net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = cpu_to_le16(MGMT_REVISION);
 280
 281         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 282                                  &rp, sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         u16 num_commands, num_events;
 290         size_t rp_size;
 291         int i, err;
 292
 293         BT_DBG("sock %p", sk);
 294
 295         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 296                 num_commands = ARRAY_SIZE(mgmt_commands);
 297                 num_events = ARRAY_SIZE(mgmt_events);
 298         } else {
 299                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 300                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 301         }
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 313                 __le16 *opcode = rp->opcodes;
 314
 315                 for (i = 0; i < num_commands; i++, opcode++)
 316                         put_unaligned_le16(mgmt_commands[i], opcode);
 317
 318                 for (i = 0; i < num_events; i++, opcode++)
 319                         put_unaligned_le16(mgmt_events[i], opcode);
 320         } else {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 328         }
 329
 330         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 331                                 rp, rp_size);
 332         kfree(rp);
 333
 334         return err;
 335 }
 336
 337 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 338                            u16 data_len)
 339 {
 340         struct mgmt_rp_read_index_list *rp;
 341         struct hci_dev *d;
 342         size_t rp_len;
 343         u16 count;
 344         int err;
 345
 346         BT_DBG("sock %p", sk);
 347
 348         read_lock(&hci_dev_list_lock);
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (d->dev_type == HCI_BREDR &&
 353                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 354                         count++;
 355         }
 356
 357         rp_len = sizeof(*rp) + (2 * count);
 358         rp = kmalloc(rp_len, GFP_ATOMIC);
 359         if (!rp) {
 360                 read_unlock(&hci_dev_list_lock);
 361                 return -ENOMEM;
 362         }
 363
 364         count = 0;
 365         list_for_each_entry(d, &hci_dev_list, list) {
 366                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 367                     hci_dev_test_flag(d, HCI_CONFIG) ||
 368                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 369                         continue;
 370
 371                 /* Devices marked as raw-only are neither configured
 372                  * nor unconfigured controllers.
 373                  */
 374                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 375                         continue;
 376
 377                 if (d->dev_type == HCI_BREDR &&
 378                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 379                         rp->index[count++] = cpu_to_le16(d->id);
 380                         BT_DBG("Added hci%u", d->id);
 381                 }
 382         }
 383
 384         rp->num_controllers = cpu_to_le16(count);
 385         rp_len = sizeof(*rp) + (2 * count);
 386
 387         read_unlock(&hci_dev_list_lock);
 388
 389         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 390                                 0, rp, rp_len);
 391
 392         kfree(rp);
 393
 394         return err;
 395 }
 396
 397 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 398                                   void *data, u16 data_len)
 399 {
 400         struct mgmt_rp_read_unconf_index_list *rp;
 401         struct hci_dev *d;
 402         size_t rp_len;
 403         u16 count;
 404         int err;
 405
 406         BT_DBG("sock %p", sk);
 407
 408         read_lock(&hci_dev_list_lock);
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (d->dev_type == HCI_BREDR &&
 413                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 414                         count++;
 415         }
 416
 417         rp_len = sizeof(*rp) + (2 * count);
 418         rp = kmalloc(rp_len, GFP_ATOMIC);
 419         if (!rp) {
 420                 read_unlock(&hci_dev_list_lock);
 421                 return -ENOMEM;
 422         }
 423
 424         count = 0;
 425         list_for_each_entry(d, &hci_dev_list, list) {
 426                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 427                     hci_dev_test_flag(d, HCI_CONFIG) ||
 428                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 429                         continue;
 430
 431                 /* Devices marked as raw-only are neither configured
 432                  * nor unconfigured controllers.
 433                  */
 434                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 435                         continue;
 436
 437                 if (d->dev_type == HCI_BREDR &&
 438                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 439                         rp->index[count++] = cpu_to_le16(d->id);
 440                         BT_DBG("Added hci%u", d->id);
 441                 }
 442         }
 443
 444         rp->num_controllers = cpu_to_le16(count);
 445         rp_len = sizeof(*rp) + (2 * count);
 446
 447         read_unlock(&hci_dev_list_lock);
 448
 449         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 450                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 451
 452         kfree(rp);
 453
 454         return err;
 455 }
 456
 457 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 458                                void *data, u16 data_len)
 459 {
 460         struct mgmt_rp_read_ext_index_list *rp;
 461         struct hci_dev *d;
 462         size_t rp_len;
 463         u16 count;
 464         int err;
 465
 466         BT_DBG("sock %p", sk);
 467
 468         read_lock(&hci_dev_list_lock);
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 473                         count++;
 474         }
 475
 476         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 477         rp = kmalloc(rp_len, GFP_ATOMIC);
 478         if (!rp) {
 479                 read_unlock(&hci_dev_list_lock);
 480                 return -ENOMEM;
 481         }
 482
 483         count = 0;
 484         list_for_each_entry(d, &hci_dev_list, list) {
 485                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 486                     hci_dev_test_flag(d, HCI_CONFIG) ||
 487                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 488                         continue;
 489
 490                 /* Devices marked as raw-only are neither configured
 491                  * nor unconfigured controllers.
 492                  */
 493                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 494                         continue;
 495
 496                 if (d->dev_type == HCI_BREDR) {
 497                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 498                                 rp->entry[count].type = 0x01;
 499                         else
 500                                 rp->entry[count].type = 0x00;
 501                 } else if (d->dev_type == HCI_AMP) {
 502                         rp->entry[count].type = 0x02;
 503                 } else {
 504                         continue;
 505                 }
 506
 507                 rp->entry[count].bus = d->bus;
 508                 rp->entry[count++].index = cpu_to_le16(d->id);
 509                 BT_DBG("Added hci%u", d->id);
 510         }
 511
 512         rp->num_controllers = cpu_to_le16(count);
 513         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 514
 515         read_unlock(&hci_dev_list_lock);
 516
 517         /* If this command is called at least once, then all the
 518          * default index and unconfigured index events are disabled
 519          * and from now on only extended index events are used.
 520          */
 521         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 522         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 523         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 524
 525         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 526                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 527
 528         kfree(rp);
 529
 530         return err;
 531 }
 532
 533 static bool is_configured(struct hci_dev *hdev)
 534 {
 535         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 536             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 537                 return false;
 538
 539         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 540             !bacmp(&hdev->public_addr, BDADDR_ANY))
 541                 return false;
 542
 543         return true;
 544 }
 545
 546 static __le32 get_missing_options(struct hci_dev *hdev)
 547 {
 548         u32 options = 0;
 549
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 557
 558         return cpu_to_le32(options);
 559 }
 560
 561 static int new_options(struct hci_dev *hdev, struct sock *skip)
 562 {
 563         __le32 options = get_missing_options(hdev);
 564
 565         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 566                                   sizeof(options), skip);
 567 }
 568
 569 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 574                                  sizeof(options));
 575 }
 576
 577 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 578                             void *data, u16 data_len)
 579 {
 580         struct mgmt_rp_read_config_info rp;
 581         u32 options = 0;
 582
 583         BT_DBG("sock %p %s", sk, hdev->name);
 584
 585         hci_dev_lock(hdev);
 586
 587         memset(&rp, 0, sizeof(rp));
 588         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 589
 590         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 591                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 592
 593         if (hdev->set_bdaddr)
 594                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 595
 596         rp.supported_options = cpu_to_le32(options);
 597         rp.missing_options = get_missing_options(hdev);
 598
 599         hci_dev_unlock(hdev);
 600
 601         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 602                                  &rp, sizeof(rp));
 603 }
 604
 605 static u32 get_supported_settings(struct hci_dev *hdev)
 606 {
 607         u32 settings = 0;
 608
 609         settings |= MGMT_SETTING_POWERED;
 610         settings |= MGMT_SETTING_BONDABLE;
 611         settings |= MGMT_SETTING_DEBUG_KEYS;
 612         settings |= MGMT_SETTING_CONNECTABLE;
 613         settings |= MGMT_SETTING_DISCOVERABLE;
 614
 615         if (lmp_bredr_capable(hdev)) {
 616                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 617                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 618                 settings |= MGMT_SETTING_BREDR;
 619                 settings |= MGMT_SETTING_LINK_SECURITY;
 620
 621                 if (lmp_ssp_capable(hdev)) {
 622                         settings |= MGMT_SETTING_SSP;
 623                         settings |= MGMT_SETTING_HS;
 624                 }
 625
 626                 if (lmp_sc_capable(hdev))
 627                         settings |= MGMT_SETTING_SECURE_CONN;
 628         }
 629
 630         if (lmp_le_capable(hdev)) {
 631                 settings |= MGMT_SETTING_LE;
 632                 settings |= MGMT_SETTING_ADVERTISING;
 633                 settings |= MGMT_SETTING_SECURE_CONN;
 634                 settings |= MGMT_SETTING_PRIVACY;
 635                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 636         }
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 639             hdev->set_bdaddr)
 640                 settings |= MGMT_SETTING_CONFIGURATION;
 641
 642         return settings;
 643 }
 644
 645 static u32 get_current_settings(struct hci_dev *hdev)
 646 {
 647         u32 settings = 0;
 648
 649         if (hdev_is_powered(hdev))
 650                 settings |= MGMT_SETTING_POWERED;
 651
 652         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 653                 settings |= MGMT_SETTING_CONNECTABLE;
 654
 655         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 656                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 657
 658         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 659                 settings |= MGMT_SETTING_DISCOVERABLE;
 660
 661         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 662                 settings |= MGMT_SETTING_BONDABLE;
 663
 664         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 665                 settings |= MGMT_SETTING_BREDR;
 666
 667         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 668                 settings |= MGMT_SETTING_LE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 671                 settings |= MGMT_SETTING_LINK_SECURITY;
 672
 673         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 674                 settings |= MGMT_SETTING_SSP;
 675
 676         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 677                 settings |= MGMT_SETTING_HS;
 678
 679         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 680                 settings |= MGMT_SETTING_ADVERTISING;
 681
 682         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 683                 settings |= MGMT_SETTING_SECURE_CONN;
 684
 685         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 686                 settings |= MGMT_SETTING_DEBUG_KEYS;
 687
 688         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 689                 settings |= MGMT_SETTING_PRIVACY;
 690
 691         /* The current setting for static address has two purposes. The
 692          * first is to indicate if the static address will be used and
 693          * the second is to indicate if it is actually set.
 694          *
 695          * This means if the static address is not configured, this flag
 696          * will never be set. If the address is configured, then if the
 697          * address is actually used decides if the flag is set or not.
 698          *
 699          * For single mode LE only controllers and dual-mode controllers
 700          * with BR/EDR disabled, the existence of the static address will
 701          * be evaluated.
 702          */
 703         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 704             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 705             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 706                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 707                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 708         }
 709
 710         return settings;
 711 }
 712
 713 #define PNP_INFO_SVCLASS_ID             0x1200
 714
 715 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 716 {
 717         u8 *ptr = data, *uuids_start = NULL;
 718         struct bt_uuid *uuid;
 719
 720         if (len < 4)
 721                 return ptr;
 722
 723         list_for_each_entry(uuid, &hdev->uuids, list) {
 724                 u16 uuid16;
 725
 726                 if (uuid->size != 16)
 727                         continue;
 728
 729                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 730                 if (uuid16 < 0x1100)
 731                         continue;
 732
 733                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 734                         continue;
 735
 736                 if (!uuids_start) {
 737                         uuids_start = ptr;
 738                         uuids_start[0] = 1;
 739                         uuids_start[1] = EIR_UUID16_ALL;
 740                         ptr += 2;
 741                 }
 742
 743                 /* Stop if not enough space to put next UUID */
 744                 if ((ptr - data) + sizeof(u16) > len) {
 745                         uuids_start[1] = EIR_UUID16_SOME;
 746                         break;
 747                 }
 748
 749                 *ptr++ = (uuid16 & 0x00ff);
 750                 *ptr++ = (uuid16 & 0xff00) >> 8;
 751                 uuids_start[0] += sizeof(uuid16);
 752         }
 753
 754         return ptr;
 755 }
 756
 757 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 758 {
 759         u8 *ptr = data, *uuids_start = NULL;
 760         struct bt_uuid *uuid;
 761
 762         if (len < 6)
 763                 return ptr;
 764
 765         list_for_each_entry(uuid, &hdev->uuids, list) {
 766                 if (uuid->size != 32)
 767                         continue;
 768
 769                 if (!uuids_start) {
 770                         uuids_start = ptr;
 771                         uuids_start[0] = 1;
 772                         uuids_start[1] = EIR_UUID32_ALL;
 773                         ptr += 2;
 774                 }
 775
 776                 /* Stop if not enough space to put next UUID */
 777                 if ((ptr - data) + sizeof(u32) > len) {
 778                         uuids_start[1] = EIR_UUID32_SOME;
 779                         break;
 780                 }
 781
 782                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 783                 ptr += sizeof(u32);
 784                 uuids_start[0] += sizeof(u32);
 785         }
 786
 787         return ptr;
 788 }
 789
 790 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 791 {
 792         u8 *ptr = data, *uuids_start = NULL;
 793         struct bt_uuid *uuid;
 794
 795         if (len < 18)
 796                 return ptr;
 797
 798         list_for_each_entry(uuid, &hdev->uuids, list) {
 799                 if (uuid->size != 128)
 800                         continue;
 801
 802                 if (!uuids_start) {
 803                         uuids_start = ptr;
 804                         uuids_start[0] = 1;
 805                         uuids_start[1] = EIR_UUID128_ALL;
 806                         ptr += 2;
 807                 }
 808
 809                 /* Stop if not enough space to put next UUID */
 810                 if ((ptr - data) + 16 > len) {
 811                         uuids_start[1] = EIR_UUID128_SOME;
 812                         break;
 813                 }
 814
 815                 memcpy(ptr, uuid->uuid, 16);
 816                 ptr += 16;
 817                 uuids_start[0] += 16;
 818         }
 819
 820         return ptr;
 821 }
 822
 823 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 824 {
 825         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 826 }
 827
 828 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 829                                                   struct hci_dev *hdev,
 830                                                   const void *data)
 831 {
 832         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 833 }
 834
 835 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 836 {
 837         u8 ad_len = 0;
 838         size_t name_len;
 839
 840         name_len = strlen(hdev->dev_name);
 841         if (name_len > 0) {
 842                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 843
 844                 if (name_len > max_len) {
 845                         name_len = max_len;
 846                         ptr[1] = EIR_NAME_SHORT;
 847                 } else
 848                         ptr[1] = EIR_NAME_COMPLETE;
 849
 850                 ptr[0] = name_len + 1;
 851
 852                 memcpy(ptr + 2, hdev->dev_name, name_len);
 853
 854                 ad_len += (name_len + 2);
 855                 ptr += (name_len + 2);
 856         }
 857
 858         return ad_len;
 859 }
 860
 861 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 862 {
 863         /* TODO: Set the appropriate entries based on advertising instance flags
 864          * here once flags other than 0 are supported.
