_complete = generic_cmd_complete;
4020
4021         /* Clear the discovery filter first to free any previously
4022          * allocated memory for the UUID list.
4023          */
4024         hci_discovery_filter_clear(hdev);
4025
4026         hdev->discovery.type = cp->type;
4027         hdev->discovery.report_invalid_rssi = false;
4028
4029         hci_req_init(&req, hdev);
4030
4031         if (!trigger_discovery(&req, &status)) {
4032                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4033                                         status, &cp->type, sizeof(cp->type));
4034                 mgmt_pending_remove(cmd);
4035                 goto failed;
4036         }
4037
4038         err = hci_req_run(&req, start_discovery_complete);
4039         if (err < 0) {
4040                 mgmt_pending_remove(cmd);
4041                 goto failed;
4042         }
4043
4044         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4045
4046 failed:
4047         hci_dev_unlock(hdev);
4048         return err;
4049 }
4050
4051 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4052                                           u8 status)
4053 {
4054         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4055                                  cmd->param, 1);
4056 }
4057
4058 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4059                                    void *data, u16 len)
4060 {
4061         struct mgmt_cp_start_service_discovery *cp = data;
4062         struct mgmt_pending_cmd *cmd;
4063         struct hci_request req;
4064         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4065         u16 uuid_count, expected_len;
4066         u8 status;
4067         int err;
4068
4069         BT_DBG("%s", hdev->name);
4070
4071         hci_dev_lock(hdev);
4072
4073         if (!hdev_is_powered(hdev)) {
4074                 err = mgmt_cmd_complete(sk, hdev->id,
4075                                         MGMT_OP_START_SERVICE_DISCOVERY,
4076                                         MGMT_STATUS_NOT_POWERED,
4077                                         &cp->type, sizeof(cp->type));
4078                 goto failed;
4079         }
4080
4081         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4082             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4083                 err = mgmt_cmd_complete(sk, hdev->id,
4084                                         MGMT_OP_START_SERVICE_DISCOVERY,
4085                                         MGMT_STATUS_BUSY, &cp->type,
4086                                         sizeof(cp->type));
4087                 goto failed;
4088         }
4089
4090         uuid_count = __le16_to_cpu(cp->uuid_count);
4091         if (uuid_count > max_uuid_count) {
4092                 BT_ERR("service_discovery: too big uuid_count value %u",
4093                        uuid_count);
4094                 err = mgmt_cmd_complete(sk, hdev->id,
4095                                         MGMT_OP_START_SERVICE_DISCOVERY,
4096                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4097                                         sizeof(cp->type));
4098                 goto failed;
4099         }
4100
4101         expected_len = sizeof(*cp) + uuid_count * 16;
4102         if (expected_len != len) {
4103                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4104                        expected_len, len);
4105                 err = mgmt_cmd_complete(sk, hdev->id,
4106                                         MGMT_OP_START_SERVICE_DISCOVERY,
4107                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4108                                         sizeof(cp->type));
4109                 goto failed;
4110         }
4111
4112         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4113                                hdev, data, len);
4114         if (!cmd) {
4115                 err = -ENOMEM;
4116                 goto failed;
4117         }
4118
4119         cmd->cmd_complete = service_discovery_cmd_complete;
4120
4121         /* Clear the discovery filter first to free any previously
4122          * allocated memory for the UUID list.
4123          */
4124         hci_discovery_filter_clear(hdev);
4125
4126         hdev->discovery.result_filtering = true;
4127         hdev->discovery.type = cp->type;
4128         hdev->discovery.rssi = cp->rssi;
4129         hdev->discovery.uuid_count = uuid_count;
4130
4131         if (uuid_count > 0) {
4132                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4133                                                 GFP_KERNEL);
4134                 if (!hdev->discovery.uuids) {
4135                         err = mgmt_cmd_complete(sk, hdev->id,
4136                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4137                                                 MGMT_STATUS_FAILED,
4138                                                 &cp->type, sizeof(cp->type));
4139                         mgmt_pending_remove(cmd);
4140                         goto failed;
4141                 }
4142         }
4143
4144         hci_req_init(&req, hdev);
4145
4146         if (!trigger_discovery(&req, &status)) {
4147                 err = mgmt_cmd_complete(sk, hdev->id,
4148                                         MGMT_OP_START_SERVICE_DISCOVERY,
4149                                         status, &cp->type, sizeof(cp->type));
4150                 mgmt_pending_remove(cmd);
4151                 goto failed;
4152         }
4153
4154         err = hci_req_run(&req, start_discovery_complete);
4155         if (err < 0) {
4156                 mgmt_pending_remove(cmd);
4157                 goto failed;
4158         }
4159
4160         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4161
4162 failed:
4163         hci_dev_unlock(hdev);
4164         return err;
4165 }
4166
4167 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4168 {
4169         struct mgmt_pending_cmd *cmd;
4170
4171         BT_DBG("status %d", status);
4172
4173         hci_dev_lock(hdev);
4174
4175         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4176         if (cmd) {
4177                 cmd->cmd_complete(cmd, mgmt_status(status));
4178                 mgmt_pending_remove(cmd);
4179         }
4180
4181         if (!status)
4182                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4183
4184         hci_dev_unlock(hdev);
4185 }
4186
4187 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4188                           u16 len)
4189 {
4190         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4191         struct mgmt_pending_cmd *cmd;
4192         struct hci_request req;
4193         int err;
4194
4195         BT_DBG("%s", hdev->name);
4196
4197         hci_dev_lock(hdev);
4198
4199         if (!hci_discovery_active(hdev)) {
4200                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4201                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4202                                         sizeof(mgmt_cp->type));
4203                 goto unlock;
4204         }
4205
4206         if (hdev->discovery.type != mgmt_cp->type) {
4207                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4208                                         MGMT_STATUS_INVALID_PARAMS,
4209                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4210                 goto unlock;
4211         }
4212
4213         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4214         if (!cmd) {
4215                 err = -ENOMEM;
4216                 goto unlock;
4217         }
4218
4219         cmd->cmd_complete = generic_cmd_complete;
4220
4221         hci_req_init(&req, hdev);
4222
4223         hci_stop_discovery(&req);
4224
4225         err = hci_req_run(&req, stop_discovery_complete);
4226         if (!err) {
4227                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4228                 goto unlock;
4229         }
4230
4231         mgmt_pending_remove(cmd);
4232
4233         /* If no HCI commands were sent we're done */
4234         if (err == -ENODATA) {
4235                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4236                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4237                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4238         }
4239
4240 unlock:
4241         hci_dev_unlock(hdev);
4242         return err;
4243 }
4244
4245 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4246                         u16 len)
4247 {
4248         struct mgmt_cp_confirm_name *cp = data;
4249         struct inquiry_entry *e;
4250         int err;
4251
4252         BT_DBG("%s", hdev->name);
4253
4254         hci_dev_lock(hdev);
4255
4256         if (!hci_discovery_active(hdev)) {
4257                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4258                                         MGMT_STATUS_FAILED, &cp->addr,
4259                                         sizeof(cp->addr));
4260                 goto failed;
4261         }
4262
4263         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4264         if (!e) {
4265                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4266                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4267                                         sizeof(cp->addr));
4268                 goto failed;
4269         }
4270
4271         if (cp->name_known) {
4272                 e->name_state = NAME_KNOWN;
4273                 list_del(&e->list);
4274         } else {
4275                 e->name_state = NAME_NEEDED;
4276                 hci_inquiry_cache_update_resolve(hdev, e);
4277         }
4278
4279         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4280                                 &cp->addr, sizeof(cp->addr));
4281
4282 failed:
4283         hci_dev_unlock(hdev);
4284         return err;
4285 }
4286
4287 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4288                         u16 len)
4289 {
4290         struct mgmt_cp_block_device *cp = data;
4291         u8 status;
4292         int err;
4293
4294         BT_DBG("%s", hdev->name);
4295
4296         if (!bdaddr_type_is_valid(cp->addr.type))
4297                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4298                                          MGMT_STATUS_INVALID_PARAMS,
4299                                          &cp->addr, sizeof(cp->addr));
4300
4301         hci_dev_lock(hdev);
4302
4303         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4304                                   cp->addr.type);
4305         if (err < 0) {
4306                 status = MGMT_STATUS_FAILED;
4307                 goto done;
4308         }
4309
4310         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4311                    sk);
4312         status = MGMT_STATUS_SUCCESS;
4313
4314 done:
4315         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4316                                 &cp->addr, sizeof(cp->addr));
4317
4318         hci_dev_unlock(hdev);
4319
4320         return err;
4321 }
4322
4323 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4324                           u16 len)
4325 {
4326         struct mgmt_cp_unblock_device *cp = data;
4327         u8 status;
4328         int err;
4329
4330         BT_DBG("%s", hdev->name);
4331
4332         if (!bdaddr_type_is_valid(cp->addr.type))
4333                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4334                                          MGMT_STATUS_INVALID_PARAMS,
4335                                          &cp->addr, sizeof(cp->addr));
4336
4337         hci_dev_lock(hdev);
4338
4339         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4340                                   cp->addr.type);
4341         if (err < 0) {
4342                 status = MGMT_STATUS_INVALID_PARAMS;
4343                 goto done;
4344         }
4345
4346         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4347                    sk);
4348         status = MGMT_STATUS_SUCCESS;
4349
4350 done:
4351         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4352                                 &cp->addr, sizeof(cp->addr));
4353
4354         hci_dev_unlock(hdev);
4355
4356         return err;
4357 }
4358
4359 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4360                          u16 len)
4361 {
4362         struct mgmt_cp_set_device_id *cp = data;
4363         struct hci_request req;
4364         int err;
4365         __u16 source;
4366
4367         BT_DBG("%s", hdev->name);
4368
4369         source = __le16_to_cpu(cp->source);
4370
4371         if (source > 0x0002)
4372                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4373                                        MGMT_STATUS_INVALID_PARAMS);
4374
4375         hci_dev_lock(hdev);
4376
4377         hdev->devid_source = source;
4378         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4379         hdev->devid_product = __le16_to_cpu(cp->product);
4380         hdev->devid_version = __le16_to_cpu(cp->version);
4381
4382         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4383                                 NULL, 0);
4384
4385         hci_req_init(&req, hdev);
4386         update_eir(&req);
4387         hci_req_run(&req, NULL);
4388
4389         hci_dev_unlock(hdev);
4390
4391         return err;
4392 }
4393
4394 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4395                                      u16 opcode)
4396 {
4397         struct cmd_lookup match = { NULL, hdev };
4398
4399         hci_dev_lock(hdev);
4400
4401         if (status) {
4402                 u8 mgmt_err = mgmt_status(status);
4403
4404                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4405                                      cmd_status_rsp, &mgmt_err);
4406                 goto unlock;
4407         }
4408
4409         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4410                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4411         else
4412                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4413
4414         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4415                              &match);
4416
4417         new_settings(hdev, match.sk);
4418
4419         if (match.sk)
4420                 sock_put(match.sk);
4421
4422 unlock:
4423         hci_dev_unlock(hdev);
4424 }
4425
4426 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4427                            u16 len)
4428 {
4429         struct mgmt_mode *cp = data;
4430         struct mgmt_pending_cmd *cmd;
4431         struct hci_request req;
4432         u8 val, status;
4433         int err;
4434
4435         BT_DBG("request for %s", hdev->name);
4436
4437         status = mgmt_le_support(hdev);
4438         if (status)
4439                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4440                                        status);
4441
4442         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4444                                        MGMT_STATUS_INVALID_PARAMS);
4445
4446         hci_dev_lock(hdev);
4447
4448         val = !!cp->val;
4449
4450         /* The following conditions are ones which mean that we should
4451          * not do any HCI communication but directly send a mgmt
4452          * response to user space (after toggling the flag if
4453          * necessary).
