net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = cpu_to_le16(MGMT_REVISION);
 280
 281         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 282                                  &rp, sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         u16 num_commands, num_events;
 290         size_t rp_size;
 291         int i, err;
 292
 293         BT_DBG("sock %p", sk);
 294
 295         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 296                 num_commands = ARRAY_SIZE(mgmt_commands);
 297                 num_events = ARRAY_SIZE(mgmt_events);
 298         } else {
 299                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 300                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 301         }
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 313                 __le16 *opcode = rp->opcodes;
 314
 315                 for (i = 0; i < num_commands; i++, opcode++)
 316                         put_unaligned_le16(mgmt_commands[i], opcode);
 317
 318                 for (i = 0; i < num_events; i++, opcode++)
 319                         put_unaligned_le16(mgmt_events[i], opcode);
 320         } else {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 328         }
 329
 330         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 331                                 rp, rp_size);
 332         kfree(rp);
 333
 334         return err;
 335 }
 336
 337 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 338                            u16 data_len)
 339 {
 340         struct mgmt_rp_read_index_list *rp;
 341         struct hci_dev *d;
 342         size_t rp_len;
 343         u16 count;
 344         int err;
 345
 346         BT_DBG("sock %p", sk);
 347
 348         read_lock(&hci_dev_list_lock);
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (d->dev_type == HCI_BREDR &&
 353                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 354                         count++;
 355         }
 356
 357         rp_len = sizeof(*rp) + (2 * count);
 358         rp = kmalloc(rp_len, GFP_ATOMIC);
 359         if (!rp) {
 360                 read_unlock(&hci_dev_list_lock);
 361                 return -ENOMEM;
 362         }
 363
 364         count = 0;
 365         list_for_each_entry(d, &hci_dev_list, list) {
 366                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 367                     hci_dev_test_flag(d, HCI_CONFIG) ||
 368                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 369                         continue;
 370
 371                 /* Devices marked as raw-only are neither configured
 372                  * nor unconfigured controllers.
 373                  */
 374                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 375                         continue;
 376
 377                 if (d->dev_type == HCI_BREDR &&
 378                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 379                         rp->index[count++] = cpu_to_le16(d->id);
 380                         BT_DBG("Added hci%u", d->id);
 381                 }
 382         }
 383
 384         rp->num_controllers = cpu_to_le16(count);
 385         rp_len = sizeof(*rp) + (2 * count);
 386
 387         read_unlock(&hci_dev_list_lock);
 388
 389         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 390                                 0, rp, rp_len);
 391
 392         kfree(rp);
 393
 394         return err;
 395 }
 396
 397 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 398                                   void *data, u16 data_len)
 399 {
 400         struct mgmt_rp_read_unconf_index_list *rp;
 401         struct hci_dev *d;
 402         size_t rp_len;
 403         u16 count;
 404         int err;
 405
 406         BT_DBG("sock %p", sk);
 407
 408         read_lock(&hci_dev_list_lock);
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (d->dev_type == HCI_BREDR &&
 413                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 414                         count++;
 415         }
 416
 417         rp_len = sizeof(*rp) + (2 * count);
 418         rp = kmalloc(rp_len, GFP_ATOMIC);
 419         if (!rp) {
 420                 read_unlock(&hci_dev_list_lock);
 421                 return -ENOMEM;
 422         }
 423
 424         count = 0;
 425         list_for_each_entry(d, &hci_dev_list, list) {
 426                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 427                     hci_dev_test_flag(d, HCI_CONFIG) ||
 428                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 429                         continue;
 430
 431                 /* Devices marked as raw-only are neither configured
 432                  * nor unconfigured controllers.
 433                  */
 434                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 435                         continue;
 436
 437                 if (d->dev_type == HCI_BREDR &&
 438                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 439                         rp->index[count++] = cpu_to_le16(d->id);
 440                         BT_DBG("Added hci%u", d->id);
 441                 }
 442         }
 443
 444         rp->num_controllers = cpu_to_le16(count);
 445         rp_len = sizeof(*rp) + (2 * count);
 446
 447         read_unlock(&hci_dev_list_lock);
 448
 449         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 450                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 451
 452         kfree(rp);
 453
 454         return err;
 455 }
 456
 457 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 458                                void *data, u16 data_len)
 459 {
 460         struct mgmt_rp_read_ext_index_list *rp;
 461         struct hci_dev *d;
 462         size_t rp_len;
 463         u16 count;
 464         int err;
 465
 466         BT_DBG("sock %p", sk);
 467
 468         read_lock(&hci_dev_list_lock);
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 473                         count++;
 474         }
 475
 476         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 477         rp = kmalloc(rp_len, GFP_ATOMIC);
 478         if (!rp) {
 479                 read_unlock(&hci_dev_list_lock);
 480                 return -ENOMEM;
 481         }
 482
 483         count = 0;
 484         list_for_each_entry(d, &hci_dev_list, list) {
 485                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 486                     hci_dev_test_flag(d, HCI_CONFIG) ||
 487                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 488                         continue;
 489
 490                 /* Devices marked as raw-only are neither configured
 491                  * nor unconfigured controllers.
 492                  */
 493                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 494                         continue;
 495
 496                 if (d->dev_type == HCI_BREDR) {
 497                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 498                                 rp->entry[count].type = 0x01;
 499                         else
 500                                 rp->entry[count].type = 0x00;
 501                 } else if (d->dev_type == HCI_AMP) {
 502                         rp->entry[count].type = 0x02;
 503                 } else {
 504                         continue;
 505                 }
 506
 507                 rp->entry[count].bus = d->bus;
 508                 rp->entry[count++].index = cpu_to_le16(d->id);
 509                 BT_DBG("Added hci%u", d->id);
 510         }
 511
 512         rp->num_controllers = cpu_to_le16(count);
 513         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 514
 515         read_unlock(&hci_dev_list_lock);
 516
 517         /* If this command is called at least once, then all the
 518          * default index and unconfigured index events are disabled
 519          * and from now on only extended index events are used.
 520          */
 521         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 522         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 523         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 524
 525         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 526                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 527
 528         kfree(rp);
 529
 530         return err;
 531 }
 532
 533 static bool is_configured(struct hci_dev *hdev)
 534 {
 535         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 536             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 537                 return false;
 538
 539         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 540             !bacmp(&hdev->public_addr, BDADDR_ANY))
 541                 return false;
 542
 543         return true;
 544 }
 545
 546 static __le32 get_missing_options(struct hci_dev *hdev)
 547 {
 548         u32 options = 0;
 549
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 557
 558         return cpu_to_le32(options);
 559 }
 560
 561 static int new_options(struct hci_dev *hdev, struct sock *skip)
 562 {
 563         __le32 options = get_missing_options(hdev);
 564
 565         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 566                                   sizeof(options), skip);
 567 }
 568
 569 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 574                                  sizeof(options));
 575 }
 576
 577 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 578                             void *data, u16 data_len)
 579 {
 580         struct mgmt_rp_read_config_info rp;
 581         u32 options = 0;
 582
 583         BT_DBG("sock %p %s", sk, hdev->name);
 584
 585         hci_dev_lock(hdev);
 586
 587         memset(&rp, 0, sizeof(rp));
 588         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 589
 590         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 591                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 592
 593         if (hdev->set_bdaddr)
 594                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 595
 596         rp.supported_options = cpu_to_le32(options);
 597         rp.missing_options = get_missing_options(hdev);
 598
 599         hci_dev_unlock(hdev);
 600
 601         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 602                                  &rp, sizeof(rp));
 603 }
 604
 605 static u32 get_supported_settings(struct hci_dev *hdev)
 606 {
 607         u32 settings = 0;
 608
 609         settings |= MGMT_SETTING_POWERED;
 610         settings |= MGMT_SETTING_BONDABLE;
 611         settings |= MGMT_SETTING_DEBUG_KEYS;
 612         settings |= MGMT_SETTING_CONNECTABLE;
 613         settings |= MGMT_SETTING_DISCOVERABLE;
 614
 615         if (lmp_bredr_capable(hdev)) {
 616                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 617                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 618                 settings |= MGMT_SETTING_BREDR;
 619                 settings |= MGMT_SETTING_LINK_SECURITY;
 620
 621                 if (lmp_ssp_capable(hdev)) {
 622                         settings |= MGMT_SETTING_SSP;
 623                         settings |= MGMT_SETTING_HS;
 624                 }
 625
 626                 if (lmp_sc_capable(hdev))
 627                         settings |= MGMT_SETTING_SECURE_CONN;
 628         }
 629
 630         if (lmp_le_capable(hdev)) {
 631                 settings |= MGMT_SETTING_LE;
 632                 settings |= MGMT_SETTING_ADVERTISING;
 633                 settings |= MGMT_SETTING_SECURE_CONN;
 634                 settings |= MGMT_SETTING_PRIVACY;
 635                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 636         }
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 639             hdev->set_bdaddr)
 640                 settings |= MGMT_SETTING_CONFIGURATION;
 641
 642         return settings;
 643 }
 644
 645 static u32 get_current_settings(struct hci_dev *hdev)
 646 {
 647         u32 settings = 0;
 648
 649         if (hdev_is_powered(hdev))
 650                 settings |= MGMT_SETTING_POWERED;
 651
 652         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 653                 settings |= MGMT_SETTING_CONNECTABLE;
 654
 655         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 656                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 657
 658         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 659                 settings |= MGMT_SETTING_DISCOVERABLE;
 660
 661         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 662                 settings |= MGMT_SETTING_BONDABLE;
 663
 664         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 665                 settings |= MGMT_SETTING_BREDR;
 666
 667         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 668                 settings |= MGMT_SETTING_LE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 671                 settings |= MGMT_SETTING_LINK_SECURITY;
 672
 673         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 674                 settings |= MGMT_SETTING_SSP;
 675
 676         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 677                 settings |= MGMT_SETTING_HS;
 678
 679         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 680                 settings |= MGMT_SETTING_ADVERTISING;
 681
 682         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 683                 settings |= MGMT_SETTING_SECURE_CONN;
 684
 685         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 686                 settings |= MGMT_SETTING_DEBUG_KEYS;
 687
 688         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 689                 settings |= MGMT_SETTING_PRIVACY;
 690
 691         /* The current setting for static address has two purposes. The
 692          * first is to indicate if the static address will be used and
 693          * the second is to indicate if it is actually set.
 694          *
 695          * This means if the static address is not configured, this flag
 696          * will never be set. If the address is configured, then if the
 697          * address is actually used decides if the flag is set or not.
 698          *
 699          * For single mode LE only controllers and dual-mode controllers
 700          * with BR/EDR disabled, the existence of the static address will
 701          * be evaluated.
 702          */
 703         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 704             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 705             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 706                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 707                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 708         }
 709
 710         return settings;
 711 }
 712
 713 #define PNP_INFO_SVCLASS_ID             0x1200
 714
 715 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 716 {
 717         u8 *ptr = data, *uuids_start = NULL;
 718         struct bt_uuid *uuid;
 719
 720         if (len < 4)
 721                 return ptr;
 722
 723         list_for_each_entry(uuid, &hdev->uuids, list) {
 724                 u16 uuid16;
 725
 726                 if (uuid->size != 16)
 727                         continue;
 728
 729                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 730                 if (uuid16 < 0x1100)
 731                         continue;
 732
 733                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 734                         continue;
 735
 736                 if (!uuids_start) {
 737                         uuids_start = ptr;
 738                         uuids_start[0] = 1;
 739                         uuids_start[1] = EIR_UUID16_ALL;
 740                         ptr += 2;
 741                 }
 742
 743                 /* Stop if not enough space to put next UUID */
 744                 if ((ptr - data) + sizeof(u16) > len) {
 745                         uuids_start[1] = EIR_UUID16_SOME;
 746                         break;
 747                 }
 748
 749                 *ptr++ = (uuid16 & 0x00ff);
 750                 *ptr++ = (uuid16 & 0xff00) >> 8;
 751                 uuids_start[0] += sizeof(uuid16);
 752         }
 753
 754         return ptr;
 755 }
 756
 757 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 758 {
 759         u8 *ptr = data, *uuids_start = NULL;
 760         struct bt_uuid *uuid;
 761
 762         if (len < 6)
 763                 return ptr;
 764
 765         list_for_each_entry(uuid, &hdev->uuids, list) {
 766                 if (uuid->size != 32)
 767                         continue;
 768
 769                 if (!uuids_start) {
 770                         uuids_start = ptr;
 771                         uuids_start[0] = 1;
 772                         uuids_start[1] = EIR_UUID32_ALL;
 773                         ptr += 2;
 774                 }
 775
 776                 /* Stop if not enough space to put next UUID */
 777                 if ((ptr - data) + sizeof(u32) > len) {
 778                         uuids_start[1] = EIR_UUID32_SOME;
 779                         break;
 780                 }
 781
 782                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 783                 ptr += sizeof(u32);
 784                 uuids_start[0] += sizeof(u32);
 785         }
 786
 787         return ptr;
 788 }
 789
 790 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 791 {
 792         u8 *ptr = data, *uuids_start = NULL;
 793         struct bt_uuid *uuid;
 794
 795         if (len < 18)
 796                 return ptr;
 797
 798         list_for_each_entry(uuid, &hdev->uuids, list) {
 799                 if (uuid->size != 128)
 800                         continue;
 801
 802                 if (!uuids_start) {
 803                         uuids_start = ptr;
 804                         uuids_start[0] = 1;
 805                         uuids_start[1] = EIR_UUID128_ALL;
 806                         ptr += 2;
 807                 }
 808
 809                 /* Stop if not enough space to put next UUID */
 810                 if ((ptr - data) + 16 > len) {
 811                         uuids_start[1] = EIR_UUID128_SOME;
 812                         break;
 813                 }
 814
 815                 memcpy(ptr, uuid->uuid, 16);
 816                 ptr += 16;
 817                 uuids_start[0] += 16;
 818         }
 819
 820         return ptr;
 821 }
 822
 823 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 824 {
 825         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 826 }
 827
 828 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 829                                                   struct hci_dev *hdev,
 830                                                   const void *data)
 831 {
 832         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 833 }
 834
 835 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 836 {
 837         u8 ad_len = 0;
 838         size_t name_len;
 839
 840         name_len = strlen(hdev->dev_name);
 841         if (name_len > 0) {
 842                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 843
 844                 if (name_len > max_len) {
 845                         name_len = max_len;
 846                         ptr[1] = EIR_NAME_SHORT;
 847                 } else
 848                         ptr[1] = EIR_NAME_COMPLETE;
 849
 850                 ptr[0] = name_len + 1;
 851
 852                 memcpy(ptr + 2, hdev->dev_name, name_len);
 853
 854                 ad_len += (name_len + 2);
 855                 ptr += (name_len + 2);
 856         }
 857
 858         return ad_len;
 859 }
 860
 861 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 862 {
 863         /* TODO: Set the appropriate entries based on advertising instance flags
 864          * here once flags other than 0 are supported.
 865          */
 866         memcpy(ptr, hdev->adv_instance.scan_rsp_data,
 867                hdev->adv_instance.scan_rsp_len);
 868
 869         return hdev->adv_instance.scan_rsp_len;
 870 }
 871
 872 static void update_scan_rsp_data_for_instance(struct hci_request *req,
 873                                               u8 instance)
 874 {
 875         struct hci_dev *hdev = req->hdev;
 876         struct hci_cp_le_set_scan_rsp_data cp;
 877         u8 len;
 878
 879         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 return;
 881
 882         memset(&cp, 0, sizeof(cp));
 883
 884         if (instance)
 885                 len = create_instance_scan_rsp_data(hdev, cp.data);
 886         else
 887                 len = create_default_scan_rsp_data(hdev, cp.data);
 888
 889         if (hdev->scan_rsp_data_len == len &&
 890             !memcmp(cp.data, hdev->scan_rsp_data, len))
 891                 return;
 892
 893         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 894         hdev->scan_rsp_data_len = len;
 895
 896         cp.length = len;
 897
 898         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 899 }
 900
 901 static void update_scan_rsp_data(struct hci_request *req)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         u8 instance;
 905
 906         /* The "Set Advertising" setting supersedes the "Add Advertising"
 907          * setting. Here we set the scan response data based on which
 908          * setting was set. When neither apply, default to the global settings,
 909          * represented by instance "0".
 910          */
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 912             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 913                 instance = 0x01;
 914         else
 915                 instance = 0x00;
 916
 917         update_scan_rsp_data_for_instance(req, instance);
 918 }
 919
 920 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 921 {
 922         struct mgmt_pending_cmd *cmd;
 923
 924         /* If there's a pending mgmt command the flags will not yet have
 925          * their final values, so check for this first.
 926          */
 927         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 928         if (cmd) {
 929                 struct mgmt_mode *cp = cmd->param;
 930                 if (cp->val == 0x01)
 931                         return LE_AD_GENERAL;
 932                 else if (cp->val == 0x02)
 933                         return LE_AD_LIMITED;
 934         } else {
 935                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 936                         return LE_AD_LIMITED;
 937                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 938                         return LE_AD_GENERAL;
 939         }
 940
 941         return 0;
 942 }
 943
 944 static u8 create_default_adv_data(struct hci_dev *hdev, u8 *ptr)
 945 {
 946         u8 ad_len = 0, flags = 0;
 947
 948         flags |= get_adv_discov_flags(hdev);
 949
 950         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 951                 flags |= LE_AD_NO_BREDR;
 952
 953         if (flags) {
 954                 BT_DBG("adv flags 0x%02x", flags);
 955
 956                 ptr[0] = 2;
 957                 ptr[1] = EIR_FLAGS;
 958                 ptr[2] = flags;
 959
 960                 ad_len += 3;
 961                 ptr += 3;
 962         }
 963
 964         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 965                 ptr[0] = 2;
 966                 ptr[1] = EIR_TX_POWER;
 967                 ptr[2] = (u8) hdev->adv_tx_power;
 968
 969                 ad_len += 3;
 970                 ptr += 3;
 971         }
 972
 973         return ad_len;
 974 }
 975
 976 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 *ptr)
 977 {
 978         u8 ad_len = 0, flags = 0;
 979
 980         /* The Add Advertising command allows userspace to set both the general
 981          * and limited discoverable flags.
 982          */
 983         if (hdev->adv_instance.flags & MGMT_ADV_FLAG_DISCOV)
 984                 flags |= LE_AD_GENERAL;
 985
 986         if (hdev->adv_instance.flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
 987                 flags |= LE_AD_LIMITED;
 988
 989         if (flags || (hdev->adv_instance.flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
 990                 /* If a discovery flag wasn't provided, simply use the global
 991                  * settings.
 992                  */
 993                 if (!flags)
 994                         flags |= get_adv_discov_flags(hdev);
 995
 996                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 997                         flags |= LE_AD_NO_BREDR;
 998
 999                 ptr[0] = 0x02;
1000                 ptr[1] = EIR_FLAGS;
1001                 ptr[2] = flags;
1002
1003                 ad_len += 3;
1004                 ptr += 3;
1005         }
1006
1007         memcpy(ptr, hdev->adv_instance.adv_data,
1008                hdev->adv_instance.adv_data_len);
1009         ad_len += hdev->adv_instance.adv_data_len;
1010
1011         return ad_len;
1012 }
1013
1014 static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
1015 {
1016         struct hci_dev *hdev = req->hdev;
1017         struct hci_cp_le_set_adv_data cp;
1018         u8 len;
1019
1020         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1021                 return;
1022
1023         memset(&cp, 0, sizeof(cp));
1024
1025         if (instance)
1026                 len = create_instance_adv_data(hdev, cp.data);
1027         else
1028                 len = create_default_adv_data(hdev, cp.data);
1029
1030         /* There's nothing to do if the data hasn't changed */
1031         if (hdev->adv_data_len == len &&
1032             memcmp(cp.data, hdev->adv_data, len) == 0)
1033                 return;
1034
1035         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1036         hdev->adv_data_len = len;
1037
1038         cp.length = len;
1039
1040         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1041 }
1042
1043 static u8 get_current_adv_instance(struct hci_dev *hdev)
1044 {
1045         /* The "Set Advertising" setting supersedes the "Add Advertising"
1046          * setting. Here we set the advertising data based on which
1047          * setting was set. When neither apply, default to the global settings,
1048          * represented by instance "0".
1049          */
1050         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
1051             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
1052                 return 0x01;
1053
1054         return 0x00;
1055 }
1056
1057 static bool get_connectable(struct hci_dev *hdev)
1058 {
1059         struct mgmt_pending_cmd *cmd;
1060
1061         /* If there's a pending mgmt command the flag will not yet have
1062          * it's final value, so check for this first.
1063          */
1064         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1065         if (cmd) {
1066                 struct mgmt_mode *cp = cmd->param;
1067
1068                 return cp->val;
1069         }
1070
1071         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1072 }
1073
1074 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1075 {
1076         u32 flags;
1077
1078         if (instance > 0x01)
1079                 return 0;
1080
1081         if (instance == 1)
1082                 return hdev->adv_instance.flags;
1083
1084         flags = 0;
1085
1086         /* For instance 0, assemble the flags from global settings */
1087         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE) ||
1088             get_connectable(hdev))
1089                 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1090
1091         /* TODO: Add the rest of the flags */
1092
1093         return flags;
1094 }
1095
1096 static void update_adv_data(struct hci_request *req)
1097 {
1098         struct hci_dev *hdev = req->hdev;
1099         u8 instance = get_current_adv_instance(hdev);
1100
1101         update_adv_data_for_instance(req, instance);
1102 }
1103
1104 int mgmt_update_adv_data(struct hci_dev *hdev)
1105 {
1106         struct hci_request req;
1107
1108         hci_req_init(&req, hdev);
1109         update_adv_data(&req);
1110
1111         return hci_req_run(&req, NULL);
1112 }
1113
1114 static void create_eir(struct hci_dev *hdev, u8 *data)
1115 {
1116         u8 *ptr = data;
1117         size_t name_len;
1118
1119         name_len = strlen(hdev->dev_name);
1120
1121         if (name_len > 0) {
1122                 /* EIR Data type */
1123                 if (name_len > 48) {
1124                         name_len = 48;
1125                         ptr[1] = EIR_NAME_SHORT;
1126                 } else
1127                         ptr[1] = EIR_NAME_COMPLETE;
1128
1129                 /* EIR Data length */
1130                 ptr[0] = name_len + 1;
1131
1132                 memcpy(ptr + 2, hdev->dev_name, name_len);
1133
1134                 ptr += (name_len + 2);
1135         }
1136
1137         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1138                 ptr[0] = 2;
1139                 ptr[1] = EIR_TX_POWER;
1140                 ptr[2] = (u8) hdev->inq_tx_power;
1141
1142                 ptr += 3;
1143         }
1144
1145         if (hdev->devid_source > 0) {
1146                 ptr[0] = 9;
1147                 ptr[1] = EIR_DEVICE_ID;
1148
1149                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1150                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1151                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1152                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1153
1154                 ptr += 10;
1155         }
1156
1157         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1158         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1159         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1160 }
1161
1162 static void update_eir(struct hci_request *req)
1163 {
1164         struct hci_dev *hdev = req->hdev;
1165         struct hci_cp_write_eir cp;
1166
1167         if (!hdev_is_powered(hdev))
1168                 return;
1169
1170         if (!lmp_ext_inq_capable(hdev))
1171                 return;
1172
1173         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1174                 return;
1175
1176         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1177                 return;
1178
1179         memset(&cp, 0, sizeof(cp));
1180
1181         create_eir(hdev, cp.data);
1182
1183         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1184                 return;
1185
1186         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1187
1188         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1189 }
1190
1191 static u8 get_service_classes(struct hci_dev *hdev)
1192 {
1193         struct bt_uuid *uuid;
1194         u8 val = 0;
1195
1196         list_for_each_entry(uuid, &hdev->uuids, list)
1197                 val |= uuid->svc_hint;
1198
1199         return val;
1200 }
1201
1202 static void update_class(struct hci_request *req)
1203 {
1204         struct hci_dev *hdev = req->hdev;
1205         u8 cod[3];
1206
1207         BT_DBG("%s", hdev->name);
1208
1209         if (!hdev_is_powered(hdev))
1210                 return;
1211
1212         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1213                 return;
1214
1215         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1216                 return;
1217
1218         cod[0] = hdev->minor_class;
1219         cod[1] = hdev->major_class;
1220         cod[2] = get_service_classes(hdev);
1221
1222         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1223                 cod[1] |= 0x20;
1224
1225         if (memcmp(cod, hdev->dev_class, 3) == 0)
1226                 return;
1227
1228         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1229 }
1230
1231 static void disable_advertising(struct hci_request *req)
1232 {
1233         u8 enable = 0x00;
1234
1235         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1236 }
1237
1238 static void enable_advertising(struct hci_request *req)
1239 {
1240         struct hci_dev *hdev = req->hdev;
1241         struct hci_cp_le_set_adv_param cp;
1242         u8 own_addr_type, enable = 0x01;
1243         bool connectable;
1244         u8 instance;
1245         u32 flags;
1246
1247         if (hci_conn_num(hdev, LE_LINK) > 0)
1248                 return;
1249
1250         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1251                 disable_advertising(req);
1252
1253         /* Clear the HCI_LE_ADV bit temporarily so that the
1254          * hci_update_random_address knows that it's safe to go ahead
1255          * and write a new random address. The flag will be set back on
1256          * as soon as the SET_ADV_ENABLE HCI command completes.
1257          */
1258         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1259
1260         instance = get_current_adv_instance(hdev);
1261         flags = get_adv_instance_flags(hdev, instance);
1262         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE);
1263
1264         /* Set require_privacy to true only when non-connectable
1265          * advertising is used. In that case it is fine to use a
1266          * non-resolvable private address.