 865          */
 866         memcpy(ptr, hdev->adv_instance.scan_rsp_data,
 867                hdev->adv_instance.scan_rsp_len);
 868
 869         return hdev->adv_instance.scan_rsp_len;
 870 }
 871
 872 static void update_scan_rsp_data_for_instance(struct hci_request *req,
 873                                               u8 instance)
 874 {
 875         struct hci_dev *hdev = req->hdev;
 876         struct hci_cp_le_set_scan_rsp_data cp;
 877         u8 len;
 878
 879         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 return;
 881
 882         memset(&cp, 0, sizeof(cp));
 883
 884         if (instance)
 885                 len = create_instance_scan_rsp_data(hdev, cp.data);
 886         else
 887                 len = create_default_scan_rsp_data(hdev, cp.data);
 888
 889         if (hdev->scan_rsp_data_len == len &&
 890             !memcmp(cp.data, hdev->scan_rsp_data, len))
 891                 return;
 892
 893         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 894         hdev->scan_rsp_data_len = len;
 895
 896         cp.length = len;
 897
 898         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 899 }
 900
 901 static void update_scan_rsp_data(struct hci_request *req)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         u8 instance;
 905
 906         /* The "Set Advertising" setting supersedes the "Add Advertising"
 907          * setting. Here we set the scan response data based on which
 908          * setting was set. When neither apply, default to the global settings,
 909          * represented by instance "0".
 910          */
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 912             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 913                 instance = 0x01;
 914         else
 915                 instance = 0x00;
 916
 917         update_scan_rsp_data_for_instance(req, instance);
 918 }
 919
 920 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 921 {
 922         struct mgmt_pending_cmd *cmd;
 923
 924         /* If there's a pending mgmt command the flags will not yet have
 925          * their final values, so check for this first.
 926          */
 927         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 928         if (cmd) {
 929                 struct mgmt_mode *cp = cmd->param;
 930                 if (cp->val == 0x01)
 931                         return LE_AD_GENERAL;
 932                 else if (cp->val == 0x02)
 933                         return LE_AD_LIMITED;
 934         } else {
 935                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 936                         return LE_AD_LIMITED;
 937                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 938                         return LE_AD_GENERAL;
 939         }
 940
 941         return 0;
 942 }
 943
 944 static u8 get_current_adv_instance(struct hci_dev *hdev)
 945 {
 946         /* The "Set Advertising" setting supersedes the "Add Advertising"
 947          * setting. Here we set the advertising data based on which
 948          * setting was set. When neither apply, default to the global settings,
 949          * represented by instance "0".
 950          */
 951         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 952             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 953                 return 0x01;
 954
 955         return 0x00;
 956 }
 957
 958 static bool get_connectable(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flag will not yet have
 963          * it's final value, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968
 969                 return cp->val;
 970         }
 971
 972         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 973 }
 974
 975 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
 976 {
 977         u32 flags;
 978
 979         if (instance > 0x01)
 980                 return 0;
 981
 982         if (instance == 0x01)
 983                 return hdev->adv_instance.flags;
 984
 985         /* Instance 0 always manages the "Tx Power" and "Flags" fields */
 986         flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
 987
 988         /* For instance 0, assemble the flags from global settings */
 989         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE) ||
 990             get_connectable(hdev))
 991                 flags |= MGMT_ADV_FLAG_CONNECTABLE;
 992
 993         return flags;
 994 }
 995
 996 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
 997 {
 998         u8 ad_len = 0, flags = 0;
 999         u32 instance_flags = get_adv_instance_flags(hdev, instance);
1000
1001         /* The Add Advertising command allows userspace to set both the general
1002          * and limited discoverable flags.
1003          */
1004         if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1005                 flags |= LE_AD_GENERAL;
1006
1007         if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1008                 flags |= LE_AD_LIMITED;
1009
1010         if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1011                 /* If a discovery flag wasn't provided, simply use the global
1012                  * settings.
1013                  */
1014                 if (!flags)
1015                         flags |= get_adv_discov_flags(hdev);
1016
1017                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1018                         flags |= LE_AD_NO_BREDR;
1019
1020                 /* If flags would still be empty, then there is no need to
1021                  * include the "Flags" AD field".
1022                  */
1023                 if (flags) {
1024                         ptr[0] = 0x02;
1025                         ptr[1] = EIR_FLAGS;
1026                         ptr[2] = flags;
1027
1028                         ad_len += 3;
1029                         ptr += 3;
1030                 }
1031         }
1032
1033         /* Provide Tx Power only if we can provide a valid value for it */
1034         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1035             (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1036                 ptr[0] = 0x02;
1037                 ptr[1] = EIR_TX_POWER;
1038                 ptr[2] = (u8)hdev->adv_tx_power;
1039
1040                 ad_len += 3;
1041                 ptr += 3;
1042         }
1043
1044         if (instance) {
1045                 memcpy(ptr, hdev->adv_instance.adv_data,
1046                        hdev->adv_instance.adv_data_len);
1047                 ad_len += hdev->adv_instance.adv_data_len;
1048         }
1049
1050         return ad_len;
1051 }
1052
1053 static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
1054 {
1055         struct hci_dev *hdev = req->hdev;
1056         struct hci_cp_le_set_adv_data cp;
1057         u8 len;
1058
1059         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1060                 return;
1061
1062         memset(&cp, 0, sizeof(cp));
1063
1064         len = create_instance_adv_data(hdev, instance, cp.data);
1065
1066         /* There's nothing to do if the data hasn't changed */
1067         if (hdev->adv_data_len == len &&
1068             memcmp(cp.data, hdev->adv_data, len) == 0)
1069                 return;
1070
1071         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1072         hdev->adv_data_len = len;
1073
1074         cp.length = len;
1075
1076         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1077 }
1078
1079 static void update_adv_data(struct hci_request *req)
1080 {
1081         struct hci_dev *hdev = req->hdev;
1082         u8 instance = get_current_adv_instance(hdev);
1083
1084         update_adv_data_for_instance(req, instance);
1085 }
1086
1087 int mgmt_update_adv_data(struct hci_dev *hdev)
1088 {
1089         struct hci_request req;
1090
1091         hci_req_init(&req, hdev);
1092         update_adv_data(&req);
1093
1094         return hci_req_run(&req, NULL);
1095 }
1096
1097 static void create_eir(struct hci_dev *hdev, u8 *data)
1098 {
1099         u8 *ptr = data;
1100         size_t name_len;
1101
1102         name_len = strlen(hdev->dev_name);
1103
1104         if (name_len > 0) {
1105                 /* EIR Data type */
1106                 if (name_len > 48) {
1107                         name_len = 48;
1108                         ptr[1] = EIR_NAME_SHORT;
1109                 } else
1110                         ptr[1] = EIR_NAME_COMPLETE;
1111
1112                 /* EIR Data length */
1113                 ptr[0] = name_len + 1;
1114
1115                 memcpy(ptr + 2, hdev->dev_name, name_len);
1116
1117                 ptr += (name_len + 2);
1118         }
1119
1120         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1121                 ptr[0] = 2;
1122                 ptr[1] = EIR_TX_POWER;
1123                 ptr[2] = (u8) hdev->inq_tx_power;
1124
1125                 ptr += 3;
1126         }
1127
1128         if (hdev->devid_source > 0) {
1129                 ptr[0] = 9;
1130                 ptr[1] = EIR_DEVICE_ID;
1131
1132                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1133                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1134                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1135                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1136
1137                 ptr += 10;
1138         }
1139
1140         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1141         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1142         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1143 }
1144
1145 static void update_eir(struct hci_request *req)
1146 {
1147         struct hci_dev *hdev = req->hdev;
1148         struct hci_cp_write_eir cp;
1149
1150         if (!hdev_is_powered(hdev))
1151                 return;
1152
1153         if (!lmp_ext_inq_capable(hdev))
1154                 return;
1155
1156         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1157                 return;
1158
1159         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1160                 return;
1161
1162         memset(&cp, 0, sizeof(cp));
1163
1164         create_eir(hdev, cp.data);
1165
1166         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1167                 return;
1168
1169         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1170
1171         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1172 }
1173
1174 static u8 get_service_classes(struct hci_dev *hdev)
1175 {
1176         struct bt_uuid *uuid;
1177         u8 val = 0;
1178
1179         list_for_each_entry(uuid, &hdev->uuids, list)
1180                 val |= uuid->svc_hint;
1181
1182         return val;
1183 }
1184
1185 static void update_class(struct hci_request *req)
1186 {
1187         struct hci_dev *hdev = req->hdev;
1188         u8 cod[3];
1189
1190         BT_DBG("%s", hdev->name);
1191
1192         if (!hdev_is_powered(hdev))
1193                 return;
1194
1195         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1196                 return;
1197
1198         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1199                 return;
1200
1201         cod[0] = hdev->minor_class;
1202         cod[1] = hdev->major_class;
1203         cod[2] = get_service_classes(hdev);
1204
1205         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1206                 cod[1] |= 0x20;
1207
1208         if (memcmp(cod, hdev->dev_class, 3) == 0)
1209                 return;
1210
1211         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1212 }
1213
1214 static void disable_advertising(struct hci_request *req)
1215 {
1216         u8 enable = 0x00;
1217
1218         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1219 }
1220
1221 static void enable_advertising(struct hci_request *req)
1222 {
1223         struct hci_dev *hdev = req->hdev;
1224         struct hci_cp_le_set_adv_param cp;
1225         u8 own_addr_type, enable = 0x01;
1226         bool connectable;
1227         u8 instance;
1228         u32 flags;
1229
1230         if (hci_conn_num(hdev, LE_LINK) > 0)
1231                 return;
1232
1233         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1234                 disable_advertising(req);
1235
1236         /* Clear the HCI_LE_ADV bit temporarily so that the
1237          * hci_update_random_address knows that it's safe to go ahead
1238          * and write a new random address. The flag will be set back on
1239          * as soon as the SET_ADV_ENABLE HCI command completes.
1240          */
1241         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1242
1243         instance = get_current_adv_instance(hdev);
1244         flags = get_adv_instance_flags(hdev, instance);
1245         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE);
1246
1247         /* Set require_privacy to true only when non-connectable
1248          * advertising is used. In that case it is fine to use a
1249          * non-resolvable private address.
1250          */
1251         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1252                 return;
1253
1254         memset(&cp, 0, sizeof(cp));
1255         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1256         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1257         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1258         cp.own_address_type = own_addr_type;
1259         cp.channel_map = hdev->le_adv_channel_map;
1260
1261         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1262
1263         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1264 }
1265
1266 static void service_cache_off(struct work_struct *work)
1267 {
1268         struct hci_dev *hdev = container_of(work, struct hci_dev,
1269                                             service_cache.work);
1270         struct hci_request req;
1271
1272         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1273                 return;
1274
1275         hci_req_init(&req, hdev);
1276
1277         hci_dev_lock(hdev);
1278
1279         update_eir(&req);
1280         update_class(&req);
1281
1282         hci_dev_unlock(hdev);
1283
1284         hci_req_run(&req, NULL);
1285 }
1286
1287 static void rpa_expired(struct work_struct *work)
1288 {
1289         struct hci_dev *hdev = container_of(work, struct hci_dev,
1290                                             rpa_expired.work);
1291         struct hci_request req;
1292
1293         BT_DBG("");
1294
1295         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1296
1297         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1298                 return;
1299
1300         /* The generation of a new RPA and programming it into the
1301          * controller happens in the enable_advertising() function.