4454          */
4455         if (!hdev_is_powered(hdev) ||
4456             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4457              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4458             hci_conn_num(hdev, LE_LINK) > 0 ||
4459             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4460              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4461                 bool changed;
4462
4463                 if (cp->val) {
4464                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4465                         if (cp->val == 0x02)
4466                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4467                         else
4468                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4469                 } else {
4470                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4471                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4472                 }
4473
4474                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4475                 if (err < 0)
4476                         goto unlock;
4477
4478                 if (changed)
4479                         err = new_settings(hdev, sk);
4480
4481                 goto unlock;
4482         }
4483
4484         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4485             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4486                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4487                                       MGMT_STATUS_BUSY);
4488                 goto unlock;
4489         }
4490
4491         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4492         if (!cmd) {
4493                 err = -ENOMEM;
4494                 goto unlock;
4495         }
4496
4497         hci_req_init(&req, hdev);
4498
4499         if (cp->val == 0x02)
4500                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4501         else
4502                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4503
4504         if (val)
4505                 enable_advertising(&req);
4506         else
4507                 disable_advertising(&req);
4508
4509         err = hci_req_run(&req, set_advertising_complete);
4510         if (err < 0)
4511                 mgmt_pending_remove(cmd);
4512
4513 unlock:
4514         hci_dev_unlock(hdev);
4515         return err;
4516 }
4517
4518 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4519                               void *data, u16 len)
4520 {
4521         struct mgmt_cp_set_static_address *cp = data;
4522         int err;
4523
4524         BT_DBG("%s", hdev->name);
4525
4526         if (!lmp_le_capable(hdev))
4527                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4528                                        MGMT_STATUS_NOT_SUPPORTED);
4529
4530         if (hdev_is_powered(hdev))
4531                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4532                                        MGMT_STATUS_REJECTED);
4533
4534         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4535                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4536                         return mgmt_cmd_status(sk, hdev->id,
4537                                                MGMT_OP_SET_STATIC_ADDRESS,
4538                                                MGMT_STATUS_INVALID_PARAMS);
4539
4540                 /* Two most significant bits shall be set */
4541                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4542                         return mgmt_cmd_status(sk, hdev->id,
4543                                                MGMT_OP_SET_STATIC_ADDRESS,
4544                                                MGMT_STATUS_INVALID_PARAMS);
4545         }
4546
4547         hci_dev_lock(hdev);
4548
4549         bacpy(&hdev->static_addr, &cp->bdaddr);
4550
4551         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4552         if (err < 0)
4553                 goto unlock;
4554
4555         err = new_settings(hdev, sk);
4556
4557 unlock:
4558         hci_dev_unlock(hdev);
4559         return err;
4560 }
4561
4562 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4563                            void *data, u16 len)
4564 {
4565         struct mgmt_cp_set_scan_params *cp = data;
4566         __u16 interval, window;
4567         int err;
4568
4569         BT_DBG("%s", hdev->name);
4570
4571         if (!lmp_le_capable(hdev))
4572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4573                                        MGMT_STATUS_NOT_SUPPORTED);
4574
4575         interval = __le16_to_cpu(cp->interval);
4576
4577         if (interval < 0x0004 || interval > 0x4000)
4578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4579                                        MGMT_STATUS_INVALID_PARAMS);
4580
4581         window = __le16_to_cpu(cp->window);
4582
4583         if (window < 0x0004 || window > 0x4000)
4584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4585                                        MGMT_STATUS_INVALID_PARAMS);
4586
4587         if (window > interval)
4588                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4589                                        MGMT_STATUS_INVALID_PARAMS);
4590
4591         hci_dev_lock(hdev);
4592
4593         hdev->le_scan_interval = interval;
4594         hdev->le_scan_window = window;
4595
4596         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4597                                 NULL, 0);
4598
4599         /* If background scan is running, restart it so new parameters are
4600          * loaded.
4601          */
4602         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4603             hdev->discovery.state == DISCOVERY_STOPPED) {
4604                 struct hci_request req;
4605
4606                 hci_req_init(&req, hdev);
4607
4608                 hci_req_add_le_scan_disable(&req);
4609                 hci_req_add_le_passive_scan(&req);
4610
4611                 hci_req_run(&req, NULL);
4612         }
4613
4614         hci_dev_unlock(hdev);
4615
4616         return err;
4617 }
4618
4619 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4620                                       u16 opcode)
4621 {
4622         struct mgmt_pending_cmd *cmd;
4623
4624         BT_DBG("status 0x%02x", status);
4625
4626         hci_dev_lock(hdev);
4627
4628         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4629         if (!cmd)
4630                 goto unlock;
4631
4632         if (status) {
4633                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4634                                 mgmt_status(status));
4635         } else {
4636                 struct mgmt_mode *cp = cmd->param;
4637
4638                 if (cp->val)
4639                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4640                 else
4641                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4642
4643                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4644                 new_settings(hdev, cmd->sk);
4645         }
4646
4647         mgmt_pending_remove(cmd);
4648
4649 unlock:
4650         hci_dev_unlock(hdev);
4651 }
4652
4653 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4654                                 void *data, u16 len)
4655 {
4656         struct mgmt_mode *cp = data;
4657         struct mgmt_pending_cmd *cmd;
4658         struct hci_request req;
4659         int err;
4660
4661         BT_DBG("%s", hdev->name);
4662
4663         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4664             hdev->hci_ver < BLUETOOTH_VER_1_2)
4665                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4666                                        MGMT_STATUS_NOT_SUPPORTED);
4667
4668         if (cp->val != 0x00 && cp->val != 0x01)
4669                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4670                                        MGMT_STATUS_INVALID_PARAMS);
4671
4672         hci_dev_lock(hdev);
4673
4674         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4675                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4676                                       MGMT_STATUS_BUSY);
4677                 goto unlock;
4678         }
4679
4680         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4681                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4682                                         hdev);
4683                 goto unlock;
4684         }
4685
4686         if (!hdev_is_powered(hdev)) {
4687                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4688                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4689                                         hdev);
4690                 new_settings(hdev, sk);
4691                 goto unlock;
4692         }
4693
4694         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4695                                data, len);
4696         if (!cmd) {
4697                 err = -ENOMEM;
4698                 goto unlock;
4699         }
4700
4701         hci_req_init(&req, hdev);
4702
4703         write_fast_connectable(&req, cp->val);
4704
4705         err = hci_req_run(&req, fast_connectable_complete);
4706         if (err < 0) {
4707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4708                                       MGMT_STATUS_FAILED);
4709                 mgmt_pending_remove(cmd);
4710         }
4711
4712 unlock:
4713         hci_dev_unlock(hdev);
4714
4715         return err;
4716 }
4717
4718 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4719 {
4720         struct mgmt_pending_cmd *cmd;
4721
4722         BT_DBG("status 0x%02x", status);
4723
4724         hci_dev_lock(hdev);
4725
4726         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4727         if (!cmd)
4728                 goto unlock;
4729
4730         if (status) {
4731                 u8 mgmt_err = mgmt_status(status);
4732
4733                 /* We need to restore the flag if related HCI commands
4734                  * failed.
4735                  */
4736                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4737
4738                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4739         } else {
4740                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4741                 new_settings(hdev, cmd->sk);
4742         }
4743
4744         mgmt_pending_remove(cmd);
4745
4746 unlock:
4747         hci_dev_unlock(hdev);
4748 }
4749
4750 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4751 {
4752         struct mgmt_mode *cp = data;
4753         struct mgmt_pending_cmd *cmd;
4754         struct hci_request req;
4755         int err;
4756
4757         BT_DBG("request for %s", hdev->name);
4758
4759         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4760                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4761                                        MGMT_STATUS_NOT_SUPPORTED);
4762
4763         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4764                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4765                                        MGMT_STATUS_REJECTED);
4766
4767         if (cp->val != 0x00 && cp->val != 0x01)
4768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4769                                        MGMT_STATUS_INVALID_PARAMS);
4770
4771         hci_dev_lock(hdev);
4772
4773         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4774                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4775                 goto unlock;
4776         }
4777
4778         if (!hdev_is_powered(hdev)) {
4779                 if (!cp->val) {
4780                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4781                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4782                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4783                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4784                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4785                 }
4786
4787                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4788
4789                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4790                 if (err < 0)
4791                         goto unlock;
4792
4793                 err = new_settings(hdev, sk);
4794                 goto unlock;
4795         }
4796
4797         /* Reject disabling when powered on */
4798         if (!cp->val) {
4799                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4800                                       MGMT_STATUS_REJECTED);
4801                 goto unlock;
4802         } else {
4803                 /* When configuring a dual-mode controller to operate
4804                  * with LE only and using a static address, then switching
4805                  * BR/EDR back on is not allowed.
4806                  *
4807                  * Dual-mode controllers shall operate with the public
4808                  * address as its identity address for BR/EDR and LE. So
4809                  * reject the attempt to create an invalid configuration.
4810                  *
4811                  * The same restrictions applies when secure connections
4812                  * has been enabled. For BR/EDR this is a controller feature
4813                  * while for LE it is a host stack feature. This means that
4814                  * switching BR/EDR back on when secure connections has been
4815                  * enabled is not a supported transaction.
4816                  */
4817                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4818                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4819                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4820                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4821                                               MGMT_STATUS_REJECTED);
4822                         goto unlock;
4823                 }
4824         }
4825
4826         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4828                                       MGMT_STATUS_BUSY);
4829                 goto unlock;
4830         }
4831
4832         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4833         if (!cmd) {
4834                 err = -ENOMEM;
4835                 goto unlock;
4836         }
4837
4838         /* We need to flip the bit already here so that update_adv_data
4839          * generates the correct flags.
4840          */
4841         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4842
4843         hci_req_init(&req, hdev);
4844
4845         write_fast_connectable(&req, false);
4846         __hci_update_page_scan(&req);
4847
4848         /* Since only the advertising data flags will change, there
4849          * is no need to update the scan response data.