1267          */
1268         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1269                 return;
1270
1271         memset(&cp, 0, sizeof(cp));
1272         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1273         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1274         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1275         cp.own_address_type = own_addr_type;
1276         cp.channel_map = hdev->le_adv_channel_map;
1277
1278         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1279
1280         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1281 }
1282
1283 static void service_cache_off(struct work_struct *work)
1284 {
1285         struct hci_dev *hdev = container_of(work, struct hci_dev,
1286                                             service_cache.work);
1287         struct hci_request req;
1288
1289         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1290                 return;
1291
1292         hci_req_init(&req, hdev);
1293
1294         hci_dev_lock(hdev);
1295
1296         update_eir(&req);
1297         update_class(&req);
1298
1299         hci_dev_unlock(hdev);
1300
1301         hci_req_run(&req, NULL);
1302 }
1303
1304 static void rpa_expired(struct work_struct *work)
1305 {
1306         struct hci_dev *hdev = container_of(work, struct hci_dev,
1307                                             rpa_expired.work);
1308         struct hci_request req;
1309
1310         BT_DBG("");
1311
1312         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1313
1314         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1315                 return;
1316
1317         /* The generation of a new RPA and programming it into the
1318          * controller happens in the enable_advertising() function.
1319          */
1320         hci_req_init(&req, hdev);
1321         enable_advertising(&req);
1322         hci_req_run(&req, NULL);
1323 }
1324
1325 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1326 {
1327         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1328                 return;
1329
1330         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1331         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1332
1333         /* Non-mgmt controlled devices get this bit set
1334          * implicitly so that pairing works for them, however
1335          * for mgmt we require user-space to explicitly enable
1336          * it
1337          */
1338         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1339 }
1340
1341 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1342                                 void *data, u16 data_len)
1343 {
1344         struct mgmt_rp_read_info rp;
1345
1346         BT_DBG("sock %p %s", sk, hdev->name);
1347
1348         hci_dev_lock(hdev);
1349
1350         memset(&rp, 0, sizeof(rp));
1351
1352         bacpy(&rp.bdaddr, &hdev->bdaddr);
1353
1354         rp.version = hdev->hci_ver;
1355         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1356
1357         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1358         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1359
1360         memcpy(rp.dev_class, hdev->dev_class, 3);
1361
1362         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1363         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1364
1365         hci_dev_unlock(hdev);
1366
1367         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1368                                  sizeof(rp));
1369 }
1370
1371 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1372 {
1373         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1374
1375         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1376                                  sizeof(settings));
1377 }
1378
1379 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1380 {
1381         BT_DBG("%s status 0x%02x", hdev->name, status);
1382
1383         if (hci_conn_count(hdev) == 0) {
1384                 cancel_delayed_work(&hdev->power_off);
1385                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1386         }
1387 }
1388
1389 static bool hci_stop_discovery(struct hci_request *req)
1390 {
1391         struct hci_dev *hdev = req->hdev;
1392         struct hci_cp_remote_name_req_cancel cp;
1393         struct inquiry_entry *e;
1394
1395         switch (hdev->discovery.state) {
1396         case DISCOVERY_FINDING:
1397                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1398                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1399
1400                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1401                         cancel_delayed_work(&hdev->le_scan_disable);
1402                         hci_req_add_le_scan_disable(req);
1403                 }
1404
1405                 return true;
1406
1407         case DISCOVERY_RESOLVING:
1408                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1409                                                      NAME_PENDING);
1410                 if (!e)
1411                         break;
1412
1413                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1414                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1415                             &cp);
1416
1417                 return true;
1418
1419         default:
1420                 /* Passive scanning */
1421                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1422                         hci_req_add_le_scan_disable(req);
1423                         return true;
1424                 }
1425
1426                 break;
1427         }
1428
1429         return false;
1430 }
1431
1432 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1433                               u8 instance)
1434 {
1435         struct mgmt_ev_advertising_added ev;
1436
1437         ev.instance = instance;
1438
1439         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1440 }
1441
1442 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1443                                 u8 instance)
1444 {
1445         struct mgmt_ev_advertising_removed ev;
1446
1447         ev.instance = instance;
1448
1449         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1450 }
1451
1452 static void clear_adv_instance(struct hci_dev *hdev)
1453 {
1454         struct hci_request req;
1455
1456         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1457                 return;
1458
1459         if (hdev->adv_instance.timeout)
1460                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1461
1462         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1463         advertising_removed(NULL, hdev, 1);
1464         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1465
1466         if (!hdev_is_powered(hdev) ||
1467             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1468                 return;
1469
1470         hci_req_init(&req, hdev);
1471         disable_advertising(&req);
1472         hci_req_run(&req, NULL);
1473 }
1474
1475 static int clean_up_hci_state(struct hci_dev *hdev)
1476 {
1477         struct hci_request req;
1478         struct hci_conn *conn;
1479         bool discov_stopped;
1480         int err;
1481
1482         hci_req_init(&req, hdev);
1483
1484         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1485             test_bit(HCI_PSCAN, &hdev->flags)) {
1486                 u8 scan = 0x00;
1487                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1488         }
1489
1490         if (hdev->adv_instance.timeout)
1491                 clear_adv_instance(hdev);
1492
1493         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1494                 disable_advertising(&req);
1495
1496         discov_stopped = hci_stop_discovery(&req);
1497
1498         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1499                 struct hci_cp_disconnect dc;
1500                 struct hci_cp_reject_conn_req rej;
1501
1502                 switch (conn->state) {
1503                 case BT_CONNECTED:
1504                 case BT_CONFIG:
1505                         dc.handle = cpu_to_le16(conn->handle);
1506                         dc.reason = 0x15; /* Terminated due to Power Off */
1507                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1508                         break;
1509                 case BT_CONNECT:
1510                         if (conn->type == LE_LINK)
1511                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1512                                             0, NULL);
1513                         else if (conn->type == ACL_LINK)
1514                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1515                                             6, &conn->dst);
1516                         break;
1517                 case BT_CONNECT2:
1518                         bacpy(&rej.bdaddr, &conn->dst);
1519                         rej.reason = 0x15; /* Terminated due to Power Off */
1520                         if (conn->type == ACL_LINK)
1521                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1522                                             sizeof(rej), &rej);
1523                         else if (conn->type == SCO_LINK)
1524                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1525                                             sizeof(rej), &rej);
1526                         break;
1527                 }
1528         }
1529
1530         err = hci_req_run(&req, clean_up_hci_complete);
1531         if (!err && discov_stopped)
1532                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1533
1534         return err;
1535 }
1536
1537 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1538                        u16 len)
1539 {
1540         struct mgmt_mode *cp = data;
1541         struct mgmt_pending_cmd *cmd;
1542         int err;
1543
1544         BT_DBG("request for %s", hdev->name);
1545
1546         if (cp->val != 0x00 && cp->val != 0x01)
1547                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1548                                        MGMT_STATUS_INVALID_PARAMS);
1549
1550         hci_dev_lock(hdev);
1551
1552         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1553                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1554                                       MGMT_STATUS_BUSY);
1555                 goto failed;
1556         }
1557
1558         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1559                 cancel_delayed_work(&hdev->power_off);
1560
1561                 if (cp->val) {
1562                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1563                                          data, len);
1564                         err = mgmt_powered(hdev, 1);
1565                         goto failed;
1566                 }
1567         }
1568
1569         if (!!cp->val == hdev_is_powered(hdev)) {
1570                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1571                 goto failed;
1572         }
1573
1574         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1575         if (!cmd) {
1576                 err = -ENOMEM;
1577                 goto failed;
1578         }
1579
1580         if (cp->val) {
1581                 queue_work(hdev->req_workqueue, &hdev->power_on);
1582                 err = 0;
1583         } else {
1584                 /* Disconnect connections, stop scans, etc */
1585                 err = clean_up_hci_state(hdev);
1586                 if (!err)
1587                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1588                                            HCI_POWER_OFF_TIMEOUT);
1589
1590                 /* ENODATA means there were no HCI commands queued */
1591                 if (err == -ENODATA) {
1592                         cancel_delayed_work(&hdev->power_off);
1593                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1594                         err = 0;
1595                 }
1596         }
1597
1598 failed:
1599         hci_dev_unlock(hdev);
1600         return err;
1601 }
1602
1603 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1604 {
1605         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1606
1607         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1608                                   sizeof(ev), skip);
1609 }
1610
1611 int mgmt_new_settings(struct hci_dev *hdev)
1612 {
1613         return new_settings(hdev, NULL);
1614 }
1615
1616 struct cmd_lookup {
1617         struct sock *sk;
1618         struct hci_dev *hdev;
1619         u8 mgmt_status;
1620 };
1621
1622 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1623 {
1624         struct cmd_lookup *match = data;
1625
1626         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1627
1628         list_del(&cmd->list);
1629
1630         if (match->sk == NULL) {
1631                 match->sk = cmd->sk;
1632                 sock_hold(match->sk);
1633         }
1634
1635         mgmt_pending_free(cmd);
1636 }
1637
1638 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1639 {
1640         u8 *status = data;
1641
1642         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1643         mgmt_pending_remove(cmd);
1644 }
1645
1646 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1647 {
1648         if (cmd->cmd_complete) {
1649                 u8 *status = data;
1650
1651                 cmd->cmd_complete(cmd, *status);
1652                 mgmt_pending_remove(cmd);
1653
1654                 return;
1655         }
1656
1657         cmd_status_rsp(cmd, data);
1658 }
1659
1660 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1661 {
1662         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1663                                  cmd->param, cmd->param_len);
1664 }
1665
1666 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1667 {
1668         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1669                                  cmd->param, sizeof(struct mgmt_addr_info));
1670 }
1671
1672 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1673 {
1674         if (!lmp_bredr_capable(hdev))
1675                 return MGMT_STATUS_NOT_SUPPORTED;
1676         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1677                 return MGMT_STATUS_REJECTED;
1678         else
1679                 return MGMT_STATUS_SUCCESS;
1680 }
1681
1682 static u8 mgmt_le_support(struct hci_dev *hdev)
1683 {
1684         if (!lmp_le_capable(hdev))
1685                 return MGMT_STATUS_NOT_SUPPORTED;
1686         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1687                 return MGMT_STATUS_REJECTED;
1688         else
1689                 return MGMT_STATUS_SUCCESS;
1690 }
1691
1692 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1693                                       u16 opcode)
1694 {
1695         struct mgmt_pending_cmd *cmd;
1696         struct mgmt_mode *cp;
1697         struct hci_request req;
1698         bool changed;
1699
1700         BT_DBG("status 0x%02x", status);
1701
1702         hci_dev_lock(hdev);
1703
1704         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1705         if (!cmd)
1706                 goto unlock;
1707
1708         if (status) {
1709                 u8 mgmt_err = mgmt_status(status);
1710                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1711                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1712                 goto remove_cmd;
1713         }
1714
1715         cp = cmd->param;
1716         if (cp->val) {
1717                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1718
1719                 if (hdev->discov_timeout > 0) {
1720                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1721                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1722                                            to);
1723                 }
1724         } else {
1725                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1726         }
1727
1728         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1729
1730         if (changed)
1731                 new_settings(hdev, cmd->sk);
1732
1733         /* When the discoverable mode gets changed, make sure
1734          * that class of device has the limited discoverable
1735          * bit correctly set. Also update page scan based on whitelist
1736          * entries.
1737          */
1738         hci_req_init(&req, hdev);
1739         __hci_update_page_scan(&req);
1740         update_class(&req);
1741         hci_req_run(&req, NULL);
1742
1743 remove_cmd:
1744         mgmt_pending_remove(cmd);
1745
1746 unlock:
1747         hci_dev_unlock(hdev);
1748 }
1749
1750 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1751                             u16 len)
1752 {
1753         struct mgmt_cp_set_discoverable *cp = data;
1754         struct mgmt_pending_cmd *cmd;
1755         struct hci_request req;
1756         u16 timeout;
1757         u8 scan;
1758         int err;
1759
1760         BT_DBG("request for %s", hdev->name);
1761
1762         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1763             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1764                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1765                                        MGMT_STATUS_REJECTED);
1766
1767         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1769                                        MGMT_STATUS_INVALID_PARAMS);
1770
1771         timeout = __le16_to_cpu(cp->timeout);
1772
1773         /* Disabling discoverable requires that no timeout is set,
1774          * and enabling limited discoverable requires a timeout.
1775          */
1776         if ((cp->val == 0x00 && timeout > 0) ||
1777             (cp->val == 0x02 && timeout == 0))
1778                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1779                                        MGMT_STATUS_INVALID_PARAMS);
1780
1781         hci_dev_lock(hdev);
1782
1783         if (!hdev_is_powered(hdev) && timeout > 0) {
1784                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1785                                       MGMT_STATUS_NOT_POWERED);
1786                 goto failed;
1787         }
1788
1789         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1790             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1791                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1792                                       MGMT_STATUS_BUSY);
1793                 goto failed;
1794         }
1795
1796         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1797                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1798                                       MGMT_STATUS_REJECTED);
1799                 goto failed;
1800         }
1801
1802         if (!hdev_is_powered(hdev)) {
1803                 bool changed = false;
1804
1805                 /* Setting limited discoverable when powered off is
1806                  * not a valid operation since it requires a timeout
1807                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1808                  */
1809                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1810                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1811                         changed = true;
1812                 }
1813
1814                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1815                 if (err < 0)
1816                         goto failed;
1817
1818                 if (changed)
1819                         err = new_settings(hdev, sk);
1820
1821                 goto failed;
1822         }
1823
1824         /* If the current mode is the same, then just update the timeout
1825          * value with the new value. And if only the timeout gets updated,
1826          * then no need for any HCI transactions.
1827          */
1828         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1829             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1830                                                    HCI_LIMITED_DISCOVERABLE)) {
1831                 cancel_delayed_work(&hdev->discov_off);
1832                 hdev->discov_timeout = timeout;
1833
1834                 if (cp->val && hdev->discov_timeout > 0) {
1835                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1836                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1837                                            to);
1838                 }
1839
1840                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1841                 goto failed;
1842         }
1843
1844         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1845         if (!cmd) {
1846                 err = -ENOMEM;
1847                 goto failed;
1848         }
1849
1850         /* Cancel any potential discoverable timeout that might be
1851          * still active and store new timeout value. The arming of
1852          * the timeout happens in the complete handler.
1853          */
1854         cancel_delayed_work(&hdev->discov_off);
1855         hdev->discov_timeout = timeout;
1856
1857         /* Limited discoverable mode */
1858         if (cp->val == 0x02)
1859                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1860         else
1861                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1862
1863         hci_req_init(&req, hdev);
1864
1865         /* The procedure for LE-only controllers is much simpler - just
1866          * update the advertising data.
1867          */
1868         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1869                 goto update_ad;
1870
1871         scan = SCAN_PAGE;
1872
1873         if (cp->val) {
1874                 struct hci_cp_write_current_iac_lap hci_cp;
1875
1876                 if (cp->val == 0x02) {
1877                         /* Limited discoverable mode */
1878                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1879                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1880                         hci_cp.iac_lap[1] = 0x8b;
1881                         hci_cp.iac_lap[2] = 0x9e;
1882                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1883                         hci_cp.iac_lap[4] = 0x8b;
1884                         hci_cp.iac_lap[5] = 0x9e;
1885                 } else {
1886                         /* General discoverable mode */
1887                         hci_cp.num_iac = 1;
1888                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1889                         hci_cp.iac_lap[1] = 0x8b;
1890                         hci_cp.iac_lap[2] = 0x9e;
1891                 }
1892
1893                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1894                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1895
1896                 scan |= SCAN_INQUIRY;
1897         } else {
1898                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1899         }
1900
1901         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1902
1903 update_ad:
1904         update_adv_data(&req);
1905
1906         err = hci_req_run(&req, set_discoverable_complete);
1907         if (err < 0)
1908                 mgmt_pending_remove(cmd);
1909
1910 failed:
1911         hci_dev_unlock(hdev);
1912         return err;
1913 }
1914
1915 static void write_fast_connectable(struct hci_request *req, bool enable)
1916 {
1917         struct hci_dev *hdev = req->hdev;
1918         struct hci_cp_write_page_scan_activity acp;
1919         u8 type;
1920
1921         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1922                 return;
1923
1924         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1925                 return;
1926
1927         if (enable) {
1928                 type = PAGE_SCAN_TYPE_INTERLACED;
1929
1930                 /* 160 msec page scan interval */
1931                 acp.interval = cpu_to_le16(0x0100);
1932         } else {
1933                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1934
1935                 /* default 1.28 sec page scan */
1936                 acp.interval = cpu_to_le16(0x0800);
1937         }
1938
1939         acp.window = cpu_to_le16(0x0012);
1940
1941         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1942             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1943                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1944                             sizeof(acp), &acp);
1945
1946         if (hdev->page_scan_type != type)
1947                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1948 }
1949
1950 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1951                                      u16 opcode)
1952 {
1953         struct mgmt_pending_cmd *cmd;
1954         struct mgmt_mode *cp;
1955         bool conn_changed, discov_changed;
1956
1957         BT_DBG("status 0x%02x", status);
1958
1959         hci_dev_lock(hdev);
1960
1961         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1962         if (!cmd)
1963                 goto unlock;
1964
1965         if (status) {
1966                 u8 mgmt_err = mgmt_status(status);
1967                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1968                 goto remove_cmd;
1969         }
1970
1971         cp = cmd->param;
1972         if (cp->val) {
1973                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1974                                                           HCI_CONNECTABLE);
1975                 discov_changed = false;
1976         } else {
1977                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1978                                                            HCI_CONNECTABLE);
1979                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1980                                                              HCI_DISCOVERABLE);
1981         }
1982
1983         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1984
1985         if (conn_changed || discov_changed) {
1986                 new_settings(hdev, cmd->sk);
1987                 hci_update_page_scan(hdev);
1988                 if (discov_changed)
1989                         mgmt_update_adv_data(hdev);
1990                 hci_update_background_scan(hdev);
1991         }
1992
1993 remove_cmd:
1994         mgmt_pending_remove(cmd);
1995
1996 unlock:
1997         hci_dev_unlock(hdev);
1998 }
1999
2000 static int set_connectable_update_settings(struct hci_dev *hdev,
2001                                            struct sock *sk, u8 val)
2002 {
2003         bool changed = false;
2004         int err;
2005
2006         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
2007                 changed = true;
2008
2009         if (val) {
2010                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
2011         } else {
2012                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2013                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2014         }
2015
2016         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2017         if (err < 0)
2018                 return err;
2019
2020         if (changed) {
2021                 hci_update_page_scan(hdev);
2022                 hci_update_background_scan(hdev);
2023                 return new_settings(hdev, sk);
2024         }
2025
2026         return 0;
2027 }
2028
2029 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2030                            u16 len)
2031 {
2032         struct mgmt_mode *cp = data;
2033         struct mgmt_pending_cmd *cmd;
2034         struct hci_request req;
2035         u8 scan;
2036         int err;
2037
2038         BT_DBG("request for %s", hdev->name);
2039
2040         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2041             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2042                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2043                                        MGMT_STATUS_REJECTED);
2044
2045         if (cp->val != 0x00 && cp->val != 0x01)
2046                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2047                                        MGMT_STATUS_INVALID_PARAMS);
2048
2049         hci_dev_lock(hdev);
2050
2051         if (!hdev_is_powered(hdev)) {
2052                 err = set_connectable_update_settings(hdev, sk, cp->val);
2053                 goto failed;
2054         }
2055
2056         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2057             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2058                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2059                                       MGMT_STATUS_BUSY);
2060                 goto failed;
2061         }
2062
2063         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2064         if (!cmd) {
2065                 err = -ENOMEM;
2066                 goto failed;
2067         }
2068
2069         hci_req_init(&req, hdev);
2070
2071         /* If BR/EDR is not enabled and we disable advertising as a
2072          * by-product of disabling connectable, we need to update the
2073          * advertising flags.
2074          */
2075         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2076                 if (!cp->val) {
2077                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2078                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2079                 }
2080                 update_adv_data(&req);
2081         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2082                 if (cp->val) {
2083                         scan = SCAN_PAGE;
2084                 } else {
2085                         /* If we don't have any whitelist entries just
2086                          * disable all scanning. If there are entries
2087                          * and we had both page and inquiry scanning
2088                          * enabled then fall back to only page scanning.
2089                          * Otherwise no changes are needed.
2090                          */
2091                         if (list_empty(&hdev->whitelist))
2092                                 scan = SCAN_DISABLED;
2093                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2094                                 scan = SCAN_PAGE;
2095                         else
2096                                 goto no_scan_update;
2097
2098                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2099                             hdev->discov_timeout > 0)
2100                                 cancel_delayed_work(&hdev->discov_off);
2101                 }
2102
2103                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2104         }
2105
2106 no_scan_update:
2107         /* Update the advertising parameters if necessary */
2108         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2109                 enable_advertising(&req);
2110
2111         err = hci_req_run(&req, set_connectable_complete);
2112         if (err < 0) {
2113                 mgmt_pending_remove(cmd);
2114                 if (err == -ENODATA)
2115                         err = set_connectable_update_settings(hdev, sk,
2116                                                               cp->val);
2117                 goto failed;
2118         }
2119
2120 failed:
2121         hci_dev_unlock(hdev);
2122         return err;
2123 }
2124
2125 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2126                         u16 len)
2127 {
2128         struct mgmt_mode *cp = data;
2129         bool changed;
2130         int err;
2131
2132         BT_DBG("request for %s", hdev->name);
2133
2134         if (cp->val != 0x00 && cp->val != 0x01)
2135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2136                                        MGMT_STATUS_INVALID_PARAMS);
2137
2138         hci_dev_lock(hdev);
2139
2140         if (cp->val)
2141                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2142         else
2143                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2144
2145         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2146         if (err < 0)
2147                 goto unlock;
2148
2149         if (changed)
2150                 err = new_settings(hdev, sk);
2151
2152 unlock:
2153         hci_dev_unlock(hdev);
2154         return err;
2155 }
2156
2157 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2158                              u16 len)
2159 {
2160         struct mgmt_mode *cp = data;
2161         struct mgmt_pending_cmd *cmd;
2162         u8 val, status;
2163         int err;
2164
2165         BT_DBG("request for %s", hdev->name);
2166
2167         status = mgmt_bredr_support(hdev);
2168         if (status)
2169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2170                                        status);
2171
2172         if (cp->val != 0x00 && cp->val != 0x01)
2173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2174                                        MGMT_STATUS_INVALID_PARAMS);
2175
2176         hci_dev_lock(hdev);
2177
2178         if (!hdev_is_powered(hdev)) {
2179                 bool changed = false;
2180
2181                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2182                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2183                         changed = true;
2184                 }
2185
2186                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2187                 if (err < 0)
2188                         goto failed;
2189
2190                 if (changed)
2191                         err = new_settings(hdev, sk);
2192
2193                 goto failed;
2194         }
2195
2196         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2197                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2198                                       MGMT_STATUS_BUSY);
2199                 goto failed;
2200         }
2201
2202         val = !!cp->val;
2203
2204         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2205                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2206                 goto failed;
2207         }
2208
2209         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2210         if (!cmd) {
2211                 err = -ENOMEM;
2212                 goto failed;
2213         }
2214
2215         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2216         if (err < 0) {
2217                 mgmt_pending_remove(cmd);
2218                 goto failed;
2219         }
2220
2221 failed:
2222         hci_dev_unlock(hdev);
2223         return err;
2224 }
2225
2226 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2227 {
2228         struct mgmt_mode *cp = data;
2229         struct mgmt_pending_cmd *cmd;
2230         u8 status;
2231         int err;
2232
2233         BT_DBG("request for %s", hdev->name);
2234
2235         status = mgmt_bredr_support(hdev);
2236         if (status)
2237                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2238
2239         if (!lmp_ssp_capable(hdev))
2240                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2241                                        MGMT_STATUS_NOT_SUPPORTED);
2242
2243         if (cp->val != 0x00 && cp->val != 0x01)
2244                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2245                                        MGMT_STATUS_INVALID_PARAMS);
2246
2247         hci_dev_lock(hdev);
2248
2249         if (!hdev_is_powered(hdev)) {
2250                 bool changed;
2251
2252                 if (cp->val) {
2253                         changed = !hci_dev_test_and_set_flag(hdev,
2254                                                              HCI_SSP_ENABLED);
2255                 } else {
2256                         changed = hci_dev_test_and_clear_flag(hdev,
2257                                                               HCI_SSP_ENABLED);
2258                         if (!changed)
2259                                 changed = hci_dev_test_and_clear_flag(hdev,
2260                                                                       HCI_HS_ENABLED);
2261                         else
2262                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2263                 }
2264
2265                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2266                 if (err < 0)
2267                         goto failed;
2268
2269                 if (changed)
2270                         err = new_settings(hdev, sk);
2271
2272                 goto failed;
2273         }
2274
2275         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2276                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2277                                       MGMT_STATUS_BUSY);
2278                 goto failed;
2279         }
2280
2281         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2282                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2283                 goto failed;
2284         }
2285
2286         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2287         if (!cmd) {
2288                 err = -ENOMEM;
2289                 goto failed;
2290         }
2291
2292         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2293                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2294                              sizeof(cp->val), &cp->val);
2295
2296         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2297         if (err < 0) {
2298                 mgmt_pending_remove(cmd);
2299                 goto failed;
2300         }
2301
2302 failed:
2303         hci_dev_unlock(hdev);
2304         return err;
2305 }
2306
2307 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2308 {
2309         struct mgmt_mode *cp = data;
2310         bool changed;
2311         u8 status;
2312         int err;
2313
2314         BT_DBG("request for %s", hdev->name);
2315
2316         status = mgmt_bredr_support(hdev);
2317         if (status)
2318                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2319
2320         if (!lmp_ssp_capable(hdev))
2321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2322                                        MGMT_STATUS_NOT_SUPPORTED);
2323
2324         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2325                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2326                                        MGMT_STATUS_REJECTED);
2327
2328         if (cp->val != 0x00 && cp->val != 0x01)
2329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2330                                        MGMT_STATUS_INVALID_PARAMS);
2331
2332         hci_dev_lock(hdev);
2333
2334         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2335                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2336                                       MGMT_STATUS_BUSY);
2337                 goto unlock;
2338         }
2339
2340         if (cp->val) {
2341                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2342         } else {
2343                 if (hdev_is_powered(hdev)) {
2344                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2345                                               MGMT_STATUS_REJECTED);
2346                         goto unlock;
2347                 }
2348
2349                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2350         }
2351
2352         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2353         if (err < 0)
2354                 goto unlock;
2355
2356         if (changed)
2357                 err = new_settings(hdev, sk);
2358
2359 unlock:
2360         hci_dev_unlock(hdev);
2361         return err;
2362 }
2363
2364 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2365 {
2366         struct cmd_lookup match = { NULL, hdev };
2367
2368         hci_dev_lock(hdev);
2369
2370         if (status) {
2371                 u8 mgmt_err = mgmt_status(status);
2372
2373                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2374                                      &mgmt_err);
2375                 goto unlock;
2376         }
2377
2378         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2379
2380         new_settings(hdev, match.sk);
2381
2382         if (match.sk)
2383                 sock_put(match.sk);
2384
2385         /* Make sure the controller has a good default for
2386          * advertising data. Restrict the update to when LE
2387          * has actually been enabled. During power on, the
2388          * update in powered_update_hci will take care of it.