1302          */
1303         hci_req_init(&req, hdev);
1304         enable_advertising(&req);
1305         hci_req_run(&req, NULL);
1306 }
1307
1308 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1309 {
1310         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1311                 return;
1312
1313         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1314         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1315
1316         /* Non-mgmt controlled devices get this bit set
1317          * implicitly so that pairing works for them, however
1318          * for mgmt we require user-space to explicitly enable
1319          * it
1320          */
1321         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1322 }
1323
1324 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1325                                 void *data, u16 data_len)
1326 {
1327         struct mgmt_rp_read_info rp;
1328
1329         BT_DBG("sock %p %s", sk, hdev->name);
1330
1331         hci_dev_lock(hdev);
1332
1333         memset(&rp, 0, sizeof(rp));
1334
1335         bacpy(&rp.bdaddr, &hdev->bdaddr);
1336
1337         rp.version = hdev->hci_ver;
1338         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1339
1340         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1341         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1342
1343         memcpy(rp.dev_class, hdev->dev_class, 3);
1344
1345         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1346         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1347
1348         hci_dev_unlock(hdev);
1349
1350         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1351                                  sizeof(rp));
1352 }
1353
1354 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1355 {
1356         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1357
1358         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1359                                  sizeof(settings));
1360 }
1361
1362 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1363 {
1364         BT_DBG("%s status 0x%02x", hdev->name, status);
1365
1366         if (hci_conn_count(hdev) == 0) {
1367                 cancel_delayed_work(&hdev->power_off);
1368                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1369         }
1370 }
1371
1372 static bool hci_stop_discovery(struct hci_request *req)
1373 {
1374         struct hci_dev *hdev = req->hdev;
1375         struct hci_cp_remote_name_req_cancel cp;
1376         struct inquiry_entry *e;
1377
1378         switch (hdev->discovery.state) {
1379         case DISCOVERY_FINDING:
1380                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1381                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1382
1383                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1384                         cancel_delayed_work(&hdev->le_scan_disable);
1385                         hci_req_add_le_scan_disable(req);
1386                 }
1387
1388                 return true;
1389
1390         case DISCOVERY_RESOLVING:
1391                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1392                                                      NAME_PENDING);
1393                 if (!e)
1394                         break;
1395
1396                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1397                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1398                             &cp);
1399
1400                 return true;
1401
1402         default:
1403                 /* Passive scanning */
1404                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1405                         hci_req_add_le_scan_disable(req);
1406                         return true;
1407                 }
1408
1409                 break;
1410         }
1411
1412         return false;
1413 }
1414
1415 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1416                               u8 instance)
1417 {
1418         struct mgmt_ev_advertising_added ev;
1419
1420         ev.instance = instance;
1421
1422         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1423 }
1424
1425 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1426                                 u8 instance)
1427 {
1428         struct mgmt_ev_advertising_removed ev;
1429
1430         ev.instance = instance;
1431
1432         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1433 }
1434
1435 static void clear_adv_instance(struct hci_dev *hdev)
1436 {
1437         struct hci_request req;
1438
1439         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1440                 return;
1441
1442         if (hdev->adv_instance.timeout)
1443                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1444
1445         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1446         advertising_removed(NULL, hdev, 1);
1447         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1448
1449         if (!hdev_is_powered(hdev) ||
1450             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1451                 return;
1452
1453         hci_req_init(&req, hdev);
1454         disable_advertising(&req);
1455         hci_req_run(&req, NULL);
1456 }
1457
1458 static int clean_up_hci_state(struct hci_dev *hdev)
1459 {
1460         struct hci_request req;
1461         struct hci_conn *conn;
1462         bool discov_stopped;
1463         int err;
1464
1465         hci_req_init(&req, hdev);
1466
1467         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1468             test_bit(HCI_PSCAN, &hdev->flags)) {
1469                 u8 scan = 0x00;
1470                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1471         }
1472
1473         if (hdev->adv_instance.timeout)
1474                 clear_adv_instance(hdev);
1475
1476         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1477                 disable_advertising(&req);
1478
1479         discov_stopped = hci_stop_discovery(&req);
1480
1481         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1482                 struct hci_cp_disconnect dc;
1483                 struct hci_cp_reject_conn_req rej;
1484
1485                 switch (conn->state) {
1486                 case BT_CONNECTED:
1487                 case BT_CONFIG:
1488                         dc.handle = cpu_to_le16(conn->handle);
1489                         dc.reason = 0x15; /* Terminated due to Power Off */
1490                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1491                         break;
1492                 case BT_CONNECT:
1493                         if (conn->type == LE_LINK)
1494                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1495                                             0, NULL);
1496                         else if (conn->type == ACL_LINK)
1497                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1498                                             6, &conn->dst);
1499                         break;
1500                 case BT_CONNECT2:
1501                         bacpy(&rej.bdaddr, &conn->dst);
1502                         rej.reason = 0x15; /* Terminated due to Power Off */
1503                         if (conn->type == ACL_LINK)
1504                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1505                                             sizeof(rej), &rej);
1506                         else if (conn->type == SCO_LINK)
1507                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1508                                             sizeof(rej), &rej);
1509                         break;
1510                 }
1511         }
1512
1513         err = hci_req_run(&req, clean_up_hci_complete);
1514         if (!err && discov_stopped)
1515                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1516
1517         return err;
1518 }
1519
1520 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1521                        u16 len)
1522 {
1523         struct mgmt_mode *cp = data;
1524         struct mgmt_pending_cmd *cmd;
1525         int err;
1526
1527         BT_DBG("request for %s", hdev->name);
1528
1529         if (cp->val != 0x00 && cp->val != 0x01)
1530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1531                                        MGMT_STATUS_INVALID_PARAMS);
1532
1533         hci_dev_lock(hdev);
1534
1535         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1536                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1537                                       MGMT_STATUS_BUSY);
1538                 goto failed;
1539         }
1540
1541         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1542                 cancel_delayed_work(&hdev->power_off);
1543
1544                 if (cp->val) {
1545                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1546                                          data, len);
1547                         err = mgmt_powered(hdev, 1);
1548                         goto failed;
1549                 }
1550         }
1551
1552         if (!!cp->val == hdev_is_powered(hdev)) {
1553                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1554                 goto failed;
1555         }
1556
1557         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1558         if (!cmd) {
1559                 err = -ENOMEM;
1560                 goto failed;
1561         }
1562
1563         if (cp->val) {
1564                 queue_work(hdev->req_workqueue, &hdev->power_on);
1565                 err = 0;
1566         } else {
1567                 /* Disconnect connections, stop scans, etc */
1568                 err = clean_up_hci_state(hdev);
1569                 if (!err)
1570                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1571                                            HCI_POWER_OFF_TIMEOUT);
1572
1573                 /* ENODATA means there were no HCI commands queued */
1574                 if (err == -ENODATA) {
1575                         cancel_delayed_work(&hdev->power_off);
1576                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1577                         err = 0;
1578                 }
1579         }
1580
1581 failed:
1582         hci_dev_unlock(hdev);
1583         return err;
1584 }
1585
1586 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1587 {
1588         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1589
1590         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1591                                   sizeof(ev), skip);
1592 }
1593
1594 int mgmt_new_settings(struct hci_dev *hdev)
1595 {
1596         return new_settings(hdev, NULL);
1597 }
1598
1599 struct cmd_lookup {
1600         struct sock *sk;
1601         struct hci_dev *hdev;
1602         u8 mgmt_status;
1603 };
1604
1605 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1606 {
1607         struct cmd_lookup *match = data;
1608
1609         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1610
1611         list_del(&cmd->list);
1612
1613         if (match->sk == NULL) {
1614                 match->sk = cmd->sk;
1615                 sock_hold(match->sk);
1616         }
1617
1618         mgmt_pending_free(cmd);
1619 }
1620
1621 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1622 {
1623         u8 *status = data;
1624
1625         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1626         mgmt_pending_remove(cmd);
1627 }
1628
1629 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1630 {
1631         if (cmd->cmd_complete) {
1632                 u8 *status = data;
1633
1634                 cmd->cmd_complete(cmd, *status);
1635                 mgmt_pending_remove(cmd);
1636
1637                 return;
1638         }
1639
1640         cmd_status_rsp(cmd, data);
1641 }
1642
1643 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1644 {
1645         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1646                                  cmd->param, cmd->param_len);
1647 }
1648
1649 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1650 {
1651         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1652                                  cmd->param, sizeof(struct mgmt_addr_info));
1653 }
1654
1655 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1656 {
1657         if (!lmp_bredr_capable(hdev))
1658                 return MGMT_STATUS_NOT_SUPPORTED;
1659         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1660                 return MGMT_STATUS_REJECTED;
1661         else
1662                 return MGMT_STATUS_SUCCESS;
1663 }
1664
1665 static u8 mgmt_le_support(struct hci_dev *hdev)
1666 {
1667         if (!lmp_le_capable(hdev))
1668                 return MGMT_STATUS_NOT_SUPPORTED;
1669         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1670                 return MGMT_STATUS_REJECTED;
1671         else
1672                 return MGMT_STATUS_SUCCESS;
1673 }
1674
1675 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1676                                       u16 opcode)
1677 {
1678         struct mgmt_pending_cmd *cmd;
1679         struct mgmt_mode *cp;
1680         struct hci_request req;
1681         bool changed;
1682
1683         BT_DBG("status 0x%02x", status);
1684
1685         hci_dev_lock(hdev);
1686
1687         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1688         if (!cmd)
1689                 goto unlock;
1690
1691         if (status) {
1692                 u8 mgmt_err = mgmt_status(status);
1693                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1694                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1695                 goto remove_cmd;
1696         }
1697
1698         cp = cmd->param;
1699         if (cp->val) {
1700                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1701
1702                 if (hdev->discov_timeout > 0) {
1703                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1704                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1705                                            to);
1706                 }
1707         } else {
1708                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1709         }
1710
1711         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1712
1713         if (changed)
1714                 new_settings(hdev, cmd->sk);
1715
1716         /* When the discoverable mode gets changed, make sure
1717          * that class of device has the limited discoverable
1718          * bit correctly set. Also update page scan based on whitelist
1719          * entries.
1720          */
1721         hci_req_init(&req, hdev);
1722         __hci_update_page_scan(&req);
1723         update_class(&req);
1724         hci_req_run(&req, NULL);
1725
1726 remove_cmd:
1727         mgmt_pending_remove(cmd);
1728
1729 unlock:
1730         hci_dev_unlock(hdev);
1731 }
1732
1733 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1734                             u16 len)
1735 {
1736         struct mgmt_cp_set_discoverable *cp = data;
1737         struct mgmt_pending_cmd *cmd;
1738         struct hci_request req;
1739         u16 timeout;
1740         u8 scan;
1741         int err;
1742
1743         BT_DBG("request for %s", hdev->name);
1744
1745         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1746             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1748                                        MGMT_STATUS_REJECTED);
1749
1750         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1752                                        MGMT_STATUS_INVALID_PARAMS);
1753
1754         timeout = __le16_to_cpu(cp->timeout);
1755
1756         /* Disabling discoverable requires that no timeout is set,
1757          * and enabling limited discoverable requires a timeout.
1758          */
1759         if ((cp->val == 0x00 && timeout > 0) ||
1760             (cp->val == 0x02 && timeout == 0))
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev) && timeout > 0) {
1767                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1768                                       MGMT_STATUS_NOT_POWERED);
1769                 goto failed;
1770         }
1771
1772         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1773             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1774                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1775                                       MGMT_STATUS_BUSY);
1776                 goto failed;
1777         }
1778
1779         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1780                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1781                                       MGMT_STATUS_REJECTED);
1782                 goto failed;
1783         }
1784
1785         if (!hdev_is_powered(hdev)) {
1786                 bool changed = false;
1787
1788                 /* Setting limited discoverable when powered off is
1789                  * not a valid operation since it requires a timeout
1790                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1791                  */
1792                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1793                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1794                         changed = true;
1795                 }
1796
1797                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1798                 if (err < 0)
1799                         goto failed;
1800
1801                 if (changed)
1802                         err = new_settings(hdev, sk);
1803
1804                 goto failed;
1805         }
1806
1807         /* If the current mode is the same, then just update the timeout
1808          * value with the new value. And if only the timeout gets updated,
1809          * then no need for any HCI transactions.
1810          */
1811         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1812             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1813                                                    HCI_LIMITED_DISCOVERABLE)) {
1814                 cancel_delayed_work(&hdev->discov_off);
1815                 hdev->discov_timeout = timeout;
1816
1817                 if (cp->val && hdev->discov_timeout > 0) {
1818                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1819                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1820                                            to);
1821                 }
1822
1823                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1824                 goto failed;
1825         }
1826
1827         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1828         if (!cmd) {
1829                 err = -ENOMEM;
1830                 goto failed;
1831         }
1832
1833         /* Cancel any potential discoverable timeout that might be
1834          * still active and store new timeout value. The arming of
1835          * the timeout happens in the complete handler.
1836          */
1837         cancel_delayed_work(&hdev->discov_off);
1838         hdev->discov_timeout = timeout;
1839
1840         /* Limited discoverable mode */
1841         if (cp->val == 0x02)
1842                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1843         else
1844                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1845
1846         hci_req_init(&req, hdev);
1847
1848         /* The procedure for LE-only controllers is much simpler - just
1849          * update the advertising data.
1850          */
1851         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1852                 goto update_ad;
1853
1854         scan = SCAN_PAGE;
1855
1856         if (cp->val) {
1857                 struct hci_cp_write_current_iac_lap hci_cp;
1858
1859                 if (cp->val == 0x02) {
1860                         /* Limited discoverable mode */
1861                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1862                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1863                         hci_cp.iac_lap[1] = 0x8b;
1864                         hci_cp.iac_lap[2] = 0x9e;
1865                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1866                         hci_cp.iac_lap[4] = 0x8b;
1867                         hci_cp.iac_lap[5] = 0x9e;
1868                 } else {
1869                         /* General discoverable mode */
1870                         hci_cp.num_iac = 1;
1871                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1872                         hci_cp.iac_lap[1] = 0x8b;
1873                         hci_cp.iac_lap[2] = 0x9e;
1874                 }
1875
1876                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1877                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1878
1879                 scan |= SCAN_INQUIRY;
1880         } else {
1881                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1882         }
1883
1884         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1885
1886 update_ad:
1887         update_adv_data(&req);
1888
1889         err = hci_req_run(&req, set_discoverable_complete);
1890         if (err < 0)
1891                 mgmt_pending_remove(cmd);
1892
1893 failed:
1894         hci_dev_unlock(hdev);
1895         return err;
1896 }
1897
1898 static void write_fast_connectable(struct hci_request *req, bool enable)
1899 {
1900         struct hci_dev *hdev = req->hdev;
1901         struct hci_cp_write_page_scan_activity acp;
1902         u8 type;
1903
1904         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1905                 return;
1906
1907         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1908                 return;
1909
1910         if (enable) {
1911                 type = PAGE_SCAN_TYPE_INTERLACED;
1912
1913                 /* 160 msec page scan interval */
1914                 acp.interval = cpu_to_le16(0x0100);
1915         } else {
1916                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1917
1918                 /* default 1.28 sec page scan */
1919                 acp.interval = cpu_to_le16(0x0800);
1920         }
1921
1922         acp.window = cpu_to_le16(0x0012);
1923
1924         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1925             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1926                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1927                             sizeof(acp), &acp);
1928
1929         if (hdev->page_scan_type != type)
1930                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1931 }
1932
1933 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1934                                      u16 opcode)
1935 {
1936         struct mgmt_pending_cmd *cmd;
1937         struct mgmt_mode *cp;
1938         bool conn_changed, discov_changed;
1939
1940         BT_DBG("status 0x%02x", status);
1941
1942         hci_dev_lock(hdev);
1943
1944         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1945         if (!cmd)
1946                 goto unlock;
1947
1948         if (status) {
1949                 u8 mgmt_err = mgmt_status(status);
1950                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1951                 goto remove_cmd;
1952         }
1953
1954         cp = cmd->param;
1955         if (cp->val) {
1956                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1957                                                           HCI_CONNECTABLE);
1958                 discov_changed = false;
1959         } else {
1960                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1961                                                            HCI_CONNECTABLE);
1962                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1963                                                              HCI_DISCOVERABLE);
1964         }
1965
1966         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1967
1968         if (conn_changed || discov_changed) {
1969                 new_settings(hdev, cmd->sk);
1970                 hci_update_page_scan(hdev);
1971                 if (discov_changed)
1972                         mgmt_update_adv_data(hdev);
1973                 hci_update_background_scan(hdev);
1974         }
1975
1976 remove_cmd:
1977         mgmt_pending_remove(cmd);
1978
1979 unlock:
1980         hci_dev_unlock(hdev);
1981 }
1982
1983 static int set_connectable_update_settings(struct hci_dev *hdev,
1984                                            struct sock *sk, u8 val)
1985 {
1986         bool changed = false;
1987         int err;
1988
1989         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1990                 changed = true;
1991
1992         if (val) {
1993                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1994         } else {
1995                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1996                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1997         }
1998
1999         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2000         if (err < 0)
2001                 return err;
2002
2003         if (changed) {
2004                 hci_update_page_scan(hdev);
2005                 hci_update_background_scan(hdev);
2006                 return new_settings(hdev, sk);
2007         }
2008
2009         return 0;
2010 }
2011
2012 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2013                            u16 len)
2014 {
2015         struct mgmt_mode *cp = data;
2016         struct mgmt_pending_cmd *cmd;
2017         struct hci_request req;
2018         u8 scan;
2019         int err;
2020
2021         BT_DBG("request for %s", hdev->name);
2022
2023         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2024             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2026                                        MGMT_STATUS_REJECTED);
2027
2028         if (cp->val != 0x00 && cp->val != 0x01)
2029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2030                                        MGMT_STATUS_INVALID_PARAMS);
2031
2032         hci_dev_lock(hdev);
2033
2034         if (!hdev_is_powered(hdev)) {
2035                 err = set_connectable_update_settings(hdev, sk, cp->val);
2036                 goto failed;
2037         }
2038
2039         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2040             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2041                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2042                                       MGMT_STATUS_BUSY);
2043                 goto failed;
2044         }
2045
2046         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2047         if (!cmd) {
2048                 err = -ENOMEM;
2049                 goto failed;
2050         }
2051
2052         hci_req_init(&req, hdev);
2053
2054         /* If BR/EDR is not enabled and we disable advertising as a
2055          * by-product of disabling connectable, we need to update the
2056          * advertising flags.