4850          */
4851         update_adv_data(&req);
4852
4853         err = hci_req_run(&req, set_bredr_complete);
4854         if (err < 0)
4855                 mgmt_pending_remove(cmd);
4856
4857 unlock:
4858         hci_dev_unlock(hdev);
4859         return err;
4860 }
4861
4862 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4863 {
4864         struct mgmt_pending_cmd *cmd;
4865         struct mgmt_mode *cp;
4866
4867         BT_DBG("%s status %u", hdev->name, status);
4868
4869         hci_dev_lock(hdev);
4870
4871         cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4872         if (!cmd)
4873                 goto unlock;
4874
4875         if (status) {
4876                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4877                                 mgmt_status(status));
4878                 goto remove;
4879         }
4880
4881         cp = cmd->param;
4882
4883         switch (cp->val) {
4884         case 0x00:
4885                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4886                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4887                 break;
4888         case 0x01:
4889                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4890                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4891                 break;
4892         case 0x02:
4893                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4894                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4895                 break;
4896         }
4897
4898         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4899         new_settings(hdev, cmd->sk);
4900
4901 remove:
4902         mgmt_pending_remove(cmd);
4903 unlock:
4904         hci_dev_unlock(hdev);
4905 }
4906
4907 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4908                            void *data, u16 len)
4909 {
4910         struct mgmt_mode *cp = data;
4911         struct mgmt_pending_cmd *cmd;
4912         struct hci_request req;
4913         u8 val;
4914         int err;
4915
4916         BT_DBG("request for %s", hdev->name);
4917
4918         if (!lmp_sc_capable(hdev) &&
4919             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4920                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4921                                        MGMT_STATUS_NOT_SUPPORTED);
4922
4923         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4924             lmp_sc_capable(hdev) &&
4925             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4927                                        MGMT_STATUS_REJECTED);
4928
4929         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4931                                   MGMT_STATUS_INVALID_PARAMS);
4932
4933         hci_dev_lock(hdev);
4934
4935         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4936             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4937                 bool changed;
4938
4939                 if (cp->val) {
4940                         changed = !hci_dev_test_and_set_flag(hdev,
4941                                                              HCI_SC_ENABLED);
4942                         if (cp->val == 0x02)
4943                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4944                         else
4945                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4946                 } else {
4947                         changed = hci_dev_test_and_clear_flag(hdev,
4948                                                               HCI_SC_ENABLED);
4949                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4950                 }
4951
4952                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4953                 if (err < 0)
4954                         goto failed;
4955
4956                 if (changed)
4957                         err = new_settings(hdev, sk);
4958
4959                 goto failed;
4960         }
4961
4962         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4963                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4964                                       MGMT_STATUS_BUSY);
4965                 goto failed;
4966         }
4967
4968         val = !!cp->val;
4969
4970         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4971             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4972                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4973                 goto failed;
4974         }
4975
4976         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4977         if (!cmd) {
4978                 err = -ENOMEM;
4979                 goto failed;
4980         }
4981
4982         hci_req_init(&req, hdev);
4983         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4984         err = hci_req_run(&req, sc_enable_complete);
4985         if (err < 0) {
4986                 mgmt_pending_remove(cmd);
4987                 goto failed;
4988         }
4989
4990 failed:
4991         hci_dev_unlock(hdev);
4992         return err;
4993 }
4994
4995 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4996                           void *data, u16 len)
4997 {
4998         struct mgmt_mode *cp = data;
4999         bool changed, use_changed;
5000         int err;
5001
5002         BT_DBG("request for %s", hdev->name);
5003
5004         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5005                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5006                                        MGMT_STATUS_INVALID_PARAMS);
5007
5008         hci_dev_lock(hdev);
5009
5010         if (cp->val)
5011                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5012         else
5013                 changed = hci_dev_test_and_clear_flag(hdev,
5014                                                       HCI_KEEP_DEBUG_KEYS);
5015
5016         if (cp->val == 0x02)
5017                 use_changed = !hci_dev_test_and_set_flag(hdev,
5018                                                          HCI_USE_DEBUG_KEYS);
5019         else
5020                 use_changed = hci_dev_test_and_clear_flag(hdev,
5021                                                           HCI_USE_DEBUG_KEYS);
5022
5023         if (hdev_is_powered(hdev) && use_changed &&
5024             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5025                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5026                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5027                              sizeof(mode), &mode);
5028         }
5029
5030         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5031         if (err < 0)
5032                 goto unlock;
5033
5034         if (changed)
5035                 err = new_settings(hdev, sk);
5036
5037 unlock:
5038         hci_dev_unlock(hdev);
5039         return err;
5040 }
5041
5042 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5043                        u16 len)
5044 {
5045         struct mgmt_cp_set_privacy *cp = cp_data;
5046         bool changed;
5047         int err;
5048
5049         BT_DBG("request for %s", hdev->name);
5050
5051         if (!lmp_le_capable(hdev))
5052                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5053                                        MGMT_STATUS_NOT_SUPPORTED);
5054
5055         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5056                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5057                                        MGMT_STATUS_INVALID_PARAMS);
5058
5059         if (hdev_is_powered(hdev))
5060                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5061                                        MGMT_STATUS_REJECTED);
5062
5063         hci_dev_lock(hdev);
5064
5065         /* If user space supports this command it is also expected to
5066          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5067          */
5068         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5069
5070         if (cp->privacy) {
5071                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5072                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5073                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5074         } else {
5075                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5076                 memset(hdev->irk, 0, sizeof(hdev->irk));
5077                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5078         }
5079
5080         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5081         if (err < 0)
5082                 goto unlock;
5083
5084         if (changed)
5085                 err = new_settings(hdev, sk);
5086
5087 unlock:
5088         hci_dev_unlock(hdev);
5089         return err;
5090 }
5091
5092 static bool irk_is_valid(struct mgmt_irk_info *irk)
5093 {
5094         switch (irk->addr.type) {
5095         case BDADDR_LE_PUBLIC:
5096                 return true;
5097
5098         case BDADDR_LE_RANDOM:
5099                 /* Two most significant bits shall be set */
5100                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5101                         return false;
5102                 return true;
5103         }
5104
5105         return false;
5106 }
5107
5108 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5109                      u16 len)
5110 {
5111         struct mgmt_cp_load_irks *cp = cp_data;
5112         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5113                                    sizeof(struct mgmt_irk_info));
5114         u16 irk_count, expected_len;
5115         int i, err;
5116
5117         BT_DBG("request for %s", hdev->name);
5118
5119         if (!lmp_le_capable(hdev))
5120                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5121                                        MGMT_STATUS_NOT_SUPPORTED);
5122
5123         irk_count = __le16_to_cpu(cp->irk_count);
5124         if (irk_count > max_irk_count) {
5125                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5126                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5127                                        MGMT_STATUS_INVALID_PARAMS);
5128         }
5129
5130         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5131         if (expected_len != len) {
5132                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5133                        expected_len, len);
5134                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5135                                        MGMT_STATUS_INVALID_PARAMS);
5136         }
5137
5138         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5139
5140         for (i = 0; i < irk_count; i++) {
5141                 struct mgmt_irk_info *key = &cp->irks[i];
5142
5143                 if (!irk_is_valid(key))
5144                         return mgmt_cmd_status(sk, hdev->id,
5145                                                MGMT_OP_LOAD_IRKS,
5146                                                MGMT_STATUS_INVALID_PARAMS);
5147         }
5148
5149         hci_dev_lock(hdev);
5150
5151         hci_smp_irks_clear(hdev);
5152
5153         for (i = 0; i < irk_count; i++) {
5154                 struct mgmt_irk_info *irk = &cp->irks[i];
5155                 u8 addr_type;
5156
5157                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5158                         addr_type = ADDR_LE_DEV_PUBLIC;
5159                 else
5160                         addr_type = ADDR_LE_DEV_RANDOM;
5161
5162                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5163                             BDADDR_ANY);
5164         }
5165
5166         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5167
5168         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5169
5170         hci_dev_unlock(hdev);
5171
5172         return err;
5173 }
5174
5175 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5176 {
5177         if (key->master != 0x00 && key->master != 0x01)
5178                 return false;
5179
5180         switch (key->addr.type) {
5181         case BDADDR_LE_PUBLIC:
5182                 return true;
5183
5184         case BDADDR_LE_RANDOM:
5185                 /* Two most significant bits shall be set */
5186                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5187                         return false;
5188                 return true;
5189         }
5190
5191         return false;
5192 }
5193
5194 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5195                                void *cp_data, u16 len)
5196 {
5197         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5198         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5199                                    sizeof(struct mgmt_ltk_info));
5200         u16 key_count, expected_len;
5201         int i, err;
5202
5203         BT_DBG("request for %s", hdev->name);
5204
5205         if (!lmp_le_capable(hdev))
5206                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5207                                        MGMT_STATUS_NOT_SUPPORTED);
5208
5209         key_count = __le16_to_cpu(cp->key_count);
5210         if (key_count > max_key_count) {
5211                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5213                                        MGMT_STATUS_INVALID_PARAMS);
5214         }
5215
5216         expected_len = sizeof(*cp) + key_count *
5217                                         sizeof(struct mgmt_ltk_info);
5218         if (expected_len != len) {
5219                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5220                        expected_len, len);
5221                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5222                                        MGMT_STATUS_INVALID_PARAMS);
5223         }
5224
5225         BT_DBG("%s key_count %u", hdev->name, key_count);
5226
5227         for (i = 0; i < key_count; i++) {
5228                 struct mgmt_ltk_info *key = &cp->keys[i];
5229
5230                 if (!ltk_is_valid(key))
5231                         return mgmt_cmd_status(sk, hdev->id,
5232                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5233                                                MGMT_STATUS_INVALID_PARAMS);
5234         }
5235
5236         hci_dev_lock(hdev);
5237
5238         hci_smp_ltks_clear(hdev);
5239
5240         for (i = 0; i < key_count; i++) {
5241                 struct mgmt_ltk_info *key = &cp->keys[i];
5242                 u8 type, addr_type, authenticated;
5243
5244                 if (key->addr.type == BDADDR_LE_PUBLIC)
5245                         addr_type = ADDR_LE_DEV_PUBLIC;
5246                 else
5247                         addr_type = ADDR_LE_DEV_RANDOM;
5248
5249                 switch (key->type) {
5250                 case MGMT_LTK_UNAUTHENTICATED:
5251                         authenticated = 0x00;
5252                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5253                         break;
5254                 case MGMT_LTK_AUTHENTICATED:
5255                         authenticated = 0x01;
5256                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5257                         break;
5258                 case MGMT_LTK_P256_UNAUTH:
5259                         authenticated = 0x00;
5260                         type = SMP_LTK_P256;
5261                         break;
5262                 case MGMT_LTK_P256_AUTH:
5263                         authenticated = 0x01;
5264                         type = SMP_LTK_P256;
5265                         break;
5266                 case MGMT_LTK_P256_DEBUG:
5267                         authenticated = 0x00;
5268                         type = SMP_LTK_P256_DEBUG;
5269                 default:
5270                         continue;
5271                 }
5272
5273                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5274                             authenticated, key->val, key->enc_size, key->ediv,
5275                             key->rand);
5276         }
5277
5278         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5279                            NULL, 0);
5280
5281         hci_dev_unlock(hdev);
5282
5283         return err;
5284 }
5285
5286 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5287 {
5288         struct hci_conn *conn = cmd->user_data;
5289         struct mgmt_rp_get_conn_info rp;
5290         int err;
5291
5292         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5293
5294         if (status == MGMT_STATUS_SUCCESS) {
5295                 rp.rssi = conn->rssi;
5296                 rp.tx_power = conn->tx_power;
5297                 rp.max_tx_power = conn->max_tx_power;
5298         } else {
5299                 rp.rssi = HCI_RSSI_INVALID;
5300                 rp.tx_power = HCI_TX_POWER_INVALID;
5301                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5302         }
5303
5304         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5305                                 status, &rp, sizeof(rp));
5306
5307         hci_conn_drop(conn);
5308         hci_conn_put(conn);
5309
5310         return err;
5311 }
5312
5313 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5314                                        u16 opcode)
5315 {
5316         struct hci_cp_read_rssi *cp;
5317         struct mgmt_pending_cmd *cmd;
5318         struct hci_conn *conn;
5319         u16 handle;
5320         u8 status;
5321
5322         BT_DBG("status 0x%02x", hci_status);
5323
5324         hci_dev_lock(hdev);
5325
5326         /* Commands sent in request are either Read RSSI or Read Transmit Power
5327          * Level so we check which one was last sent to retrieve connection
5328          * handle.  Both commands have handle as first parameter so it's safe to
5329          * cast data on the same command struct.
5330          *
5331          * First command sent is always Read RSSI and we fail only if it fails.
5332          * In other case we simply override error to indicate success as we
5333          * already remembered if TX power value is actually valid.
5334          */
5335         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5336         if (!cp) {
5337                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5338                 status = MGMT_STATUS_SUCCESS;
5339         } else {
5340                 status = mgmt_status(hci_status);
5341         }
5342
5343         if (!cp) {
5344                 BT_ERR("invalid sent_cmd in conn_info response");
5345                 goto unlock;
5346         }
5347
5348         handle = __le16_to_cpu(cp->handle);
5349         conn = hci_conn_hash_lookup_handle(hdev, handle);
5350         if (!conn) {
5351                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5352                 goto unlock;
5353         }
5354
5355         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5356         if (!cmd)
5357                 goto unlock;
5358
5359         cmd->cmd_complete(cmd, status);
5360         mgmt_pending_remove(cmd);
5361
5362 unlock:
5363         hci_dev_unlock(hdev);
5364 }
5365
5366 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5367                          u16 len)
5368 {
5369         struct mgmt_cp_get_conn_info *cp = data;
5370         struct mgmt_rp_get_conn_info rp;
5371         struct hci_conn *conn;
5372         unsigned long conn_info_age;
5373         int err = 0;
5374
5375         BT_DBG("%s", hdev->name);
5376
5377         memset(&rp, 0, sizeof(rp));
5378         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5379         rp.addr.type = cp->addr.type;
5380
5381         if (!bdaddr_type_is_valid(cp->addr.type))
5382                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5383                                          MGMT_STATUS_INVALID_PARAMS,
5384                                          &rp, sizeof(rp));
5385
5386         hci_dev_lock(hdev);
5387
5388         if (!hdev_is_powered(hdev)) {
5389                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5390                                         MGMT_STATUS_NOT_POWERED, &rp,
5391                                         sizeof(rp));
5392                 goto unlock;
5393         }
5394
5395         if (cp->addr.type == BDADDR_BREDR)
5396                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5397                                                &cp->addr.bdaddr);
5398         else
5399                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5400
5401         if (!conn || conn->state != BT_CONNECTED) {
5402                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5403                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5404                                         sizeof(rp));
5405                 goto unlock;
5406         }
5407
5408         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5409                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5410                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5411                 goto unlock;
5412         }
5413
5414         /* To avoid client trying to guess when to poll again for information we
5415          * calculate conn info age as random value between min/max set in hdev.