2389          */
2390         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2391                 struct hci_request req;
2392
2393                 hci_req_init(&req, hdev);
2394                 update_adv_data(&req);
2395                 update_scan_rsp_data(&req);
2396                 __hci_update_background_scan(&req);
2397                 hci_req_run(&req, NULL);
2398         }
2399
2400 unlock:
2401         hci_dev_unlock(hdev);
2402 }
2403
2404 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2405 {
2406         struct mgmt_mode *cp = data;
2407         struct hci_cp_write_le_host_supported hci_cp;
2408         struct mgmt_pending_cmd *cmd;
2409         struct hci_request req;
2410         int err;
2411         u8 val, enabled;
2412
2413         BT_DBG("request for %s", hdev->name);
2414
2415         if (!lmp_le_capable(hdev))
2416                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2417                                        MGMT_STATUS_NOT_SUPPORTED);
2418
2419         if (cp->val != 0x00 && cp->val != 0x01)
2420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2421                                        MGMT_STATUS_INVALID_PARAMS);
2422
2423         /* Bluetooth single mode LE only controllers or dual-mode
2424          * controllers configured as LE only devices, do not allow
2425          * switching LE off. These have either LE enabled explicitly
2426          * or BR/EDR has been previously switched off.
2427          *
2428          * When trying to enable an already enabled LE, then gracefully
2429          * send a positive response. Trying to disable it however will
2430          * result into rejection.
2431          */
2432         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2433                 if (cp->val == 0x01)
2434                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2435
2436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2437                                        MGMT_STATUS_REJECTED);
2438         }
2439
2440         hci_dev_lock(hdev);
2441
2442         val = !!cp->val;
2443         enabled = lmp_host_le_capable(hdev);
2444
2445         if (!hdev_is_powered(hdev) || val == enabled) {
2446                 bool changed = false;
2447
2448                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2449                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2450                         changed = true;
2451                 }
2452
2453                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2454                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2455                         changed = true;
2456                 }
2457
2458                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2459                 if (err < 0)
2460                         goto unlock;
2461
2462                 if (changed)
2463                         err = new_settings(hdev, sk);
2464
2465                 goto unlock;
2466         }
2467
2468         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2469             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2470                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2471                                       MGMT_STATUS_BUSY);
2472                 goto unlock;
2473         }
2474
2475         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2476         if (!cmd) {
2477                 err = -ENOMEM;
2478                 goto unlock;
2479         }
2480
2481         hci_req_init(&req, hdev);
2482
2483         memset(&hci_cp, 0, sizeof(hci_cp));
2484
2485         if (val) {
2486                 hci_cp.le = val;
2487                 hci_cp.simul = 0x00;
2488         } else {
2489                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2490                         disable_advertising(&req);
2491         }
2492
2493         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2494                     &hci_cp);
2495
2496         err = hci_req_run(&req, le_enable_complete);
2497         if (err < 0)
2498                 mgmt_pending_remove(cmd);
2499
2500 unlock:
2501         hci_dev_unlock(hdev);
2502         return err;
2503 }
2504
2505 /* This is a helper function to test for pending mgmt commands that can
2506  * cause CoD or EIR HCI commands. We can only allow one such pending
2507  * mgmt command at a time since otherwise we cannot easily track what
2508  * the current values are, will be, and based on that calculate if a new
2509  * HCI command needs to be sent and if yes with what value.
2510  */
2511 static bool pending_eir_or_class(struct hci_dev *hdev)
2512 {
2513         struct mgmt_pending_cmd *cmd;
2514
2515         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2516                 switch (cmd->opcode) {
2517                 case MGMT_OP_ADD_UUID:
2518                 case MGMT_OP_REMOVE_UUID:
2519                 case MGMT_OP_SET_DEV_CLASS:
2520                 case MGMT_OP_SET_POWERED:
2521                         return true;
2522                 }
2523         }
2524
2525         return false;
2526 }
2527
2528 static const u8 bluetooth_base_uuid[] = {
2529                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2530                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2531 };
2532
2533 static u8 get_uuid_size(const u8 *uuid)
2534 {
2535         u32 val;
2536
2537         if (memcmp(uuid, bluetooth_base_uuid, 12))
2538                 return 128;
2539
2540         val = get_unaligned_le32(&uuid[12]);
2541         if (val > 0xffff)
2542                 return 32;
2543
2544         return 16;
2545 }
2546
2547 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2548 {
2549         struct mgmt_pending_cmd *cmd;
2550
2551         hci_dev_lock(hdev);
2552
2553         cmd = pending_find(mgmt_op, hdev);
2554         if (!cmd)
2555                 goto unlock;
2556
2557         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2558                           mgmt_status(status), hdev->dev_class, 3);
2559
2560         mgmt_pending_remove(cmd);
2561
2562 unlock:
2563         hci_dev_unlock(hdev);
2564 }
2565
2566 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2567 {
2568         BT_DBG("status 0x%02x", status);
2569
2570         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2571 }
2572
2573 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2574 {
2575         struct mgmt_cp_add_uuid *cp = data;
2576         struct mgmt_pending_cmd *cmd;
2577         struct hci_request req;
2578         struct bt_uuid *uuid;
2579         int err;
2580
2581         BT_DBG("request for %s", hdev->name);
2582
2583         hci_dev_lock(hdev);
2584
2585         if (pending_eir_or_class(hdev)) {
2586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2587                                       MGMT_STATUS_BUSY);
2588                 goto failed;
2589         }
2590
2591         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2592         if (!uuid) {
2593                 err = -ENOMEM;
2594                 goto failed;
2595         }
2596
2597         memcpy(uuid->uuid, cp->uuid, 16);
2598         uuid->svc_hint = cp->svc_hint;
2599         uuid->size = get_uuid_size(cp->uuid);
2600
2601         list_add_tail(&uuid->list, &hdev->uuids);
2602
2603         hci_req_init(&req, hdev);
2604
2605         update_class(&req);
2606         update_eir(&req);
2607
2608         err = hci_req_run(&req, add_uuid_complete);
2609         if (err < 0) {
2610                 if (err != -ENODATA)
2611                         goto failed;
2612
2613                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2614                                         hdev->dev_class, 3);
2615                 goto failed;
2616         }
2617
2618         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2619         if (!cmd) {
2620                 err = -ENOMEM;
2621                 goto failed;
2622         }
2623
2624         err = 0;
2625
2626 failed:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static bool enable_service_cache(struct hci_dev *hdev)
2632 {
2633         if (!hdev_is_powered(hdev))
2634                 return false;
2635
2636         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2637                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2638                                    CACHE_TIMEOUT);
2639                 return true;
2640         }
2641
2642         return false;
2643 }
2644
2645 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2646 {
2647         BT_DBG("status 0x%02x", status);
2648
2649         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2650 }
2651
2652 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2653                        u16 len)
2654 {
2655         struct mgmt_cp_remove_uuid *cp = data;
2656         struct mgmt_pending_cmd *cmd;
2657         struct bt_uuid *match, *tmp;
2658         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2659         struct hci_request req;
2660         int err, found;
2661
2662         BT_DBG("request for %s", hdev->name);
2663
2664         hci_dev_lock(hdev);
2665
2666         if (pending_eir_or_class(hdev)) {
2667                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2668                                       MGMT_STATUS_BUSY);
2669                 goto unlock;
2670         }
2671
2672         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2673                 hci_uuids_clear(hdev);
2674
2675                 if (enable_service_cache(hdev)) {
2676                         err = mgmt_cmd_complete(sk, hdev->id,
2677                                                 MGMT_OP_REMOVE_UUID,
2678                                                 0, hdev->dev_class, 3);
2679                         goto unlock;
2680                 }
2681
2682                 goto update_class;
2683         }
2684
2685         found = 0;
2686
2687         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2688                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2689                         continue;
2690
2691                 list_del(&match->list);
2692                 kfree(match);
2693                 found++;
2694         }
2695
2696         if (found == 0) {
2697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2698                                       MGMT_STATUS_INVALID_PARAMS);
2699                 goto unlock;
2700         }
2701
2702 update_class:
2703         hci_req_init(&req, hdev);
2704
2705         update_class(&req);
2706         update_eir(&req);
2707
2708         err = hci_req_run(&req, remove_uuid_complete);
2709         if (err < 0) {
2710                 if (err != -ENODATA)
2711                         goto unlock;
2712
2713                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2714                                         hdev->dev_class, 3);
2715                 goto unlock;
2716         }
2717
2718         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2719         if (!cmd) {
2720                 err = -ENOMEM;
2721                 goto unlock;
2722         }
2723
2724         err = 0;
2725
2726 unlock:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2732 {
2733         BT_DBG("status 0x%02x", status);
2734
2735         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2736 }
2737
2738 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2739                          u16 len)
2740 {
2741         struct mgmt_cp_set_dev_class *cp = data;
2742         struct mgmt_pending_cmd *cmd;
2743         struct hci_request req;
2744         int err;
2745
2746         BT_DBG("request for %s", hdev->name);
2747
2748         if (!lmp_bredr_capable(hdev))
2749                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2750                                        MGMT_STATUS_NOT_SUPPORTED);
2751
2752         hci_dev_lock(hdev);
2753
2754         if (pending_eir_or_class(hdev)) {
2755                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2756                                       MGMT_STATUS_BUSY);
2757                 goto unlock;
2758         }
2759
2760         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2761                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2762                                       MGMT_STATUS_INVALID_PARAMS);
2763                 goto unlock;
2764         }
2765
2766         hdev->major_class = cp->major;
2767         hdev->minor_class = cp->minor;
2768
2769         if (!hdev_is_powered(hdev)) {
2770                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2771                                         hdev->dev_class, 3);
2772                 goto unlock;
2773         }
2774
2775         hci_req_init(&req, hdev);
2776
2777         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2778                 hci_dev_unlock(hdev);
2779                 cancel_delayed_work_sync(&hdev->service_cache);
2780                 hci_dev_lock(hdev);
2781                 update_eir(&req);
2782         }
2783
2784         update_class(&req);
2785
2786         err = hci_req_run(&req, set_class_complete);
2787         if (err < 0) {
2788                 if (err != -ENODATA)
2789                         goto unlock;
2790
2791                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2792                                         hdev->dev_class, 3);
2793                 goto unlock;
2794         }
2795
2796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2797         if (!cmd) {
2798                 err = -ENOMEM;
2799                 goto unlock;
2800         }
2801
2802         err = 0;
2803
2804 unlock:
2805         hci_dev_unlock(hdev);
2806         return err;
2807 }
2808
2809 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2810                           u16 len)
2811 {
2812         struct mgmt_cp_load_link_keys *cp = data;
2813         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2814                                    sizeof(struct mgmt_link_key_info));
2815         u16 key_count, expected_len;
2816         bool changed;
2817         int i;
2818
2819         BT_DBG("request for %s", hdev->name);
2820
2821         if (!lmp_bredr_capable(hdev))
2822                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2823                                        MGMT_STATUS_NOT_SUPPORTED);
2824
2825         key_count = __le16_to_cpu(cp->key_count);
2826         if (key_count > max_key_count) {
2827                 BT_ERR("load_link_keys: too big key_count value %u",
2828                        key_count);
2829                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2830                                        MGMT_STATUS_INVALID_PARAMS);
2831         }
2832
2833         expected_len = sizeof(*cp) + key_count *
2834                                         sizeof(struct mgmt_link_key_info);
2835         if (expected_len != len) {
2836                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2837                        expected_len, len);
2838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2839                                        MGMT_STATUS_INVALID_PARAMS);
2840         }
2841
2842         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2844                                        MGMT_STATUS_INVALID_PARAMS);
2845
2846         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2847                key_count);
2848
2849         for (i = 0; i < key_count; i++) {
2850                 struct mgmt_link_key_info *key = &cp->keys[i];
2851
2852                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2853                         return mgmt_cmd_status(sk, hdev->id,
2854                                                MGMT_OP_LOAD_LINK_KEYS,
2855                                                MGMT_STATUS_INVALID_PARAMS);
2856         }
2857
2858         hci_dev_lock(hdev);
2859
2860         hci_link_keys_clear(hdev);
2861
2862         if (cp->debug_keys)
2863                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2864         else
2865                 changed = hci_dev_test_and_clear_flag(hdev,
2866                                                       HCI_KEEP_DEBUG_KEYS);
2867
2868         if (changed)
2869                 new_settings(hdev, NULL);
2870
2871         for (i = 0; i < key_count; i++) {
2872                 struct mgmt_link_key_info *key = &cp->keys[i];
2873
2874                 /* Always ignore debug keys and require a new pairing if
2875                  * the user wants to use them.
2876                  */
2877                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2878                         continue;
2879
2880                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2881                                  key->type, key->pin_len, NULL);
2882         }
2883
2884         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2885
2886         hci_dev_unlock(hdev);
2887
2888         return 0;
2889 }
2890
2891 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2892                            u8 addr_type, struct sock *skip_sk)
2893 {
2894         struct mgmt_ev_device_unpaired ev;
2895
2896         bacpy(&ev.addr.bdaddr, bdaddr);
2897         ev.addr.type = addr_type;
2898
2899         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2900                           skip_sk);
2901 }
2902
2903 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2904                          u16 len)
2905 {
2906         struct mgmt_cp_unpair_device *cp = data;
2907         struct mgmt_rp_unpair_device rp;
2908         struct hci_cp_disconnect dc;
2909         struct mgmt_pending_cmd *cmd;
2910         struct hci_conn *conn;
2911         int err;
2912
2913         memset(&rp, 0, sizeof(rp));
2914         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2915         rp.addr.type = cp->addr.type;
2916
2917         if (!bdaddr_type_is_valid(cp->addr.type))
2918                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2919                                          MGMT_STATUS_INVALID_PARAMS,
2920                                          &rp, sizeof(rp));
2921
2922         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2923                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2924                                          MGMT_STATUS_INVALID_PARAMS,
2925                                          &rp, sizeof(rp));
2926
2927         hci_dev_lock(hdev);
2928
2929         if (!hdev_is_powered(hdev)) {
2930                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2931                                         MGMT_STATUS_NOT_POWERED, &rp,
2932                                         sizeof(rp));
2933                 goto unlock;
2934         }
2935
2936         if (cp->addr.type == BDADDR_BREDR) {
2937                 /* If disconnection is requested, then look up the
2938                  * connection. If the remote device is connected, it
2939                  * will be later used to terminate the link.
2940                  *
2941                  * Setting it to NULL explicitly will cause no
2942                  * termination of the link.
2943                  */
2944                 if (cp->disconnect)
2945                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2946                                                        &cp->addr.bdaddr);
2947                 else
2948                         conn = NULL;
2949
2950                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2951         } else {
2952                 u8 addr_type;
2953
2954                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2955                                                &cp->addr.bdaddr);
2956                 if (conn) {
2957                         /* Defer clearing up the connection parameters
2958                          * until closing to give a chance of keeping
2959                          * them if a repairing happens.
2960                          */
2961                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2962
2963                         /* If disconnection is not requested, then
2964                          * clear the connection variable so that the
2965                          * link is not terminated.
2966                          */
2967                         if (!cp->disconnect)
2968                                 conn = NULL;
2969                 }
2970
2971                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2972                         addr_type = ADDR_LE_DEV_PUBLIC;
2973                 else
2974                         addr_type = ADDR_LE_DEV_RANDOM;
2975
2976                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2977
2978                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2979         }
2980
2981         if (err < 0) {
2982                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2983                                         MGMT_STATUS_NOT_PAIRED, &rp,
2984                                         sizeof(rp));
2985                 goto unlock;
2986         }
2987
2988         /* If the connection variable is set, then termination of the
2989          * link is requested.
2990          */
2991         if (!conn) {
2992                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2993                                         &rp, sizeof(rp));
2994                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2995                 goto unlock;
2996         }
2997
2998         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2999                                sizeof(*cp));
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 goto unlock;
3003         }
3004
3005         cmd->cmd_complete = addr_cmd_complete;
3006
3007         dc.handle = cpu_to_le16(conn->handle);
3008         dc.reason = 0x13; /* Remote User Terminated Connection */
3009         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3010         if (err < 0)
3011                 mgmt_pending_remove(cmd);
3012
3013 unlock:
3014         hci_dev_unlock(hdev);
3015         return err;
3016 }
3017
3018 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3019                       u16 len)
3020 {
3021         struct mgmt_cp_disconnect *cp = data;
3022         struct mgmt_rp_disconnect rp;
3023         struct mgmt_pending_cmd *cmd;
3024         struct hci_conn *conn;
3025         int err;
3026
3027         BT_DBG("");
3028
3029         memset(&rp, 0, sizeof(rp));
3030         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3031         rp.addr.type = cp->addr.type;
3032
3033         if (!bdaddr_type_is_valid(cp->addr.type))
3034                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3035                                          MGMT_STATUS_INVALID_PARAMS,
3036                                          &rp, sizeof(rp));
3037
3038         hci_dev_lock(hdev);
3039
3040         if (!test_bit(HCI_UP, &hdev->flags)) {
3041                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3042                                         MGMT_STATUS_NOT_POWERED, &rp,
3043                                         sizeof(rp));
3044                 goto failed;
3045         }
3046
3047         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3048                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3049                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3050                 goto failed;
3051         }
3052
3053         if (cp->addr.type == BDADDR_BREDR)
3054                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3055                                                &cp->addr.bdaddr);
3056         else
3057                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
3058
3059         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3060                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3061                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3062                                         sizeof(rp));
3063                 goto failed;
3064         }
3065
3066         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3067         if (!cmd) {
3068                 err = -ENOMEM;
3069                 goto failed;
3070         }
3071
3072         cmd->cmd_complete = generic_cmd_complete;
3073
3074         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3075         if (err < 0)
3076                 mgmt_pending_remove(cmd);
3077
3078 failed:
3079         hci_dev_unlock(hdev);
3080         return err;
3081 }
3082
3083 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3084 {
3085         switch (link_type) {
3086         case LE_LINK:
3087                 switch (addr_type) {
3088                 case ADDR_LE_DEV_PUBLIC:
3089                         return BDADDR_LE_PUBLIC;
3090
3091                 default:
3092                         /* Fallback to LE Random address type */
3093                         return BDADDR_LE_RANDOM;
3094                 }
3095
3096         default:
3097                 /* Fallback to BR/EDR type */
3098                 return BDADDR_BREDR;
3099         }
3100 }
3101
3102 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3103                            u16 data_len)
3104 {
3105         struct mgmt_rp_get_connections *rp;
3106         struct hci_conn *c;
3107         size_t rp_len;
3108         int err;
3109         u16 i;
3110
3111         BT_DBG("");
3112
3113         hci_dev_lock(hdev);
3114
3115         if (!hdev_is_powered(hdev)) {
3116                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3117                                       MGMT_STATUS_NOT_POWERED);
3118                 goto unlock;
3119         }
3120
3121         i = 0;
3122         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3123                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3124                         i++;
3125         }
3126
3127         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3128         rp = kmalloc(rp_len, GFP_KERNEL);
3129         if (!rp) {
3130                 err = -ENOMEM;
3131                 goto unlock;
3132         }
3133
3134         i = 0;
3135         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3136                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3137                         continue;
3138                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3139                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3140                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3141                         continue;
3142                 i++;
3143         }
3144
3145         rp->conn_count = cpu_to_le16(i);
3146
3147         /* Recalculate length in case of filtered SCO connections, etc */
3148         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3149
3150         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3151                                 rp_len);
3152
3153         kfree(rp);
3154
3155 unlock:
3156         hci_dev_unlock(hdev);
3157         return err;
3158 }
3159
3160 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3161                                    struct mgmt_cp_pin_code_neg_reply *cp)
3162 {
3163         struct mgmt_pending_cmd *cmd;
3164         int err;
3165
3166         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3167                                sizeof(*cp));
3168         if (!cmd)
3169                 return -ENOMEM;
3170
3171         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3172                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3173         if (err < 0)
3174                 mgmt_pending_remove(cmd);
3175
3176         return err;
3177 }
3178
3179 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3180                           u16 len)
3181 {
3182         struct hci_conn *conn;
3183         struct mgmt_cp_pin_code_reply *cp = data;
3184         struct hci_cp_pin_code_reply reply;
3185         struct mgmt_pending_cmd *cmd;
3186         int err;
3187
3188         BT_DBG("");
3189
3190         hci_dev_lock(hdev);
3191
3192         if (!hdev_is_powered(hdev)) {
3193                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3194                                       MGMT_STATUS_NOT_POWERED);
3195                 goto failed;
3196         }
3197
3198         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3199         if (!conn) {
3200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3201                                       MGMT_STATUS_NOT_CONNECTED);
3202                 goto failed;
3203         }
3204
3205         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3206                 struct mgmt_cp_pin_code_neg_reply ncp;
3207
3208                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3209
3210                 BT_ERR("PIN code is not 16 bytes long");
3211
3212                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3213                 if (err >= 0)
3214                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3215                                               MGMT_STATUS_INVALID_PARAMS);
3216
3217                 goto failed;
3218         }
3219
3220         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3221         if (!cmd) {
3222                 err = -ENOMEM;
3223                 goto failed;
3224         }
3225
3226         cmd->cmd_complete = addr_cmd_complete;
3227
3228         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3229         reply.pin_len = cp->pin_len;
3230         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3231
3232         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3233         if (err < 0)
3234                 mgmt_pending_remove(cmd);
3235
3236 failed:
3237         hci_dev_unlock(hdev);
3238         return err;
3239 }
3240
3241 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3242                              u16 len)
3243 {
3244         struct mgmt_cp_set_io_capability *cp = data;
3245
3246         BT_DBG("");
3247
3248         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3249                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3250                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3251
3252         hci_dev_lock(hdev);
3253
3254         hdev->io_capability = cp->io_capability;
3255
3256         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3257                hdev->io_capability);
3258
3259         hci_dev_unlock(hdev);
3260
3261         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3262                                  NULL, 0);
3263 }
3264
3265 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3266 {
3267         struct hci_dev *hdev = conn->hdev;
3268         struct mgmt_pending_cmd *cmd;
3269
3270         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3271                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3272                         continue;
3273
3274                 if (cmd->user_data != conn)
3275                         continue;
3276
3277                 return cmd;
3278         }
3279
3280         return NULL;
3281 }
3282
3283 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3284 {
3285         struct mgmt_rp_pair_device rp;
3286         struct hci_conn *conn = cmd->user_data;
3287         int err;
3288
3289         bacpy(&rp.addr.bdaddr, &conn->dst);
3290         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3291
3292         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3293                                 status, &rp, sizeof(rp));
3294
3295         /* So we don't get further callbacks for this connection */
3296         conn->connect_cfm_cb = NULL;
3297         conn->security_cfm_cb = NULL;
3298         conn->disconn_cfm_cb = NULL;
3299
3300         hci_conn_drop(conn);
3301
3302         /* The device is paired so there is no need to remove
3303          * its connection parameters anymore.
3304          */
3305         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3306
3307         hci_conn_put(conn);
3308
3309         return err;
3310 }
3311
3312 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3313 {
3314         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3315         struct mgmt_pending_cmd *cmd;
3316
3317         cmd = find_pairing(conn);
3318         if (cmd) {
3319                 cmd->cmd_complete(cmd, status);
3320                 mgmt_pending_remove(cmd);
3321         }
3322 }
3323
3324 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3325 {
3326         struct mgmt_pending_cmd *cmd;
3327
3328         BT_DBG("status %u", status);
3329
3330         cmd = find_pairing(conn);
3331         if (!cmd) {
3332                 BT_DBG("Unable to find a pending command");
3333                 return;
3334         }
3335
3336         cmd->cmd_complete(cmd, mgmt_status(status));
3337         mgmt_pending_remove(cmd);
3338 }
3339
3340 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3341 {
3342         struct mgmt_pending_cmd *cmd;
3343
3344         BT_DBG("status %u", status);
3345
3346         if (!status)
3347                 return;
3348
3349         cmd = find_pairing(conn);
3350         if (!cmd) {
3351                 BT_DBG("Unable to find a pending command");
3352                 return;
3353         }
3354
3355         cmd->cmd_complete(cmd, mgmt_status(status));
3356         mgmt_pending_remove(cmd);
3357 }
3358
3359 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3360                        u16 len)
3361 {
3362         struct mgmt_cp_pair_device *cp = data;
3363         struct mgmt_rp_pair_device rp;
3364         struct mgmt_pending_cmd *cmd;
3365         u8 sec_level, auth_type;
3366         struct hci_conn *conn;
3367         int err;
3368
3369         BT_DBG("");
3370
3371         memset(&rp, 0, sizeof(rp));
3372         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3373         rp.addr.type = cp->addr.type;
3374
3375         if (!bdaddr_type_is_valid(cp->addr.type))
3376                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3377                                          MGMT_STATUS_INVALID_PARAMS,
3378                                          &rp, sizeof(rp));
3379
3380         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3381                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3382                                          MGMT_STATUS_INVALID_PARAMS,
3383                                          &rp, sizeof(rp));
3384
3385         hci_dev_lock(hdev);
3386
3387         if (!hdev_is_powered(hdev)) {
3388                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3389                                         MGMT_STATUS_NOT_POWERED, &rp,
3390                                         sizeof(rp));
3391                 goto unlock;
3392         }
3393
3394         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3395                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3396                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3397                                         sizeof(rp));
3398                 goto unlock;
3399         }
3400
3401         sec_level = BT_SECURITY_MEDIUM;
3402         auth_type = HCI_AT_DEDICATED_BONDING;
3403
3404         if (cp->addr.type == BDADDR_BREDR) {
3405                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3406                                        auth_type);
3407         } else {
3408                 u8 addr_type;
3409
3410                 /* Convert from L2CAP channel address type to HCI address type
3411                  */
3412                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3413                         addr_type = ADDR_LE_DEV_PUBLIC;
3414                 else
3415                         addr_type = ADDR_LE_DEV_RANDOM;
3416
3417                 /* When pairing a new device, it is expected to remember
3418                  * this device for future connections. Adding the connection
3419                  * parameter information ahead of time allows tracking
3420                  * of the slave preferred values and will speed up any
3421                  * further connection establishment.