2057          */
2058         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2059                 if (!cp->val) {
2060                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2061                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2062                 }
2063                 update_adv_data(&req);
2064         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2065                 if (cp->val) {
2066                         scan = SCAN_PAGE;
2067                 } else {
2068                         /* If we don't have any whitelist entries just
2069                          * disable all scanning. If there are entries
2070                          * and we had both page and inquiry scanning
2071                          * enabled then fall back to only page scanning.
2072                          * Otherwise no changes are needed.
2073                          */
2074                         if (list_empty(&hdev->whitelist))
2075                                 scan = SCAN_DISABLED;
2076                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2077                                 scan = SCAN_PAGE;
2078                         else
2079                                 goto no_scan_update;
2080
2081                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2082                             hdev->discov_timeout > 0)
2083                                 cancel_delayed_work(&hdev->discov_off);
2084                 }
2085
2086                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2087         }
2088
2089 no_scan_update:
2090         /* Update the advertising parameters if necessary */
2091         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2092                 enable_advertising(&req);
2093
2094         err = hci_req_run(&req, set_connectable_complete);
2095         if (err < 0) {
2096                 mgmt_pending_remove(cmd);
2097                 if (err == -ENODATA)
2098                         err = set_connectable_update_settings(hdev, sk,
2099                                                               cp->val);
2100                 goto failed;
2101         }
2102
2103 failed:
2104         hci_dev_unlock(hdev);
2105         return err;
2106 }
2107
2108 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2109                         u16 len)
2110 {
2111         struct mgmt_mode *cp = data;
2112         bool changed;
2113         int err;
2114
2115         BT_DBG("request for %s", hdev->name);
2116
2117         if (cp->val != 0x00 && cp->val != 0x01)
2118                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2119                                        MGMT_STATUS_INVALID_PARAMS);
2120
2121         hci_dev_lock(hdev);
2122
2123         if (cp->val)
2124                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2125         else
2126                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2127
2128         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2129         if (err < 0)
2130                 goto unlock;
2131
2132         if (changed)
2133                 err = new_settings(hdev, sk);
2134
2135 unlock:
2136         hci_dev_unlock(hdev);
2137         return err;
2138 }
2139
2140 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2141                              u16 len)
2142 {
2143         struct mgmt_mode *cp = data;
2144         struct mgmt_pending_cmd *cmd;
2145         u8 val, status;
2146         int err;
2147
2148         BT_DBG("request for %s", hdev->name);
2149
2150         status = mgmt_bredr_support(hdev);
2151         if (status)
2152                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2153                                        status);
2154
2155         if (cp->val != 0x00 && cp->val != 0x01)
2156                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2157                                        MGMT_STATUS_INVALID_PARAMS);
2158
2159         hci_dev_lock(hdev);
2160
2161         if (!hdev_is_powered(hdev)) {
2162                 bool changed = false;
2163
2164                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2165                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2166                         changed = true;
2167                 }
2168
2169                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2170                 if (err < 0)
2171                         goto failed;
2172
2173                 if (changed)
2174                         err = new_settings(hdev, sk);
2175
2176                 goto failed;
2177         }
2178
2179         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2180                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2181                                       MGMT_STATUS_BUSY);
2182                 goto failed;
2183         }
2184
2185         val = !!cp->val;
2186
2187         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2188                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2189                 goto failed;
2190         }
2191
2192         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2193         if (!cmd) {
2194                 err = -ENOMEM;
2195                 goto failed;
2196         }
2197
2198         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2199         if (err < 0) {
2200                 mgmt_pending_remove(cmd);
2201                 goto failed;
2202         }
2203
2204 failed:
2205         hci_dev_unlock(hdev);
2206         return err;
2207 }
2208
2209 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2210 {
2211         struct mgmt_mode *cp = data;
2212         struct mgmt_pending_cmd *cmd;
2213         u8 status;
2214         int err;
2215
2216         BT_DBG("request for %s", hdev->name);
2217
2218         status = mgmt_bredr_support(hdev);
2219         if (status)
2220                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2221
2222         if (!lmp_ssp_capable(hdev))
2223                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2224                                        MGMT_STATUS_NOT_SUPPORTED);
2225
2226         if (cp->val != 0x00 && cp->val != 0x01)
2227                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2228                                        MGMT_STATUS_INVALID_PARAMS);
2229
2230         hci_dev_lock(hdev);
2231
2232         if (!hdev_is_powered(hdev)) {
2233                 bool changed;
2234
2235                 if (cp->val) {
2236                         changed = !hci_dev_test_and_set_flag(hdev,
2237                                                              HCI_SSP_ENABLED);
2238                 } else {
2239                         changed = hci_dev_test_and_clear_flag(hdev,
2240                                                               HCI_SSP_ENABLED);
2241                         if (!changed)
2242                                 changed = hci_dev_test_and_clear_flag(hdev,
2243                                                                       HCI_HS_ENABLED);
2244                         else
2245                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2246                 }
2247
2248                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2249                 if (err < 0)
2250                         goto failed;
2251
2252                 if (changed)
2253                         err = new_settings(hdev, sk);
2254
2255                 goto failed;
2256         }
2257
2258         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2259                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2260                                       MGMT_STATUS_BUSY);
2261                 goto failed;
2262         }
2263
2264         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2265                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2266                 goto failed;
2267         }
2268
2269         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2270         if (!cmd) {
2271                 err = -ENOMEM;
2272                 goto failed;
2273         }
2274
2275         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2276                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2277                              sizeof(cp->val), &cp->val);
2278
2279         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2280         if (err < 0) {
2281                 mgmt_pending_remove(cmd);
2282                 goto failed;
2283         }
2284
2285 failed:
2286         hci_dev_unlock(hdev);
2287         return err;
2288 }
2289
2290 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2291 {
2292         struct mgmt_mode *cp = data;
2293         bool changed;
2294         u8 status;
2295         int err;
2296
2297         BT_DBG("request for %s", hdev->name);
2298
2299         status = mgmt_bredr_support(hdev);
2300         if (status)
2301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2302
2303         if (!lmp_ssp_capable(hdev))
2304                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2305                                        MGMT_STATUS_NOT_SUPPORTED);
2306
2307         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2309                                        MGMT_STATUS_REJECTED);
2310
2311         if (cp->val != 0x00 && cp->val != 0x01)
2312                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2313                                        MGMT_STATUS_INVALID_PARAMS);
2314
2315         hci_dev_lock(hdev);
2316
2317         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2318                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2319                                       MGMT_STATUS_BUSY);
2320                 goto unlock;
2321         }
2322
2323         if (cp->val) {
2324                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2325         } else {
2326                 if (hdev_is_powered(hdev)) {
2327                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2328                                               MGMT_STATUS_REJECTED);
2329                         goto unlock;
2330                 }
2331
2332                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2333         }
2334
2335         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2336         if (err < 0)
2337                 goto unlock;
2338
2339         if (changed)
2340                 err = new_settings(hdev, sk);
2341
2342 unlock:
2343         hci_dev_unlock(hdev);
2344         return err;
2345 }
2346
2347 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2348 {
2349         struct cmd_lookup match = { NULL, hdev };
2350
2351         hci_dev_lock(hdev);
2352
2353         if (status) {
2354                 u8 mgmt_err = mgmt_status(status);
2355
2356                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2357                                      &mgmt_err);
2358                 goto unlock;
2359         }
2360
2361         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2362
2363         new_settings(hdev, match.sk);
2364
2365         if (match.sk)
2366                 sock_put(match.sk);
2367
2368         /* Make sure the controller has a good default for
2369          * advertising data. Restrict the update to when LE
2370          * has actually been enabled. During power on, the
2371          * update in powered_update_hci will take care of it.
2372          */
2373         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2374                 struct hci_request req;
2375
2376                 hci_req_init(&req, hdev);
2377                 update_adv_data(&req);
2378                 update_scan_rsp_data(&req);
2379                 __hci_update_background_scan(&req);
2380                 hci_req_run(&req, NULL);
2381         }
2382
2383 unlock:
2384         hci_dev_unlock(hdev);
2385 }
2386
2387 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2388 {
2389         struct mgmt_mode *cp = data;
2390         struct hci_cp_write_le_host_supported hci_cp;
2391         struct mgmt_pending_cmd *cmd;
2392         struct hci_request req;
2393         int err;
2394         u8 val, enabled;
2395
2396         BT_DBG("request for %s", hdev->name);
2397
2398         if (!lmp_le_capable(hdev))
2399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2400                                        MGMT_STATUS_NOT_SUPPORTED);
2401
2402         if (cp->val != 0x00 && cp->val != 0x01)
2403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2404                                        MGMT_STATUS_INVALID_PARAMS);
2405
2406         /* Bluetooth single mode LE only controllers or dual-mode
2407          * controllers configured as LE only devices, do not allow
2408          * switching LE off. These have either LE enabled explicitly
2409          * or BR/EDR has been previously switched off.
2410          *
2411          * When trying to enable an already enabled LE, then gracefully
2412          * send a positive response. Trying to disable it however will
2413          * result into rejection.
2414          */
2415         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2416                 if (cp->val == 0x01)
2417                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2418
2419                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2420                                        MGMT_STATUS_REJECTED);
2421         }
2422
2423         hci_dev_lock(hdev);
2424
2425         val = !!cp->val;
2426         enabled = lmp_host_le_capable(hdev);
2427
2428         if (!hdev_is_powered(hdev) || val == enabled) {
2429                 bool changed = false;
2430
2431                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2432                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2433                         changed = true;
2434                 }
2435
2436                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2437                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2438                         changed = true;
2439                 }
2440
2441                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2442                 if (err < 0)
2443                         goto unlock;
2444
2445                 if (changed)
2446                         err = new_settings(hdev, sk);
2447
2448                 goto unlock;
2449         }
2450
2451         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2452             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2454                                       MGMT_STATUS_BUSY);
2455                 goto unlock;
2456         }
2457
2458         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2459         if (!cmd) {
2460                 err = -ENOMEM;
2461                 goto unlock;
2462         }
2463
2464         hci_req_init(&req, hdev);
2465
2466         memset(&hci_cp, 0, sizeof(hci_cp));
2467
2468         if (val) {
2469                 hci_cp.le = val;
2470                 hci_cp.simul = 0x00;
2471         } else {
2472                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2473                         disable_advertising(&req);
2474         }
2475
2476         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2477                     &hci_cp);
2478
2479         err = hci_req_run(&req, le_enable_complete);
2480         if (err < 0)
2481                 mgmt_pending_remove(cmd);
2482
2483 unlock:
2484         hci_dev_unlock(hdev);
2485         return err;
2486 }
2487
2488 /* This is a helper function to test for pending mgmt commands that can
2489  * cause CoD or EIR HCI commands. We can only allow one such pending
2490  * mgmt command at a time since otherwise we cannot easily track what
2491  * the current values are, will be, and based on that calculate if a new
2492  * HCI command needs to be sent and if yes with what value.