5416          */
5417         conn_info_age = hdev->conn_info_min_age +
5418                         prandom_u32_max(hdev->conn_info_max_age -
5419                                         hdev->conn_info_min_age);
5420
5421         /* Query controller to refresh cached values if they are too old or were
5422          * never read.
5423          */
5424         if (time_after(jiffies, conn->conn_info_timestamp +
5425                        msecs_to_jiffies(conn_info_age)) ||
5426             !conn->conn_info_timestamp) {
5427                 struct hci_request req;
5428                 struct hci_cp_read_tx_power req_txp_cp;
5429                 struct hci_cp_read_rssi req_rssi_cp;
5430                 struct mgmt_pending_cmd *cmd;
5431
5432                 hci_req_init(&req, hdev);
5433                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5434                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5435                             &req_rssi_cp);
5436
5437                 /* For LE links TX power does not change thus we don't need to
5438                  * query for it once value is known.
5439                  */
5440                 if (!bdaddr_type_is_le(cp->addr.type) ||
5441                     conn->tx_power == HCI_TX_POWER_INVALID) {
5442                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5443                         req_txp_cp.type = 0x00;
5444                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5445                                     sizeof(req_txp_cp), &req_txp_cp);
5446                 }
5447
5448                 /* Max TX power needs to be read only once per connection */
5449                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5450                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5451                         req_txp_cp.type = 0x01;
5452                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5453                                     sizeof(req_txp_cp), &req_txp_cp);
5454                 }
5455
5456                 err = hci_req_run(&req, conn_info_refresh_complete);
5457                 if (err < 0)
5458                         goto unlock;
5459
5460                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5461                                        data, len);
5462                 if (!cmd) {
5463                         err = -ENOMEM;
5464                         goto unlock;
5465                 }
5466
5467                 hci_conn_hold(conn);
5468                 cmd->user_data = hci_conn_get(conn);
5469                 cmd->cmd_complete = conn_info_cmd_complete;
5470
5471                 conn->conn_info_timestamp = jiffies;
5472         } else {
5473                 /* Cache is valid, just reply with values cached in hci_conn */
5474                 rp.rssi = conn->rssi;
5475                 rp.tx_power = conn->tx_power;
5476                 rp.max_tx_power = conn->max_tx_power;
5477
5478                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5479                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5480         }
5481
5482 unlock:
5483         hci_dev_unlock(hdev);
5484         return err;
5485 }
5486
5487 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5488 {
5489         struct hci_conn *conn = cmd->user_data;
5490         struct mgmt_rp_get_clock_info rp;
5491         struct hci_dev *hdev;
5492         int err;
5493
5494         memset(&rp, 0, sizeof(rp));
5495         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5496
5497         if (status)
5498                 goto complete;
5499
5500         hdev = hci_dev_get(cmd->index);
5501         if (hdev) {
5502                 rp.local_clock = cpu_to_le32(hdev->clock);
5503                 hci_dev_put(hdev);
5504         }
5505
5506         if (conn) {
5507                 rp.piconet_clock = cpu_to_le32(conn->clock);
5508                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5509         }
5510
5511 complete:
5512         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5513                                 sizeof(rp));
5514
5515         if (conn) {
5516                 hci_conn_drop(conn);
5517                 hci_conn_put(conn);
5518         }
5519
5520         return err;
5521 }
5522
5523 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5524 {
5525         struct hci_cp_read_clock *hci_cp;
5526         struct mgmt_pending_cmd *cmd;
5527         struct hci_conn *conn;
5528
5529         BT_DBG("%s status %u", hdev->name, status);
5530
5531         hci_dev_lock(hdev);
5532
5533         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5534         if (!hci_cp)
5535                 goto unlock;
5536
5537         if (hci_cp->which) {
5538                 u16 handle = __le16_to_cpu(hci_cp->handle);
5539                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5540         } else {
5541                 conn = NULL;
5542         }
5543
5544         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5545         if (!cmd)
5546                 goto unlock;
5547
5548         cmd->cmd_complete(cmd, mgmt_status(status));
5549         mgmt_pending_remove(cmd);
5550
5551 unlock:
5552         hci_dev_unlock(hdev);
5553 }
5554
5555 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5556                          u16 len)
5557 {
5558         struct mgmt_cp_get_clock_info *cp = data;
5559         struct mgmt_rp_get_clock_info rp;
5560         struct hci_cp_read_clock hci_cp;
5561         struct mgmt_pending_cmd *cmd;
5562         struct hci_request req;
5563         struct hci_conn *conn;
5564         int err;
5565
5566         BT_DBG("%s", hdev->name);
5567
5568         memset(&rp, 0, sizeof(rp));
5569         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5570         rp.addr.type = cp->addr.type;
5571
5572         if (cp->addr.type != BDADDR_BREDR)
5573                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5574                                          MGMT_STATUS_INVALID_PARAMS,
5575                                          &rp, sizeof(rp));
5576
5577         hci_dev_lock(hdev);
5578
5579         if (!hdev_is_powered(hdev)) {
5580                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5581                                         MGMT_STATUS_NOT_POWERED, &rp,
5582                                         sizeof(rp));
5583                 goto unlock;
5584         }
5585
5586         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5587                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5588                                                &cp->addr.bdaddr);
5589                 if (!conn || conn->state != BT_CONNECTED) {
5590                         err = mgmt_cmd_complete(sk, hdev->id,
5591                                                 MGMT_OP_GET_CLOCK_INFO,
5592                                                 MGMT_STATUS_NOT_CONNECTED,
5593                                                 &rp, sizeof(rp));
5594                         goto unlock;
5595                 }
5596         } else {
5597                 conn = NULL;
5598         }
5599
5600         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5601         if (!cmd) {
5602                 err = -ENOMEM;
5603                 goto unlock;
5604         }
5605
5606         cmd->cmd_complete = clock_info_cmd_complete;
5607
5608         hci_req_init(&req, hdev);
5609
5610         memset(&hci_cp, 0, sizeof(hci_cp));
5611         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5612
5613         if (conn) {
5614                 hci_conn_hold(conn);
5615                 cmd->user_data = hci_conn_get(conn);
5616
5617                 hci_cp.handle = cpu_to_le16(conn->handle);
5618                 hci_cp.which = 0x01; /* Piconet clock */
5619                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5620         }
5621
5622         err = hci_req_run(&req, get_clock_info_complete);
5623         if (err < 0)
5624                 mgmt_pending_remove(cmd);
5625
5626 unlock:
5627         hci_dev_unlock(hdev);
5628         return err;
5629 }
5630
5631 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5632 {
5633         struct hci_conn *conn;
5634
5635         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5636         if (!conn)
5637                 return false;
5638
5639         if (conn->dst_type != type)
5640                 return false;
5641
5642         if (conn->state != BT_CONNECTED)
5643                 return false;
5644
5645         return true;
5646 }
5647
5648 /* This function requires the caller holds hdev->lock */
5649 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5650                                u8 addr_type, u8 auto_connect)
5651 {
5652         struct hci_dev *hdev = req->hdev;
5653         struct hci_conn_params *params;
5654
5655         params = hci_conn_params_add(hdev, addr, addr_type);
5656         if (!params)
5657                 return -EIO;
5658
5659         if (params->auto_connect == auto_connect)
5660                 return 0;
5661
5662         list_del_init(&params->action);
5663
5664         switch (auto_connect) {
5665         case HCI_AUTO_CONN_DISABLED:
5666         case HCI_AUTO_CONN_LINK_LOSS:
5667                 __hci_update_background_scan(req);
5668                 break;
5669         case HCI_AUTO_CONN_REPORT:
5670                 list_add(&params->action, &hdev->pend_le_reports);
5671                 __hci_update_background_scan(req);
5672                 break;
5673         case HCI_AUTO_CONN_DIRECT:
5674         case HCI_AUTO_CONN_ALWAYS:
5675                 if (!is_connected(hdev, addr, addr_type)) {
5676                         list_add(&params->action, &hdev->pend_le_conns);
5677                         __hci_update_background_scan(req);
5678                 }
5679                 break;
5680         }
5681
5682         params->auto_connect = auto_connect;
5683
5684         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5685                auto_connect);
5686
5687         return 0;
5688 }
5689
5690 static void device_added(struct sock *sk, struct hci_dev *hdev,
5691                          bdaddr_t *bdaddr, u8 type, u8 action)
5692 {
5693         struct mgmt_ev_device_added ev;
5694
5695         bacpy(&ev.addr.bdaddr, bdaddr);
5696         ev.addr.type = type;
5697         ev.action = action;
5698
5699         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5700 }
5701
5702 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5703 {
5704         struct mgmt_pending_cmd *cmd;
5705
5706         BT_DBG("status 0x%02x", status);
5707
5708         hci_dev_lock(hdev);
5709
5710         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5711         if (!cmd)
5712                 goto unlock;
5713
5714         cmd->cmd_complete(cmd, mgmt_status(status));
5715         mgmt_pending_remove(cmd);
5716
5717 unlock:
5718         hci_dev_unlock(hdev);
5719 }
5720
5721 static int add_device(struct sock *sk, struct hci_dev *hdev,
5722                       void *data, u16 len)
5723 {
5724         struct mgmt_cp_add_device *cp = data;
5725         struct mgmt_pending_cmd *cmd;
5726         struct hci_request req;
5727         u8 auto_conn, addr_type;
5728         int err;
5729
5730         BT_DBG("%s", hdev->name);
5731
5732         if (!bdaddr_type_is_valid(cp->addr.type) ||
5733             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5734                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5735                                          MGMT_STATUS_INVALID_PARAMS,
5736                                          &cp->addr, sizeof(cp->addr));
5737
5738         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5739                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5740                                          MGMT_STATUS_INVALID_PARAMS,
5741                                          &cp->addr, sizeof(cp->addr));
5742
5743         hci_req_init(&req, hdev);
5744
5745         hci_dev_lock(hdev);
5746
5747         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5748         if (!cmd) {
5749                 err = -ENOMEM;
5750                 goto unlock;
5751         }
5752
5753         cmd->cmd_complete = addr_cmd_complete;
5754
5755         if (cp->addr.type == BDADDR_BREDR) {
5756                 /* Only incoming connections action is supported for now */
5757                 if (cp->action != 0x01) {
5758                         err = cmd->cmd_complete(cmd,
5759                                                 MGMT_STATUS_INVALID_PARAMS);
5760                         mgmt_pending_remove(cmd);
5761                         goto unlock;
5762                 }
5763
5764                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5765                                           cp->addr.type);
5766                 if (err)
5767                         goto unlock;
5768
5769                 __hci_update_page_scan(&req);
5770
5771                 goto added;
5772         }
5773
5774         if (cp->addr.type == BDADDR_LE_PUBLIC)
5775                 addr_type = ADDR_LE_DEV_PUBLIC;
5776         else
5777                 addr_type = ADDR_LE_DEV_RANDOM;
5778
5779         if (cp->action == 0x02)
5780                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5781         else if (cp->action == 0x01)
5782                 auto_conn = HCI_AUTO_CONN_DIRECT;
5783         else
5784                 auto_conn = HCI_AUTO_CONN_REPORT;
5785
5786         /* If the connection parameters don't exist for this device,
5787          * they will be created and configured with defaults.
5788          */
5789         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5790                                 auto_conn) < 0) {
5791                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5792                 mgmt_pending_remove(cmd);
5793                 goto unlock;
5794         }
5795
5796 added:
5797         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5798
5799         err = hci_req_run(&req, add_device_complete);
5800         if (err < 0) {
5801                 /* ENODATA means no HCI commands were needed (e.g. if
5802                  * the adapter is powered off).