3422                  *
3423                  * If connection parameters already exist, then they
3424                  * will be kept and this function does nothing.
3425                  */
3426                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3427
3428                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3429                                       sec_level, HCI_LE_CONN_TIMEOUT,
3430                                       HCI_ROLE_MASTER);
3431         }
3432
3433         if (IS_ERR(conn)) {
3434                 int status;
3435
3436                 if (PTR_ERR(conn) == -EBUSY)
3437                         status = MGMT_STATUS_BUSY;
3438                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3439                         status = MGMT_STATUS_NOT_SUPPORTED;
3440                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3441                         status = MGMT_STATUS_REJECTED;
3442                 else
3443                         status = MGMT_STATUS_CONNECT_FAILED;
3444
3445                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3446                                         status, &rp, sizeof(rp));
3447                 goto unlock;
3448         }
3449
3450         if (conn->connect_cfm_cb) {
3451                 hci_conn_drop(conn);
3452                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3453                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3454                 goto unlock;
3455         }
3456
3457         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3458         if (!cmd) {
3459                 err = -ENOMEM;
3460                 hci_conn_drop(conn);
3461                 goto unlock;
3462         }
3463
3464         cmd->cmd_complete = pairing_complete;
3465
3466         /* For LE, just connecting isn't a proof that the pairing finished */
3467         if (cp->addr.type == BDADDR_BREDR) {
3468                 conn->connect_cfm_cb = pairing_complete_cb;
3469                 conn->security_cfm_cb = pairing_complete_cb;
3470                 conn->disconn_cfm_cb = pairing_complete_cb;
3471         } else {
3472                 conn->connect_cfm_cb = le_pairing_complete_cb;
3473                 conn->security_cfm_cb = le_pairing_complete_cb;
3474                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3475         }
3476
3477         conn->io_capability = cp->io_cap;
3478         cmd->user_data = hci_conn_get(conn);
3479
3480         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3481             hci_conn_security(conn, sec_level, auth_type, true)) {
3482                 cmd->cmd_complete(cmd, 0);
3483                 mgmt_pending_remove(cmd);
3484         }
3485
3486         err = 0;
3487
3488 unlock:
3489         hci_dev_unlock(hdev);
3490         return err;
3491 }
3492
3493 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3494                               u16 len)
3495 {
3496         struct mgmt_addr_info *addr = data;
3497         struct mgmt_pending_cmd *cmd;
3498         struct hci_conn *conn;
3499         int err;
3500
3501         BT_DBG("");
3502
3503         hci_dev_lock(hdev);
3504
3505         if (!hdev_is_powered(hdev)) {
3506                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3507                                       MGMT_STATUS_NOT_POWERED);
3508                 goto unlock;
3509         }
3510
3511         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3512         if (!cmd) {
3513                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3514                                       MGMT_STATUS_INVALID_PARAMS);
3515                 goto unlock;
3516         }
3517
3518         conn = cmd->user_data;
3519
3520         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3521                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3522                                       MGMT_STATUS_INVALID_PARAMS);
3523                 goto unlock;
3524         }
3525
3526         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3527         mgmt_pending_remove(cmd);
3528
3529         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3530                                 addr, sizeof(*addr));
3531 unlock:
3532         hci_dev_unlock(hdev);
3533         return err;
3534 }
3535
3536 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3537                              struct mgmt_addr_info *addr, u16 mgmt_op,
3538                              u16 hci_op, __le32 passkey)
3539 {
3540         struct mgmt_pending_cmd *cmd;
3541         struct hci_conn *conn;
3542         int err;
3543
3544         hci_dev_lock(hdev);
3545
3546         if (!hdev_is_powered(hdev)) {
3547                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3548                                         MGMT_STATUS_NOT_POWERED, addr,
3549                                         sizeof(*addr));
3550                 goto done;
3551         }
3552
3553         if (addr->type == BDADDR_BREDR)
3554                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3555         else
3556                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3557
3558         if (!conn) {
3559                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3560                                         MGMT_STATUS_NOT_CONNECTED, addr,
3561                                         sizeof(*addr));
3562                 goto done;
3563         }
3564
3565         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3566                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3567                 if (!err)
3568                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3569                                                 MGMT_STATUS_SUCCESS, addr,
3570                                                 sizeof(*addr));
3571                 else
3572                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3573                                                 MGMT_STATUS_FAILED, addr,
3574                                                 sizeof(*addr));
3575
3576                 goto done;
3577         }
3578
3579         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3580         if (!cmd) {
3581                 err = -ENOMEM;
3582                 goto done;
3583         }
3584
3585         cmd->cmd_complete = addr_cmd_complete;
3586
3587         /* Continue with pairing via HCI */
3588         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3589                 struct hci_cp_user_passkey_reply cp;
3590
3591                 bacpy(&cp.bdaddr, &addr->bdaddr);
3592                 cp.passkey = passkey;
3593                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3594         } else
3595                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3596                                    &addr->bdaddr);
3597
3598         if (err < 0)
3599                 mgmt_pending_remove(cmd);
3600
3601 done:
3602         hci_dev_unlock(hdev);
3603         return err;
3604 }
3605
3606 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3607                               void *data, u16 len)
3608 {
3609         struct mgmt_cp_pin_code_neg_reply *cp = data;
3610
3611         BT_DBG("");
3612
3613         return user_pairing_resp(sk, hdev, &cp->addr,
3614                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3615                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3616 }
3617
3618 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3619                               u16 len)
3620 {
3621         struct mgmt_cp_user_confirm_reply *cp = data;
3622
3623         BT_DBG("");
3624
3625         if (len != sizeof(*cp))
3626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3627                                        MGMT_STATUS_INVALID_PARAMS);
3628
3629         return user_pairing_resp(sk, hdev, &cp->addr,
3630                                  MGMT_OP_USER_CONFIRM_REPLY,
3631                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3632 }
3633
3634 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3635                                   void *data, u16 len)
3636 {
3637         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3638
3639         BT_DBG("");
3640
3641         return user_pairing_resp(sk, hdev, &cp->addr,
3642                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3643                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3644 }
3645
3646 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3647                               u16 len)
3648 {
3649         struct mgmt_cp_user_passkey_reply *cp = data;
3650
3651         BT_DBG("");
3652
3653         return user_pairing_resp(sk, hdev, &cp->addr,
3654                                  MGMT_OP_USER_PASSKEY_REPLY,
3655                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3656 }
3657
3658 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3659                                   void *data, u16 len)
3660 {
3661         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3662
3663         BT_DBG("");
3664
3665         return user_pairing_resp(sk, hdev, &cp->addr,
3666                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3667                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3668 }
3669
3670 static void update_name(struct hci_request *req)
3671 {
3672         struct hci_dev *hdev = req->hdev;
3673         struct hci_cp_write_local_name cp;
3674
3675         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3676
3677         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3678 }
3679
3680 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3681 {
3682         struct mgmt_cp_set_local_name *cp;
3683         struct mgmt_pending_cmd *cmd;
3684
3685         BT_DBG("status 0x%02x", status);
3686
3687         hci_dev_lock(hdev);
3688
3689         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3690         if (!cmd)
3691                 goto unlock;
3692
3693         cp = cmd->param;
3694
3695         if (status)
3696                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3697                                 mgmt_status(status));
3698         else
3699                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3700                                   cp, sizeof(*cp));
3701
3702         mgmt_pending_remove(cmd);
3703
3704 unlock:
3705         hci_dev_unlock(hdev);
3706 }
3707
3708 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3709                           u16 len)
3710 {
3711         struct mgmt_cp_set_local_name *cp = data;
3712         struct mgmt_pending_cmd *cmd;
3713         struct hci_request req;
3714         int err;
3715
3716         BT_DBG("");
3717
3718         hci_dev_lock(hdev);
3719
3720         /* If the old values are the same as the new ones just return a
3721          * direct command complete event.
3722          */
3723         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3724             !memcmp(hdev->short_name, cp->short_name,
3725                     sizeof(hdev->short_name))) {
3726                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3727                                         data, len);
3728                 goto failed;
3729         }
3730
3731         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3732
3733         if (!hdev_is_powered(hdev)) {
3734                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3735
3736                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3737                                         data, len);
3738                 if (err < 0)
3739                         goto failed;
3740
3741                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3742                                          data, len, sk);
3743
3744                 goto failed;
3745         }
3746
3747         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3748         if (!cmd) {
3749                 err = -ENOMEM;
3750                 goto failed;
3751         }
3752
3753         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3754
3755         hci_req_init(&req, hdev);
3756
3757         if (lmp_bredr_capable(hdev)) {
3758                 update_name(&req);
3759                 update_eir(&req);
3760         }
3761
3762         /* The name is stored in the scan response data and so
3763          * no need to udpate the advertising data here.
3764          */
3765         if (lmp_le_capable(hdev))
3766                 update_scan_rsp_data(&req);
3767
3768         err = hci_req_run(&req, set_name_complete);
3769         if (err < 0)
3770                 mgmt_pending_remove(cmd);
3771
3772 failed:
3773         hci_dev_unlock(hdev);
3774         return err;
3775 }
3776
3777 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3778                                void *data, u16 data_len)
3779 {
3780         struct mgmt_pending_cmd *cmd;
3781         int err;
3782
3783         BT_DBG("%s", hdev->name);
3784
3785         hci_dev_lock(hdev);
3786
3787         if (!hdev_is_powered(hdev)) {
3788                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3789                                       MGMT_STATUS_NOT_POWERED);
3790                 goto unlock;
3791         }
3792
3793         if (!lmp_ssp_capable(hdev)) {
3794                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3795                                       MGMT_STATUS_NOT_SUPPORTED);
3796                 goto unlock;
3797         }
3798
3799         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3800                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3801                                       MGMT_STATUS_BUSY);
3802                 goto unlock;
3803         }
3804
3805         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3806         if (!cmd) {
3807                 err = -ENOMEM;
3808                 goto unlock;
3809         }
3810
3811         if (bredr_sc_enabled(hdev))
3812                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3813                                    0, NULL);
3814         else
3815                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3816
3817         if (err < 0)
3818                 mgmt_pending_remove(cmd);
3819
3820 unlock:
3821         hci_dev_unlock(hdev);
3822         return err;
3823 }
3824
3825 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3826                                void *data, u16 len)
3827 {
3828         struct mgmt_addr_info *addr = data;
3829         int err;
3830
3831         BT_DBG("%s ", hdev->name);
3832
3833         if (!bdaddr_type_is_valid(addr->type))
3834                 return mgmt_cmd_complete(sk, hdev->id,
3835                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3836                                          MGMT_STATUS_INVALID_PARAMS,
3837                                          addr, sizeof(*addr));
3838
3839         hci_dev_lock(hdev);
3840
3841         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3842                 struct mgmt_cp_add_remote_oob_data *cp = data;
3843                 u8 status;
3844
3845                 if (cp->addr.type != BDADDR_BREDR) {
3846                         err = mgmt_cmd_complete(sk, hdev->id,
3847                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3848                                                 MGMT_STATUS_INVALID_PARAMS,
3849                                                 &cp->addr, sizeof(cp->addr));
3850                         goto unlock;
3851                 }
3852
3853                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3854                                               cp->addr.type, cp->hash,
3855                                               cp->rand, NULL, NULL);
3856                 if (err < 0)
3857                         status = MGMT_STATUS_FAILED;
3858                 else
3859                         status = MGMT_STATUS_SUCCESS;
3860
3861                 err = mgmt_cmd_complete(sk, hdev->id,
3862                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3863                                         &cp->addr, sizeof(cp->addr));
3864         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3865                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3866                 u8 *rand192, *hash192, *rand256, *hash256;
3867                 u8 status;
3868
3869                 if (bdaddr_type_is_le(cp->addr.type)) {
3870                         /* Enforce zero-valued 192-bit parameters as
3871                          * long as legacy SMP OOB isn't implemented.
3872                          */
3873                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3874                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3875                                 err = mgmt_cmd_complete(sk, hdev->id,
3876                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3877                                                         MGMT_STATUS_INVALID_PARAMS,
3878                                                         addr, sizeof(*addr));
3879                                 goto unlock;
3880                         }
3881
3882                         rand192 = NULL;
3883                         hash192 = NULL;
3884                 } else {
3885                         /* In case one of the P-192 values is set to zero,
3886                          * then just disable OOB data for P-192.
3887                          */
3888                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3889                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3890                                 rand192 = NULL;
3891                                 hash192 = NULL;
3892                         } else {
3893                                 rand192 = cp->rand192;
3894                                 hash192 = cp->hash192;
3895                         }
3896                 }
3897
3898                 /* In case one of the P-256 values is set to zero, then just
3899                  * disable OOB data for P-256.
3900                  */
3901                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3902                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3903                         rand256 = NULL;
3904                         hash256 = NULL;
3905                 } else {
3906                         rand256 = cp->rand256;
3907                         hash256 = cp->hash256;
3908                 }
3909
3910                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3911                                               cp->addr.type, hash192, rand192,
3912                                               hash256, rand256);
3913                 if (err < 0)
3914                         status = MGMT_STATUS_FAILED;
3915                 else
3916                         status = MGMT_STATUS_SUCCESS;
3917
3918                 err = mgmt_cmd_complete(sk, hdev->id,
3919                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3920                                         status, &cp->addr, sizeof(cp->addr));
3921         } else {
3922                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3923                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3924                                       MGMT_STATUS_INVALID_PARAMS);
3925         }
3926
3927 unlock:
3928         hci_dev_unlock(hdev);
3929         return err;
3930 }
3931
3932 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3933                                   void *data, u16 len)
3934 {
3935         struct mgmt_cp_remove_remote_oob_data *cp = data;
3936         u8 status;
3937         int err;
3938
3939         BT_DBG("%s", hdev->name);
3940
3941         if (cp->addr.type != BDADDR_BREDR)
3942                 return mgmt_cmd_complete(sk, hdev->id,
3943                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3944                                          MGMT_STATUS_INVALID_PARAMS,
3945                                          &cp->addr, sizeof(cp->addr));
3946
3947         hci_dev_lock(hdev);
3948
3949         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3950                 hci_remote_oob_data_clear(hdev);
3951                 status = MGMT_STATUS_SUCCESS;
3952                 goto done;
3953         }
3954
3955         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3956         if (err < 0)
3957                 status = MGMT_STATUS_INVALID_PARAMS;
3958         else
3959                 status = MGMT_STATUS_SUCCESS;
3960
3961 done:
3962         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3963                                 status, &cp->addr, sizeof(cp->addr));
3964
3965         hci_dev_unlock(hdev);
3966         return err;
3967 }
3968
3969 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
3970 {
3971         struct hci_dev *hdev = req->hdev;
3972         struct hci_cp_inquiry cp;
3973         /* General inquiry access code (GIAC) */
3974         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3975
3976         *status = mgmt_bredr_support(hdev);
3977         if (*status)
3978                 return false;
3979
3980         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3981                 *status = MGMT_STATUS_BUSY;
3982                 return false;
3983         }
3984
3985         hci_inquiry_cache_flush(hdev);
3986
3987         memset(&cp, 0, sizeof(cp));
3988         memcpy(&cp.lap, lap, sizeof(cp.lap));
3989         cp.length = DISCOV_BREDR_INQUIRY_LEN;
3990
3991         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3992
3993         return true;
3994 }
3995
3996 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
3997 {
3998         struct hci_dev *hdev = req->hdev;
3999         struct hci_cp_le_set_scan_param param_cp;
4000         struct hci_cp_le_set_scan_enable enable_cp;
4001         u8 own_addr_type;
4002         int err;
4003
4004         *status = mgmt_le_support(hdev);
4005         if (*status)
4006                 return false;
4007
4008         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4009                 /* Don't let discovery abort an outgoing connection attempt
4010                  * that's using directed advertising.
4011                  */
4012                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4013                         *status = MGMT_STATUS_REJECTED;
4014                         return false;
4015                 }
4016
4017                 disable_advertising(req);
4018         }
4019
4020         /* If controller is scanning, it means the background scanning is
4021          * running. Thus, we should temporarily stop it in order to set the
4022          * discovery scanning parameters.
4023          */
4024         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4025                 hci_req_add_le_scan_disable(req);
4026
4027         /* All active scans will be done with either a resolvable private
4028          * address (when privacy feature has been enabled) or non-resolvable
4029          * private address.
4030          */
4031         err = hci_update_random_address(req, true, &own_addr_type);
4032         if (err < 0) {
4033                 *status = MGMT_STATUS_FAILED;
4034                 return false;
4035         }
4036
4037         memset(&param_cp, 0, sizeof(param_cp));
4038         param_cp.type = LE_SCAN_ACTIVE;
4039         param_cp.interval = cpu_to_le16(interval);
4040         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4041         param_cp.own_address_type = own_addr_type;
4042
4043         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4044                     &param_cp);
4045
4046         memset(&enable_cp, 0, sizeof(enable_cp));
4047         enable_cp.enable = LE_SCAN_ENABLE;
4048         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4049
4050         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4051                     &enable_cp);
4052
4053         return true;
4054 }
4055
4056 static bool trigger_discovery(struct hci_request *req, u8 *status)
4057 {
4058         struct hci_dev *hdev = req->hdev;
4059
4060         switch (hdev->discovery.type) {
4061         case DISCOV_TYPE_BREDR:
4062                 if (!trigger_bredr_inquiry(req, status))
4063                         return false;
4064                 break;
4065
4066         case DISCOV_TYPE_INTERLEAVED:
4067                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4068                              &hdev->quirks)) {
4069                         /* During simultaneous discovery, we double LE scan
4070                          * interval. We must leave some time for the controller
4071                          * to do BR/EDR inquiry.
4072                          */
4073                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4074                                              status))
4075                                 return false;
4076
4077                         if (!trigger_bredr_inquiry(req, status))
4078                                 return false;
4079
4080                         return true;
4081                 }
4082
4083                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4084                         *status = MGMT_STATUS_NOT_SUPPORTED;
4085                         return false;
4086                 }
4087                 /* fall through */
4088
4089         case DISCOV_TYPE_LE:
4090                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4091                         return false;
4092                 break;
4093
4094         default:
4095                 *status = MGMT_STATUS_INVALID_PARAMS;
4096                 return false;
4097         }
4098
4099         return true;
4100 }
4101
4102 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4103                                      u16 opcode)
4104 {
4105         struct mgmt_pending_cmd *cmd;
4106         unsigned long timeout;
4107
4108         BT_DBG("status %d", status);
4109
4110         hci_dev_lock(hdev);
4111
4112         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4113         if (!cmd)
4114                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4115
4116         if (cmd) {
4117                 cmd->cmd_complete(cmd, mgmt_status(status));
4118                 mgmt_pending_remove(cmd);
4119         }
4120
4121         if (status) {
4122                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4123                 goto unlock;
4124         }
4125
4126         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4127
4128         /* If the scan involves LE scan, pick proper timeout to schedule
4129          * hdev->le_scan_disable that will stop it.
4130          */
4131         switch (hdev->discovery.type) {
4132         case DISCOV_TYPE_LE:
4133                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4134                 break;
4135         case DISCOV_TYPE_INTERLEAVED:
4136                  /* When running simultaneous discovery, the LE scanning time
4137                  * should occupy the whole discovery time sine BR/EDR inquiry
4138                  * and LE scanning are scheduled by the controller.
4139                  *
4140                  * For interleaving discovery in comparison, BR/EDR inquiry
4141                  * and LE scanning are done sequentially with separate
4142                  * timeouts.
4143                  */
4144                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4145                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4146                 else
4147                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4148                 break;
4149         case DISCOV_TYPE_BREDR:
4150                 timeout = 0;
4151                 break;
4152         default:
4153                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4154                 timeout = 0;
4155                 break;
4156         }
4157
4158         if (timeout) {
4159                 /* When service discovery is used and the controller has
4160                  * a strict duplicate filter, it is important to remember
4161                  * the start and duration of the scan. This is required
4162                  * for restarting scanning during the discovery phase.
4163                  */
4164                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4165                              &hdev->quirks) &&
4166                     hdev->discovery.result_filtering) {
4167                         hdev->discovery.scan_start = jiffies;
4168                         hdev->discovery.scan_duration = timeout;
4169                 }
4170
4171                 queue_delayed_work(hdev->workqueue,
4172                                    &hdev->le_scan_disable, timeout);
4173         }
4174
4175 unlock:
4176         hci_dev_unlock(hdev);
4177 }
4178
4179 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4180                            void *data, u16 len)
4181 {
4182         struct mgmt_cp_start_discovery *cp = data;
4183         struct mgmt_pending_cmd *cmd;
4184         struct hci_request req;
4185         u8 status;
4186         int err;
4187
4188         BT_DBG("%s", hdev->name);
4189
4190         hci_dev_lock(hdev);
4191
4192         if (!hdev_is_powered(hdev)) {
4193                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4194                                         MGMT_STATUS_NOT_POWERED,
4195                                         &cp->type, sizeof(cp->type));
4196                 goto failed;
4197         }
4198
4199         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4200             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4201                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4202                                         MGMT_STATUS_BUSY, &cp->type,
4203                                         sizeof(cp->type));
4204                 goto failed;
4205         }
4206
4207         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4208         if (!cmd) {
4209                 err = -ENOMEM;
4210                 goto failed;
4211         }
4212
4213         cmd->cmd_complete = generic_cmd_complete;
4214
4215         /* Clear the discovery filter first to free any previously
4216          * allocated memory for the UUID list.
4217          */
4218         hci_discovery_filter_clear(hdev);
4219
4220         hdev->discovery.type = cp->type;
4221         hdev->discovery.report_invalid_rssi = false;
4222
4223         hci_req_init(&req, hdev);
4224
4225         if (!trigger_discovery(&req, &status)) {
4226                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4227                                         status, &cp->type, sizeof(cp->type));
4228                 mgmt_pending_remove(cmd);
4229                 goto failed;
4230         }
4231
4232         err = hci_req_run(&req, start_discovery_complete);
4233         if (err < 0) {
4234                 mgmt_pending_remove(cmd);
4235                 goto failed;
4236         }
4237
4238         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4239
4240 failed:
4241         hci_dev_unlock(hdev);
4242         return err;
4243 }
4244
4245 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4246                                           u8 status)
4247 {
4248         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4249                                  cmd->param, 1);
4250 }
4251
4252 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4253                                    void *data, u16 len)
4254 {
4255         struct mgmt_cp_start_service_discovery *cp = data;
4256         struct mgmt_pending_cmd *cmd;
4257         struct hci_request req;
4258         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4259         u16 uuid_count, expected_len;
4260         u8 status;
4261         int err;
4262
4263         BT_DBG("%s", hdev->name);
4264
4265         hci_dev_lock(hdev);
4266
4267         if (!hdev_is_powered(hdev)) {
4268                 err = mgmt_cmd_complete(sk, hdev->id,
4269                                         MGMT_OP_START_SERVICE_DISCOVERY,
4270                                         MGMT_STATUS_NOT_POWERED,
4271                                         &cp->type, sizeof(cp->type));
4272                 goto failed;
4273         }
4274
4275         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4276             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4277                 err = mgmt_cmd_complete(sk, hdev->id,
4278                                         MGMT_OP_START_SERVICE_DISCOVERY,
4279                                         MGMT_STATUS_BUSY, &cp->type,
4280                                         sizeof(cp->type));
4281                 goto failed;
4282         }
4283
4284         uuid_count = __le16_to_cpu(cp->uuid_count);
4285         if (uuid_count > max_uuid_count) {
4286                 BT_ERR("service_discovery: too big uuid_count value %u",
4287                        uuid_count);
4288                 err = mgmt_cmd_complete(sk, hdev->id,
4289                                         MGMT_OP_START_SERVICE_DISCOVERY,
4290                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4291                                         sizeof(cp->type));
4292                 goto failed;
4293         }
4294
4295         expected_len = sizeof(*cp) + uuid_count * 16;
4296         if (expected_len != len) {
4297                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4298                        expected_len, len);
4299                 err = mgmt_cmd_complete(sk, hdev->id,
4300                                         MGMT_OP_START_SERVICE_DISCOVERY,
4301                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4302                                         sizeof(cp->type));
4303                 goto failed;
4304         }
4305
4306         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4307                                hdev, data, len);
4308         if (!cmd) {
4309                 err = -ENOMEM;
4310                 goto failed;
4311         }
4312
4313         cmd->cmd_complete = service_discovery_cmd_complete;
4314
4315         /* Clear the discovery filter first to free any previously
4316          * allocated memory for the UUID list.