2493  */
2494 static bool pending_eir_or_class(struct hci_dev *hdev)
2495 {
2496         struct mgmt_pending_cmd *cmd;
2497
2498         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2499                 switch (cmd->opcode) {
2500                 case MGMT_OP_ADD_UUID:
2501                 case MGMT_OP_REMOVE_UUID:
2502                 case MGMT_OP_SET_DEV_CLASS:
2503                 case MGMT_OP_SET_POWERED:
2504                         return true;
2505                 }
2506         }
2507
2508         return false;
2509 }
2510
2511 static const u8 bluetooth_base_uuid[] = {
2512                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2513                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2514 };
2515
2516 static u8 get_uuid_size(const u8 *uuid)
2517 {
2518         u32 val;
2519
2520         if (memcmp(uuid, bluetooth_base_uuid, 12))
2521                 return 128;
2522
2523         val = get_unaligned_le32(&uuid[12]);
2524         if (val > 0xffff)
2525                 return 32;
2526
2527         return 16;
2528 }
2529
2530 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2531 {
2532         struct mgmt_pending_cmd *cmd;
2533
2534         hci_dev_lock(hdev);
2535
2536         cmd = pending_find(mgmt_op, hdev);
2537         if (!cmd)
2538                 goto unlock;
2539
2540         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2541                           mgmt_status(status), hdev->dev_class, 3);
2542
2543         mgmt_pending_remove(cmd);
2544
2545 unlock:
2546         hci_dev_unlock(hdev);
2547 }
2548
2549 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2550 {
2551         BT_DBG("status 0x%02x", status);
2552
2553         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2554 }
2555
2556 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2557 {
2558         struct mgmt_cp_add_uuid *cp = data;
2559         struct mgmt_pending_cmd *cmd;
2560         struct hci_request req;
2561         struct bt_uuid *uuid;
2562         int err;
2563
2564         BT_DBG("request for %s", hdev->name);
2565
2566         hci_dev_lock(hdev);
2567
2568         if (pending_eir_or_class(hdev)) {
2569                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2570                                       MGMT_STATUS_BUSY);
2571                 goto failed;
2572         }
2573
2574         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2575         if (!uuid) {
2576                 err = -ENOMEM;
2577                 goto failed;
2578         }
2579
2580         memcpy(uuid->uuid, cp->uuid, 16);
2581         uuid->svc_hint = cp->svc_hint;
2582         uuid->size = get_uuid_size(cp->uuid);
2583
2584         list_add_tail(&uuid->list, &hdev->uuids);
2585
2586         hci_req_init(&req, hdev);
2587
2588         update_class(&req);
2589         update_eir(&req);
2590
2591         err = hci_req_run(&req, add_uuid_complete);
2592         if (err < 0) {
2593                 if (err != -ENODATA)
2594                         goto failed;
2595
2596                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2597                                         hdev->dev_class, 3);
2598                 goto failed;
2599         }
2600
2601         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2602         if (!cmd) {
2603                 err = -ENOMEM;
2604                 goto failed;
2605         }
2606
2607         err = 0;
2608
2609 failed:
2610         hci_dev_unlock(hdev);
2611         return err;
2612 }
2613
2614 static bool enable_service_cache(struct hci_dev *hdev)
2615 {
2616         if (!hdev_is_powered(hdev))
2617                 return false;
2618
2619         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2620                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2621                                    CACHE_TIMEOUT);
2622                 return true;
2623         }
2624
2625         return false;
2626 }
2627
2628 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2629 {
2630         BT_DBG("status 0x%02x", status);
2631
2632         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2633 }
2634
2635 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2636                        u16 len)
2637 {
2638         struct mgmt_cp_remove_uuid *cp = data;
2639         struct mgmt_pending_cmd *cmd;
2640         struct bt_uuid *match, *tmp;
2641         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2642         struct hci_request req;
2643         int err, found;
2644
2645         BT_DBG("request for %s", hdev->name);
2646
2647         hci_dev_lock(hdev);
2648
2649         if (pending_eir_or_class(hdev)) {
2650                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2651                                       MGMT_STATUS_BUSY);
2652                 goto unlock;
2653         }
2654
2655         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2656                 hci_uuids_clear(hdev);
2657
2658                 if (enable_service_cache(hdev)) {
2659                         err = mgmt_cmd_complete(sk, hdev->id,
2660                                                 MGMT_OP_REMOVE_UUID,
2661                                                 0, hdev->dev_class, 3);
2662                         goto unlock;
2663                 }
2664
2665                 goto update_class;
2666         }
2667
2668         found = 0;
2669
2670         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2671                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2672                         continue;
2673
2674                 list_del(&match->list);
2675                 kfree(match);
2676                 found++;
2677         }
2678
2679         if (found == 0) {
2680                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2681                                       MGMT_STATUS_INVALID_PARAMS);
2682                 goto unlock;
2683         }
2684
2685 update_class:
2686         hci_req_init(&req, hdev);
2687
2688         update_class(&req);
2689         update_eir(&req);
2690
2691         err = hci_req_run(&req, remove_uuid_complete);
2692         if (err < 0) {
2693                 if (err != -ENODATA)
2694                         goto unlock;
2695
2696                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2697                                         hdev->dev_class, 3);
2698                 goto unlock;
2699         }
2700
2701         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2702         if (!cmd) {
2703                 err = -ENOMEM;
2704                 goto unlock;
2705         }
2706
2707         err = 0;
2708
2709 unlock:
2710         hci_dev_unlock(hdev);
2711         return err;
2712 }
2713
2714 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2715 {
2716         BT_DBG("status 0x%02x", status);
2717
2718         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2719 }
2720
2721 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2722                          u16 len)
2723 {
2724         struct mgmt_cp_set_dev_class *cp = data;
2725         struct mgmt_pending_cmd *cmd;
2726         struct hci_request req;
2727         int err;
2728
2729         BT_DBG("request for %s", hdev->name);
2730
2731         if (!lmp_bredr_capable(hdev))
2732                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2733                                        MGMT_STATUS_NOT_SUPPORTED);
2734
2735         hci_dev_lock(hdev);
2736
2737         if (pending_eir_or_class(hdev)) {
2738                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2739                                       MGMT_STATUS_BUSY);
2740                 goto unlock;
2741         }
2742
2743         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2744                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2745                                       MGMT_STATUS_INVALID_PARAMS);
2746                 goto unlock;
2747         }
2748
2749         hdev->major_class = cp->major;
2750         hdev->minor_class = cp->minor;
2751
2752         if (!hdev_is_powered(hdev)) {
2753                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2754                                         hdev->dev_class, 3);
2755                 goto unlock;
2756         }
2757
2758         hci_req_init(&req, hdev);
2759
2760         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2761                 hci_dev_unlock(hdev);
2762                 cancel_delayed_work_sync(&hdev->service_cache);
2763                 hci_dev_lock(hdev);
2764                 update_eir(&req);
2765         }
2766
2767         update_class(&req);
2768
2769         err = hci_req_run(&req, set_class_complete);
2770         if (err < 0) {
2771                 if (err != -ENODATA)
2772                         goto unlock;
2773
2774                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2775                                         hdev->dev_class, 3);
2776                 goto unlock;
2777         }
2778
2779         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2780         if (!cmd) {
2781                 err = -ENOMEM;
2782                 goto unlock;
2783         }
2784
2785         err = 0;
2786
2787 unlock:
2788         hci_dev_unlock(hdev);
2789         return err;
2790 }
2791
2792 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2793                           u16 len)
2794 {
2795         struct mgmt_cp_load_link_keys *cp = data;
2796         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2797                                    sizeof(struct mgmt_link_key_info));
2798         u16 key_count, expected_len;
2799         bool changed;
2800         int i;
2801
2802         BT_DBG("request for %s", hdev->name);
2803
2804         if (!lmp_bredr_capable(hdev))
2805                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2806                                        MGMT_STATUS_NOT_SUPPORTED);
2807
2808         key_count = __le16_to_cpu(cp->key_count);
2809         if (key_count > max_key_count) {
2810                 BT_ERR("load_link_keys: too big key_count value %u",
2811                        key_count);
2812                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2813                                        MGMT_STATUS_INVALID_PARAMS);
2814         }
2815
2816         expected_len = sizeof(*cp) + key_count *
2817                                         sizeof(struct mgmt_link_key_info);
2818         if (expected_len != len) {
2819                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2820                        expected_len, len);
2821                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2822                                        MGMT_STATUS_INVALID_PARAMS);
2823         }
2824
2825         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2826                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2827                                        MGMT_STATUS_INVALID_PARAMS);
2828
2829         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2830                key_count);
2831
2832         for (i = 0; i < key_count; i++) {
2833                 struct mgmt_link_key_info *key = &cp->keys[i];
2834
2835                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2836                         return mgmt_cmd_status(sk, hdev->id,
2837                                                MGMT_OP_LOAD_LINK_KEYS,
2838                                                MGMT_STATUS_INVALID_PARAMS);
2839         }
2840
2841         hci_dev_lock(hdev);
2842
2843         hci_link_keys_clear(hdev);
2844
2845         if (cp->debug_keys)
2846                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2847         else
2848                 changed = hci_dev_test_and_clear_flag(hdev,
2849                                                       HCI_KEEP_DEBUG_KEYS);
2850
2851         if (changed)
2852                 new_settings(hdev, NULL);
2853
2854         for (i = 0; i < key_count; i++) {
2855                 struct mgmt_link_key_info *key = &cp->keys[i];
2856
2857                 /* Always ignore debug keys and require a new pairing if
2858                  * the user wants to use them.
2859                  */
2860                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2861                         continue;
2862
2863                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2864                                  key->type, key->pin_len, NULL);
2865         }
2866
2867         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2868
2869         hci_dev_unlock(hdev);
2870
2871         return 0;
2872 }
2873
2874 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2875                            u8 addr_type, struct sock *skip_sk)
2876 {
2877         struct mgmt_ev_device_unpaired ev;
2878
2879         bacpy(&ev.addr.bdaddr, bdaddr);
2880         ev.addr.type = addr_type;
2881
2882         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2883                           skip_sk);
2884 }
2885
2886 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2887                          u16 len)
2888 {
2889         struct mgmt_cp_unpair_device *cp = data;
2890         struct mgmt_rp_unpair_device rp;
2891         struct hci_cp_disconnect dc;
2892         struct mgmt_pending_cmd *cmd;
2893         struct hci_conn *conn;
2894         int err;
2895
2896         memset(&rp, 0, sizeof(rp));
2897         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2898         rp.addr.type = cp->addr.type;
2899
2900         if (!bdaddr_type_is_valid(cp->addr.type))
2901                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2902                                          MGMT_STATUS_INVALID_PARAMS,
2903                                          &rp, sizeof(rp));
2904
2905         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2906                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2907                                          MGMT_STATUS_INVALID_PARAMS,
2908                                          &rp, sizeof(rp));
2909
2910         hci_dev_lock(hdev);
2911
2912         if (!hdev_is_powered(hdev)) {
2913                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2914                                         MGMT_STATUS_NOT_POWERED, &rp,
2915                                         sizeof(rp));
2916                 goto unlock;
2917         }
2918
2919         if (cp->addr.type == BDADDR_BREDR) {
2920                 /* If disconnection is requested, then look up the
2921                  * connection. If the remote device is connected, it
2922                  * will be later used to terminate the link.
2923                  *
2924                  * Setting it to NULL explicitly will cause no
2925                  * termination of the link.
2926                  */
2927                 if (cp->disconnect)
2928                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2929                                                        &cp->addr.bdaddr);
2930                 else
2931                         conn = NULL;
2932
2933                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2934         } else {
2935                 u8 addr_type;
2936
2937                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2938                                                &cp->addr.bdaddr);
2939                 if (conn) {
2940                         /* Defer clearing up the connection parameters
2941                          * until closing to give a chance of keeping
2942                          * them if a repairing happens.
2943                          */
2944                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2945
2946                         /* If disconnection is not requested, then
2947                          * clear the connection variable so that the
2948                          * link is not terminated.
2949                          */
2950                         if (!cp->disconnect)
2951                                 conn = NULL;
2952                 }
2953
2954                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2955                         addr_type = ADDR_LE_DEV_PUBLIC;
2956                 else
2957                         addr_type = ADDR_LE_DEV_RANDOM;
2958
2959                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2960
2961                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2962         }
2963
2964         if (err < 0) {
2965                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2966                                         MGMT_STATUS_NOT_PAIRED, &rp,
2967                                         sizeof(rp));
2968                 goto unlock;
2969         }
2970
2971         /* If the connection variable is set, then termination of the
2972          * link is requested.
2973          */
2974         if (!conn) {
2975                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2976                                         &rp, sizeof(rp));
2977                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2978                 goto unlock;
2979         }
2980
2981         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2982                                sizeof(*cp));
2983         if (!cmd) {
2984                 err = -ENOMEM;
2985                 goto unlock;
2986         }
2987
2988         cmd->cmd_complete = addr_cmd_complete;
2989
2990         dc.handle = cpu_to_le16(conn->handle);
2991         dc.reason = 0x13; /* Remote User Terminated Connection */
2992         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2993         if (err < 0)
2994                 mgmt_pending_remove(cmd);
2995
2996 unlock:
2997         hci_dev_unlock(hdev);
2998         return err;
2999 }
3000
3001 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3002                       u16 len)
3003 {
3004         struct mgmt_cp_disconnect *cp = data;
3005         struct mgmt_rp_disconnect rp;
3006         struct mgmt_pending_cmd *cmd;
3007         struct hci_conn *conn;
3008         int err;
3009
3010         BT_DBG("");
3011
3012         memset(&rp, 0, sizeof(rp));
3013         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3014         rp.addr.type = cp->addr.type;
3015
3016         if (!bdaddr_type_is_valid(cp->addr.type))
3017                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3018                                          MGMT_STATUS_INVALID_PARAMS,
3019                                          &rp, sizeof(rp));
3020
3021         hci_dev_lock(hdev);
3022
3023         if (!test_bit(HCI_UP, &hdev->flags)) {
3024                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3025                                         MGMT_STATUS_NOT_POWERED, &rp,
3026                                         sizeof(rp));
3027                 goto failed;
3028         }
3029
3030         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3031                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3032                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3033                 goto failed;
3034         }
3035
3036         if (cp->addr.type == BDADDR_BREDR)
3037                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3038                                                &cp->addr.bdaddr);
3039         else
3040                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
3041
3042         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3043                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3044                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3045                                         sizeof(rp));
3046                 goto failed;
3047         }
3048
3049         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3050         if (!cmd) {
3051                 err = -ENOMEM;
3052                 goto failed;
3053         }
3054
3055         cmd->cmd_complete = generic_cmd_complete;
3056
3057         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3058         if (err < 0)
3059                 mgmt_pending_remove(cmd);
3060
3061 failed:
3062         hci_dev_unlock(hdev);
3063         return err;
3064 }
3065
3066 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3067 {
3068         switch (link_type) {
3069         case LE_LINK:
3070                 switch (addr_type) {
3071                 case ADDR_LE_DEV_PUBLIC:
3072                         return BDADDR_LE_PUBLIC;
3073
3074                 default:
3075                         /* Fallback to LE Random address type */
3076                         return BDADDR_LE_RANDOM;
3077                 }
3078
3079         default:
3080                 /* Fallback to BR/EDR type */
3081                 return BDADDR_BREDR;
3082         }
3083 }
3084
3085 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3086                            u16 data_len)
3087 {
3088         struct mgmt_rp_get_connections *rp;
3089         struct hci_conn *c;
3090         size_t rp_len;
3091         int err;
3092         u16 i;
3093
3094         BT_DBG("");
3095
3096         hci_dev_lock(hdev);
3097
3098         if (!hdev_is_powered(hdev)) {
3099                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3100                                       MGMT_STATUS_NOT_POWERED);
3101                 goto unlock;
3102         }
3103
3104         i = 0;
3105         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3106                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3107                         i++;
3108         }
3109
3110         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3111         rp = kmalloc(rp_len, GFP_KERNEL);
3112         if (!rp) {
3113                 err = -ENOMEM;
3114                 goto unlock;
3115         }
3116
3117         i = 0;
3118         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3119                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3120                         continue;
3121                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3122                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3123                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3124                         continue;
3125                 i++;
3126         }
3127
3128         rp->conn_count = cpu_to_le16(i);
3129
3130         /* Recalculate length in case of filtered SCO connections, etc */
3131         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3132
3133         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3134                                 rp_len);
3135
3136         kfree(rp);
3137
3138 unlock:
3139         hci_dev_unlock(hdev);
3140         return err;
3141 }
3142
3143 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3144                                    struct mgmt_cp_pin_code_neg_reply *cp)
3145 {
3146         struct mgmt_pending_cmd *cmd;
3147         int err;
3148
3149         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3150                                sizeof(*cp));
3151         if (!cmd)
3152                 return -ENOMEM;
3153
3154         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3155                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3156         if (err < 0)
3157                 mgmt_pending_remove(cmd);
3158
3159         return err;
3160 }
3161
3162 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3163                           u16 len)
3164 {
3165         struct hci_conn *conn;
3166         struct mgmt_cp_pin_code_reply *cp = data;
3167         struct hci_cp_pin_code_reply reply;
3168         struct mgmt_pending_cmd *cmd;
3169         int err;
3170
3171         BT_DBG("");
3172
3173         hci_dev_lock(hdev);
3174
3175         if (!hdev_is_powered(hdev)) {
3176                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3177                                       MGMT_STATUS_NOT_POWERED);
3178                 goto failed;
3179         }
3180
3181         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3182         if (!conn) {
3183                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3184                                       MGMT_STATUS_NOT_CONNECTED);
3185                 goto failed;
3186         }
3187
3188         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3189                 struct mgmt_cp_pin_code_neg_reply ncp;
3190
3191                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3192
3193                 BT_ERR("PIN code is not 16 bytes long");
3194
3195                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3196                 if (err >= 0)
3197                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3198                                               MGMT_STATUS_INVALID_PARAMS);
3199
3200                 goto failed;
3201         }
3202
3203         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3204         if (!cmd) {
3205                 err = -ENOMEM;
3206                 goto failed;
3207         }
3208
3209         cmd->cmd_complete = addr_cmd_complete;
3210
3211         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3212         reply.pin_len = cp->pin_len;
3213         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3214
3215         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3216         if (err < 0)
3217                 mgmt_pending_remove(cmd);
3218
3219 failed:
3220         hci_dev_unlock(hdev);
3221         return err;
3222 }
3223
3224 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3225                              u16 len)
3226 {
3227         struct mgmt_cp_set_io_capability *cp = data;
3228
3229         BT_DBG("");
3230
3231         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3232                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3233                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3234
3235         hci_dev_lock(hdev);
3236
3237         hdev->io_capability = cp->io_capability;
3238
3239         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3240                hdev->io_capability);
3241
3242         hci_dev_unlock(hdev);
3243
3244         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3245                                  NULL, 0);
3246 }
3247
3248 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3249 {
3250         struct hci_dev *hdev = conn->hdev;
3251         struct mgmt_pending_cmd *cmd;
3252
3253         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3254                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3255                         continue;
3256
3257                 if (cmd->user_data != conn)
3258                         continue;
3259
3260                 return cmd;
3261         }
3262
3263         return NULL;
3264 }
3265
3266 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3267 {
3268         struct mgmt_rp_pair_device rp;
3269         struct hci_conn *conn = cmd->user_data;
3270         int err;
3271
3272         bacpy(&rp.addr.bdaddr, &conn->dst);
3273         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3274
3275         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3276                                 status, &rp, sizeof(rp));
3277
3278         /* So we don't get further callbacks for this connection */
3279         conn->connect_cfm_cb = NULL;
3280         conn->security_cfm_cb = NULL;
3281         conn->disconn_cfm_cb = NULL;
3282
3283         hci_conn_drop(conn);
3284
3285         /* The device is paired so there is no need to remove
3286          * its connection parameters anymore.