5803                  */
5804                 if (err == -ENODATA)
5805                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5806                 mgmt_pending_remove(cmd);
5807         }
5808
5809 unlock:
5810         hci_dev_unlock(hdev);
5811         return err;
5812 }
5813
5814 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5815                            bdaddr_t *bdaddr, u8 type)
5816 {
5817         struct mgmt_ev_device_removed ev;
5818
5819         bacpy(&ev.addr.bdaddr, bdaddr);
5820         ev.addr.type = type;
5821
5822         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5823 }
5824
5825 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5826 {
5827         struct mgmt_pending_cmd *cmd;
5828
5829         BT_DBG("status 0x%02x", status);
5830
5831         hci_dev_lock(hdev);
5832
5833         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5834         if (!cmd)
5835                 goto unlock;
5836
5837         cmd->cmd_complete(cmd, mgmt_status(status));
5838         mgmt_pending_remove(cmd);
5839
5840 unlock:
5841         hci_dev_unlock(hdev);
5842 }
5843
5844 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5845                          void *data, u16 len)
5846 {
5847         struct mgmt_cp_remove_device *cp = data;
5848         struct mgmt_pending_cmd *cmd;
5849         struct hci_request req;
5850         int err;
5851
5852         BT_DBG("%s", hdev->name);
5853
5854         hci_req_init(&req, hdev);
5855
5856         hci_dev_lock(hdev);
5857
5858         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5859         if (!cmd) {
5860                 err = -ENOMEM;
5861                 goto unlock;
5862         }
5863
5864         cmd->cmd_complete = addr_cmd_complete;
5865
5866         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5867                 struct hci_conn_params *params;
5868                 u8 addr_type;
5869
5870                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5871                         err = cmd->cmd_complete(cmd,
5872                                                 MGMT_STATUS_INVALID_PARAMS);
5873                         mgmt_pending_remove(cmd);
5874                         goto unlock;
5875                 }
5876
5877                 if (cp->addr.type == BDADDR_BREDR) {
5878                         err = hci_bdaddr_list_del(&hdev->whitelist,
5879                                                   &cp->addr.bdaddr,
5880                                                   cp->addr.type);
5881                         if (err) {
5882                                 err = cmd->cmd_complete(cmd,
5883                                                         MGMT_STATUS_INVALID_PARAMS);
5884                                 mgmt_pending_remove(cmd);
5885                                 goto unlock;
5886                         }
5887
5888                         __hci_update_page_scan(&req);
5889
5890                         device_removed(sk, hdev, &cp->addr.bdaddr,
5891                                        cp->addr.type);
5892                         goto complete;
5893                 }
5894
5895                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5896                         addr_type = ADDR_LE_DEV_PUBLIC;
5897                 else
5898                         addr_type = ADDR_LE_DEV_RANDOM;
5899
5900                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5901                                                 addr_type);
5902                 if (!params) {
5903                         err = cmd->cmd_complete(cmd,
5904                                                 MGMT_STATUS_INVALID_PARAMS);
5905                         mgmt_pending_remove(cmd);
5906                         goto unlock;
5907                 }
5908
5909                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5910                         err = cmd->cmd_complete(cmd,
5911                                                 MGMT_STATUS_INVALID_PARAMS);
5912                         mgmt_pending_remove(cmd);
5913                         goto unlock;
5914                 }
5915
5916                 list_del(&params->action);
5917                 list_del(&params->list);
5918                 kfree(params);
5919                 __hci_update_background_scan(&req);
5920
5921                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5922         } else {
5923                 struct hci_conn_params *p, *tmp;
5924                 struct bdaddr_list *b, *btmp;
5925
5926                 if (cp->addr.type) {
5927                         err = cmd->cmd_complete(cmd,
5928                                                 MGMT_STATUS_INVALID_PARAMS);
5929                         mgmt_pending_remove(cmd);
5930                         goto unlock;
5931                 }
5932
5933                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5934                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5935                         list_del(&b->list);
5936                         kfree(b);
5937                 }
5938
5939                 __hci_update_page_scan(&req);
5940
5941                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5942                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5943                                 continue;
5944                         device_removed(sk, hdev, &p->addr, p->addr_type);
5945                         list_del(&p->action);
5946                         list_del(&p->list);
5947                         kfree(p);
5948                 }
5949
5950                 BT_DBG("All LE connection parameters were removed");
5951
5952                 __hci_update_background_scan(&req);
5953         }
5954
5955 complete:
5956         err = hci_req_run(&req, remove_device_complete);
5957         if (err < 0) {
5958                 /* ENODATA means no HCI commands were needed (e.g. if
5959                  * the adapter is powered off).
5960                  */
5961                 if (err == -ENODATA)
5962                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5963                 mgmt_pending_remove(cmd);
5964         }
5965
5966 unlock:
5967         hci_dev_unlock(hdev);
5968         return err;
5969 }
5970
5971 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5972                            u16 len)
5973 {
5974         struct mgmt_cp_load_conn_param *cp = data;
5975         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5976                                      sizeof(struct mgmt_conn_param));
5977         u16 param_count, expected_len;
5978         int i;
5979
5980         if (!lmp_le_capable(hdev))
5981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5982                                        MGMT_STATUS_NOT_SUPPORTED);
5983
5984         param_count = __le16_to_cpu(cp->param_count);
5985         if (param_count > max_param_count) {
5986                 BT_ERR("load_conn_param: too big param_count value %u",
5987                        param_count);
5988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5989                                        MGMT_STATUS_INVALID_PARAMS);
5990         }
5991
5992         expected_len = sizeof(*cp) + param_count *
5993                                         sizeof(struct mgmt_conn_param);
5994         if (expected_len != len) {
5995                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5996                        expected_len, len);
5997                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5998                                        MGMT_STATUS_INVALID_PARAMS);
5999         }
6000
6001         BT_DBG("%s param_count %u", hdev->name, param_count);
6002
6003         hci_dev_lock(hdev);
6004
6005         hci_conn_params_clear_disabled(hdev);
6006
6007         for (i = 0; i < param_count; i++) {
6008                 struct mgmt_conn_param *param = &cp->params[i];
6009                 struct hci_conn_params *hci_param;
6010                 u16 min, max, latency, timeout;
6011                 u8 addr_type;
6012
6013                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6014                        param->addr.type);
6015
6016                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6017                         addr_type = ADDR_LE_DEV_PUBLIC;
6018                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6019                         addr_type = ADDR_LE_DEV_RANDOM;
6020                 } else {
6021                         BT_ERR("Ignoring invalid connection parameters");
6022                         continue;
6023                 }
6024
6025                 min = le16_to_cpu(param->min_interval);
6026                 max = le16_to_cpu(param->max_interval);
6027                 latency = le16_to_cpu(param->latency);
6028                 timeout = le16_to_cpu(param->timeout);
6029
6030                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6031                        min, max, latency, timeout);
6032
6033                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6034                         BT_ERR("Ignoring invalid connection parameters");
6035                         continue;
6036                 }
6037
6038                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6039                                                 addr_type);
6040                 if (!hci_param) {
6041                         BT_ERR("Failed to add connection parameters");
6042                         continue;
6043                 }
6044
6045                 hci_param->conn_min_interval = min;
6046                 hci_param->conn_max_interval = max;
6047                 hci_param->conn_latency = latency;
6048                 hci_param->supervision_timeout = timeout;
6049         }
6050
6051         hci_dev_unlock(hdev);
6052
6053         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6054                                  NULL, 0);
6055 }
6056
6057 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6058                                void *data, u16 len)
6059 {
6060         struct mgmt_cp_set_external_config *cp = data;
6061         bool changed;
6062         int err;
6063
6064         BT_DBG("%s", hdev->name);
6065
6066         if (hdev_is_powered(hdev))
6067                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6068                                        MGMT_STATUS_REJECTED);
6069
6070         if (cp->config != 0x00 && cp->config != 0x01)
6071                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6072                                          MGMT_STATUS_INVALID_PARAMS);
6073
6074         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6076                                        MGMT_STATUS_NOT_SUPPORTED);
6077
6078         hci_dev_lock(hdev);
6079
6080         if (cp->config)
6081                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6082         else
6083                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6084
6085         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6086         if (err < 0)
6087                 goto unlock;
6088
6089         if (!changed)
6090                 goto unlock;
6091
6092         err = new_options(hdev, sk);
6093
6094         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6095                 mgmt_index_removed(hdev);
6096
6097                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6098                         hci_dev_set_flag(hdev, HCI_CONFIG);
6099                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6100
6101                         queue_work(hdev->req_workqueue, &hdev->power_on);
6102                 } else {
6103                         set_bit(HCI_RAW, &hdev->flags);
6104                         mgmt_index_added(hdev);
6105                 }
6106         }
6107
6108 unlock:
6109         hci_dev_unlock(hdev);
6110         return err;
6111 }
6112
6113 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6114                               void *data, u16 len)
6115 {
6116         struct mgmt_cp_set_public_address *cp = data;
6117         bool changed;
6118         int err;
6119
6120         BT_DBG("%s", hdev->name);
6121
6122         if (hdev_is_powered(hdev))
6123                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6124                                        MGMT_STATUS_REJECTED);
6125
6126         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6127                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6128                                        MGMT_STATUS_INVALID_PARAMS);
6129
6130         if (!hdev->set_bdaddr)
6131                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6132                                        MGMT_STATUS_NOT_SUPPORTED);
6133
6134         hci_dev_lock(hdev);
6135
6136         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6137         bacpy(&hdev->public_addr, &cp->bdaddr);
6138
6139         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6140         if (err < 0)
6141                 goto unlock;
6142
6143         if (!changed)
6144                 goto unlock;
6145
6146         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6147                 err = new_options(hdev, sk);
6148
6149         if (is_configured(hdev)) {
6150                 mgmt_index_removed(hdev);
6151
6152                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6153
6154                 hci_dev_set_flag(hdev, HCI_CONFIG);
6155                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6156
6157                 queue_work(hdev->req_workqueue, &hdev->power_on);
6158         }
6159
6160 unlock:
6161         hci_dev_unlock(hdev);
6162         return err;
6163 }
6164
6165 static const struct hci_mgmt_handler mgmt_handlers[] = {
6166         { NULL }, /* 0x0000 (no command) */
6167         { read_version,            MGMT_READ_VERSION_SIZE,
6168                                                 HCI_MGMT_NO_HDEV },
6169         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6170                                                 HCI_MGMT_NO_HDEV },
6171         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6172                                                 HCI_MGMT_NO_HDEV },
6173         { read_controller_info,    MGMT_READ_INFO_SIZE,                 0 },
6174         { set_powered,             MGMT_SETTING_SIZE,                   0 },
6175         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE,          0 },
6176         { set_connectable,         MGMT_SETTING_SIZE,                   0 },
6177         { set_fast_connectable,    MGMT_SETTING_SIZE,                   0 },
6178         { set_bondable,            MGMT_SETTING_SIZE,                   0 },
6179         { set_link_security,       MGMT_SETTING_SIZE,                   0 },
6180         { set_ssp,                 MGMT_SETTING_SIZE,                   0 },
6181         { set_hs,                  MGMT_SETTING_SIZE,                   0 },
6182         { set_le,                  MGMT_SETTING_SIZE,                   0 },
6183         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE,             0 },
6184         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE,            0 },
6185         { add_uuid,                MGMT_ADD_UUID_SIZE,                  0 },
6186         { remove_uuid,             MGMT_REMOVE_UUID_SIZE,               0 },
6187         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6188                                                 HCI_MGMT_VAR_LEN },
6189         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6190                                                 HCI_MGMT_VAR_LEN },
6191         { disconnect,              MGMT_DISCONNECT_SIZE,                0 },
6192         { get_connections,         MGMT_GET_CONNECTIONS_SIZE,           0 },