4317          */
4318         hci_discovery_filter_clear(hdev);
4319
4320         hdev->discovery.result_filtering = true;
4321         hdev->discovery.type = cp->type;
4322         hdev->discovery.rssi = cp->rssi;
4323         hdev->discovery.uuid_count = uuid_count;
4324
4325         if (uuid_count > 0) {
4326                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4327                                                 GFP_KERNEL);
4328                 if (!hdev->discovery.uuids) {
4329                         err = mgmt_cmd_complete(sk, hdev->id,
4330                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4331                                                 MGMT_STATUS_FAILED,
4332                                                 &cp->type, sizeof(cp->type));
4333                         mgmt_pending_remove(cmd);
4334                         goto failed;
4335                 }
4336         }
4337
4338         hci_req_init(&req, hdev);
4339
4340         if (!trigger_discovery(&req, &status)) {
4341                 err = mgmt_cmd_complete(sk, hdev->id,
4342                                         MGMT_OP_START_SERVICE_DISCOVERY,
4343                                         status, &cp->type, sizeof(cp->type));
4344                 mgmt_pending_remove(cmd);
4345                 goto failed;
4346         }
4347
4348         err = hci_req_run(&req, start_discovery_complete);
4349         if (err < 0) {
4350                 mgmt_pending_remove(cmd);
4351                 goto failed;
4352         }
4353
4354         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4355
4356 failed:
4357         hci_dev_unlock(hdev);
4358         return err;
4359 }
4360
4361 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4362 {
4363         struct mgmt_pending_cmd *cmd;
4364
4365         BT_DBG("status %d", status);
4366
4367         hci_dev_lock(hdev);
4368
4369         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4370         if (cmd) {
4371                 cmd->cmd_complete(cmd, mgmt_status(status));
4372                 mgmt_pending_remove(cmd);
4373         }
4374
4375         if (!status)
4376                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4377
4378         hci_dev_unlock(hdev);
4379 }
4380
4381 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4382                           u16 len)
4383 {
4384         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4385         struct mgmt_pending_cmd *cmd;
4386         struct hci_request req;
4387         int err;
4388
4389         BT_DBG("%s", hdev->name);
4390
4391         hci_dev_lock(hdev);
4392
4393         if (!hci_discovery_active(hdev)) {
4394                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4395                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4396                                         sizeof(mgmt_cp->type));
4397                 goto unlock;
4398         }
4399
4400         if (hdev->discovery.type != mgmt_cp->type) {
4401                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4402                                         MGMT_STATUS_INVALID_PARAMS,
4403                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4404                 goto unlock;
4405         }
4406
4407         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4408         if (!cmd) {
4409                 err = -ENOMEM;
4410                 goto unlock;
4411         }
4412
4413         cmd->cmd_complete = generic_cmd_complete;
4414
4415         hci_req_init(&req, hdev);
4416
4417         hci_stop_discovery(&req);
4418
4419         err = hci_req_run(&req, stop_discovery_complete);
4420         if (!err) {
4421                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4422                 goto unlock;
4423         }
4424
4425         mgmt_pending_remove(cmd);
4426
4427         /* If no HCI commands were sent we're done */
4428         if (err == -ENODATA) {
4429                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4430                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4431                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4432         }
4433
4434 unlock:
4435         hci_dev_unlock(hdev);
4436         return err;
4437 }
4438
4439 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4440                         u16 len)
4441 {
4442         struct mgmt_cp_confirm_name *cp = data;
4443         struct inquiry_entry *e;
4444         int err;
4445
4446         BT_DBG("%s", hdev->name);
4447
4448         hci_dev_lock(hdev);
4449
4450         if (!hci_discovery_active(hdev)) {
4451                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4452                                         MGMT_STATUS_FAILED, &cp->addr,
4453                                         sizeof(cp->addr));
4454                 goto failed;
4455         }
4456
4457         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4458         if (!e) {
4459                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4460                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4461                                         sizeof(cp->addr));
4462                 goto failed;
4463         }
4464
4465         if (cp->name_known) {
4466                 e->name_state = NAME_KNOWN;
4467                 list_del(&e->list);
4468         } else {
4469                 e->name_state = NAME_NEEDED;
4470                 hci_inquiry_cache_update_resolve(hdev, e);
4471         }
4472
4473         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4474                                 &cp->addr, sizeof(cp->addr));
4475
4476 failed:
4477         hci_dev_unlock(hdev);
4478         return err;
4479 }
4480
4481 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4482                         u16 len)
4483 {
4484         struct mgmt_cp_block_device *cp = data;
4485         u8 status;
4486         int err;
4487
4488         BT_DBG("%s", hdev->name);
4489
4490         if (!bdaddr_type_is_valid(cp->addr.type))
4491                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4492                                          MGMT_STATUS_INVALID_PARAMS,
4493                                          &cp->addr, sizeof(cp->addr));
4494
4495         hci_dev_lock(hdev);
4496
4497         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4498                                   cp->addr.type);
4499         if (err < 0) {
4500                 status = MGMT_STATUS_FAILED;
4501                 goto done;
4502         }
4503
4504         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4505                    sk);
4506         status = MGMT_STATUS_SUCCESS;
4507
4508 done:
4509         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4510                                 &cp->addr, sizeof(cp->addr));
4511
4512         hci_dev_unlock(hdev);
4513
4514         return err;
4515 }
4516
4517 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4518                           u16 len)
4519 {
4520         struct mgmt_cp_unblock_device *cp = data;
4521         u8 status;
4522         int err;
4523
4524         BT_DBG("%s", hdev->name);
4525
4526         if (!bdaddr_type_is_valid(cp->addr.type))
4527                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4528                                          MGMT_STATUS_INVALID_PARAMS,
4529                                          &cp->addr, sizeof(cp->addr));
4530
4531         hci_dev_lock(hdev);
4532
4533         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4534                                   cp->addr.type);
4535         if (err < 0) {
4536                 status = MGMT_STATUS_INVALID_PARAMS;
4537                 goto done;
4538         }
4539
4540         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4541                    sk);
4542         status = MGMT_STATUS_SUCCESS;
4543
4544 done:
4545         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4546                                 &cp->addr, sizeof(cp->addr));
4547
4548         hci_dev_unlock(hdev);
4549
4550         return err;
4551 }
4552
4553 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4554                          u16 len)
4555 {
4556         struct mgmt_cp_set_device_id *cp = data;
4557         struct hci_request req;
4558         int err;
4559         __u16 source;
4560
4561         BT_DBG("%s", hdev->name);
4562
4563         source = __le16_to_cpu(cp->source);
4564
4565         if (source > 0x0002)
4566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4567                                        MGMT_STATUS_INVALID_PARAMS);
4568
4569         hci_dev_lock(hdev);
4570
4571         hdev->devid_source = source;
4572         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4573         hdev->devid_product = __le16_to_cpu(cp->product);
4574         hdev->devid_version = __le16_to_cpu(cp->version);
4575
4576         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4577                                 NULL, 0);
4578
4579         hci_req_init(&req, hdev);
4580         update_eir(&req);
4581         hci_req_run(&req, NULL);
4582
4583         hci_dev_unlock(hdev);
4584
4585         return err;
4586 }
4587
4588 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4589                                         u16 opcode)
4590 {
4591         BT_DBG("status %d", status);
4592 }
4593
4594 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4595                                      u16 opcode)
4596 {
4597         struct cmd_lookup match = { NULL, hdev };
4598         struct hci_request req;
4599
4600         hci_dev_lock(hdev);
4601
4602         if (status) {
4603                 u8 mgmt_err = mgmt_status(status);
4604
4605                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4606                                      cmd_status_rsp, &mgmt_err);
4607                 goto unlock;
4608         }
4609
4610         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4611                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4612         else
4613                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4614
4615         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4616                              &match);
4617
4618         new_settings(hdev, match.sk);
4619
4620         if (match.sk)
4621                 sock_put(match.sk);
4622
4623         /* If "Set Advertising" was just disabled and instance advertising was
4624          * set up earlier, then enable the advertising instance.
4625          */
4626         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4627             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4628                 goto unlock;
4629
4630         hci_req_init(&req, hdev);
4631
4632         update_adv_data(&req);
4633         enable_advertising(&req);
4634
4635         if (hci_req_run(&req, enable_advertising_instance) < 0)
4636                 BT_ERR("Failed to re-configure advertising");
4637
4638 unlock:
4639         hci_dev_unlock(hdev);
4640 }
4641
4642 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4643                            u16 len)
4644 {
4645         struct mgmt_mode *cp = data;
4646         struct mgmt_pending_cmd *cmd;
4647         struct hci_request req;
4648         u8 val, status;
4649         int err;
4650
4651         BT_DBG("request for %s", hdev->name);
4652
4653         status = mgmt_le_support(hdev);
4654         if (status)
4655                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4656                                        status);
4657
4658         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4659                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4660                                        MGMT_STATUS_INVALID_PARAMS);
4661
4662         hci_dev_lock(hdev);
4663
4664         val = !!cp->val;
4665
4666         /* The following conditions are ones which mean that we should
4667          * not do any HCI communication but directly send a mgmt
4668          * response to user space (after toggling the flag if
4669          * necessary).
4670          */
4671         if (!hdev_is_powered(hdev) ||
4672             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4673              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4674             hci_conn_num(hdev, LE_LINK) > 0 ||
4675             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4676              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4677                 bool changed;
4678
4679                 if (cp->val) {
4680                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4681                         if (cp->val == 0x02)
4682                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4683                         else
4684                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4685                 } else {
4686                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4687                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4688                 }
4689
4690                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4691                 if (err < 0)
4692                         goto unlock;
4693
4694                 if (changed)
4695                         err = new_settings(hdev, sk);
4696
4697                 goto unlock;
4698         }
4699
4700         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4701             pending_find(MGMT_OP_SET_LE, hdev)) {
4702                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4703                                       MGMT_STATUS_BUSY);
4704                 goto unlock;
4705         }
4706
4707         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4708         if (!cmd) {
4709                 err = -ENOMEM;
4710                 goto unlock;
4711         }
4712
4713         hci_req_init(&req, hdev);
4714
4715         if (cp->val == 0x02)
4716                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4717         else
4718                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4719
4720         if (val) {
4721                 /* Switch to instance "0" for the Set Advertising setting. */
4722                 update_adv_data_for_instance(&req, 0);
4723                 update_scan_rsp_data_for_instance(&req, 0);
4724                 enable_advertising(&req);
4725         } else {
4726                 disable_advertising(&req);
4727         }
4728
4729         err = hci_req_run(&req, set_advertising_complete);
4730         if (err < 0)
4731                 mgmt_pending_remove(cmd);
4732
4733 unlock:
4734         hci_dev_unlock(hdev);
4735         return err;
4736 }
4737
4738 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4739                               void *data, u16 len)
4740 {
4741         struct mgmt_cp_set_static_address *cp = data;
4742         int err;
4743
4744         BT_DBG("%s", hdev->name);
4745
4746         if (!lmp_le_capable(hdev))
4747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4748                                        MGMT_STATUS_NOT_SUPPORTED);
4749
4750         if (hdev_is_powered(hdev))
4751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4752                                        MGMT_STATUS_REJECTED);
4753
4754         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4755                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4756                         return mgmt_cmd_status(sk, hdev->id,
4757                                                MGMT_OP_SET_STATIC_ADDRESS,
4758                                                MGMT_STATUS_INVALID_PARAMS);
4759
4760                 /* Two most significant bits shall be set */
4761                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4762                         return mgmt_cmd_status(sk, hdev->id,
4763                                                MGMT_OP_SET_STATIC_ADDRESS,
4764                                                MGMT_STATUS_INVALID_PARAMS);
4765         }
4766
4767         hci_dev_lock(hdev);
4768
4769         bacpy(&hdev->static_addr, &cp->bdaddr);
4770
4771         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4772         if (err < 0)
4773                 goto unlock;
4774
4775         err = new_settings(hdev, sk);
4776
4777 unlock:
4778         hci_dev_unlock(hdev);
4779         return err;
4780 }
4781
4782 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4783                            void *data, u16 len)
4784 {
4785         struct mgmt_cp_set_scan_params *cp = data;
4786         __u16 interval, window;
4787         int err;
4788
4789         BT_DBG("%s", hdev->name);
4790
4791         if (!lmp_le_capable(hdev))
4792                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4793                                        MGMT_STATUS_NOT_SUPPORTED);
4794
4795         interval = __le16_to_cpu(cp->interval);
4796
4797         if (interval < 0x0004 || interval > 0x4000)
4798                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4799                                        MGMT_STATUS_INVALID_PARAMS);
4800
4801         window = __le16_to_cpu(cp->window);
4802
4803         if (window < 0x0004 || window > 0x4000)
4804                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4805                                        MGMT_STATUS_INVALID_PARAMS);
4806
4807         if (window > interval)
4808                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4809                                        MGMT_STATUS_INVALID_PARAMS);
4810
4811         hci_dev_lock(hdev);
4812
4813         hdev->le_scan_interval = interval;
4814         hdev->le_scan_window = window;
4815
4816         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4817                                 NULL, 0);
4818
4819         /* If background scan is running, restart it so new parameters are
4820          * loaded.
4821          */
4822         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4823             hdev->discovery.state == DISCOVERY_STOPPED) {
4824                 struct hci_request req;
4825
4826                 hci_req_init(&req, hdev);
4827
4828                 hci_req_add_le_scan_disable(&req);
4829                 hci_req_add_le_passive_scan(&req);
4830
4831                 hci_req_run(&req, NULL);
4832         }
4833
4834         hci_dev_unlock(hdev);
4835
4836         return err;
4837 }
4838
4839 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4840                                       u16 opcode)
4841 {
4842         struct mgmt_pending_cmd *cmd;
4843
4844         BT_DBG("status 0x%02x", status);
4845
4846         hci_dev_lock(hdev);
4847
4848         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4849         if (!cmd)
4850                 goto unlock;
4851
4852         if (status) {
4853                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4854                                 mgmt_status(status));
4855         } else {
4856                 struct mgmt_mode *cp = cmd->param;
4857
4858                 if (cp->val)
4859                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4860                 else
4861                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4862
4863                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4864                 new_settings(hdev, cmd->sk);
4865         }
4866
4867         mgmt_pending_remove(cmd);
4868
4869 unlock:
4870         hci_dev_unlock(hdev);
4871 }
4872
4873 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4874                                 void *data, u16 len)
4875 {
4876         struct mgmt_mode *cp = data;
4877         struct mgmt_pending_cmd *cmd;
4878         struct hci_request req;
4879         int err;
4880
4881         BT_DBG("%s", hdev->name);
4882
4883         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4884             hdev->hci_ver < BLUETOOTH_VER_1_2)
4885                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4886                                        MGMT_STATUS_NOT_SUPPORTED);
4887
4888         if (cp->val != 0x00 && cp->val != 0x01)
4889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4890                                        MGMT_STATUS_INVALID_PARAMS);
4891
4892         hci_dev_lock(hdev);
4893
4894         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4895                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4896                                       MGMT_STATUS_BUSY);
4897                 goto unlock;
4898         }
4899
4900         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4901                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4902                                         hdev);
4903                 goto unlock;
4904         }
4905
4906         if (!hdev_is_powered(hdev)) {
4907                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4908                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4909                                         hdev);
4910                 new_settings(hdev, sk);
4911                 goto unlock;
4912         }
4913
4914         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4915                                data, len);
4916         if (!cmd) {
4917                 err = -ENOMEM;
4918                 goto unlock;
4919         }
4920
4921         hci_req_init(&req, hdev);
4922
4923         write_fast_connectable(&req, cp->val);
4924
4925         err = hci_req_run(&req, fast_connectable_complete);
4926         if (err < 0) {
4927                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4928                                       MGMT_STATUS_FAILED);
4929                 mgmt_pending_remove(cmd);
4930         }
4931
4932 unlock:
4933         hci_dev_unlock(hdev);
4934
4935         return err;
4936 }
4937
4938 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4939 {
4940         struct mgmt_pending_cmd *cmd;
4941
4942         BT_DBG("status 0x%02x", status);
4943
4944         hci_dev_lock(hdev);
4945
4946         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4947         if (!cmd)
4948                 goto unlock;
4949
4950         if (status) {
4951                 u8 mgmt_err = mgmt_status(status);
4952
4953                 /* We need to restore the flag if related HCI commands
4954                  * failed.
4955                  */
4956                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4957
4958                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4959         } else {
4960                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4961                 new_settings(hdev, cmd->sk);
4962         }
4963
4964         mgmt_pending_remove(cmd);
4965
4966 unlock:
4967         hci_dev_unlock(hdev);
4968 }
4969
4970 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4971 {
4972         struct mgmt_mode *cp = data;
4973         struct mgmt_pending_cmd *cmd;
4974         struct hci_request req;
4975         int err;
4976
4977         BT_DBG("request for %s", hdev->name);
4978
4979         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4980                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4981                                        MGMT_STATUS_NOT_SUPPORTED);
4982
4983         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4985                                        MGMT_STATUS_REJECTED);
4986
4987         if (cp->val != 0x00 && cp->val != 0x01)
4988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4989                                        MGMT_STATUS_INVALID_PARAMS);
4990
4991         hci_dev_lock(hdev);
4992
4993         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4994                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4995                 goto unlock;
4996         }
4997
4998         if (!hdev_is_powered(hdev)) {
4999                 if (!cp->val) {
5000                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5001                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5002                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5003                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5004                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5005                 }
5006
5007                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5008
5009                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5010                 if (err < 0)
5011                         goto unlock;
5012
5013                 err = new_settings(hdev, sk);
5014                 goto unlock;
5015         }
5016
5017         /* Reject disabling when powered on */
5018         if (!cp->val) {
5019                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5020                                       MGMT_STATUS_REJECTED);
5021                 goto unlock;
5022         } else {
5023                 /* When configuring a dual-mode controller to operate
5024                  * with LE only and using a static address, then switching
5025                  * BR/EDR back on is not allowed.
5026                  *
5027                  * Dual-mode controllers shall operate with the public
5028                  * address as its identity address for BR/EDR and LE. So
5029                  * reject the attempt to create an invalid configuration.
5030                  *
5031                  * The same restrictions applies when secure connections
5032                  * has been enabled. For BR/EDR this is a controller feature
5033                  * while for LE it is a host stack feature. This means that
5034                  * switching BR/EDR back on when secure connections has been
5035                  * enabled is not a supported transaction.
5036                  */
5037                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5038                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5039                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5040                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5041                                               MGMT_STATUS_REJECTED);
5042                         goto unlock;
5043                 }
5044         }
5045
5046         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5047                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5048                                       MGMT_STATUS_BUSY);
5049                 goto unlock;
5050         }
5051
5052         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5053         if (!cmd) {
5054                 err = -ENOMEM;
5055                 goto unlock;
5056         }
5057
5058         /* We need to flip the bit already here so that update_adv_data
5059          * generates the correct flags.
5060          */
5061         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5062
5063         hci_req_init(&req, hdev);
5064
5065         write_fast_connectable(&req, false);
5066         __hci_update_page_scan(&req);
5067
5068         /* Since only the advertising data flags will change, there
5069          * is no need to update the scan response data.
5070          */
5071         update_adv_data(&req);
5072
5073         err = hci_req_run(&req, set_bredr_complete);
5074         if (err < 0)
5075                 mgmt_pending_remove(cmd);
5076
5077 unlock:
5078         hci_dev_unlock(hdev);
5079         return err;
5080 }
5081
5082 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5083 {
5084         struct mgmt_pending_cmd *cmd;
5085         struct mgmt_mode *cp;
5086
5087         BT_DBG("%s status %u", hdev->name, status);
5088
5089         hci_dev_lock(hdev);
5090
5091         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5092         if (!cmd)
5093                 goto unlock;
5094
5095         if (status) {
5096                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5097                                 mgmt_status(status));
5098                 goto remove;
5099         }
5100
5101         cp = cmd->param;
5102
5103         switch (cp->val) {
5104         case 0x00:
5105                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5106                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5107                 break;
5108         case 0x01:
5109                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5110                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5111                 break;
5112         case 0x02:
5113                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5114                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5115                 break;
5116         }
5117
5118         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5119         new_settings(hdev, cmd->sk);
5120
5121 remove:
5122         mgmt_pending_remove(cmd);
5123 unlock:
5124         hci_dev_unlock(hdev);
5125 }
5126
5127 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5128                            void *data, u16 len)
5129 {
5130         struct mgmt_mode *cp = data;
5131         struct mgmt_pending_cmd *cmd;
5132         struct hci_request req;
5133         u8 val;
5134         int err;
5135
5136         BT_DBG("request for %s", hdev->name);
5137
5138         if (!lmp_sc_capable(hdev) &&
5139             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5140                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5141                                        MGMT_STATUS_NOT_SUPPORTED);
5142
5143         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5144             lmp_sc_capable(hdev) &&
5145             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5146                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5147                                        MGMT_STATUS_REJECTED);
5148
5149         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5151                                   MGMT_STATUS_INVALID_PARAMS);
5152
5153         hci_dev_lock(hdev);
5154
5155         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5156             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5157                 bool changed;
5158
5159                 if (cp->val) {
5160                         changed = !hci_dev_test_and_set_flag(hdev,
5161                                                              HCI_SC_ENABLED);
5162                         if (cp->val == 0x02)
5163                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5164                         else
5165                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5166                 } else {
5167                         changed = hci_dev_test_and_clear_flag(hdev,
5168                                                               HCI_SC_ENABLED);
5169                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5170                 }
5171
5172                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5173                 if (err < 0)
5174                         goto failed;
5175
5176                 if (changed)
5177                         err = new_settings(hdev, sk);
5178
5179                 goto failed;
5180         }
5181
5182         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5183                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5184                                       MGMT_STATUS_BUSY);
5185                 goto failed;
5186         }
5187
5188         val = !!cp->val;
5189
5190         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5191             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5192                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5193                 goto failed;
5194         }
5195
5196         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5197         if (!cmd) {
5198                 err = -ENOMEM;
5199                 goto failed;
5200         }
5201
5202         hci_req_init(&req, hdev);
5203         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5204         err = hci_req_run(&req, sc_enable_complete);
5205         if (err < 0) {
5206                 mgmt_pending_remove(cmd);
5207                 goto failed;
5208         }
5209
5210 failed:
5211         hci_dev_unlock(hdev);
5212         return err;
5213 }
5214
5215 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5216                           void *data, u16 len)
5217 {
5218         struct mgmt_mode *cp = data;
5219         bool changed, use_changed;
5220         int err;
5221
5222         BT_DBG("request for %s", hdev->name);
5223
5224         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5225                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5226                                        MGMT_STATUS_INVALID_PARAMS);
5227
5228         hci_dev_lock(hdev);
5229
5230         if (cp->val)
5231                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5232         else
5233                 changed = hci_dev_test_and_clear_flag(hdev,
5234                                                       HCI_KEEP_DEBUG_KEYS);
5235
5236         if (cp->val == 0x02)
5237                 use_changed = !hci_dev_test_and_set_flag(hdev,
5238                                                          HCI_USE_DEBUG_KEYS);
5239         else
5240                 use_changed = hci_dev_test_and_clear_flag(hdev,
5241                                                           HCI_USE_DEBUG_KEYS);
5242
5243         if (hdev_is_powered(hdev) && use_changed &&
5244             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5245                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5246                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5247                              sizeof(mode), &mode);
5248         }
5249
5250         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5251         if (err < 0)
5252                 goto unlock;
5253
5254         if (changed)
5255                 err = new_settings(hdev, sk);
5256
5257 unlock:
5258         hci_dev_unlock(hdev);
5259         return err;
5260 }
5261
5262 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5263                        u16 len)
5264 {
5265         struct mgmt_cp_set_privacy *cp = cp_data;
5266         bool changed;
5267         int err;
5268
5269         BT_DBG("request for %s", hdev->name);
5270
5271         if (!lmp_le_capable(hdev))
5272                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5273                                        MGMT_STATUS_NOT_SUPPORTED);
5274
5275         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5277                                        MGMT_STATUS_INVALID_PARAMS);
5278
5279         if (hdev_is_powered(hdev))
5280                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5281                                        MGMT_STATUS_REJECTED);
5282
5283         hci_dev_lock(hdev);
5284
5285         /* If user space supports this command it is also expected to
5286          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5287          */
5288         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5289
5290         if (cp->privacy) {
5291                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5292                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5293                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5294         } else {
5295                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5296                 memset(hdev->irk, 0, sizeof(hdev->irk));
5297                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5298         }
5299
5300         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5301         if (err < 0)
5302                 goto unlock;
5303
5304         if (changed)
5305                 err = new_settings(hdev, sk);
5306
5307 unlock:
5308         hci_dev_unlock(hdev);
5309         return err;
5310 }
5311
5312 static bool irk_is_valid(struct mgmt_irk_info *irk)
5313 {
5314         switch (irk->addr.type) {
5315         case BDADDR_LE_PUBLIC:
5316                 return true;
5317
5318         case BDADDR_LE_RANDOM:
5319                 /* Two most significant bits shall be set */
5320                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5321                         return false;
5322                 return true;
5323         }
5324
5325         return false;
5326 }
5327
5328 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5329                      u16 len)
5330 {
5331         struct mgmt_cp_load_irks *cp = cp_data;
5332         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5333                                    sizeof(struct mgmt_irk_info));
5334         u16 irk_count, expected_len;
5335         int i, err;
5336
5337         BT_DBG("request for %s", hdev->name);
5338
5339         if (!lmp_le_capable(hdev))
5340                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5341                                        MGMT_STATUS_NOT_SUPPORTED);
5342
5343         irk_count = __le16_to_cpu(cp->irk_count);
5344         if (irk_count > max_irk_count) {
5345                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5347                                        MGMT_STATUS_INVALID_PARAMS);
5348         }
5349
5350         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5351         if (expected_len != len) {
5352                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5353                        expected_len, len);
5354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5355                                        MGMT_STATUS_INVALID_PARAMS);
5356         }
5357
5358         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5359
5360         for (i = 0; i < irk_count; i++) {
5361                 struct mgmt_irk_info *key = &cp->irks[i];
5362
5363                 if (!irk_is_valid(key))
5364                         return mgmt_cmd_status(sk, hdev->id,
5365                                                MGMT_OP_LOAD_IRKS,
5366                                                MGMT_STATUS_INVALID_PARAMS);
5367         }
5368
5369         hci_dev_lock(hdev);
5370
5371         hci_smp_irks_clear(hdev);
5372
5373         for (i = 0; i < irk_count; i++) {
5374                 struct mgmt_irk_info *irk = &cp->irks[i];
5375                 u8 addr_type;
5376
5377                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5378                         addr_type = ADDR_LE_DEV_PUBLIC;
5379                 else
5380                         addr_type = ADDR_LE_DEV_RANDOM;
5381
5382                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5383                             BDADDR_ANY);
5384         }
5385
5386         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5387
5388         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5389
5390         hci_dev_unlock(hdev);
5391
5392         return err;
5393 }
5394
5395 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5396 {
5397         if (key->master != 0x00 && key->master != 0x01)
5398                 return false;
5399
5400         switch (key->addr.type) {
5401         case BDADDR_LE_PUBLIC:
5402                 return true;
5403
5404         case BDADDR_LE_RANDOM:
5405                 /* Two most significant bits shall be set */
5406                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5407                         return false;
5408                 return true;
5409         }
5410
5411         return false;
5412 }
5413
5414 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5415                                void *cp_data, u16 len)
5416 {
5417         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5418         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5419                                    sizeof(struct mgmt_ltk_info));
5420         u16 key_count, expected_len;
5421         int i, err;
5422
5423         BT_DBG("request for %s", hdev->name);
5424
5425         if (!lmp_le_capable(hdev))
5426                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5427                                        MGMT_STATUS_NOT_SUPPORTED);
5428
5429         key_count = __le16_to_cpu(cp->key_count);
5430         if (key_count > max_key_count) {
5431                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5432                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5433                                        MGMT_STATUS_INVALID_PARAMS);
5434         }
5435
5436         expected_len = sizeof(*cp) + key_count *
5437                                         sizeof(struct mgmt_ltk_info);
5438         if (expected_len != len) {
5439                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5440                        expected_len, len);
5441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5442                                        MGMT_STATUS_INVALID_PARAMS);
5443         }
5444
5445         BT_DBG("%s key_count %u", hdev->name, key_count);
5446
5447         for (i = 0; i < key_count; i++) {
5448                 struct mgmt_ltk_info *key = &cp->keys[i];
5449
5450                 if (!ltk_is_valid(key))
5451                         return mgmt_cmd_status(sk, hdev->id,
5452                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5453                                                MGMT_STATUS_INVALID_PARAMS);
5454         }
5455
5456         hci_dev_lock(hdev);
5457
5458         hci_smp_ltks_clear(hdev);
5459
5460         for (i = 0; i < key_count; i++) {
5461                 struct mgmt_ltk_info *key = &cp->keys[i];
5462                 u8 type, addr_type, authenticated;
5463
5464                 if (key->addr.type == BDADDR_LE_PUBLIC)
5465                         addr_type = ADDR_LE_DEV_PUBLIC;
5466                 else
5467                         addr_type = ADDR_LE_DEV_RANDOM;
5468
5469                 switch (key->type) {
5470                 case MGMT_LTK_UNAUTHENTICATED:
5471                         authenticated = 0x00;
5472                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5473                         break;
5474                 case MGMT_LTK_AUTHENTICATED:
5475                         authenticated = 0x01;
5476                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5477                         break;
5478                 case MGMT_LTK_P256_UNAUTH:
5479                         authenticated = 0x00;
5480                         type = SMP_LTK_P256;
5481                         break;
5482                 case MGMT_LTK_P256_AUTH:
5483                         authenticated = 0x01;
5484                         type = SMP_LTK_P256;
5485                         break;
5486                 case MGMT_LTK_P256_DEBUG:
5487                         authenticated = 0x00;
5488                         type = SMP_LTK_P256_DEBUG;
5489                 default:
5490                         continue;
5491                 }
5492
5493                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5494                             authenticated, key->val, key->enc_size, key->ediv,
5495                             key->rand);
5496         }
5497
5498         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5499                            NULL, 0);
5500
5501         hci_dev_unlock(hdev);
5502
5503         return err;
5504 }
5505
5506 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5507 {
5508         struct hci_conn *conn = cmd->user_data;
5509         struct mgmt_rp_get_conn_info rp;
5510         int err;
5511
5512         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5513
5514         if (status == MGMT_STATUS_SUCCESS) {
5515                 rp.rssi = conn->rssi;
5516                 rp.tx_power = conn->tx_power;
5517                 rp.max_tx_power = conn->max_tx_power;
5518         } else {
5519                 rp.rssi = HCI_RSSI_INVALID;
5520                 rp.tx_power = HCI_TX_POWER_INVALID;
5521                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5522         }
5523
5524         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5525                                 status, &rp, sizeof(rp));
5526
5527         hci_conn_drop(conn);
5528         hci_conn_put(conn);
5529
5530         return err;
5531 }
5532
5533 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5534                                        u16 opcode)
5535 {
5536         struct hci_cp_read_rssi *cp;
5537         struct mgmt_pending_cmd *cmd;
5538         struct hci_conn *conn;
5539         u16 handle;
5540         u8 status;
5541
5542         BT_DBG("status 0x%02x", hci_status);
5543
5544         hci_dev_lock(hdev);
5545
5546         /* Commands sent in request are either Read RSSI or Read Transmit Power
5547          * Level so we check which one was last sent to retrieve connection
5548          * handle.  Both commands have handle as first parameter so it's safe to
5549          * cast data on the same command struct.