3287          */
3288         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3289
3290         hci_conn_put(conn);
3291
3292         return err;
3293 }
3294
3295 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3296 {
3297         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3298         struct mgmt_pending_cmd *cmd;
3299
3300         cmd = find_pairing(conn);
3301         if (cmd) {
3302                 cmd->cmd_complete(cmd, status);
3303                 mgmt_pending_remove(cmd);
3304         }
3305 }
3306
3307 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3308 {
3309         struct mgmt_pending_cmd *cmd;
3310
3311         BT_DBG("status %u", status);
3312
3313         cmd = find_pairing(conn);
3314         if (!cmd) {
3315                 BT_DBG("Unable to find a pending command");
3316                 return;
3317         }
3318
3319         cmd->cmd_complete(cmd, mgmt_status(status));
3320         mgmt_pending_remove(cmd);
3321 }
3322
3323 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3324 {
3325         struct mgmt_pending_cmd *cmd;
3326
3327         BT_DBG("status %u", status);
3328
3329         if (!status)
3330                 return;
3331
3332         cmd = find_pairing(conn);
3333         if (!cmd) {
3334                 BT_DBG("Unable to find a pending command");
3335                 return;
3336         }
3337
3338         cmd->cmd_complete(cmd, mgmt_status(status));
3339         mgmt_pending_remove(cmd);
3340 }
3341
3342 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3343                        u16 len)
3344 {
3345         struct mgmt_cp_pair_device *cp = data;
3346         struct mgmt_rp_pair_device rp;
3347         struct mgmt_pending_cmd *cmd;
3348         u8 sec_level, auth_type;
3349         struct hci_conn *conn;
3350         int err;
3351
3352         BT_DBG("");
3353
3354         memset(&rp, 0, sizeof(rp));
3355         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3356         rp.addr.type = cp->addr.type;
3357
3358         if (!bdaddr_type_is_valid(cp->addr.type))
3359                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3360                                          MGMT_STATUS_INVALID_PARAMS,
3361                                          &rp, sizeof(rp));
3362
3363         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3364                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3365                                          MGMT_STATUS_INVALID_PARAMS,
3366                                          &rp, sizeof(rp));
3367
3368         hci_dev_lock(hdev);
3369
3370         if (!hdev_is_powered(hdev)) {
3371                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3372                                         MGMT_STATUS_NOT_POWERED, &rp,
3373                                         sizeof(rp));
3374                 goto unlock;
3375         }
3376
3377         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3378                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3379                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3380                                         sizeof(rp));
3381                 goto unlock;
3382         }
3383
3384         sec_level = BT_SECURITY_MEDIUM;
3385         auth_type = HCI_AT_DEDICATED_BONDING;
3386
3387         if (cp->addr.type == BDADDR_BREDR) {
3388                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3389                                        auth_type);
3390         } else {
3391                 u8 addr_type;
3392
3393                 /* Convert from L2CAP channel address type to HCI address type
3394                  */
3395                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3396                         addr_type = ADDR_LE_DEV_PUBLIC;
3397                 else
3398                         addr_type = ADDR_LE_DEV_RANDOM;
3399
3400                 /* When pairing a new device, it is expected to remember
3401                  * this device for future connections. Adding the connection
3402                  * parameter information ahead of time allows tracking
3403                  * of the slave preferred values and will speed up any
3404                  * further connection establishment.
3405                  *
3406                  * If connection parameters already exist, then they
3407                  * will be kept and this function does nothing.
3408                  */
3409                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3410
3411                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3412                                       sec_level, HCI_LE_CONN_TIMEOUT,
3413                                       HCI_ROLE_MASTER);
3414         }
3415
3416         if (IS_ERR(conn)) {
3417                 int status;
3418
3419                 if (PTR_ERR(conn) == -EBUSY)
3420                         status = MGMT_STATUS_BUSY;
3421                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3422                         status = MGMT_STATUS_NOT_SUPPORTED;
3423                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3424                         status = MGMT_STATUS_REJECTED;
3425                 else
3426                         status = MGMT_STATUS_CONNECT_FAILED;
3427
3428                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3429                                         status, &rp, sizeof(rp));
3430                 goto unlock;
3431         }
3432
3433         if (conn->connect_cfm_cb) {
3434                 hci_conn_drop(conn);
3435                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3436                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3437                 goto unlock;
3438         }
3439
3440         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3441         if (!cmd) {
3442                 err = -ENOMEM;
3443                 hci_conn_drop(conn);
3444                 goto unlock;
3445         }
3446
3447         cmd->cmd_complete = pairing_complete;
3448
3449         /* For LE, just connecting isn't a proof that the pairing finished */
3450         if (cp->addr.type == BDADDR_BREDR) {
3451                 conn->connect_cfm_cb = pairing_complete_cb;
3452                 conn->security_cfm_cb = pairing_complete_cb;
3453                 conn->disconn_cfm_cb = pairing_complete_cb;
3454         } else {
3455                 conn->connect_cfm_cb = le_pairing_complete_cb;
3456                 conn->security_cfm_cb = le_pairing_complete_cb;
3457                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3458         }
3459
3460         conn->io_capability = cp->io_cap;
3461         cmd->user_data = hci_conn_get(conn);
3462
3463         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3464             hci_conn_security(conn, sec_level, auth_type, true)) {
3465                 cmd->cmd_complete(cmd, 0);
3466                 mgmt_pending_remove(cmd);
3467         }
3468
3469         err = 0;
3470
3471 unlock:
3472         hci_dev_unlock(hdev);
3473         return err;
3474 }
3475
3476 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3477                               u16 len)
3478 {
3479         struct mgmt_addr_info *addr = data;
3480         struct mgmt_pending_cmd *cmd;
3481         struct hci_conn *conn;
3482         int err;
3483
3484         BT_DBG("");
3485
3486         hci_dev_lock(hdev);
3487
3488         if (!hdev_is_powered(hdev)) {
3489                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3490                                       MGMT_STATUS_NOT_POWERED);
3491                 goto unlock;
3492         }
3493
3494         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3495         if (!cmd) {
3496                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3497                                       MGMT_STATUS_INVALID_PARAMS);
3498                 goto unlock;
3499         }
3500
3501         conn = cmd->user_data;
3502
3503         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3504                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3505                                       MGMT_STATUS_INVALID_PARAMS);
3506                 goto unlock;
3507         }
3508
3509         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3510         mgmt_pending_remove(cmd);
3511
3512         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3513                                 addr, sizeof(*addr));
3514 unlock:
3515         hci_dev_unlock(hdev);
3516         return err;
3517 }
3518
3519 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3520                              struct mgmt_addr_info *addr, u16 mgmt_op,
3521                              u16 hci_op, __le32 passkey)
3522 {
3523         struct mgmt_pending_cmd *cmd;
3524         struct hci_conn *conn;
3525         int err;
3526
3527         hci_dev_lock(hdev);
3528
3529         if (!hdev_is_powered(hdev)) {
3530                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3531                                         MGMT_STATUS_NOT_POWERED, addr,
3532                                         sizeof(*addr));
3533                 goto done;
3534         }
3535
3536         if (addr->type == BDADDR_BREDR)
3537                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3538         else
3539                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3540
3541         if (!conn) {
3542                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3543                                         MGMT_STATUS_NOT_CONNECTED, addr,
3544                                         sizeof(*addr));
3545                 goto done;
3546         }
3547
3548         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3549                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3550                 if (!err)
3551                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3552                                                 MGMT_STATUS_SUCCESS, addr,
3553                                                 sizeof(*addr));
3554                 else
3555                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3556                                                 MGMT_STATUS_FAILED, addr,
3557                                                 sizeof(*addr));
3558
3559                 goto done;
3560         }
3561
3562         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3563         if (!cmd) {
3564                 err = -ENOMEM;
3565                 goto done;
3566         }
3567
3568         cmd->cmd_complete = addr_cmd_complete;
3569
3570         /* Continue with pairing via HCI */
3571         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3572                 struct hci_cp_user_passkey_reply cp;
3573
3574                 bacpy(&cp.bdaddr, &addr->bdaddr);
3575                 cp.passkey = passkey;
3576                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3577         } else
3578                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3579                                    &addr->bdaddr);
3580
3581         if (err < 0)
3582                 mgmt_pending_remove(cmd);
3583
3584 done:
3585         hci_dev_unlock(hdev);
3586         return err;
3587 }
3588
3589 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3590                               void *data, u16 len)
3591 {
3592         struct mgmt_cp_pin_code_neg_reply *cp = data;
3593
3594         BT_DBG("");
3595
3596         return user_pairing_resp(sk, hdev, &cp->addr,
3597                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3598                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3599 }
3600
3601 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3602                               u16 len)
3603 {
3604         struct mgmt_cp_user_confirm_reply *cp = data;
3605
3606         BT_DBG("");
3607
3608         if (len != sizeof(*cp))
3609                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3610                                        MGMT_STATUS_INVALID_PARAMS);
3611
3612         return user_pairing_resp(sk, hdev, &cp->addr,
3613                                  MGMT_OP_USER_CONFIRM_REPLY,
3614                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3615 }
3616
3617 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3618                                   void *data, u16 len)
3619 {
3620         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3621
3622         BT_DBG("");
3623
3624         return user_pairing_resp(sk, hdev, &cp->addr,
3625                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3626                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3627 }
3628
3629 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3630                               u16 len)
3631 {
3632         struct mgmt_cp_user_passkey_reply *cp = data;
3633
3634         BT_DBG("");
3635
3636         return user_pairing_resp(sk, hdev, &cp->addr,
3637                                  MGMT_OP_USER_PASSKEY_REPLY,
3638                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3639 }
3640
3641 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3642                                   void *data, u16 len)
3643 {
3644         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3645
3646         BT_DBG("");
3647
3648         return user_pairing_resp(sk, hdev, &cp->addr,
3649                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3650                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3651 }
3652
3653 static void update_name(struct hci_request *req)
3654 {
3655         struct hci_dev *hdev = req->hdev;
3656         struct hci_cp_write_local_name cp;
3657
3658         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3659
3660         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3661 }
3662
3663 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3664 {
3665         struct mgmt_cp_set_local_name *cp;
3666         struct mgmt_pending_cmd *cmd;
3667
3668         BT_DBG("status 0x%02x", status);
3669
3670         hci_dev_lock(hdev);
3671
3672         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3673         if (!cmd)
3674                 goto unlock;
3675
3676         cp = cmd->param;
3677
3678         if (status)
3679                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3680                                 mgmt_status(status));
3681         else
3682                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3683                                   cp, sizeof(*cp));
3684
3685         mgmt_pending_remove(cmd);
3686
3687 unlock:
3688         hci_dev_unlock(hdev);
3689 }
3690
3691 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3692                           u16 len)
3693 {
3694         struct mgmt_cp_set_local_name *cp = data;
3695         struct mgmt_pending_cmd *cmd;
3696         struct hci_request req;
3697         int err;
3698
3699         BT_DBG("");
3700
3701         hci_dev_lock(hdev);
3702
3703         /* If the old values are the same as the new ones just return a
3704          * direct command complete event.