6193         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE,            0 },
6194         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE,        0 },
6195         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE,         0 },
6196         { pair_device,             MGMT_PAIR_DEVICE_SIZE,               0 },
6197         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE,        0 },
6198         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE,             0 },
6199         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE,        0 },
6200         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE,    0 },
6201         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE,        0 },
6202         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE,    0 },
6203         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6204         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6205                                                 HCI_MGMT_VAR_LEN },
6206         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE,    0 },
6207         { start_discovery,         MGMT_START_DISCOVERY_SIZE,           0 },
6208         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE,            0 },
6209         { confirm_name,            MGMT_CONFIRM_NAME_SIZE,              0 },
6210         { block_device,            MGMT_BLOCK_DEVICE_SIZE,              0 },
6211         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE,            0 },
6212         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE,             0 },
6213         { set_advertising,         MGMT_SETTING_SIZE,                   0 },
6214         { set_bredr,               MGMT_SETTING_SIZE,                   0 },
6215         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE,        0 },
6216         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE,           0 },
6217         { set_secure_conn,         MGMT_SETTING_SIZE,                   0 },
6218         { set_debug_keys,          MGMT_SETTING_SIZE,                   0 },
6219         { set_privacy,             MGMT_SET_PRIVACY_SIZE,               0 },
6220         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6221                                                 HCI_MGMT_VAR_LEN },
6222         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE,             0 },
6223         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE,            0 },
6224         { add_device,              MGMT_ADD_DEVICE_SIZE,                0 },
6225         { remove_device,           MGMT_REMOVE_DEVICE_SIZE,             0 },
6226         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6227                                                 HCI_MGMT_VAR_LEN },
6228         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6229                                                 HCI_MGMT_NO_HDEV },
6230         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6231                                                 HCI_MGMT_UNCONFIGURED },
6232         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6233                                                 HCI_MGMT_UNCONFIGURED },
6234         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6235                                                 HCI_MGMT_UNCONFIGURED },
6236         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6237                                                 HCI_MGMT_VAR_LEN },
6238 };
6239
6240 int mgmt_control(struct hci_mgmt_chan *chan, struct sock *sk,
6241                  struct msghdr *msg, size_t msglen)
6242 {
6243         void *buf;
6244         u8 *cp;
6245         struct mgmt_hdr *hdr;
6246         u16 opcode, index, len;
6247         struct hci_dev *hdev = NULL;
6248         const struct hci_mgmt_handler *handler;
6249         bool var_len, no_hdev;
6250         int err;
6251
6252         BT_DBG("got %zu bytes", msglen);
6253
6254         if (msglen < sizeof(*hdr))
6255                 return -EINVAL;
6256
6257         buf = kmalloc(msglen, GFP_KERNEL);
6258         if (!buf)
6259                 return -ENOMEM;
6260
6261         if (memcpy_from_msg(buf, msg, msglen)) {
6262                 err = -EFAULT;
6263                 goto done;
6264         }
6265
6266         hdr = buf;
6267         opcode = __le16_to_cpu(hdr->opcode);
6268         index = __le16_to_cpu(hdr->index);
6269         len = __le16_to_cpu(hdr->len);
6270
6271         if (len != msglen - sizeof(*hdr)) {
6272                 err = -EINVAL;
6273                 goto done;
6274         }
6275
6276         if (opcode >= chan->handler_count ||
6277             chan->handlers[opcode].func == NULL) {
6278                 BT_DBG("Unknown op %u", opcode);
6279                 err = mgmt_cmd_status(sk, index, opcode,
6280                                       MGMT_STATUS_UNKNOWN_COMMAND);
6281                 goto done;
6282         }
6283
6284         handler = &chan->handlers[opcode];
6285
6286         if (index != MGMT_INDEX_NONE) {
6287                 hdev = hci_dev_get(index);
6288                 if (!hdev) {
6289                         err = mgmt_cmd_status(sk, index, opcode,
6290                                               MGMT_STATUS_INVALID_INDEX);
6291                         goto done;
6292                 }
6293
6294                 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
6295                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
6296                     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
6297                         err = mgmt_cmd_status(sk, index, opcode,
6298                                               MGMT_STATUS_INVALID_INDEX);
6299                         goto done;
6300                 }
6301
6302                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
6303                     !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
6304                         err = mgmt_cmd_status(sk, index, opcode,
6305                                               MGMT_STATUS_INVALID_INDEX);
6306                         goto done;
6307                 }
6308         }
6309
6310         no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
6311         if (no_hdev != !hdev) {
6312                 err = mgmt_cmd_status(sk, index, opcode,
6313                                       MGMT_STATUS_INVALID_INDEX);
6314                 goto done;
6315         }
6316
6317         var_len = (handler->flags & HCI_MGMT_VAR_LEN);
6318         if ((var_len && len < handler->data_len) ||
6319             (!var_len && len != handler->data_len)) {
6320                 err = mgmt_cmd_status(sk, index, opcode,
6321                                       MGMT_STATUS_INVALID_PARAMS);
6322                 goto done;
6323         }
6324
6325         if (hdev)
6326                 mgmt_init_hdev(sk, hdev);
6327
6328         cp = buf + sizeof(*hdr);
6329
6330         err = handler->func(sk, hdev, cp, len);
6331         if (err < 0)
6332                 goto done;
6333
6334         err = msglen;
6335
6336 done:
6337         if (hdev)
6338                 hci_dev_put(hdev);
6339
6340         kfree(buf);
6341         return err;
6342 }
6343
6344 void mgmt_index_added(struct hci_dev *hdev)
6345 {
6346         if (hdev->dev_type != HCI_BREDR)
6347                 return;
6348
6349         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6350                 return;
6351
6352         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6353                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6354         else
6355                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6356 }
6357
6358 void mgmt_index_removed(struct hci_dev *hdev)
6359 {
6360         u8 status = MGMT_STATUS_INVALID_INDEX;
6361
6362         if (hdev->dev_type != HCI_BREDR)
6363                 return;
6364
6365         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6366                 return;
6367
6368         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6369
6370         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6371                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6372         else
6373                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6374 }
6375
6376 /* This function requires the caller holds hdev->lock */
6377 static void restart_le_actions(struct hci_request *req)
6378 {
6379         struct hci_dev *hdev = req->hdev;
6380         struct hci_conn_params *p;
6381
6382         list_for_each_entry(p, &hdev->le_conn_params, list) {
6383                 /* Needed for AUTO_OFF case where might not "really"
6384                  * have been powered off.
6385                  */
6386                 list_del_init(&p->action);
6387
6388                 switch (p->auto_connect) {
6389                 case HCI_AUTO_CONN_DIRECT:
6390                 case HCI_AUTO_CONN_ALWAYS:
6391                         list_add(&p->action, &hdev->pend_le_conns);
6392                         break;
6393                 case HCI_AUTO_CONN_REPORT:
6394                         list_add(&p->action, &hdev->pend_le_reports);
6395                         break;
6396                 default:
6397                         break;
6398                 }
6399         }
6400
6401         __hci_update_background_scan(req);
6402 }
6403
6404 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6405 {
6406         struct cmd_lookup match = { NULL, hdev };
6407
6408         BT_DBG("status 0x%02x", status);
6409
6410         if (!status) {
6411                 /* Register the available SMP channels (BR/EDR and LE) only
6412                  * when successfully powering on the controller. This late
6413                  * registration is required so that LE SMP can clearly
6414                  * decide if the public address or static address is used.
6415                  */
6416                 smp_register(hdev);
6417         }
6418
6419         hci_dev_lock(hdev);
6420
6421         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6422
6423         new_settings(hdev, match.sk);
6424
6425         hci_dev_unlock(hdev);
6426
6427         if (match.sk)
6428                 sock_put(match.sk);
6429 }
6430
6431 static int powered_update_hci(struct hci_dev *hdev)
6432 {
6433         struct hci_request req;
6434         u8 link_sec;
6435
6436         hci_req_init(&req, hdev);
6437
6438         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
6439             !lmp_host_ssp_capable(hdev)) {
6440                 u8 mode = 0x01;
6441
6442                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6443
6444                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6445                         u8 support = 0x01;
6446
6447                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6448                                     sizeof(support), &support);
6449                 }
6450         }
6451
6452         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
6453             lmp_bredr_capable(hdev)) {
6454                 struct hci_cp_write_le_host_supported cp;
6455
6456                 cp.le = 0x01;
6457                 cp.simul = 0x00;
6458
6459                 /* Check first if we already have the right
6460                  * host state (host features set)
6461                  */
6462                 if (cp.le != lmp_host_le_capable(hdev) ||
6463                     cp.simul != lmp_host_le_br_capable(hdev))
6464                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6465                                     sizeof(cp), &cp);
6466         }
6467
6468         if (lmp_le_capable(hdev)) {
6469                 /* Make sure the controller has a good default for
6470                  * advertising data. This also applies to the case
6471                  * where BR/EDR was toggled during the AUTO_OFF phase.
6472                  */
6473                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
6474                         update_adv_data(&req);
6475                         update_scan_rsp_data(&req);
6476                 }
6477
6478                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6479                         enable_advertising(&req);
6480
6481                 restart_le_actions(&req);
6482         }
6483
6484         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
6485         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6486                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6487                             sizeof(link_sec), &link_sec);
6488
6489         if (lmp_bredr_capable(hdev)) {
6490                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
6491                         write_fast_connectable(&req, true);
6492                 else
6493                         write_fast_connectable(&req, false);
6494                 __hci_update_page_scan(&req);
6495                 update_class(&req);
6496                 update_name(&req);
6497                 update_eir(&req);
6498         }
6499
6500         return hci_req_run(&req, powered_complete);
6501 }
6502
6503 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6504 {
6505         struct cmd_lookup match = { NULL, hdev };
6506         u8 status, zero_cod[] = { 0, 0, 0 };
6507         int err;
6508
6509         if (!hci_dev_test_flag(hdev, HCI_MGMT))
6510                 return 0;
6511
6512         if (powered) {
6513                 if (powered_update_hci(hdev) == 0)
6514                         return 0;
6515
6516                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6517                                      &match);
6518                 goto new_settings;
6519         }
6520
6521         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6522
6523         /* If the power off is because of hdev unregistration let
6524          * use the appropriate INVALID_INDEX status. Otherwise use
6525          * NOT_POWERED. We cover both scenarios here since later in
6526          * mgmt_index_removed() any hci_conn callbacks will have already
6527          * been triggered, potentially causing misleading DISCONNECTED
6528          * status responses.
6529          */
6530         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6531                 status = MGMT_STATUS_INVALID_INDEX;
6532         else
6533                 status = MGMT_STATUS_NOT_POWERED;
6534
6535         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6536
6537         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6538                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6539                            zero_cod, sizeof(zero_cod), NULL);
6540
6541 new_settings:
6542         err = new_settings(hdev, match.sk);
6543
6544         if (match.sk)
6545                 sock_put(match.sk);
6546
6547         return err;
6548 }
6549
6550 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6551 {
6552         struct mgmt_pending_cmd *cmd;
6553         u8 status;
6554
6555         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6556         if (!cmd)
6557                 return;
6558
6559         if (err == -ERFKILL)
6560                 status = MGMT_STATUS_RFKILLED;
6561         else
6562                 status = MGMT_STATUS_FAILED;
6563
6564         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6565
6566         mgmt_pending_remove(cmd);
6567 }
6568
6569 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6570 {
6571         struct hci_request req;
6572
6573         hci_dev_lock(hdev);
6574
6575         /* When discoverable timeout triggers, then just make sure
6576          * the limited discoverable flag is cleared. Even in the case
6577          * of a timeout triggered from general discoverable, it is
6578          * safe to unconditionally clear the flag.