5550          *
5551          * First command sent is always Read RSSI and we fail only if it fails.
5552          * In other case we simply override error to indicate success as we
5553          * already remembered if TX power value is actually valid.
5554          */
5555         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5556         if (!cp) {
5557                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5558                 status = MGMT_STATUS_SUCCESS;
5559         } else {
5560                 status = mgmt_status(hci_status);
5561         }
5562
5563         if (!cp) {
5564                 BT_ERR("invalid sent_cmd in conn_info response");
5565                 goto unlock;
5566         }
5567
5568         handle = __le16_to_cpu(cp->handle);
5569         conn = hci_conn_hash_lookup_handle(hdev, handle);
5570         if (!conn) {
5571                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5572                 goto unlock;
5573         }
5574
5575         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5576         if (!cmd)
5577                 goto unlock;
5578
5579         cmd->cmd_complete(cmd, status);
5580         mgmt_pending_remove(cmd);
5581
5582 unlock:
5583         hci_dev_unlock(hdev);
5584 }
5585
5586 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5587                          u16 len)
5588 {
5589         struct mgmt_cp_get_conn_info *cp = data;
5590         struct mgmt_rp_get_conn_info rp;
5591         struct hci_conn *conn;
5592         unsigned long conn_info_age;
5593         int err = 0;
5594
5595         BT_DBG("%s", hdev->name);
5596
5597         memset(&rp, 0, sizeof(rp));
5598         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5599         rp.addr.type = cp->addr.type;
5600
5601         if (!bdaddr_type_is_valid(cp->addr.type))
5602                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5603                                          MGMT_STATUS_INVALID_PARAMS,
5604                                          &rp, sizeof(rp));
5605
5606         hci_dev_lock(hdev);
5607
5608         if (!hdev_is_powered(hdev)) {
5609                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5610                                         MGMT_STATUS_NOT_POWERED, &rp,
5611                                         sizeof(rp));
5612                 goto unlock;
5613         }
5614
5615         if (cp->addr.type == BDADDR_BREDR)
5616                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5617                                                &cp->addr.bdaddr);
5618         else
5619                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5620
5621         if (!conn || conn->state != BT_CONNECTED) {
5622                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5623                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5624                                         sizeof(rp));
5625                 goto unlock;
5626         }
5627
5628         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5629                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5630                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5631                 goto unlock;
5632         }
5633
5634         /* To avoid client trying to guess when to poll again for information we
5635          * calculate conn info age as random value between min/max set in hdev.
5636          */
5637         conn_info_age = hdev->conn_info_min_age +
5638                         prandom_u32_max(hdev->conn_info_max_age -
5639                                         hdev->conn_info_min_age);
5640
5641         /* Query controller to refresh cached values if they are too old or were
5642          * never read.
5643          */
5644         if (time_after(jiffies, conn->conn_info_timestamp +
5645                        msecs_to_jiffies(conn_info_age)) ||
5646             !conn->conn_info_timestamp) {
5647                 struct hci_request req;
5648                 struct hci_cp_read_tx_power req_txp_cp;
5649                 struct hci_cp_read_rssi req_rssi_cp;
5650                 struct mgmt_pending_cmd *cmd;
5651
5652                 hci_req_init(&req, hdev);
5653                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5654                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5655                             &req_rssi_cp);
5656
5657                 /* For LE links TX power does not change thus we don't need to
5658                  * query for it once value is known.
5659                  */
5660                 if (!bdaddr_type_is_le(cp->addr.type) ||
5661                     conn->tx_power == HCI_TX_POWER_INVALID) {
5662                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5663                         req_txp_cp.type = 0x00;
5664                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5665                                     sizeof(req_txp_cp), &req_txp_cp);
5666                 }
5667
5668                 /* Max TX power needs to be read only once per connection */
5669                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5670                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5671                         req_txp_cp.type = 0x01;
5672                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5673                                     sizeof(req_txp_cp), &req_txp_cp);
5674                 }
5675
5676                 err = hci_req_run(&req, conn_info_refresh_complete);
5677                 if (err < 0)
5678                         goto unlock;
5679
5680                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5681                                        data, len);
5682                 if (!cmd) {
5683                         err = -ENOMEM;
5684                         goto unlock;
5685                 }
5686
5687                 hci_conn_hold(conn);
5688                 cmd->user_data = hci_conn_get(conn);
5689                 cmd->cmd_complete = conn_info_cmd_complete;
5690
5691                 conn->conn_info_timestamp = jiffies;
5692         } else {
5693                 /* Cache is valid, just reply with values cached in hci_conn */
5694                 rp.rssi = conn->rssi;
5695                 rp.tx_power = conn->tx_power;
5696                 rp.max_tx_power = conn->max_tx_power;
5697
5698                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5699                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5700         }
5701
5702 unlock:
5703         hci_dev_unlock(hdev);
5704         return err;
5705 }
5706
5707 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5708 {
5709         struct hci_conn *conn = cmd->user_data;
5710         struct mgmt_rp_get_clock_info rp;
5711         struct hci_dev *hdev;
5712         int err;
5713
5714         memset(&rp, 0, sizeof(rp));
5715         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5716
5717         if (status)
5718                 goto complete;
5719
5720         hdev = hci_dev_get(cmd->index);
5721         if (hdev) {
5722                 rp.local_clock = cpu_to_le32(hdev->clock);
5723                 hci_dev_put(hdev);
5724         }
5725
5726         if (conn) {
5727                 rp.piconet_clock = cpu_to_le32(conn->clock);
5728                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5729         }
5730
5731 complete:
5732         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5733                                 sizeof(rp));
5734
5735         if (conn) {
5736                 hci_conn_drop(conn);
5737                 hci_conn_put(conn);
5738         }
5739
5740         return err;
5741 }
5742
5743 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5744 {
5745         struct hci_cp_read_clock *hci_cp;
5746         struct mgmt_pending_cmd *cmd;
5747         struct hci_conn *conn;
5748
5749         BT_DBG("%s status %u", hdev->name, status);
5750
5751         hci_dev_lock(hdev);
5752
5753         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5754         if (!hci_cp)
5755                 goto unlock;
5756
5757         if (hci_cp->which) {
5758                 u16 handle = __le16_to_cpu(hci_cp->handle);
5759                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5760         } else {
5761                 conn = NULL;
5762         }
5763
5764         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5765         if (!cmd)
5766                 goto unlock;
5767
5768         cmd->cmd_complete(cmd, mgmt_status(status));
5769         mgmt_pending_remove(cmd);
5770
5771 unlock:
5772         hci_dev_unlock(hdev);
5773 }
5774
5775 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5776                          u16 len)
5777 {
5778         struct mgmt_cp_get_clock_info *cp = data;
5779         struct mgmt_rp_get_clock_info rp;
5780         struct hci_cp_read_clock hci_cp;
5781         struct mgmt_pending_cmd *cmd;
5782         struct hci_request req;
5783         struct hci_conn *conn;
5784         int err;
5785
5786         BT_DBG("%s", hdev->name);
5787
5788         memset(&rp, 0, sizeof(rp));
5789         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5790         rp.addr.type = cp->addr.type;
5791
5792         if (cp->addr.type != BDADDR_BREDR)
5793                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5794                                          MGMT_STATUS_INVALID_PARAMS,
5795                                          &rp, sizeof(rp));
5796
5797         hci_dev_lock(hdev);
5798
5799         if (!hdev_is_powered(hdev)) {
5800                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5801                                         MGMT_STATUS_NOT_POWERED, &rp,
5802                                         sizeof(rp));
5803                 goto unlock;
5804         }
5805
5806         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5807                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5808                                                &cp->addr.bdaddr);
5809                 if (!conn || conn->state != BT_CONNECTED) {
5810                         err = mgmt_cmd_complete(sk, hdev->id,
5811                                                 MGMT_OP_GET_CLOCK_INFO,
5812                                                 MGMT_STATUS_NOT_CONNECTED,
5813                                                 &rp, sizeof(rp));
5814                         goto unlock;
5815                 }
5816         } else {
5817                 conn = NULL;
5818         }
5819
5820         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5821         if (!cmd) {
5822                 err = -ENOMEM;
5823                 goto unlock;
5824         }
5825
5826         cmd->cmd_complete = clock_info_cmd_complete;
5827
5828         hci_req_init(&req, hdev);
5829
5830         memset(&hci_cp, 0, sizeof(hci_cp));
5831         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5832
5833         if (conn) {
5834                 hci_conn_hold(conn);
5835                 cmd->user_data = hci_conn_get(conn);
5836
5837                 hci_cp.handle = cpu_to_le16(conn->handle);
5838                 hci_cp.which = 0x01; /* Piconet clock */
5839                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5840         }
5841
5842         err = hci_req_run(&req, get_clock_info_complete);
5843         if (err < 0)
5844                 mgmt_pending_remove(cmd);
5845
5846 unlock:
5847         hci_dev_unlock(hdev);
5848         return err;
5849 }
5850
5851 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5852 {
5853         struct hci_conn *conn;
5854
5855         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5856         if (!conn)
5857                 return false;
5858
5859         if (conn->dst_type != type)
5860                 return false;
5861
5862         if (conn->state != BT_CONNECTED)
5863                 return false;
5864
5865         return true;
5866 }
5867
5868 /* This function requires the caller holds hdev->lock */
5869 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5870                                u8 addr_type, u8 auto_connect)
5871 {
5872         struct hci_dev *hdev = req->hdev;
5873         struct hci_conn_params *params;
5874
5875         params = hci_conn_params_add(hdev, addr, addr_type);
5876         if (!params)
5877                 return -EIO;
5878
5879         if (params->auto_connect == auto_connect)
5880                 return 0;
5881
5882         list_del_init(&params->action);
5883
5884         switch (auto_connect) {
5885         case HCI_AUTO_CONN_DISABLED:
5886         case HCI_AUTO_CONN_LINK_LOSS:
5887                 __hci_update_background_scan(req);
5888                 break;
5889         case HCI_AUTO_CONN_REPORT:
5890                 list_add(&params->action, &hdev->pend_le_reports);
5891                 __hci_update_background_scan(req);
5892                 break;
5893         case HCI_AUTO_CONN_DIRECT:
5894         case HCI_AUTO_CONN_ALWAYS:
5895                 if (!is_connected(hdev, addr, addr_type)) {
5896                         list_add(&params->action, &hdev->pend_le_conns);
5897                         __hci_update_background_scan(req);
5898                 }
5899                 break;
5900         }
5901
5902         params->auto_connect = auto_connect;
5903
5904         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5905                auto_connect);
5906
5907         return 0;
5908 }
5909
5910 static void device_added(struct sock *sk, struct hci_dev *hdev,
5911                          bdaddr_t *bdaddr, u8 type, u8 action)
5912 {
5913         struct mgmt_ev_device_added ev;
5914
5915         bacpy(&ev.addr.bdaddr, bdaddr);
5916         ev.addr.type = type;
5917         ev.action = action;
5918
5919         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5920 }
5921
5922 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5923 {
5924         struct mgmt_pending_cmd *cmd;
5925
5926         BT_DBG("status 0x%02x", status);
5927
5928         hci_dev_lock(hdev);
5929
5930         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5931         if (!cmd)
5932                 goto unlock;
5933
5934         cmd->cmd_complete(cmd, mgmt_status(status));
5935         mgmt_pending_remove(cmd);
5936
5937 unlock:
5938         hci_dev_unlock(hdev);
5939 }
5940
5941 static int add_device(struct sock *sk, struct hci_dev *hdev,
5942                       void *data, u16 len)
5943 {
5944         struct mgmt_cp_add_device *cp = data;
5945         struct mgmt_pending_cmd *cmd;
5946         struct hci_request req;
5947         u8 auto_conn, addr_type;
5948         int err;
5949
5950         BT_DBG("%s", hdev->name);
5951
5952         if (!bdaddr_type_is_valid(cp->addr.type) ||
5953             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5954                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5955                                          MGMT_STATUS_INVALID_PARAMS,
5956                                          &cp->addr, sizeof(cp->addr));
5957
5958         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5959                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5960                                          MGMT_STATUS_INVALID_PARAMS,
5961                                          &cp->addr, sizeof(cp->addr));
5962
5963         hci_req_init(&req, hdev);
5964
5965         hci_dev_lock(hdev);
5966
5967         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5968         if (!cmd) {
5969                 err = -ENOMEM;
5970                 goto unlock;
5971         }
5972
5973         cmd->cmd_complete = addr_cmd_complete;
5974
5975         if (cp->addr.type == BDADDR_BREDR) {
5976                 /* Only incoming connections action is supported for now */
5977                 if (cp->action != 0x01) {
5978                         err = cmd->cmd_complete(cmd,
5979                                                 MGMT_STATUS_INVALID_PARAMS);
5980                         mgmt_pending_remove(cmd);
5981                         goto unlock;
5982                 }
5983
5984                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5985                                           cp->addr.type);
5986                 if (err)
5987                         goto unlock;
5988
5989                 __hci_update_page_scan(&req);
5990
5991                 goto added;
5992         }
5993
5994         if (cp->addr.type == BDADDR_LE_PUBLIC)
5995                 addr_type = ADDR_LE_DEV_PUBLIC;
5996         else
5997                 addr_type = ADDR_LE_DEV_RANDOM;
5998
5999         if (cp->action == 0x02)
6000                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6001         else if (cp->action == 0x01)
6002                 auto_conn = HCI_AUTO_CONN_DIRECT;
6003         else
6004                 auto_conn = HCI_AUTO_CONN_REPORT;
6005
6006         /* If the connection parameters don't exist for this device,
6007          * they will be created and configured with defaults.
6008          */
6009         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
6010                                 auto_conn) < 0) {
6011                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
6012                 mgmt_pending_remove(cmd);
6013                 goto unlock;
6014         }
6015
6016 added:
6017         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6018
6019         err = hci_req_run(&req, add_device_complete);
6020         if (err < 0) {
6021                 /* ENODATA means no HCI commands were needed (e.g. if
6022                  * the adapter is powered off).
6023                  */
6024                 if (err == -ENODATA)
6025                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6026                 mgmt_pending_remove(cmd);
6027         }
6028
6029 unlock:
6030         hci_dev_unlock(hdev);
6031         return err;
6032 }
6033
6034 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6035                            bdaddr_t *bdaddr, u8 type)
6036 {
6037         struct mgmt_ev_device_removed ev;
6038
6039         bacpy(&ev.addr.bdaddr, bdaddr);
6040         ev.addr.type = type;
6041
6042         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6043 }
6044
6045 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6046 {
6047         struct mgmt_pending_cmd *cmd;
6048
6049         BT_DBG("status 0x%02x", status);
6050
6051         hci_dev_lock(hdev);
6052
6053         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6054         if (!cmd)
6055                 goto unlock;
6056
6057         cmd->cmd_complete(cmd, mgmt_status(status));
6058         mgmt_pending_remove(cmd);
6059
6060 unlock:
6061         hci_dev_unlock(hdev);
6062 }
6063
6064 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6065                          void *data, u16 len)
6066 {
6067         struct mgmt_cp_remove_device *cp = data;
6068         struct mgmt_pending_cmd *cmd;
6069         struct hci_request req;
6070         int err;
6071
6072         BT_DBG("%s", hdev->name);
6073
6074         hci_req_init(&req, hdev);
6075
6076         hci_dev_lock(hdev);
6077
6078         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6079         if (!cmd) {
6080                 err = -ENOMEM;
6081                 goto unlock;
6082         }
6083
6084         cmd->cmd_complete = addr_cmd_complete;
6085
6086         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6087                 struct hci_conn_params *params;
6088                 u8 addr_type;
6089
6090                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6091                         err = cmd->cmd_complete(cmd,
6092                                                 MGMT_STATUS_INVALID_PARAMS);
6093                         mgmt_pending_remove(cmd);
6094                         goto unlock;
6095                 }
6096
6097                 if (cp->addr.type == BDADDR_BREDR) {
6098                         err = hci_bdaddr_list_del(&hdev->whitelist,
6099                                                   &cp->addr.bdaddr,
6100                                                   cp->addr.type);
6101                         if (err) {
6102                                 err = cmd->cmd_complete(cmd,
6103                                                         MGMT_STATUS_INVALID_PARAMS);
6104                                 mgmt_pending_remove(cmd);
6105                                 goto unlock;
6106                         }
6107
6108                         __hci_update_page_scan(&req);
6109
6110                         device_removed(sk, hdev, &cp->addr.bdaddr,
6111                                        cp->addr.type);
6112                         goto complete;
6113                 }
6114
6115                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6116                         addr_type = ADDR_LE_DEV_PUBLIC;
6117                 else
6118                         addr_type = ADDR_LE_DEV_RANDOM;
6119
6120                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6121                                                 addr_type);
6122                 if (!params) {
6123                         err = cmd->cmd_complete(cmd,
6124                                                 MGMT_STATUS_INVALID_PARAMS);
6125                         mgmt_pending_remove(cmd);
6126                         goto unlock;
6127                 }
6128
6129                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
6130                         err = cmd->cmd_complete(cmd,
6131                                                 MGMT_STATUS_INVALID_PARAMS);
6132                         mgmt_pending_remove(cmd);
6133                         goto unlock;
6134                 }
6135
6136                 list_del(&params->action);
6137                 list_del(&params->list);
6138                 kfree(params);
6139                 __hci_update_background_scan(&req);
6140
6141                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6142         } else {
6143                 struct hci_conn_params *p, *tmp;
6144                 struct bdaddr_list *b, *btmp;
6145
6146                 if (cp->addr.type) {
6147                         err = cmd->cmd_complete(cmd,
6148                                                 MGMT_STATUS_INVALID_PARAMS);
6149                         mgmt_pending_remove(cmd);
6150                         goto unlock;
6151                 }
6152
6153                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6154                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6155                         list_del(&b->list);
6156                         kfree(b);
6157                 }
6158
6159                 __hci_update_page_scan(&req);
6160
6161                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6162                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6163                                 continue;
6164                         device_removed(sk, hdev, &p->addr, p->addr_type);
6165                         list_del(&p->action);
6166                         list_del(&p->list);
6167                         kfree(p);
6168                 }
6169
6170                 BT_DBG("All LE connection parameters were removed");
6171
6172                 __hci_update_background_scan(&req);
6173         }
6174
6175 complete:
6176         err = hci_req_run(&req, remove_device_complete);
6177         if (err < 0) {
6178                 /* ENODATA means no HCI commands were needed (e.g. if
6179                  * the adapter is powered off).