3705          */
3706         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3707             !memcmp(hdev->short_name, cp->short_name,
3708                     sizeof(hdev->short_name))) {
3709                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3710                                         data, len);
3711                 goto failed;
3712         }
3713
3714         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3715
3716         if (!hdev_is_powered(hdev)) {
3717                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3718
3719                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3720                                         data, len);
3721                 if (err < 0)
3722                         goto failed;
3723
3724                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3725                                          data, len, sk);
3726
3727                 goto failed;
3728         }
3729
3730         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3731         if (!cmd) {
3732                 err = -ENOMEM;
3733                 goto failed;
3734         }
3735
3736         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3737
3738         hci_req_init(&req, hdev);
3739
3740         if (lmp_bredr_capable(hdev)) {
3741                 update_name(&req);
3742                 update_eir(&req);
3743         }
3744
3745         /* The name is stored in the scan response data and so
3746          * no need to udpate the advertising data here.
3747          */
3748         if (lmp_le_capable(hdev))
3749                 update_scan_rsp_data(&req);
3750
3751         err = hci_req_run(&req, set_name_complete);
3752         if (err < 0)
3753                 mgmt_pending_remove(cmd);
3754
3755 failed:
3756         hci_dev_unlock(hdev);
3757         return err;
3758 }
3759
3760 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3761                                void *data, u16 data_len)
3762 {
3763         struct mgmt_pending_cmd *cmd;
3764         int err;
3765
3766         BT_DBG("%s", hdev->name);
3767
3768         hci_dev_lock(hdev);
3769
3770         if (!hdev_is_powered(hdev)) {
3771                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3772                                       MGMT_STATUS_NOT_POWERED);
3773                 goto unlock;
3774         }
3775
3776         if (!lmp_ssp_capable(hdev)) {
3777                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3778                                       MGMT_STATUS_NOT_SUPPORTED);
3779                 goto unlock;
3780         }
3781
3782         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3783                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3784                                       MGMT_STATUS_BUSY);
3785                 goto unlock;
3786         }
3787
3788         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3789         if (!cmd) {
3790                 err = -ENOMEM;
3791                 goto unlock;
3792         }
3793
3794         if (bredr_sc_enabled(hdev))
3795                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3796                                    0, NULL);
3797         else
3798                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3799
3800         if (err < 0)
3801                 mgmt_pending_remove(cmd);
3802
3803 unlock:
3804         hci_dev_unlock(hdev);
3805         return err;
3806 }
3807
3808 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3809                                void *data, u16 len)
3810 {
3811         struct mgmt_addr_info *addr = data;
3812         int err;
3813
3814         BT_DBG("%s ", hdev->name);
3815
3816         if (!bdaddr_type_is_valid(addr->type))
3817                 return mgmt_cmd_complete(sk, hdev->id,
3818                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3819                                          MGMT_STATUS_INVALID_PARAMS,
3820                                          addr, sizeof(*addr));
3821
3822         hci_dev_lock(hdev);
3823
3824         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3825                 struct mgmt_cp_add_remote_oob_data *cp = data;
3826                 u8 status;
3827
3828                 if (cp->addr.type != BDADDR_BREDR) {
3829                         err = mgmt_cmd_complete(sk, hdev->id,
3830                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3831                                                 MGMT_STATUS_INVALID_PARAMS,
3832                                                 &cp->addr, sizeof(cp->addr));
3833                         goto unlock;
3834                 }
3835
3836                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3837                                               cp->addr.type, cp->hash,
3838                                               cp->rand, NULL, NULL);
3839                 if (err < 0)
3840                         status = MGMT_STATUS_FAILED;
3841                 else
3842                         status = MGMT_STATUS_SUCCESS;
3843
3844                 err = mgmt_cmd_complete(sk, hdev->id,
3845                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3846                                         &cp->addr, sizeof(cp->addr));
3847         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3848                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3849                 u8 *rand192, *hash192, *rand256, *hash256;
3850                 u8 status;
3851
3852                 if (bdaddr_type_is_le(cp->addr.type)) {
3853                         /* Enforce zero-valued 192-bit parameters as
3854                          * long as legacy SMP OOB isn't implemented.
3855                          */
3856                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3857                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3858                                 err = mgmt_cmd_complete(sk, hdev->id,
3859                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3860                                                         MGMT_STATUS_INVALID_PARAMS,
3861                                                         addr, sizeof(*addr));
3862                                 goto unlock;
3863                         }
3864
3865                         rand192 = NULL;
3866                         hash192 = NULL;
3867                 } else {
3868                         /* In case one of the P-192 values is set to zero,
3869                          * then just disable OOB data for P-192.
3870                          */
3871                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3872                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3873                                 rand192 = NULL;
3874                                 hash192 = NULL;
3875                         } else {
3876                                 rand192 = cp->rand192;
3877                                 hash192 = cp->hash192;
3878                         }
3879                 }
3880
3881                 /* In case one of the P-256 values is set to zero, then just
3882                  * disable OOB data for P-256.
3883                  */
3884                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3885                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3886                         rand256 = NULL;
3887                         hash256 = NULL;
3888                 } else {
3889                         rand256 = cp->rand256;
3890                         hash256 = cp->hash256;
3891                 }
3892
3893                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3894                                               cp->addr.type, hash192, rand192,
3895                                               hash256, rand256);
3896                 if (err < 0)
3897                         status = MGMT_STATUS_FAILED;
3898                 else
3899                         status = MGMT_STATUS_SUCCESS;
3900
3901                 err = mgmt_cmd_complete(sk, hdev->id,
3902                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3903                                         status, &cp->addr, sizeof(cp->addr));
3904         } else {
3905                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3906                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3907                                       MGMT_STATUS_INVALID_PARAMS);
3908         }
3909
3910 unlock:
3911         hci_dev_unlock(hdev);
3912         return err;
3913 }
3914
3915 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3916                                   void *data, u16 len)
3917 {
3918         struct mgmt_cp_remove_remote_oob_data *cp = data;
3919         u8 status;
3920         int err;
3921
3922         BT_DBG("%s", hdev->name);
3923
3924         if (cp->addr.type != BDADDR_BREDR)
3925                 return mgmt_cmd_complete(sk, hdev->id,
3926                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3927                                          MGMT_STATUS_INVALID_PARAMS,
3928                                          &cp->addr, sizeof(cp->addr));
3929
3930         hci_dev_lock(hdev);
3931
3932         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3933                 hci_remote_oob_data_clear(hdev);
3934                 status = MGMT_STATUS_SUCCESS;
3935                 goto done;
3936         }
3937
3938         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3939         if (err < 0)
3940                 status = MGMT_STATUS_INVALID_PARAMS;
3941         else
3942                 status = MGMT_STATUS_SUCCESS;
3943
3944 done:
3945         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3946                                 status, &cp->addr, sizeof(cp->addr));
3947
3948         hci_dev_unlock(hdev);
3949         return err;
3950 }
3951
3952 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
3953 {
3954         struct hci_dev *hdev = req->hdev;
3955         struct hci_cp_inquiry cp;
3956         /* General inquiry access code (GIAC) */
3957         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3958
3959         *status = mgmt_bredr_support(hdev);
3960         if (*status)
3961                 return false;
3962
3963         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3964                 *status = MGMT_STATUS_BUSY;
3965                 return false;
3966         }
3967
3968         hci_inquiry_cache_flush(hdev);
3969
3970         memset(&cp, 0, sizeof(cp));
3971         memcpy(&cp.lap, lap, sizeof(cp.lap));
3972         cp.length = DISCOV_BREDR_INQUIRY_LEN;
3973
3974         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3975
3976         return true;
3977 }
3978
3979 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
3980 {
3981         struct hci_dev *hdev = req->hdev;
3982         struct hci_cp_le_set_scan_param param_cp;
3983         struct hci_cp_le_set_scan_enable enable_cp;
3984         u8 own_addr_type;
3985         int err;
3986
3987         *status = mgmt_le_support(hdev);
3988         if (*status)
3989                 return false;
3990
3991         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
3992                 /* Don't let discovery abort an outgoing connection attempt
3993                  * that's using directed advertising.
3994                  */
3995                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3996                         *status = MGMT_STATUS_REJECTED;
3997                         return false;
3998                 }
3999
4000                 disable_advertising(req);
4001         }
4002
4003         /* If controller is scanning, it means the background scanning is
4004          * running. Thus, we should temporarily stop it in order to set the
4005          * discovery scanning parameters.
4006          */
4007         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4008                 hci_req_add_le_scan_disable(req);
4009
4010         /* All active scans will be done with either a resolvable private
4011          * address (when privacy feature has been enabled) or non-resolvable
4012          * private address.
4013          */
4014         err = hci_update_random_address(req, true, &own_addr_type);
4015         if (err < 0) {
4016                 *status = MGMT_STATUS_FAILED;
4017                 return false;
4018         }
4019
4020         memset(&param_cp, 0, sizeof(param_cp));
4021         param_cp.type = LE_SCAN_ACTIVE;
4022         param_cp.interval = cpu_to_le16(interval);
4023         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4024         param_cp.own_address_type = own_addr_type;
4025
4026         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4027                     &param_cp);
4028
4029         memset(&enable_cp, 0, sizeof(enable_cp));
4030         enable_cp.enable = LE_SCAN_ENABLE;
4031         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4032
4033         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4034                     &enable_cp);
4035
4036         return true;
4037 }
4038
4039 static bool trigger_discovery(struct hci_request *req, u8 *status)
4040 {
4041         struct hci_dev *hdev = req->hdev;
4042
4043         switch (hdev->discovery.type) {
4044         case DISCOV_TYPE_BREDR:
4045                 if (!trigger_bredr_inquiry(req, status))
4046                         return false;
4047                 break;
4048
4049         case DISCOV_TYPE_INTERLEAVED:
4050                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4051                              &hdev->quirks)) {
4052                         /* During simultaneous discovery, we double LE scan
4053                          * interval. We must leave some time for the controller
4054                          * to do BR/EDR inquiry.
4055                          */
4056                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4057                                              status))
4058                                 return false;
4059
4060                         if (!trigger_bredr_inquiry(req, status))
4061                                 return false;
4062
4063                         return true;
4064                 }
4065
4066                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4067                         *status = MGMT_STATUS_NOT_SUPPORTED;
4068                         return false;
4069                 }
4070                 /* fall through */
4071
4072         case DISCOV_TYPE_LE:
4073                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4074                         return false;
4075                 break;
4076
4077         default:
4078                 *status = MGMT_STATUS_INVALID_PARAMS;
4079                 return false;
4080         }
4081
4082         return true;
4083 }
4084
4085 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4086                                      u16 opcode)
4087 {
4088         struct mgmt_pending_cmd *cmd;
4089         unsigned long timeout;
4090
4091         BT_DBG("status %d", status);
4092
4093         hci_dev_lock(hdev);
4094
4095         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4096         if (!cmd)
4097                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4098
4099         if (cmd) {
4100                 cmd->cmd_complete(cmd, mgmt_status(status));
4101                 mgmt_pending_remove(cmd);
4102         }
4103
4104         if (status) {
4105                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4106                 goto unlock;
4107         }
4108
4109         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4110
4111         /* If the scan involves LE scan, pick proper timeout to schedule
4112          * hdev->le_scan_disable that will stop it.
4113          */
4114         switch (hdev->discovery.type) {
4115         case DISCOV_TYPE_LE:
4116                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4117                 break;
4118         case DISCOV_TYPE_INTERLEAVED:
4119                  /* When running simultaneous discovery, the LE scanning time
4120                  * should occupy the whole discovery time sine BR/EDR inquiry
4121                  * and LE scanning are scheduled by the controller.
4122                  *
4123                  * For interleaving discovery in comparison, BR/EDR inquiry
4124                  * and LE scanning are done sequentially with separate
4125                  * timeouts.
4126                  */
4127                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4128                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4129                 else
4130                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4131                 break;
4132         case DISCOV_TYPE_BREDR:
4133                 timeout = 0;
4134                 break;
4135         default:
4136                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4137                 timeout = 0;
4138                 break;
4139         }
4140
4141         if (timeout) {
4142                 /* When service discovery is used and the controller has
4143                  * a strict duplicate filter, it is important to remember
4144                  * the start and duration of the scan. This is required
4145                  * for restarting scanning during the discovery phase.
4146                  */
4147                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4148                              &hdev->quirks) &&
4149                     hdev->discovery.result_filtering) {
4150                         hdev->discovery.scan_start = jiffies;
4151                         hdev->discovery.scan_duration = timeout;
4152                 }
4153
4154                 queue_delayed_work(hdev->workqueue,
4155                                    &hdev->le_scan_disable, timeout);
4156         }
4157
4158 unlock:
4159         hci_dev_unlock(hdev);
4160 }
4161
4162 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4163                            void *data, u16 len)
4164 {
4165         struct mgmt_cp_start_discovery *cp = data;
4166         struct mgmt_pending_cmd *cmd;
4167         struct hci_request req;
4168         u8 status;
4169         int err;
4170
4171         BT_DBG("%s", hdev->name);
4172
4173         hci_dev_lock(hdev);
4174
4175         if (!hdev_is_powered(hdev)) {
4176                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4177                                         MGMT_STATUS_NOT_POWERED,
4178                                         &cp->type, sizeof(cp->type));
4179                 goto failed;
4180         }
4181
4182         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4183             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4184                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4185                                         MGMT_STATUS_BUSY, &cp->type,
4186                                         sizeof(cp->type));
4187                 goto failed;
4188         }
4189
4190         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4191         if (!cmd) {
4192                 err = -ENOMEM;
4193                 goto failed;
4194         }
4195
4196         cmd->cmd_complete = generic_cmd_complete;
4197
4198         /* Clear the discovery filter first to free any previously
4199          * allocated memory for the UUID list.