6579          */
6580         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
6581         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6582
6583         hci_req_init(&req, hdev);
6584         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6585                 u8 scan = SCAN_PAGE;
6586                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6587                             sizeof(scan), &scan);
6588         }
6589         update_class(&req);
6590         update_adv_data(&req);
6591         hci_req_run(&req, NULL);
6592
6593         hdev->discov_timeout = 0;
6594
6595         new_settings(hdev, NULL);
6596
6597         hci_dev_unlock(hdev);
6598 }
6599
6600 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6601                        bool persistent)
6602 {
6603         struct mgmt_ev_new_link_key ev;
6604
6605         memset(&ev, 0, sizeof(ev));
6606
6607         ev.store_hint = persistent;
6608         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6609         ev.key.addr.type = BDADDR_BREDR;
6610         ev.key.type = key->type;
6611         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6612         ev.key.pin_len = key->pin_len;
6613
6614         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6615 }
6616
6617 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6618 {
6619         switch (ltk->type) {
6620         case SMP_LTK:
6621         case SMP_LTK_SLAVE:
6622                 if (ltk->authenticated)
6623                         return MGMT_LTK_AUTHENTICATED;
6624                 return MGMT_LTK_UNAUTHENTICATED;
6625         case SMP_LTK_P256:
6626                 if (ltk->authenticated)
6627                         return MGMT_LTK_P256_AUTH;
6628                 return MGMT_LTK_P256_UNAUTH;
6629         case SMP_LTK_P256_DEBUG:
6630                 return MGMT_LTK_P256_DEBUG;
6631         }
6632
6633         return MGMT_LTK_UNAUTHENTICATED;
6634 }
6635
6636 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6637 {
6638         struct mgmt_ev_new_long_term_key ev;
6639
6640         memset(&ev, 0, sizeof(ev));
6641
6642         /* Devices using resolvable or non-resolvable random addresses
6643          * without providing an indentity resolving key don't require
6644          * to store long term keys. Their addresses will change the
6645          * next time around.
6646          *
6647          * Only when a remote device provides an identity address
6648          * make sure the long term key is stored. If the remote
6649          * identity is known, the long term keys are internally
6650          * mapped to the identity address. So allow static random
6651          * and public addresses here.
6652          */
6653         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6654             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6655                 ev.store_hint = 0x00;
6656         else
6657                 ev.store_hint = persistent;
6658
6659         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6660         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6661         ev.key.type = mgmt_ltk_type(key);
6662         ev.key.enc_size = key->enc_size;
6663         ev.key.ediv = key->ediv;
6664         ev.key.rand = key->rand;
6665
6666         if (key->type == SMP_LTK)
6667                 ev.key.master = 1;
6668
6669         memcpy(ev.key.val, key->val, sizeof(key->val));
6670
6671         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6672 }
6673
6674 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6675 {
6676         struct mgmt_ev_new_irk ev;
6677
6678         memset(&ev, 0, sizeof(ev));
6679
6680         /* For identity resolving keys from devices that are already
6681          * using a public address or static random address, do not
6682          * ask for storing this key. The identity resolving key really
6683          * is only mandatory for devices using resovlable random
6684          * addresses.
6685          *
6686          * Storing all identity resolving keys has the downside that
6687          * they will be also loaded on next boot of they system. More
6688          * identity resolving keys, means more time during scanning is
6689          * needed to actually resolve these addresses.
6690          */
6691         if (bacmp(&irk->rpa, BDADDR_ANY))
6692                 ev.store_hint = 0x01;
6693         else
6694                 ev.store_hint = 0x00;
6695
6696         bacpy(&ev.rpa, &irk->rpa);
6697         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6698         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6699         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6700
6701         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6702 }
6703
6704 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6705                    bool persistent)
6706 {
6707         struct mgmt_ev_new_csrk ev;
6708
6709         memset(&ev, 0, sizeof(ev));
6710
6711         /* Devices using resolvable or non-resolvable random addresses
6712          * without providing an indentity resolving key don't require
6713          * to store signature resolving keys. Their addresses will change
6714          * the next time around.
6715          *
6716          * Only when a remote device provides an identity address
6717          * make sure the signature resolving key is stored. So allow
6718          * static random and public addresses here.
6719          */
6720         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6721             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6722                 ev.store_hint = 0x00;
6723         else
6724                 ev.store_hint = persistent;
6725
6726         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6727         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6728         ev.key.type = csrk->type;
6729         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6730
6731         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6732 }
6733
6734 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6735                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6736                          u16 max_interval, u16 latency, u16 timeout)
6737 {
6738         struct mgmt_ev_new_conn_param ev;
6739
6740         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6741                 return;
6742
6743         memset(&ev, 0, sizeof(ev));
6744         bacpy(&ev.addr.bdaddr, bdaddr);
6745         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6746         ev.store_hint = store_hint;
6747         ev.min_interval = cpu_to_le16(min_interval);
6748         ev.max_interval = cpu_to_le16(max_interval);
6749         ev.latency = cpu_to_le16(latency);
6750         ev.timeout = cpu_to_le16(timeout);
6751
6752         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6753 }
6754
6755 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6756                                   u8 data_len)
6757 {
6758         eir[eir_len++] = sizeof(type) + data_len;
6759         eir[eir_len++] = type;
6760         memcpy(&eir[eir_len], data, data_len);
6761         eir_len += data_len;
6762
6763         return eir_len;
6764 }
6765
6766 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6767                            u32 flags, u8 *name, u8 name_len)
6768 {
6769         char buf[512];
6770         struct mgmt_ev_device_connected *ev = (void *) buf;
6771         u16 eir_len = 0;
6772
6773         bacpy(&ev->addr.bdaddr, &conn->dst);
6774         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6775
6776         ev->flags = __cpu_to_le32(flags);
6777
6778         /* We must ensure that the EIR Data fields are ordered and
6779          * unique. Keep it simple for now and avoid the problem by not
6780          * adding any BR/EDR data to the LE adv.
6781          */
6782         if (conn->le_adv_data_len > 0) {
6783                 memcpy(&ev->eir[eir_len],
6784                        conn->le_adv_data, conn->le_adv_data_len);
6785                 eir_len = conn->le_adv_data_len;
6786         } else {
6787                 if (name_len > 0)
6788                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6789                                                   name, name_len);
6790
6791                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6792                         eir_len = eir_append_data(ev->eir, eir_len,
6793                                                   EIR_CLASS_OF_DEV,
6794                                                   conn->dev_class, 3);
6795         }
6796
6797         ev->eir_len = cpu_to_le16(eir_len);
6798
6799         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6800                     sizeof(*ev) + eir_len, NULL);
6801 }
6802
6803 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6804 {
6805         struct sock **sk = data;
6806
6807         cmd->cmd_complete(cmd, 0);
6808
6809         *sk = cmd->sk;
6810         sock_hold(*sk);
6811
6812         mgmt_pending_remove(cmd);
6813 }
6814
6815 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6816 {
6817         struct hci_dev *hdev = data;
6818         struct mgmt_cp_unpair_device *cp = cmd->param;
6819
6820         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6821
6822         cmd->cmd_complete(cmd, 0);
6823         mgmt_pending_remove(cmd);
6824 }
6825
6826 bool mgmt_powering_down(struct hci_dev *hdev)
6827 {
6828         struct mgmt_pending_cmd *cmd;
6829         struct mgmt_mode *cp;
6830
6831         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6832         if (!cmd)
6833                 return false;
6834
6835         cp = cmd->param;
6836         if (!cp->val)
6837                 return true;
6838
6839         return false;
6840 }
6841
6842 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6843                               u8 link_type, u8 addr_type, u8 reason,
6844                               bool mgmt_connected)
6845 {
6846         struct mgmt_ev_device_disconnected ev;
6847         struct sock *sk = NULL;
6848
6849         /* The connection is still in hci_conn_hash so test for 1
6850          * instead of 0 to know if this is the last one.
6851          */
6852         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6853                 cancel_delayed_work(&hdev->power_off);
6854                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6855         }
6856
6857         if (!mgmt_connected)
6858                 return;
6859
6860         if (link_type != ACL_LINK && link_type != LE_LINK)
6861                 return;
6862
6863         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6864
6865         bacpy(&ev.addr.bdaddr, bdaddr);
6866         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6867         ev.reason = reason;
6868
6869         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6870
6871         if (sk)
6872                 sock_put(sk);
6873
6874         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6875                              hdev);
6876 }
6877
6878 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6879                             u8 link_type, u8 addr_type, u8 status)
6880 {
6881         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6882         struct mgmt_cp_disconnect *cp;
6883         struct mgmt_pending_cmd *cmd;
6884
6885         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6886                              hdev);
6887
6888         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6889         if (!cmd)
6890                 return;
6891
6892         cp = cmd->param;
6893
6894         if (bacmp(bdaddr, &cp->addr.bdaddr))
6895                 return;
6896
6897         if (cp->addr.type != bdaddr_type)
6898                 return;
6899
6900         cmd->cmd_complete(cmd, mgmt_status(status));
6901         mgmt_pending_remove(cmd);
6902 }
6903
6904 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6905                          u8 addr_type, u8 status)
6906 {
6907         struct mgmt_ev_connect_failed ev;
6908
6909         /* The connection is still in hci_conn_hash so test for 1
6910          * instead of 0 to know if this is the last one.