6180                  */
6181                 if (err == -ENODATA)
6182                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6183                 mgmt_pending_remove(cmd);
6184         }
6185
6186 unlock:
6187         hci_dev_unlock(hdev);
6188         return err;
6189 }
6190
6191 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6192                            u16 len)
6193 {
6194         struct mgmt_cp_load_conn_param *cp = data;
6195         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6196                                      sizeof(struct mgmt_conn_param));
6197         u16 param_count, expected_len;
6198         int i;
6199
6200         if (!lmp_le_capable(hdev))
6201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6202                                        MGMT_STATUS_NOT_SUPPORTED);
6203
6204         param_count = __le16_to_cpu(cp->param_count);
6205         if (param_count > max_param_count) {
6206                 BT_ERR("load_conn_param: too big param_count value %u",
6207                        param_count);
6208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6209                                        MGMT_STATUS_INVALID_PARAMS);
6210         }
6211
6212         expected_len = sizeof(*cp) + param_count *
6213                                         sizeof(struct mgmt_conn_param);
6214         if (expected_len != len) {
6215                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6216                        expected_len, len);
6217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6218                                        MGMT_STATUS_INVALID_PARAMS);
6219         }
6220
6221         BT_DBG("%s param_count %u", hdev->name, param_count);
6222
6223         hci_dev_lock(hdev);
6224
6225         hci_conn_params_clear_disabled(hdev);
6226
6227         for (i = 0; i < param_count; i++) {
6228                 struct mgmt_conn_param *param = &cp->params[i];
6229                 struct hci_conn_params *hci_param;
6230                 u16 min, max, latency, timeout;
6231                 u8 addr_type;
6232
6233                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6234                        param->addr.type);
6235
6236                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6237                         addr_type = ADDR_LE_DEV_PUBLIC;
6238                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6239                         addr_type = ADDR_LE_DEV_RANDOM;
6240                 } else {
6241                         BT_ERR("Ignoring invalid connection parameters");
6242                         continue;
6243                 }
6244
6245                 min = le16_to_cpu(param->min_interval);
6246                 max = le16_to_cpu(param->max_interval);
6247                 latency = le16_to_cpu(param->latency);
6248                 timeout = le16_to_cpu(param->timeout);
6249
6250                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6251                        min, max, latency, timeout);
6252
6253                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6254                         BT_ERR("Ignoring invalid connection parameters");
6255                         continue;
6256                 }
6257
6258                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6259                                                 addr_type);
6260                 if (!hci_param) {
6261                         BT_ERR("Failed to add connection parameters");
6262                         continue;
6263                 }
6264
6265                 hci_param->conn_min_interval = min;
6266                 hci_param->conn_max_interval = max;
6267                 hci_param->conn_latency = latency;
6268                 hci_param->supervision_timeout = timeout;
6269         }
6270
6271         hci_dev_unlock(hdev);
6272
6273         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6274                                  NULL, 0);
6275 }
6276
6277 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6278                                void *data, u16 len)
6279 {
6280         struct mgmt_cp_set_external_config *cp = data;
6281         bool changed;
6282         int err;
6283
6284         BT_DBG("%s", hdev->name);
6285
6286         if (hdev_is_powered(hdev))
6287                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6288                                        MGMT_STATUS_REJECTED);
6289
6290         if (cp->config != 0x00 && cp->config != 0x01)
6291                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6292                                          MGMT_STATUS_INVALID_PARAMS);
6293
6294         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6295                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6296                                        MGMT_STATUS_NOT_SUPPORTED);
6297
6298         hci_dev_lock(hdev);
6299
6300         if (cp->config)
6301                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6302         else
6303                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6304
6305         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6306         if (err < 0)
6307                 goto unlock;
6308
6309         if (!changed)
6310                 goto unlock;
6311
6312         err = new_options(hdev, sk);
6313
6314         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6315                 mgmt_index_removed(hdev);
6316
6317                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6318                         hci_dev_set_flag(hdev, HCI_CONFIG);
6319                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6320
6321                         queue_work(hdev->req_workqueue, &hdev->power_on);
6322                 } else {
6323                         set_bit(HCI_RAW, &hdev->flags);
6324                         mgmt_index_added(hdev);
6325                 }
6326         }
6327
6328 unlock:
6329         hci_dev_unlock(hdev);
6330         return err;
6331 }
6332
6333 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6334                               void *data, u16 len)
6335 {
6336         struct mgmt_cp_set_public_address *cp = data;
6337         bool changed;
6338         int err;
6339
6340         BT_DBG("%s", hdev->name);
6341
6342         if (hdev_is_powered(hdev))
6343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6344                                        MGMT_STATUS_REJECTED);
6345
6346         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6347                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6348                                        MGMT_STATUS_INVALID_PARAMS);
6349
6350         if (!hdev->set_bdaddr)
6351                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6352                                        MGMT_STATUS_NOT_SUPPORTED);
6353
6354         hci_dev_lock(hdev);
6355
6356         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6357         bacpy(&hdev->public_addr, &cp->bdaddr);
6358
6359         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6360         if (err < 0)
6361                 goto unlock;
6362
6363         if (!changed)
6364                 goto unlock;
6365
6366         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6367                 err = new_options(hdev, sk);
6368
6369         if (is_configured(hdev)) {
6370                 mgmt_index_removed(hdev);
6371
6372                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6373
6374                 hci_dev_set_flag(hdev, HCI_CONFIG);
6375                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6376
6377                 queue_work(hdev->req_workqueue, &hdev->power_on);
6378         }
6379
6380 unlock:
6381         hci_dev_unlock(hdev);
6382         return err;
6383 }
6384
6385 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6386                                   u8 data_len)
6387 {
6388         eir[eir_len++] = sizeof(type) + data_len;
6389         eir[eir_len++] = type;
6390         memcpy(&eir[eir_len], data, data_len);
6391         eir_len += data_len;
6392
6393         return eir_len;
6394 }
6395
6396 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6397                                    void *data, u16 data_len)
6398 {
6399         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6400         struct mgmt_rp_read_local_oob_ext_data *rp;
6401         size_t rp_len;
6402         u16 eir_len;
6403         u8 status, flags, role, addr[7], hash[16], rand[16];
6404         int err;
6405
6406         BT_DBG("%s", hdev->name);
6407
6408         if (!hdev_is_powered(hdev))
6409                 return mgmt_cmd_complete(sk, hdev->id,
6410                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6411                                          MGMT_STATUS_NOT_POWERED,
6412                                          &cp->type, sizeof(cp->type));
6413
6414         switch (cp->type) {
6415         case BIT(BDADDR_BREDR):
6416                 status = mgmt_bredr_support(hdev);
6417                 if (status)
6418                         return mgmt_cmd_complete(sk, hdev->id,
6419                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6420                                                  status, &cp->type,
6421                                                  sizeof(cp->type));
6422                 eir_len = 5;
6423                 break;
6424         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6425                 status = mgmt_le_support(hdev);
6426                 if (status)
6427                         return mgmt_cmd_complete(sk, hdev->id,
6428                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6429                                                  status, &cp->type,
6430                                                  sizeof(cp->type));
6431                 eir_len = 9 + 3 + 18 + 18 + 3;
6432                 break;
6433         default:
6434                 return mgmt_cmd_complete(sk, hdev->id,
6435                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6436                                          MGMT_STATUS_INVALID_PARAMS,
6437                                          &cp->type, sizeof(cp->type));
6438         }
6439
6440         hci_dev_lock(hdev);
6441
6442         rp_len = sizeof(*rp) + eir_len;
6443         rp = kmalloc(rp_len, GFP_ATOMIC);
6444         if (!rp) {
6445                 hci_dev_unlock(hdev);
6446                 return -ENOMEM;
6447         }
6448
6449         eir_len = 0;
6450         switch (cp->type) {
6451         case BIT(BDADDR_BREDR):
6452                 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6453                                           hdev->dev_class, 3);
6454                 break;
6455         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6456                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6457                     smp_generate_oob(hdev, hash, rand) < 0) {
6458                         hci_dev_unlock(hdev);
6459                         err = mgmt_cmd_complete(sk, hdev->id,
6460                                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6461                                                 MGMT_STATUS_FAILED,
6462                                                 &cp->type, sizeof(cp->type));
6463                         goto done;
6464                 }
6465
6466                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6467                         memcpy(addr, &hdev->rpa, 6);
6468                         addr[6] = 0x01;
6469                 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6470                            !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6471                            (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6472                             bacmp(&hdev->static_addr, BDADDR_ANY))) {
6473                         memcpy(addr, &hdev->static_addr, 6);
6474                         addr[6] = 0x01;
6475                 } else {
6476                         memcpy(addr, &hdev->bdaddr, 6);
6477                         addr[6] = 0x00;
6478                 }
6479
6480                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6481                                           addr, sizeof(addr));
6482
6483                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6484                         role = 0x02;
6485                 else
6486                         role = 0x01;
6487
6488                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6489                                           &role, sizeof(role));
6490
6491                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6492                         eir_len = eir_append_data(rp->eir, eir_len,
6493                                                   EIR_LE_SC_CONFIRM,
6494                                                   hash, sizeof(hash));
6495
6496                         eir_len = eir_append_data(rp->eir, eir_len,
6497                                                   EIR_LE_SC_RANDOM,
6498                                                   rand, sizeof(rand));
6499                 }
6500
6501                 flags = get_adv_discov_flags(hdev);
6502
6503                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6504                         flags |= LE_AD_NO_BREDR;
6505
6506                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6507                                           &flags, sizeof(flags));
6508                 break;
6509         }
6510
6511         rp->type = cp->type;
6512         rp->eir_len = cpu_to_le16(eir_len);
6513
6514         hci_dev_unlock(hdev);
6515
6516         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6517
6518         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6519                                 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
6520         if (err < 0)
6521                 goto done;
6522
6523         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6524                                  rp, sizeof(*rp) + eir_len,
6525                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6526
6527 done:
6528         kfree(rp);
6529
6530         return err;
6531 }
6532
6533 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6534                              void *data, u16 data_len)
6535 {
6536         struct mgmt_rp_read_adv_features *rp;
6537         size_t rp_len;
6538         int err;
6539         bool instance;
6540
6541         BT_DBG("%s", hdev->name);
6542
6543         hci_dev_lock(hdev);
6544
6545         rp_len = sizeof(*rp);
6546
6547         /* Currently only one instance is supported, so just add 1 to the
6548          * response length.
6549          */
6550         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6551         if (instance)
6552                 rp_len++;
6553
6554         rp = kmalloc(rp_len, GFP_ATOMIC);
6555         if (!rp) {
6556                 hci_dev_unlock(hdev);
6557                 return -ENOMEM;
6558         }
6559
6560         rp->supported_flags = cpu_to_le32(0);
6561         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6562         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6563         rp->max_instances = 1;
6564
6565         /* Currently only one instance is supported, so simply return the
6566          * current instance number.
6567          */
6568         if (instance) {
6569                 rp->num_instances = 1;
6570                 rp->instance[0] = 1;
6571         } else {
6572                 rp->num_instances = 0;
6573         }
6574
6575         hci_dev_unlock(hdev);
6576
6577         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6578                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6579
6580         kfree(rp);
6581
6582         return err;
6583 }
6584
6585 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6586                               u8 len, bool is_adv_data)
6587 {
6588         u8 max_len = HCI_MAX_AD_LENGTH;
6589         int i, cur_len;
6590         bool flags_managed = false;
6591         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6592                            MGMT_ADV_FLAG_MANAGED_FLAGS;
6593
6594         if (is_adv_data && (adv_flags & flags_params)) {
6595                 flags_managed = true;
6596                 max_len -= 3;
6597         }
6598
6599         if (len > max_len)
6600                 return false;
6601
6602         /* Make sure that the data is correctly formatted. */
6603         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6604                 cur_len = data[i];
6605
6606                 if (flags_managed && data[i + 1] == EIR_FLAGS)
6607                         return false;
6608
6609                 /* If the current field length would exceed the total data
6610                  * length, then it's invalid.
6611                  */
6612                 if (i + cur_len >= len)
6613                         return false;
6614         }
6615
6616         return true;
6617 }
6618
6619 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6620                                      u16 opcode)
6621 {
6622         struct mgmt_pending_cmd *cmd;
6623         struct mgmt_rp_add_advertising rp;
6624
6625         BT_DBG("status %d", status);
6626
6627         hci_dev_lock(hdev);
6628
6629         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6630
6631         if (status) {
6632                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6633                 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6634                 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6635         }
6636
6637         if (!cmd)
6638                 goto unlock;
6639
6640         rp.instance = 0x01;
6641
6642         if (status)
6643                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6644                                 mgmt_status(status));
6645         else
6646                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6647                                   mgmt_status(status), &rp, sizeof(rp));
6648
6649         mgmt_pending_remove(cmd);
6650
6651 unlock:
6652         hci_dev_unlock(hdev);
6653 }
6654
6655 static void adv_timeout_expired(struct work_struct *work)
6656 {
6657         struct hci_dev *hdev = container_of(work, struct hci_dev,
6658                                             adv_instance.timeout_exp.work);
6659
6660         hdev->adv_instance.timeout = 0;
6661
6662         hci_dev_lock(hdev);
6663         clear_adv_instance(hdev);
6664         hci_dev_unlock(hdev);
6665 }
6666
6667 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6668                            void *data, u16 data_len)
6669 {
6670         struct mgmt_cp_add_advertising *cp = data;
6671         struct mgmt_rp_add_advertising rp;
6672         u32 flags;
6673         u8 status;
6674         u16 timeout;
6675         int err;
6676         struct mgmt_pending_cmd *cmd;
6677         struct hci_request req;
6678
6679         BT_DBG("%s", hdev->name);
6680
6681         status = mgmt_le_support(hdev);
6682         if (status)
6683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6684                                        status);
6685
6686         flags = __le32_to_cpu(cp->flags);
6687         timeout = __le16_to_cpu(cp->timeout);
6688
6689         /* The current implementation only supports adding one instance */
6690         if (cp->instance != 0x01)
6691                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6692                                        MGMT_STATUS_INVALID_PARAMS);
6693
6694         hci_dev_lock(hdev);
6695
6696         if (timeout && !hdev_is_powered(hdev)) {
6697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6698                                       MGMT_STATUS_REJECTED);
6699                 goto unlock;
6700         }
6701
6702         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6703             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6704             pending_find(MGMT_OP_SET_LE, hdev)) {
6705                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6706                                       MGMT_STATUS_BUSY);
6707                 goto unlock;
6708         }
6709
6710         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6711             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6712                                cp->scan_rsp_len, false)) {
6713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6714                                       MGMT_STATUS_INVALID_PARAMS);
6715                 goto unlock;
6716         }
6717
6718         INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6719
6720         hdev->adv_instance.flags = flags;
6721         hdev->adv_instance.adv_data_len = cp->adv_data_len;
6722         hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6723
6724         if (cp->adv_data_len)
6725                 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6726
6727         if (cp->scan_rsp_len)
6728                 memcpy(hdev->adv_instance.scan_rsp_data,
6729                        cp->data + cp->adv_data_len, cp->scan_rsp_len);
6730
6731         if (hdev->adv_instance.timeout)
6732                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6733
6734         hdev->adv_instance.timeout = timeout;
6735
6736         if (timeout)
6737                 queue_delayed_work(hdev->workqueue,
6738                                    &hdev->adv_instance.timeout_exp,
6739                                    msecs_to_jiffies(timeout * 1000));
6740
6741         if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6742                 advertising_added(sk, hdev, 1);
6743
6744         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6745          * we have no HCI communication to make. Simply return.
6746          */
6747         if (!hdev_is_powered(hdev) ||
6748             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6749                 rp.instance = 0x01;
6750                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6751                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6752                 goto unlock;
6753         }
6754
6755         /* We're good to go, update advertising data, parameters, and start
6756          * advertising.
6757          */
6758         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6759                                data_len);
6760         if (!cmd) {
6761                 err = -ENOMEM;
6762                 goto unlock;
6763         }
6764
6765         hci_req_init(&req, hdev);
6766
6767         update_adv_data(&req);
6768         update_scan_rsp_data(&req);
6769         enable_advertising(&req);
6770
6771         err = hci_req_run(&req, add_advertising_complete);
6772         if (err < 0)
6773                 mgmt_pending_remove(cmd);
6774
6775 unlock:
6776         hci_dev_unlock(hdev);
6777
6778         return err;
6779 }
6780
6781 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6782                                         u16 opcode)
6783 {
6784         struct mgmt_pending_cmd *cmd;
6785         struct mgmt_rp_remove_advertising rp;
6786
6787         BT_DBG("status %d", status);
6788
6789         hci_dev_lock(hdev);
6790
6791         /* A failure status here only means that we failed to disable
6792          * advertising. Otherwise, the advertising instance has been removed,
6793          * so report success.
6794          */
6795         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6796         if (!cmd)
6797                 goto unlock;
6798
6799         rp.instance = 1;
6800
6801         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6802                           &rp, sizeof(rp));
6803         mgmt_pending_remove(cmd);
6804
6805 unlock:
6806         hci_dev_unlock(hdev);
6807 }
6808
6809 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6810                               void *data, u16 data_len)
6811 {
6812         struct mgmt_cp_remove_advertising *cp = data;
6813         struct mgmt_rp_remove_advertising rp;
6814         int err;
6815         struct mgmt_pending_cmd *cmd;
6816         struct hci_request req;
6817
6818         BT_DBG("%s", hdev->name);
6819
6820         /* The current implementation only allows modifying instance no 1. A
6821          * value of 0 indicates that all instances should be cleared.
6822          */
6823         if (cp->instance > 1)
6824                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6825                                        MGMT_STATUS_INVALID_PARAMS);
6826
6827         hci_dev_lock(hdev);
6828
6829         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6830             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6831             pending_find(MGMT_OP_SET_LE, hdev)) {
6832                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6833                                       MGMT_STATUS_BUSY);
6834                 goto unlock;
6835         }
6836
6837         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6838                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6839                                       MGMT_STATUS_INVALID_PARAMS);
6840                 goto unlock;
6841         }
6842
6843         if (hdev->adv_instance.timeout)
6844                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6845
6846         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6847
6848         advertising_removed(sk, hdev, 1);
6849
6850         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6851
6852         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6853          * we have no HCI communication to make. Simply return.
6854          */
6855         if (!hdev_is_powered(hdev) ||
6856             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6857                 rp.instance = 1;
6858                 err = mgmt_cmd_complete(sk, hdev->id,
6859                                         MGMT_OP_REMOVE_ADVERTISING,
6860                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6861                 goto unlock;
6862         }
6863
6864         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6865                                data_len);
6866         if (!cmd) {
6867                 err = -ENOMEM;
6868                 goto unlock;
6869         }
6870
6871         hci_req_init(&req, hdev);
6872         disable_advertising(&req);
6873
6874         err = hci_req_run(&req, remove_advertising_complete);
6875         if (err < 0)
6876                 mgmt_pending_remove(cmd);
6877
6878 unlock:
6879         hci_dev_unlock(hdev);
6880
6881         return err;
6882 }
6883
6884 static const struct hci_mgmt_handler mgmt_handlers[] = {
6885         { NULL }, /* 0x0000 (no command) */
6886         { read_version,            MGMT_READ_VERSION_SIZE,
6887                                                 HCI_MGMT_NO_HDEV |
6888                                                 HCI_MGMT_UNTRUSTED },
6889         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6890                                                 HCI_MGMT_NO_HDEV |
6891                                                 HCI_MGMT_UNTRUSTED },
6892         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6893                                                 HCI_MGMT_NO_HDEV |
6894                                                 HCI_MGMT_UNTRUSTED },
6895         { read_controller_info,    MGMT_READ_INFO_SIZE,
6896                                                 HCI_MGMT_UNTRUSTED },
6897         { set_powered,             MGMT_SETTING_SIZE },
6898         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6899         { set_connectable,         MGMT_SETTING_SIZE },
6900         { set_fast_connectable,    MGMT_SETTING_SIZE },
6901         { set_bondable,            MGMT_SETTING_SIZE },
6902         { set_link_security,       MGMT_SETTING_SIZE },
6903         { set_ssp,                 MGMT_SETTING_SIZE },
6904         { set_hs,                  MGMT_SETTING_SIZE },
6905         { set_le,                  MGMT_SETTING_SIZE },
6906         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6907         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6908         { add_uuid,                MGMT_ADD_UUID_SIZE },
6909         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6910         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6911                                                 HCI_MGMT_VAR_LEN },
6912         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6913                                                 HCI_MGMT_VAR_LEN },
6914         { disconnect,              MGMT_DISCONNECT_SIZE },
6915         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6916         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6917         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6918         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6919         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6920         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6921         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6922         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6923         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6924         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6925         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6926         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6927         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6928                                                 HCI_MGMT_VAR_LEN },
6929         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6930         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6931         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6932         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6933         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6934         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6935         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6936         { set_advertising,         MGMT_SETTING_SIZE },
6937         { set_bredr,               MGMT_SETTING_SIZE },
6938         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6939         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6940         { set_secure_conn,         MGMT_SETTING_SIZE },
6941         { set_debug_keys,          MGMT_SETTING_SIZE },
6942         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6943         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6944                                                 HCI_MGMT_VAR_LEN },
6945         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6946         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6947         { add_device,              MGMT_ADD_DEVICE_SIZE },
6948         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6949         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6950                                                 HCI_MGMT_VAR_LEN },
6951         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6952                                                 HCI_MGMT_NO_HDEV |
6953                                                 HCI_MGMT_UNTRUSTED },
6954         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6955                                                 HCI_MGMT_UNCONFIGURED |
6956                                                 HCI_MGMT_UNTRUSTED },
6957         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6958                                                 HCI_MGMT_UNCONFIGURED },
6959         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6960                                                 HCI_MGMT_UNCONFIGURED },
6961         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6962                                                 HCI_MGMT_VAR_LEN },
6963         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6964         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6965                                                 HCI_MGMT_NO_HDEV |
6966                                                 HCI_MGMT_UNTRUSTED },
6967         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6968         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6969                                                 HCI_MGMT_VAR_LEN },
6970         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6971 };
6972
6973 void mgmt_index_added(struct hci_dev *hdev)
6974 {
6975         struct mgmt_ev_ext_index ev;
6976
6977         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6978                 return;
6979
6980         switch (hdev->dev_type) {
6981         case HCI_BREDR:
6982                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6983                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6984                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6985                         ev.type = 0x01;
6986                 } else {
6987                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6988                                          HCI_MGMT_INDEX_EVENTS);
6989                         ev.type = 0x00;
6990                 }
6991                 break;
6992         case HCI_AMP:
6993                 ev.type = 0x02;
6994                 break;
6995         default:
6996                 return;
6997         }
6998
6999         ev.bus = hdev->bus;
7000
7001         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7002                          HCI_MGMT_EXT_INDEX_EVENTS);
7003 }
7004
7005 void mgmt_index_removed(struct hci_dev *hdev)
7006 {
7007         struct mgmt_ev_ext_index ev;
7008         u8 status = MGMT_STATUS_INVALID_INDEX;
7009
7010         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7011                 return;
7012
7013         switch (hdev->dev_type) {
7014         case HCI_BREDR:
7015                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7016
7017                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7018                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7019                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7020                         ev.type = 0x01;
7021                 } else {
7022                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7023                                          HCI_MGMT_INDEX_EVENTS);
7024                         ev.type = 0x00;
7025                 }
7026                 break;
7027         case HCI_AMP:
7028                 ev.type = 0x02;
7029                 break;
7030         default:
7031                 return;
7032         }
7033
7034         ev.bus = hdev->bus;
7035
7036         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7037                          HCI_MGMT_EXT_INDEX_EVENTS);
7038 }
7039
7040 /* This function requires the caller holds hdev->lock */
7041 static void restart_le_actions(struct hci_request *req)
7042 {
7043         struct hci_dev *hdev = req->hdev;
7044         struct hci_conn_params *p;
7045
7046         list_for_each_entry(p, &hdev->le_conn_params, list) {
7047                 /* Needed for AUTO_OFF case where might not "really"
7048                  * have been powered off.
7049                  */
7050                 list_del_init(&p->action);
7051
7052                 switch (p->auto_connect) {
7053                 case HCI_AUTO_CONN_DIRECT:
7054                 case HCI_AUTO_CONN_ALWAYS:
7055                         list_add(&p->action, &hdev->pend_le_conns);
7056                         break;
7057                 case HCI_AUTO_CONN_REPORT:
7058                         list_add(&p->action, &hdev->pend_le_reports);
7059                         break;
7060                 default:
7061                         break;
7062                 }
7063         }
7064
7065         __hci_update_background_scan(req);
7066 }
7067
7068 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7069 {
7070         struct cmd_lookup match = { NULL, hdev };
7071
7072         BT_DBG("status 0x%02x", status);
7073
7074         if (!status) {
7075                 /* Register the available SMP channels (BR/EDR and LE) only
7076                  * when successfully powering on the controller. This late
7077                  * registration is required so that LE SMP can clearly
7078                  * decide if the public address or static address is used.
7079                  */
7080                 smp_register(hdev);
7081         }
7082
7083         hci_dev_lock(hdev);
7084
7085         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7086
7087         new_settings(hdev, match.sk);
7088
7089         hci_dev_unlock(hdev);
7090
7091         if (match.sk)
7092                 sock_put(match.sk);
7093 }
7094
7095 static int powered_update_hci(struct hci_dev *hdev)
7096 {
7097         struct hci_request req;
7098         u8 link_sec;
7099
7100         hci_req_init(&req, hdev);
7101
7102         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7103             !lmp_host_ssp_capable(hdev)) {
7104                 u8 mode = 0x01;
7105
7106                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7107
7108                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7109                         u8 support = 0x01;
7110
7111                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7112                                     sizeof(support), &support);
7113                 }
7114         }
7115
7116         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7117             lmp_bredr_capable(hdev)) {
7118                 struct hci_cp_write_le_host_supported cp;
7119
7120                 cp.le = 0x01;
7121                 cp.simul = 0x00;
7122
7123                 /* Check first if we already have the right
7124                  * host state (host features set)
7125                  */
7126                 if (cp.le != lmp_host_le_capable(hdev) ||
7127                     cp.simul != lmp_host_le_br_capable(hdev))
7128                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7129                                     sizeof(cp), &cp);
7130         }
7131
7132         if (lmp_le_capable(hdev)) {
7133                 /* Make sure the controller has a good default for
7134                  * advertising data. This also applies to the case
7135                  * where BR/EDR was toggled during the AUTO_OFF phase.
7136                  */
7137                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
7138                         update_adv_data(&req);
7139                         update_scan_rsp_data(&req);
7140                 }
7141
7142                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7143                     hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
7144                         enable_advertising(&req);
7145
7146                 restart_le_actions(&req);
7147         }
7148
7149         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7150         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7151                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7152                             sizeof(link_sec), &link_sec);
7153
7154         if (lmp_bredr_capable(hdev)) {
7155                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7156                         write_fast_connectable(&req, true);
7157                 else
7158                         write_fast_connectable(&req, false);
7159                 __hci_update_page_scan(&req);
7160                 update_class(&req);
7161                 update_name(&req);
7162                 update_eir(&req);
7163         }
7164
7165         return hci_req_run(&req, powered_complete);
7166 }
7167
7168 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7169 {
7170         struct cmd_lookup match = { NULL, hdev };
7171         u8 status, zero_cod[] = { 0, 0, 0 };
7172         int err;
7173
7174         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7175                 return 0;
7176
7177         if (powered) {
7178                 if (powered_update_hci(hdev) == 0)
7179                         return 0;
7180
7181                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7182                                      &match);
7183                 goto new_settings;
7184         }
7185
7186         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7187
7188         /* If the power off is because of hdev unregistration let
7189          * use the appropriate INVALID_INDEX status. Otherwise use
7190          * NOT_POWERED. We cover both scenarios here since later in
7191          * mgmt_index_removed() any hci_conn callbacks will have already
7192          * been triggered, potentially causing misleading DISCONNECTED
7193          * status responses.
7194          */
7195         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7196                 status = MGMT_STATUS_INVALID_INDEX;
7197         else
7198                 status = MGMT_STATUS_NOT_POWERED;
7199
7200         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7201
7202         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7203                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7204                                    zero_cod, sizeof(zero_cod), NULL);
7205
7206 new_settings:
7207         err = new_settings(hdev, match.sk);
7208
7209         if (match.sk)
7210                 sock_put(match.sk);
7211
7212         return err;
7213 }
7214
7215 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7216 {
7217         struct mgmt_pending_cmd *cmd;
7218         u8 status;
7219
7220         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7221         if (!cmd)
7222                 return;
7223
7224         if (err == -ERFKILL)
7225                 status = MGMT_STATUS_RFKILLED;
7226         else
7227                 status = MGMT_STATUS_FAILED;
7228
7229         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7230
7231         mgmt_pending_remove(cmd);
7232 }
7233
7234 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7235 {
7236         struct hci_request req;
7237
7238         hci_dev_lock(hdev);
7239
7240         /* When discoverable timeout triggers, then just make sure
7241          * the limited discoverable flag is cleared. Even in the case
7242          * of a timeout triggered from general discoverable, it is
7243          * safe to unconditionally clear the flag.
7244          */
7245         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7246         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7247
7248         hci_req_init(&req, hdev);
7249         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7250                 u8 scan = SCAN_PAGE;
7251                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7252                             sizeof(scan), &scan);
7253         }
7254         update_class(&req);
7255
7256         /* Advertising instances don't use the global discoverable setting, so
7257          * only update AD if advertising was enabled using Set Advertising.
7258          */
7259         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7260                 update_adv_data(&req);
7261
7262         hci_req_run(&req, NULL);
7263
7264         hdev->discov_timeout = 0;
7265
7266         new_settings(hdev, NULL);
7267
7268         hci_dev_unlock(hdev);
7269 }
7270
7271 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7272                        bool persistent)
7273 {
7274         struct mgmt_ev_new_link_key ev;
7275
7276         memset(&ev, 0, sizeof(ev));
7277
7278         ev.store_hint = persistent;
7279         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7280         ev.key.addr.type = BDADDR_BREDR;
7281         ev.key.type = key->type;
7282         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7283         ev.key.pin_len = key->pin_len;
7284
7285         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7286 }
7287
7288 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7289 {
7290         switch (ltk->type) {
7291         case SMP_LTK:
7292         case SMP_LTK_SLAVE:
7293                 if (ltk->authenticated)
7294                         return MGMT_LTK_AUTHENTICATED;
7295                 return MGMT_LTK_UNAUTHENTICATED;
7296         case SMP_LTK_P256:
7297                 if (ltk->authenticated)
7298                         return MGMT_LTK_P256_AUTH;
7299                 return MGMT_LTK_P256_UNAUTH;
7300         case SMP_LTK_P256_DEBUG:
7301                 return MGMT_LTK_P256_DEBUG;
7302         }
7303
7304         return MGMT_LTK_UNAUTHENTICATED;
7305 }
7306
7307 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7308 {
7309         struct mgmt_ev_new_long_term_key ev;
7310
7311         memset(&ev, 0, sizeof(ev));
7312
7313         /* Devices using resolvable or non-resolvable random addresses
7314          * without providing an indentity resolving key don't require
7315          * to store long term keys. Their addresses will change the
7316          * next time around.
7317          *
7318          * Only when a remote device provides an identity address
7319          * make sure the long term key is stored. If the remote
7320          * identity is known, the long term keys are internally
7321          * mapped to the identity address. So allow static random
7322          * and public addresses here.
7323          */
7324         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7325             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7326                 ev.store_hint = 0x00;
7327         else
7328                 ev.store_hint = persistent;
7329
7330         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7331         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7332         ev.key.type = mgmt_ltk_type(key);
7333         ev.key.enc_size = key->enc_size;
7334         ev.key.ediv = key->ediv;
7335         ev.key.rand = key->rand;
7336
7337         if (key->type == SMP_LTK)
7338                 ev.key.master = 1;
7339
7340         memcpy(ev.key.val, key->val, sizeof(key->val));
7341
7342         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7343 }
7344
7345 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7346 {
7347         struct mgmt_ev_new_irk ev;
7348
7349         memset(&ev, 0, sizeof(ev));
7350
7351         /* For identity resolving keys from devices that are already
7352          * using a public address or static random address, do not
7353          * ask for storing this key. The identity resolving key really
7354          * is only mandatory for devices using resovlable random
7355          * addresses.
7356          *
7357          * Storing all identity resolving keys has the downside that
7358          * they will be also loaded on next boot of they system. More
7359          * identity resolving keys, means more time during scanning is
7360          * needed to actually resolve these addresses.
7361          */
7362         if (bacmp(&irk->rpa, BDADDR_ANY))
7363                 ev.store_hint = 0x01;
7364         else
7365                 ev.store_hint = 0x00;
7366
7367         bacpy(&ev.rpa, &irk->rpa);
7368         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7369         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7370         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7371
7372         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7373 }
7374
7375 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7376                    bool persistent)
7377 {
7378         struct mgmt_ev_new_csrk ev;
7379
7380         memset(&ev, 0, sizeof(ev));
7381
7382         /* Devices using resolvable or non-resolvable random addresses
7383          * without providing an indentity resolving key don't require
7384          * to store signature resolving keys. Their addresses will change
7385          * the next time around.
7386          *
7387          * Only when a remote device provides an identity address
7388          * make sure the signature resolving key is stored. So allow
7389          * static random and public addresses here.
7390          */
7391         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7392             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7393                 ev.store_hint = 0x00;
7394         else
7395                 ev.store_hint = persistent;
7396
7397         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7398         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7399         ev.key.type = csrk->type;
7400         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7401
7402         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7403 }
7404
7405 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7406                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7407                          u16 max_interval, u16 latency, u16 timeout)
7408 {
7409         struct mgmt_ev_new_conn_param ev;
7410
7411         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7412                 return;
7413
7414         memset(&ev, 0, sizeof(ev));
7415         bacpy(&ev.addr.bdaddr, bdaddr);
7416         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7417         ev.store_hint = store_hint;
7418         ev.min_interval = cpu_to_le16(min_interval);
7419         ev.max_interval = cpu_to_le16(max_interval);
7420         ev.latency = cpu_to_le16(latency);
7421         ev.timeout = cpu_to_le16(timeout);
7422
7423         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7424 }
7425
7426 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7427                            u32 flags, u8 *name, u8 name_len)
7428 {
7429         char buf[512];
7430         struct mgmt_ev_device_connected *ev = (void *) buf;
7431         u16 eir_len = 0;
7432
7433         bacpy(&ev->addr.bdaddr, &conn->dst);
7434         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7435
7436         ev->flags = __cpu_to_le32(flags);
7437
7438         /* We must ensure that the EIR Data fields are ordered and
7439          * unique. Keep it simple for now and avoid the problem by not
7440          * adding any BR/EDR data to the LE adv.
7441          */
7442         if (conn->le_adv_data_len > 0) {
7443                 memcpy(&ev->eir[eir_len],
7444                        conn->le_adv_data, conn->le_adv_data_len);
7445                 eir_len = conn->le_adv_data_len;
7446         } else {
7447                 if (name_len > 0)
7448                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7449                                                   name, name_len);
7450
7451                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7452                         eir_len = eir_append_data(ev->eir, eir_len,
7453                                                   EIR_CLASS_OF_DEV,
7454                                                   conn->dev_class, 3);
7455         }
7456
7457         ev->eir_len = cpu_to_le16(eir_len);
7458
7459         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7460                     sizeof(*ev) + eir_len, NULL);
7461 }
7462
7463 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7464 {
7465         struct sock **sk = data;
7466
7467         cmd->cmd_complete(cmd, 0);
7468
7469         *sk = cmd->sk;
7470         sock_hold(*sk);
7471
7472         mgmt_pending_remove(cmd);
7473 }
7474
7475 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7476 {
7477         struct hci_dev *hdev = data;
7478         struct mgmt_cp_unpair_device *cp = cmd->param;
7479
7480         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7481
7482         cmd->cmd_complete(cmd, 0);
7483         mgmt_pending_remove(cmd);
7484 }
7485
7486 bool mgmt_powering_down(struct hci_dev *hdev)
7487 {
7488         struct mgmt_pending_cmd *cmd;
7489         struct mgmt_mode *cp;
7490
7491         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7492         if (!cmd)
7493                 return false;
7494
7495         cp = cmd->param;
7496         if (!cp->val)
7497                 return true;
7498
7499         return false;
7500 }
7501
7502 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7503                               u8 link_type, u8 addr_type, u8 reason,
7504                               bool mgmt_connected)
7505 {
7506         struct mgmt_ev_device_disconnected ev;
7507         struct sock *sk = NULL;
7508
7509         /* The connection is still in hci_conn_hash so test for 1
7510          * instead of 0 to know if this is the last one.
7511          */
7512         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7513                 cancel_delayed_work(&hdev->power_off);
7514                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7515         }
7516
7517         if (!mgmt_connected)
7518                 return;
7519
7520         if (link_type != ACL_LINK && link_type != LE_LINK)
7521                 return;
7522
7523         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7524
7525         bacpy(&ev.addr.bdaddr, bdaddr);
7526         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7527         ev.reason = reason;
7528
7529         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7530
7531         if (sk)
7532                 sock_put(sk);
7533
7534         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7535                              hdev);
7536 }
7537
7538 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7539                             u8 link_type, u8 addr_type, u8 status)
7540 {
7541         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7542         struct mgmt_cp_disconnect *cp;
7543         struct mgmt_pending_cmd *cmd;
7544
7545         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7546                              hdev);
7547
7548         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7549         if (!cmd)
7550                 return;
7551
7552         cp = cmd->param;
7553
7554         if (bacmp(bdaddr, &cp->addr.bdaddr))
7555                 return;
7556
7557         if (cp->addr.type != bdaddr_type)
7558                 return;
7559
7560         cmd->cmd_complete(cmd, mgmt_status(status));
7561         mgmt_pending_remove(cmd);
7562 }
7563
7564 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7565                          u8 addr_type, u8 status)
7566 {
7567         struct mgmt_ev_connect_failed ev;
7568
7569         /* The connection is still in hci_conn_hash so test for 1
7570          * instead of 0 to know if this is the last one.
7571          */
7572         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7573                 cancel_delayed_work(&hdev->power_off);
7574                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7575         }
7576
7577         bacpy(&ev.addr.bdaddr, bdaddr);
7578         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7579         ev.status = mgmt_status(status);
7580
7581         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7582 }
7583
7584 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7585 {
7586         struct mgmt_ev_pin_code_request ev;
7587
7588         bacpy(&ev.addr.bdaddr, bdaddr);
7589         ev.addr.type = BDADDR_BREDR;
7590         ev.secure = secure;
7591
7592         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7593 }
7594
7595 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7596                                   u8 status)
7597 {
7598         struct mgmt_pending_cmd *cmd;
7599
7600         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7601         if (!cmd)
7602                 return;
7603
7604         cmd->cmd_complete(cmd, mgmt_status(status));
7605         mgmt_pending_remove(cmd);
7606 }
7607
7608 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7609                                       u8 status)
7610 {
7611         struct mgmt_pending_cmd *cmd;
7612
7613         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7614         if (!cmd)
7615                 return;
7616
7617         cmd->cmd_complete(cmd, mgmt_status(status));
7618         mgmt_pending_remove(cmd);
7619 }
7620
7621 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7622                               u8 link_type, u8 addr_type, u32 value,
7623                               u8 confirm_hint)
7624 {
7625         struct mgmt_ev_user_confirm_request ev;
7626
7627         BT_DBG("%s", hdev->name);
7628
7629         bacpy(&ev.addr.bdaddr, bdaddr);
7630         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7631         ev.confirm_hint = confirm_hint;
7632         ev.value = cpu_to_le32(value);
7633
7634         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7635                           NULL);
7636 }
7637
7638 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7639                               u8 link_type, u8 addr_type)
7640 {
7641         struct mgmt_ev_user_passkey_request ev;
7642
7643         BT_DBG("%s", hdev->name);
7644
7645         bacpy(&ev.addr.bdaddr, bdaddr);
7646         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7647
7648         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7649                           NULL);
7650 }
7651
7652 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7653                                       u8 link_type, u8 addr_type, u8 status,
7654                                       u8 opcode)
7655 {
7656         struct mgmt_pending_cmd *cmd;
7657
7658         cmd = pending_find(opcode, hdev);
7659         if (!cmd)
7660                 return -ENOENT;
7661
7662         cmd->cmd_complete(cmd, mgmt_status(status));
7663         mgmt_pending_remove(cmd);
7664
7665         return 0;
7666 }
7667
7668 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7669                                      u8 link_type, u8 addr_type, u8 status)
7670 {
7671         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7672                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7673 }
7674
7675 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7676                                          u8 link_type, u8 addr_type, u8 status)
7677 {
7678         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7679                                           status,
7680                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7681 }
7682
7683 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7684                                      u8 link_type, u8 addr_type, u8 status)
7685 {
7686         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7687                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7688 }
7689
7690 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7691                                          u8 link_type, u8 addr_type, u8 status)
7692 {
7693         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7694                                           status,
7695                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7696 }
7697
7698 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7699                              u8 link_type, u8 addr_type, u32 passkey,
7700                              u8 entered)
7701 {
7702         struct mgmt_ev_passkey_notify ev;
7703
7704         BT_DBG("%s", hdev->name);
7705
7706         bacpy(&ev.addr.bdaddr, bdaddr);
7707         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7708         ev.passkey = __cpu_to_le32(passkey);
7709         ev.entered = entered;
7710
7711         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7712 }
7713
7714 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7715 {
7716         struct mgmt_ev_auth_failed ev;
7717         struct mgmt_pending_cmd *cmd;
7718         u8 status = mgmt_status(hci_status);
7719
7720         bacpy(&ev.addr.bdaddr, &conn->dst);
7721         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7722         ev.status = status;
7723
7724         cmd = find_pairing(conn);
7725
7726         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7727                     cmd ? cmd->sk : NULL);
7728
7729         if (cmd) {
7730                 cmd->cmd_complete(cmd, status);
7731                 mgmt_pending_remove(cmd);
7732         }
7733 }
7734
7735 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7736 {
7737         struct cmd_lookup match = { NULL, hdev };
7738         bool changed;
7739
7740         if (status) {
7741                 u8 mgmt_err = mgmt_status(status);
7742                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7743                                      cmd_status_rsp, &mgmt_err);
7744                 return;
7745         }
7746
7747         if (test_bit(HCI_AUTH, &hdev->flags))
7748                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7749         else
7750                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7751
7752         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7753                              &match);
7754
7755         if (changed)
7756                 new_settings(hdev, match.sk);
7757
7758         if (match.sk)
7759                 sock_put(match.sk);
7760 }
7761
7762 static void clear_eir(struct hci_request *req)
7763 {
7764         struct hci_dev *hdev = req->hdev;
7765         struct hci_cp_write_eir cp;
7766
7767         if (!lmp_ext_inq_capable(hdev))
7768                 return;
7769
7770         memset(hdev->eir, 0, sizeof(hdev->eir));
7771
7772         memset(&cp, 0, sizeof(cp));
7773
7774         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7775 }
7776
7777 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7778 {
7779         struct cmd_lookup match = { NULL, hdev };
7780         struct hci_request req;
7781         bool changed = false;
7782
7783         if (status) {
7784                 u8 mgmt_err = mgmt_status(status);
7785
7786                 if (enable && hci_dev_test_and_clear_flag(hdev,
7787                                                           HCI_SSP_ENABLED)) {
7788                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7789                         new_settings(hdev, NULL);
7790                 }
7791
7792                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7793                                      &mgmt_err);
7794                 return;
7795         }
7796
7797         if (enable) {
7798                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7799         } else {
7800                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7801                 if (!changed)
7802                         changed = hci_dev_test_and_clear_flag(hdev,
7803                                                               HCI_HS_ENABLED);
7804                 else
7805                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7806         }
7807
7808         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7809
7810         if (changed)
7811                 new_settings(hdev, match.sk);
7812
7813         if (match.sk)
7814                 sock_put(match.sk);
7815
7816         hci_req_init(&req, hdev);
7817
7818         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7819                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7820                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7821                                     sizeof(enable), &enable);
7822                 update_eir(&req);
7823         } else {
7824                 clear_eir(&req);
7825         }
7826
7827         hci_req_run(&req, NULL);
7828 }
7829
7830 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7831 {
7832         struct cmd_lookup *match = data;
7833
7834         if (match->sk == NULL) {
7835                 match->sk = cmd->sk;
7836                 sock_hold(match->sk);
7837         }
7838 }
7839
7840 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7841                                     u8 status)
7842 {
7843         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7844
7845         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7846         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7847         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7848
7849         if (!status)
7850                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7851                                    dev_class, 3, NULL);
7852
7853         if (match.sk)
7854                 sock_put(match.sk);
7855 }
7856
7857 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7858 {
7859         struct mgmt_cp_set_local_name ev;
7860         struct mgmt_pending_cmd *cmd;
7861
7862         if (status)
7863                 return;
7864
7865         memset(&ev, 0, sizeof(ev));
7866         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7867         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7868
7869         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7870         if (!cmd) {
7871                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7872
7873                 /* If this is a HCI command related to powering on the
7874                  * HCI dev don't send any mgmt signals.
7875                  */
7876                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7877                         return;
7878         }
7879
7880         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7881                            cmd ? cmd->sk : NULL);
7882 }
7883
7884 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7885                                        u8 *rand192, u8 *hash256, u8 *rand256,
7886                                        u8 status)
7887 {
7888         struct mgmt_pending_cmd *cmd;
7889
7890         BT_DBG("%s status %u", hdev->name, status);
7891
7892         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7893         if (!cmd)
7894                 return;
7895
7896         if (status) {
7897                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7898                                 mgmt_status(status));
7899         } else {
7900                 struct mgmt_rp_read_local_oob_data rp;
7901                 size_t rp_size = sizeof(rp);
7902
7903                 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7904                 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7905
7906                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7907                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7908                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7909                 } else {
7910                         rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
7911                 }
7912
7913                 mgmt_cmd_complete(cmd->sk, hdev->id,
7914                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7915                                   &rp, rp_size);
7916         }
7917
7918         mgmt_pending_remove(cmd);
7919 }
7920
7921 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7922 {
7923         int i;
7924
7925         for (i = 0; i < uuid_count; i++) {
7926                 if (!memcmp(uuid, uuids[i], 16))
7927                         return true;
7928         }
7929
7930         return false;
7931 }
7932
7933 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7934 {
7935         u16 parsed = 0;
7936
7937         while (parsed < eir_len) {
7938                 u8 field_len = eir[0];
7939                 u8 uuid[16];
7940                 int i;
7941
7942                 if (field_len == 0)
7943                         break;
7944
7945                 if (eir_len - parsed < field_len + 1)
7946                         break;
7947
7948                 switch (eir[1]) {
7949                 case EIR_UUID16_ALL:
7950                 case EIR_UUID16_SOME:
7951                         for (i = 0; i + 3 <= field_len; i += 2) {
7952                                 memcpy(uuid, bluetooth_base_uuid, 16);
7953                                 uuid[13] = eir[i + 3];
7954                                 uuid[12] = eir[i + 2];
7955                                 if (has_uuid(uuid, uuid_count, uuids))
7956                                         return true;
7957                         }
7958                         break;
7959                 case EIR_UUID32_ALL:
7960                 case EIR_UUID32_SOME:
7961                         for (i = 0; i + 5 <= field_len; i += 4) {
7962                                 memcpy(uuid, bluetooth_base_uuid, 16);
7963                                 uuid[15] = eir[i + 5];
7964                                 uuid[14] = eir[i + 4];
7965                                 uuid[13] = eir[i + 3];
7966                                 uuid[12] = eir[i + 2];
7967                                 if (has_uuid(uuid, uuid_count, uuids))
7968                                         return true;
7969                         }
7970                         break;
7971                 case EIR_UUID128_ALL:
7972                 case EIR_UUID128_SOME:
7973                         for (i = 0; i + 17 <= field_len; i += 16) {
7974                                 memcpy(uuid, eir + i + 2, 16);
7975                                 if (has_uuid(uuid, uuid_count, uuids))
7976                                         return true;
7977                         }
7978                         break;
7979                 }
7980
7981                 parsed += field_len + 1;
7982                 eir += field_len + 1;
7983         }
7984
7985         return false;
7986 }
7987
7988 static void restart_le_scan(struct hci_dev *hdev)
7989 {
7990         /* If controller is not scanning we are done. */
7991         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7992                 return;
7993
7994         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7995                        hdev->discovery.scan_start +
7996                        hdev->discovery.scan_duration))
7997                 return;
7998
7999         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8000                            DISCOV_LE_RESTART_DELAY);
8001 }
8002
8003 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8004                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8005 {
8006         /* If a RSSI threshold has been specified, and
8007          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8008          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8009          * is set, let it through for further processing, as we might need to
8010          * restart the scan.
8011          *
8012          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8013          * the results are also dropped.
8014          */
8015         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8016             (rssi == HCI_RSSI_INVALID ||
8017             (rssi < hdev->discovery.rssi &&
8018              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8019                 return  false;
8020
8021         if (hdev->discovery.uuid_count != 0) {
8022                 /* If a list of UUIDs is provided in filter, results with no
8023                  * matching UUID should be dropped.
8024                  */
8025                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8026                                    hdev->discovery.uuids) &&
8027                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8028                                    hdev->discovery.uuid_count,
8029                                    hdev->discovery.uuids))
8030                         return false;
8031         }
8032
8033         /* If duplicate filtering does not report RSSI changes, then restart
8034          * scanning to ensure updated result with updated RSSI values.
8035          */
8036         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8037                 restart_le_scan(hdev);
8038
8039                 /* Validate RSSI value against the RSSI threshold once more. */
8040                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8041                     rssi < hdev->discovery.rssi)
8042                         return false;
8043         }
8044
8045         return true;
8046 }
8047
8048 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8049                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8050                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8051 {
8052         char buf[512];
8053         struct mgmt_ev_device_found *ev = (void *)buf;
8054         size_t ev_size;
8055
8056         /* Don't send events for a non-kernel initiated discovery. With
8057          * LE one exception is if we have pend_le_reports > 0 in which
8058          * case we're doing passive scanning and want these events.
8059          */
8060         if (!hci_discovery_active(hdev)) {
8061                 if (link_type == ACL_LINK)
8062                         return;
8063                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8064                         return;
8065         }
8066
8067         if (hdev->discovery.result_filtering) {
8068                 /* We are using service discovery */
8069                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8070                                      scan_rsp_len))
8071                         return;
8072         }
8073
8074         /* Make sure that the buffer is big enough. The 5 extra bytes
8075          * are for the potential CoD field.
8076          */
8077         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8078                 return;
8079
8080         memset(buf, 0, sizeof(buf));
8081
8082         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8083          * RSSI value was reported as 0 when not available. This behavior
8084          * is kept when using device discovery. This is required for full
8085          * backwards compatibility with the API.
8086          *
8087          * However when using service discovery, the value 127 will be
8088          * returned when the RSSI is not available.
8089          */
8090         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8091             link_type == ACL_LINK)
8092                 rssi = 0;
8093
8094         bacpy(&ev->addr.bdaddr, bdaddr);
8095         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8096         ev->rssi = rssi;
8097         ev->flags = cpu_to_le32(flags);
8098
8099         if (eir_len > 0)
8100                 /* Copy EIR or advertising data into event */
8101                 memcpy(ev->eir, eir, eir_len);
8102
8103         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8104                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8105                                           dev_class, 3);
8106
8107         if (scan_rsp_len > 0)
8108                 /* Append scan response data to event */
8109                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8110
8111         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8112         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8113
8114         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8115 }
8116
8117 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8118                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8119 {
8120         struct mgmt_ev_device_found *ev;
8121         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8122         u16 eir_len;
8123
8124         ev = (struct mgmt_ev_device_found *) buf;
8125
8126         memset(buf, 0, sizeof(buf));
8127
8128         bacpy(&ev->addr.bdaddr, bdaddr);
8129         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8130         ev->rssi = rssi;
8131
8132         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8133                                   name_len);
8134
8135         ev->eir_len = cpu_to_le16(eir_len);
8136
8137         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8138 }
8139
8140 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8141 {
8142         struct mgmt_ev_discovering ev;
8143
8144         BT_DBG("%s discovering %u", hdev->name, discovering);
8145
8146         memset(&ev, 0, sizeof(ev));
8147         ev.type = hdev->discovery.type;
8148         ev.discovering = discovering;
8149
8150         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8151 }
8152
8153 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8154 {
8155         BT_DBG("%s status %u", hdev->name, status);
8156 }
8157
8158 void mgmt_reenable_advertising(struct hci_dev *hdev)
8159 {
8160         struct hci_request req;
8161
8162         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8163             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8164                 return;
8165
8166         hci_req_init(&req, hdev);
8167         enable_advertising(&req);
8168         hci_req_run(&req, adv_enable_complete);
8169 }
8170
8171 static struct hci_mgmt_chan chan = {
8172         .channel        = HCI_CHANNEL_CONTROL,
8173         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8174         .handlers       = mgmt_handlers,
8175         .hdev_init      = mgmt_init_hdev,
8176 };
8177
8178 int mgmt_init(void)
8179 {
8180         return hci_mgmt_chan_register(&chan);
8181 }
8182
8183 void mgmt_exit(void)
8184 {
8185         hci_mgmt_chan_unregister(&chan);
8186 }