6911          */
6912         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6913                 cancel_delayed_work(&hdev->power_off);
6914                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6915         }
6916
6917         bacpy(&ev.addr.bdaddr, bdaddr);
6918         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6919         ev.status = mgmt_status(status);
6920
6921         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6922 }
6923
6924 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6925 {
6926         struct mgmt_ev_pin_code_request ev;
6927
6928         bacpy(&ev.addr.bdaddr, bdaddr);
6929         ev.addr.type = BDADDR_BREDR;
6930         ev.secure = secure;
6931
6932         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6933 }
6934
6935 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6936                                   u8 status)
6937 {
6938         struct mgmt_pending_cmd *cmd;
6939
6940         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6941         if (!cmd)
6942                 return;
6943
6944         cmd->cmd_complete(cmd, mgmt_status(status));
6945         mgmt_pending_remove(cmd);
6946 }
6947
6948 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6949                                       u8 status)
6950 {
6951         struct mgmt_pending_cmd *cmd;
6952
6953         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6954         if (!cmd)
6955                 return;
6956
6957         cmd->cmd_complete(cmd, mgmt_status(status));
6958         mgmt_pending_remove(cmd);
6959 }
6960
6961 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6962                               u8 link_type, u8 addr_type, u32 value,
6963                               u8 confirm_hint)
6964 {
6965         struct mgmt_ev_user_confirm_request ev;
6966
6967         BT_DBG("%s", hdev->name);
6968
6969         bacpy(&ev.addr.bdaddr, bdaddr);
6970         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6971         ev.confirm_hint = confirm_hint;
6972         ev.value = cpu_to_le32(value);
6973
6974         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6975                           NULL);
6976 }
6977
6978 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6979                               u8 link_type, u8 addr_type)
6980 {
6981         struct mgmt_ev_user_passkey_request ev;
6982
6983         BT_DBG("%s", hdev->name);
6984
6985         bacpy(&ev.addr.bdaddr, bdaddr);
6986         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6987
6988         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6989                           NULL);
6990 }
6991
6992 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6993                                       u8 link_type, u8 addr_type, u8 status,
6994                                       u8 opcode)
6995 {
6996         struct mgmt_pending_cmd *cmd;
6997
6998         cmd = mgmt_pending_find(opcode, hdev);
6999         if (!cmd)
7000                 return -ENOENT;
7001
7002         cmd->cmd_complete(cmd, mgmt_status(status));
7003         mgmt_pending_remove(cmd);
7004
7005         return 0;
7006 }
7007
7008 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7009                                      u8 link_type, u8 addr_type, u8 status)
7010 {
7011         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7012                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7013 }
7014
7015 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7016                                          u8 link_type, u8 addr_type, u8 status)
7017 {
7018         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7019                                           status,
7020                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7021 }
7022
7023 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7024                                      u8 link_type, u8 addr_type, u8 status)
7025 {
7026         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7027                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7028 }
7029
7030 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7031                                          u8 link_type, u8 addr_type, u8 status)
7032 {
7033         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7034                                           status,
7035                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7036 }
7037
7038 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7039                              u8 link_type, u8 addr_type, u32 passkey,
7040                              u8 entered)
7041 {
7042         struct mgmt_ev_passkey_notify ev;
7043
7044         BT_DBG("%s", hdev->name);
7045
7046         bacpy(&ev.addr.bdaddr, bdaddr);
7047         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7048         ev.passkey = __cpu_to_le32(passkey);
7049         ev.entered = entered;
7050
7051         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7052 }
7053
7054 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7055 {
7056         struct mgmt_ev_auth_failed ev;
7057         struct mgmt_pending_cmd *cmd;
7058         u8 status = mgmt_status(hci_status);
7059
7060         bacpy(&ev.addr.bdaddr, &conn->dst);
7061         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7062         ev.status = status;
7063
7064         cmd = find_pairing(conn);
7065
7066         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7067                     cmd ? cmd->sk : NULL);
7068
7069         if (cmd) {
7070                 cmd->cmd_complete(cmd, status);
7071                 mgmt_pending_remove(cmd);
7072         }
7073 }
7074
7075 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7076 {
7077         struct cmd_lookup match = { NULL, hdev };
7078         bool changed;
7079
7080         if (status) {
7081                 u8 mgmt_err = mgmt_status(status);
7082                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7083                                      cmd_status_rsp, &mgmt_err);
7084                 return;
7085         }
7086
7087         if (test_bit(HCI_AUTH, &hdev->flags))
7088                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7089         else
7090                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7091
7092         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7093                              &match);
7094
7095         if (changed)
7096                 new_settings(hdev, match.sk);
7097
7098         if (match.sk)
7099                 sock_put(match.sk);
7100 }
7101
7102 static void clear_eir(struct hci_request *req)
7103 {
7104         struct hci_dev *hdev = req->hdev;
7105         struct hci_cp_write_eir cp;
7106
7107         if (!lmp_ext_inq_capable(hdev))
7108                 return;
7109
7110         memset(hdev->eir, 0, sizeof(hdev->eir));
7111
7112         memset(&cp, 0, sizeof(cp));
7113
7114         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7115 }
7116
7117 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7118 {
7119         struct cmd_lookup match = { NULL, hdev };
7120         struct hci_request req;
7121         bool changed = false;
7122
7123         if (status) {
7124                 u8 mgmt_err = mgmt_status(status);
7125
7126                 if (enable && hci_dev_test_and_clear_flag(hdev,
7127                                                           HCI_SSP_ENABLED)) {
7128                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7129                         new_settings(hdev, NULL);
7130                 }
7131
7132                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7133                                      &mgmt_err);
7134                 return;
7135         }
7136
7137         if (enable) {
7138                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7139         } else {
7140                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7141                 if (!changed)
7142                         changed = hci_dev_test_and_clear_flag(hdev,
7143                                                               HCI_HS_ENABLED);
7144                 else
7145                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7146         }
7147
7148         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7149
7150         if (changed)
7151                 new_settings(hdev, match.sk);
7152
7153         if (match.sk)
7154                 sock_put(match.sk);
7155
7156         hci_req_init(&req, hdev);
7157
7158         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7159                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7160                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7161                                     sizeof(enable), &enable);
7162                 update_eir(&req);
7163         } else {
7164                 clear_eir(&req);
7165         }
7166
7167         hci_req_run(&req, NULL);
7168 }
7169
7170 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7171 {
7172         struct cmd_lookup *match = data;
7173
7174         if (match->sk == NULL) {
7175                 match->sk = cmd->sk;
7176                 sock_hold(match->sk);
7177         }
7178 }
7179
7180 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7181                                     u8 status)
7182 {
7183         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7184
7185         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7186         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7187         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7188
7189         if (!status)
7190                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7191                            NULL);
7192
7193         if (match.sk)
7194                 sock_put(match.sk);
7195 }
7196
7197 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7198 {
7199         struct mgmt_cp_set_local_name ev;
7200         struct mgmt_pending_cmd *cmd;
7201
7202         if (status)
7203                 return;
7204
7205         memset(&ev, 0, sizeof(ev));
7206         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7207         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7208
7209         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7210         if (!cmd) {
7211                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7212
7213                 /* If this is a HCI command related to powering on the
7214                  * HCI dev don't send any mgmt signals.
7215                  */
7216                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7217                         return;
7218         }
7219
7220         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7221                    cmd ? cmd->sk : NULL);
7222 }
7223
7224 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7225                                        u8 *rand192, u8 *hash256, u8 *rand256,
7226                                        u8 status)
7227 {
7228         struct mgmt_pending_cmd *cmd;
7229
7230         BT_DBG("%s status %u", hdev->name, status);
7231
7232         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7233         if (!cmd)
7234                 return;
7235
7236         if (status) {
7237                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7238                                 mgmt_status(status));
7239         } else {
7240                 struct mgmt_rp_read_local_oob_data rp;
7241                 size_t rp_size = sizeof(rp);
7242
7243                 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7244                 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7245
7246                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7247                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7248                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7249                 } else {
7250                         rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
7251                 }
7252
7253                 mgmt_cmd_complete(cmd->sk, hdev->id,
7254                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7255                                   &rp, rp_size);
7256         }
7257
7258         mgmt_pending_remove(cmd);
7259 }
7260
7261 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7262 {
7263         int i;
7264
7265         for (i = 0; i < uuid_count; i++) {
7266                 if (!memcmp(uuid, uuids[i], 16))
7267                         return true;
7268         }
7269
7270         return false;
7271 }
7272
7273 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7274 {
7275         u16 parsed = 0;
7276
7277         while (parsed < eir_len) {
7278                 u8 field_len = eir[0];
7279                 u8 uuid[16];
7280                 int i;
7281
7282                 if (field_len == 0)
7283                         break;
7284
7285                 if (eir_len - parsed < field_len + 1)
7286                         break;
7287
7288                 switch (eir[1]) {
7289                 case EIR_UUID16_ALL:
7290                 case EIR_UUID16_SOME:
7291                         for (i = 0; i + 3 <= field_len; i += 2) {
7292                                 memcpy(uuid, bluetooth_base_uuid, 16);
7293                                 uuid[13] = eir[i + 3];
7294                                 uuid[12] = eir[i + 2];
7295                                 if (has_uuid(uuid, uuid_count, uuids))
7296                                         return true;
7297                         }
7298                         break;
7299                 case EIR_UUID32_ALL:
7300                 case EIR_UUID32_SOME:
7301                         for (i = 0; i + 5 <= field_len; i += 4) {
7302                                 memcpy(uuid, bluetooth_base_uuid, 16);
7303                                 uuid[15] = eir[i + 5];
7304                                 uuid[14] = eir[i + 4];
7305                                 uuid[13] = eir[i + 3];
7306                                 uuid[12] = eir[i + 2];
7307                                 if (has_uuid(uuid, uuid_count, uuids))
7308                                         return true;
7309                         }
7310                         break;
7311                 case EIR_UUID128_ALL:
7312                 case EIR_UUID128_SOME:
7313                         for (i = 0; i + 17 <= field_len; i += 16) {
7314                                 memcpy(uuid, eir + i + 2, 16);
7315                                 if (has_uuid(uuid, uuid_count, uuids))
7316                                         return true;
7317                         }
7318                         break;
7319                 }
7320
7321                 parsed += field_len + 1;
7322                 eir += field_len + 1;
7323         }
7324
7325         return false;
7326 }
7327
7328 static void restart_le_scan(struct hci_dev *hdev)
7329 {
7330         /* If controller is not scanning we are done. */
7331         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7332                 return;
7333
7334         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7335                        hdev->discovery.scan_start +
7336                        hdev->discovery.scan_duration))
7337                 return;
7338
7339         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7340                            DISCOV_LE_RESTART_DELAY);
7341 }
7342
7343 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7344                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7345 {
7346         /* If a RSSI threshold has been specified, and
7347          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7348          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7349          * is set, let it through for further processing, as we might need to
7350          * restart the scan.
7351          *
7352          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7353          * the results are also dropped.
7354          */
7355         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7356             (rssi == HCI_RSSI_INVALID ||
7357             (rssi < hdev->discovery.rssi &&
7358              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7359                 return  false;
7360
7361         if (hdev->discovery.uuid_count != 0) {
7362                 /* If a list of UUIDs is provided in filter, results with no
7363                  * matching UUID should be dropped.
7364                  */
7365                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7366                                    hdev->discovery.uuids) &&
7367                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7368                                    hdev->discovery.uuid_count,
7369                                    hdev->discovery.uuids))
7370                         return false;
7371         }
7372
7373         /* If duplicate filtering does not report RSSI changes, then restart
7374          * scanning to ensure updated result with updated RSSI values.
7375          */
7376         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7377                 restart_le_scan(hdev);
7378
7379                 /* Validate RSSI value against the RSSI threshold once more. */
7380                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7381                     rssi < hdev->discovery.rssi)
7382                         return false;
7383         }
7384
7385         return true;
7386 }
7387
7388 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7389                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7390                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7391 {
7392         char buf[512];
7393         struct mgmt_ev_device_found *ev = (void *)buf;
7394         size_t ev_size;
7395
7396         /* Don't send events for a non-kernel initiated discovery. With
7397          * LE one exception is if we have pend_le_reports > 0 in which
7398          * case we're doing passive scanning and want these events.
7399          */
7400         if (!hci_discovery_active(hdev)) {
7401                 if (link_type == ACL_LINK)
7402                         return;
7403                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7404                         return;
7405         }
7406
7407         if (hdev->discovery.result_filtering) {
7408                 /* We are using service discovery */
7409                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7410                                      scan_rsp_len))
7411                         return;
7412         }
7413
7414         /* Make sure that the buffer is big enough. The 5 extra bytes
7415          * are for the potential CoD field.
7416          */
7417         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7418                 return;
7419
7420         memset(buf, 0, sizeof(buf));
7421
7422         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7423          * RSSI value was reported as 0 when not available. This behavior
7424          * is kept when using device discovery. This is required for full
7425          * backwards compatibility with the API.
7426          *
7427          * However when using service discovery, the value 127 will be
7428          * returned when the RSSI is not available.
7429          */
7430         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7431             link_type == ACL_LINK)
7432                 rssi = 0;
7433
7434         bacpy(&ev->addr.bdaddr, bdaddr);
7435         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7436         ev->rssi = rssi;
7437         ev->flags = cpu_to_le32(flags);
7438
7439         if (eir_len > 0)
7440                 /* Copy EIR or advertising data into event */
7441                 memcpy(ev->eir, eir, eir_len);
7442
7443         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7444                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7445                                           dev_class, 3);
7446
7447         if (scan_rsp_len > 0)
7448                 /* Append scan response data to event */
7449                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7450
7451         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7452         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7453
7454         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7455 }
7456
7457 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7458                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7459 {
7460         struct mgmt_ev_device_found *ev;
7461         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7462         u16 eir_len;
7463
7464         ev = (struct mgmt_ev_device_found *) buf;
7465
7466         memset(buf, 0, sizeof(buf));
7467
7468         bacpy(&ev->addr.bdaddr, bdaddr);
7469         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7470         ev->rssi = rssi;
7471
7472         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7473                                   name_len);
7474
7475         ev->eir_len = cpu_to_le16(eir_len);
7476
7477         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7478 }
7479
7480 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7481 {
7482         struct mgmt_ev_discovering ev;
7483
7484         BT_DBG("%s discovering %u", hdev->name, discovering);
7485
7486         memset(&ev, 0, sizeof(ev));
7487         ev.type = hdev->discovery.type;
7488         ev.discovering = discovering;
7489
7490         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7491 }
7492
7493 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7494 {
7495         BT_DBG("%s status %u", hdev->name, status);
7496 }
7497
7498 void mgmt_reenable_advertising(struct hci_dev *hdev)
7499 {
7500         struct hci_request req;
7501
7502         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
7503                 return;
7504
7505         hci_req_init(&req, hdev);
7506         enable_advertising(&req);
7507         hci_req_run(&req, adv_enable_complete);
7508 }
7509
7510 static struct hci_mgmt_chan chan = {
7511         .channel        = HCI_CHANNEL_CONTROL,
7512         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7513         .handlers       = mgmt_handlers,
7514 };
7515
7516 int mgmt_init(void)
7517 {
7518         return hci_mgmt_chan_register(&chan);
7519 }
7520
7521 void mgmt_exit(void)
7522 {
7523         hci_mgmt_chan_unregister(&chan);
7524 }