4200          */
4201         hci_discovery_filter_clear(hdev);
4202
4203         hdev->discovery.type = cp->type;
4204         hdev->discovery.report_invalid_rssi = false;
4205
4206         hci_req_init(&req, hdev);
4207
4208         if (!trigger_discovery(&req, &status)) {
4209                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4210                                         status, &cp->type, sizeof(cp->type));
4211                 mgmt_pending_remove(cmd);
4212                 goto failed;
4213         }
4214
4215         err = hci_req_run(&req, start_discovery_complete);
4216         if (err < 0) {
4217                 mgmt_pending_remove(cmd);
4218                 goto failed;
4219         }
4220
4221         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4222
4223 failed:
4224         hci_dev_unlock(hdev);
4225         return err;
4226 }
4227
4228 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4229                                           u8 status)
4230 {
4231         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4232                                  cmd->param, 1);
4233 }
4234
4235 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4236                                    void *data, u16 len)
4237 {
4238         struct mgmt_cp_start_service_discovery *cp = data;
4239         struct mgmt_pending_cmd *cmd;
4240         struct hci_request req;
4241         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4242         u16 uuid_count, expected_len;
4243         u8 status;
4244         int err;
4245
4246         BT_DBG("%s", hdev->name);
4247
4248         hci_dev_lock(hdev);
4249
4250         if (!hdev_is_powered(hdev)) {
4251                 err = mgmt_cmd_complete(sk, hdev->id,
4252                                         MGMT_OP_START_SERVICE_DISCOVERY,
4253                                         MGMT_STATUS_NOT_POWERED,
4254                                         &cp->type, sizeof(cp->type));
4255                 goto failed;
4256         }
4257
4258         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4259             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4260                 err = mgmt_cmd_complete(sk, hdev->id,
4261                                         MGMT_OP_START_SERVICE_DISCOVERY,
4262                                         MGMT_STATUS_BUSY, &cp->type,
4263                                         sizeof(cp->type));
4264                 goto failed;
4265         }
4266
4267         uuid_count = __le16_to_cpu(cp->uuid_count);
4268         if (uuid_count > max_uuid_count) {
4269                 BT_ERR("service_discovery: too big uuid_count value %u",
4270                        uuid_count);
4271                 err = mgmt_cmd_complete(sk, hdev->id,
4272                                         MGMT_OP_START_SERVICE_DISCOVERY,
4273                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4274                                         sizeof(cp->type));
4275                 goto failed;
4276         }
4277
4278         expected_len = sizeof(*cp) + uuid_count * 16;
4279         if (expected_len != len) {
4280                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4281                        expected_len, len);
4282                 err = mgmt_cmd_complete(sk, hdev->id,
4283                                         MGMT_OP_START_SERVICE_DISCOVERY,
4284                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4285                                         sizeof(cp->type));
4286                 goto failed;
4287         }
4288
4289         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4290                                hdev, data, len);
4291         if (!cmd) {
4292                 err = -ENOMEM;
4293                 goto failed;
4294         }
4295
4296         cmd->cmd_complete = service_discovery_cmd_complete;
4297
4298         /* Clear the discovery filter first to free any previously
4299          * allocated memory for the UUID list.
4300          */
4301         hci_discovery_filter_clear(hdev);
4302
4303         hdev->discovery.result_filtering = true;
4304         hdev->discovery.type = cp->type;
4305         hdev->discovery.rssi = cp->rssi;
4306         hdev->discovery.uuid_count = uuid_count;
4307
4308         if (uuid_count > 0) {
4309                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4310                                                 GFP_KERNEL);
4311                 if (!hdev->discovery.uuids) {
4312                         err = mgmt_cmd_complete(sk, hdev->id,
4313                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4314                                                 MGMT_STATUS_FAILED,
4315                                                 &cp->type, sizeof(cp->type));
4316                         mgmt_pending_remove(cmd);
4317                         goto failed;
4318                 }
4319         }
4320
4321         hci_req_init(&req, hdev);
4322
4323         if (!trigger_discovery(&req, &status)) {
4324                 err = mgmt_cmd_complete(sk, hdev->id,
4325                                         MGMT_OP_START_SERVICE_DISCOVERY,
4326                                         status, &cp->type, sizeof(cp->type));
4327                 mgmt_pending_remove(cmd);
4328                 goto failed;
4329         }
4330
4331         err = hci_req_run(&req, start_discovery_complete);
4332         if (err < 0) {
4333                 mgmt_pending_remove(cmd);
4334                 goto failed;
4335         }
4336
4337         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4338
4339 failed:
4340         hci_dev_unlock(hdev);
4341         return err;
4342 }
4343
4344 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4345 {
4346         struct mgmt_pending_cmd *cmd;
4347
4348         BT_DBG("status %d", status);
4349
4350         hci_dev_lock(hdev);
4351
4352         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4353         if (cmd) {
4354                 cmd->cmd_complete(cmd, mgmt_status(status));
4355                 mgmt_pending_remove(cmd);
4356         }
4357
4358         if (!status)
4359                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4360
4361         hci_dev_unlock(hdev);
4362 }
4363
4364 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4365                           u16 len)
4366 {
4367         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4368         struct mgmt_pending_cmd *cmd;
4369         struct hci_request req;
4370         int err;
4371
4372         BT_DBG("%s", hdev->name);
4373
4374         hci_dev_lock(hdev);
4375
4376         if (!hci_discovery_active(hdev)) {
4377                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4378                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4379                                         sizeof(mgmt_cp->type));
4380                 goto unlock;
4381         }
4382
4383         if (hdev->discovery.type != mgmt_cp->type) {
4384                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4385                                         MGMT_STATUS_INVALID_PARAMS,
4386                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4387                 goto unlock;
4388         }
4389
4390         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4391         if (!cmd) {
4392                 err = -ENOMEM;
4393                 goto unlock;
4394         }
4395
4396         cmd->cmd_complete = generic_cmd_complete;
4397
4398         hci_req_init(&req, hdev);
4399
4400         hci_stop_discovery(&req);
4401
4402         err = hci_req_run(&req, stop_discovery_complete);
4403         if (!err) {
4404                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4405                 goto unlock;
4406         }
4407
4408         mgmt_pending_remove(cmd);
4409
4410         /* If no HCI commands were sent we're done */
4411         if (err == -ENODATA) {
4412                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4413                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4414                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4415         }
4416
4417 unlock:
4418         hci_dev_unlock(hdev);
4419         return err;
4420 }
4421
4422 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4423                         u16 len)
4424 {
4425         struct mgmt_cp_confirm_name *cp = data;
4426         struct inquiry_entry *e;
4427         int err;
4428
4429         BT_DBG("%s", hdev->name);
4430
4431         hci_dev_lock(hdev);
4432
4433         if (!hci_discovery_active(hdev)) {
4434                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4435                                         MGMT_STATUS_FAILED, &cp->addr,
4436                                         sizeof(cp->addr));
4437                 goto failed;
4438         }
4439
4440         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4441         if (!e) {
4442                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4443                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4444                                         sizeof(cp->addr));
4445                 goto failed;
4446         }
4447
4448         if (cp->name_known) {
4449                 e->name_state = NAME_KNOWN;
4450                 list_del(&e->list);
4451         } else {
4452                 e->name_state = NAME_NEEDED;
4453                 hci_inquiry_cache_update_resolve(hdev, e);
4454         }
4455
4456         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4457                                 &cp->addr, sizeof(cp->addr));
4458
4459 failed:
4460         hci_dev_unlock(hdev);
4461         return err;
4462 }
4463
4464 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4465                         u16 len)
4466 {
4467         struct mgmt_cp_block_device *cp = data;
4468         u8 status;
4469         int err;
4470
4471         BT_DBG("%s", hdev->name);
4472
4473         if (!bdaddr_type_is_valid(cp->addr.type))
4474                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4475                                          MGMT_STATUS_INVALID_PARAMS,
4476                                          &cp->addr, sizeof(cp->addr));
4477
4478         hci_dev_lock(hdev);
4479
4480         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4481                                   cp->addr.type);
4482         if (err < 0) {
4483                 status = MGMT_STATUS_FAILED;
4484                 goto done;
4485         }
4486
4487         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4488                    sk);
4489         status = MGMT_STATUS_SUCCESS;
4490
4491 done:
4492         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4493                                 &cp->addr, sizeof(cp->addr));
4494
4495         hci_dev_unlock(hdev);
4496
4497         return err;
4498 }
4499
4500 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4501                           u16 len)
4502 {
4503         struct mgmt_cp_unblock_device *cp = data;
4504         u8 status;
4505         int err;
4506
4507         BT_DBG("%s", hdev->name);
4508
4509         if (!bdaddr_type_is_valid(cp->addr.type))
4510                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4511                                          MGMT_STATUS_INVALID_PARAMS,
4512                                          &cp->addr, sizeof(cp->addr));
4513
4514         hci_dev_lock(hdev);
4515
4516         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4517                                   cp->addr.type);
4518         if (err < 0) {
4519                 status = MGMT_STATUS_INVALID_PARAMS;
4520                 goto done;
4521         }
4522
4523         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4524                    sk);
4525         status = MGMT_STATUS_SUCCESS;
4526
4527 done:
4528         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4529                                 &cp->addr, sizeof(cp->addr));
4530
4531         hci_dev_unlock(hdev);
4532
4533         return err;
4534 }
4535
4536 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4537                          u16 len)
4538 {
4539         struct mgmt_cp_set_device_id *cp = data;
4540         struct hci_request req;
4541         int err;
4542         __u16 source;
4543
4544         BT_DBG("%s", hdev->name);
4545
4546         source = __le16_to_cpu(cp->source);
4547
4548         if (source > 0x0002)
4549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4550                                        MGMT_STATUS_INVALID_PARAMS);
4551
4552         hci_dev_lock(hdev);
4553
4554         hdev->devid_source = source;
4555         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4556         hdev->devid_product = __le16_to_cpu(cp->product);
4557         hdev->devid_version = __le16_to_cpu(cp->version);
4558
4559         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4560                                 NULL, 0);
4561
4562         hci_req_init(&req, hdev);
4563         update_eir(&req);
4564         hci_req_run(&req, NULL);
4565
4566         hci_dev_unlock(hdev);
4567
4568         return err;
4569 }
4570
4571 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4572                                         u16 opcode)
4573 {
4574         BT_DBG("status %d", status);
4575 }
4576
4577 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4578                                      u16 opcode)
4579 {
4580         struct cmd_lookup match = { NULL, hdev };
4581         struct hci_request req;
4582
4583         hci_dev_lock(hdev);
4584
4585         if (status) {
4586                 u8 mgmt_err = mgmt_status(status);
4587
4588                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4589                                      cmd_status_rsp, &mgmt_err);
4590                 goto unlock;
4591         }
4592
4593         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4594                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4595         else
4596                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4597
4598         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4599                              &match);
4600
4601         new_settings(hdev, match.sk);
4602
4603         if (match.sk)
4604                 sock_put(match.sk);
4605
4606         /* If "Set Advertising" was just disabled and instance advertising was
4607          * set up earlier, then enable the advertising instance.
4608          */
4609         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4610             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4611                 goto unlock;
4612
4613         hci_req_init(&req, hdev);
4614
4615         update_adv_data(&req);
4616         enable_advertising(&req);
4617
4618         if (hci_req_run(&req, enable_advertising_instance) < 0)
4619                 BT_ERR("Failed to re-configure advertising");
4620
4621 unlock:
4622         hci_dev_unlock(hdev);
4623 }
4624
4625 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4626                            u16 len)
4627 {
4628         struct mgmt_mode *cp = data;
4629         struct mgmt_pending_cmd *cmd;
4630         struct hci_request req;
4631         u8 val, status;
4632         int err;
4633
4634         BT_DBG("request for %s", hdev->name);
4635
4636         status = mgmt_le_support(hdev);
4637         if (status)
4638                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4639                                        status);
4640
4641         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4642                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4643                                        MGMT_STATUS_INVALID_PARAMS);
4644
4645         hci_dev_lock(hdev);
4646
4647         val = !!cp->val;
4648
4649         /* The following conditions are ones which mean that we should
4650          * not do any HCI communication but directly send a mgmt
4651          * response to user space (after toggling the flag if
4652          * necessary).
4653          */
4654         if (!hdev_is_powered(hdev) ||
4655             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4656              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4657             hci_conn_num(hdev, LE_LINK) > 0 ||
4658             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4659              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4660                 bool changed;
4661
4662                 if (cp->val) {
4663                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4664                         if (cp->val == 0x02)
4665                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4666                         else
4667                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4668                 } else {
4669                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4670                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4671                 }
4672
4673                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4674                 if (err < 0)
4675                         goto unlock;
4676
4677                 if (changed)
4678                         err = new_settings(hdev, sk);
4679
4680                 goto unlock;
4681         }
4682
4683         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4684             pending_find(MGMT_OP_SET_LE, hdev)) {
4685                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4686                                       MGMT_STATUS_BUSY);
4687                 goto unlock;
4688         }
4689
4690         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4691         if (!cmd) {
4692                 err = -ENOMEM;
4693                 goto unlock;
4694         }
4695
4696         hci_req_init(&req, hdev);
4697
4698         if (cp->val == 0x02)
4699                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4700         else
4701                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4702
4703         if (val) {
4704                 /* Switch to instance "0" for the Set Advertising setting. */
4705                 update_adv_data_for_instance(&req, 0);
4706                 update_scan_rsp_data_for_instance(&req, 0);
4707                 enable_advertising(&req);
4708         } else {
4709                 disable_advertising(&req);
4710         }
4711
4712         err = hci_req_run(&req, set_advertising_complete);
4713         if (err < 0)
4714                 mgmt_pending_remove(cmd);
4715
4716 unlock:
4717         hci_dev_unlock(hdev);
4718         return err;
4719 }
4720
4721 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4722                               void *data, u16 len)
4723 {
4724         struct mgmt_cp_set_static_address *cp = data;
4725         int err;
4726
4727         BT_DBG("%s", hdev->name);
4728
4729         if (!lmp_le_capable(hdev))
4730                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4731                                        MGMT_STATUS_NOT_SUPPORTED);
4732
4733         if (hdev_is_powered(hdev))
4734                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4735                                        MGMT_STATUS_REJECTED);
4736
4737         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4738                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4739                         return mgmt_cmd_status(sk, hdev->id,
4740                                                MGMT_OP_SET_STATIC_ADDRESS,
4741                                                MGMT_STATUS_INVALID_PARAMS);
4742
4743                 /* Two most significant bits shall be set */
4744                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4745                         return mgmt_cmd_status(sk, hdev->id,
4746                                                MGMT_OP_SET_STATIC_ADDRESS,
4747                                                MGMT_STATUS_INVALID_PARAMS);
4748         }
4749
4750         hci_dev_lock(hdev);
4751
4752         bacpy(&hdev->static_addr, &cp->bdaddr);
4753
4754         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4755         if (err < 0)
4756                 goto unlock;
4757
4758         err = new_settings(hdev, sk);
4759
4760 unlock:
4761         hci_dev_unlock(hdev);
4762         return err;
4763 }
4764
4765 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4766                            void *data, u16 len)
4767 {
4768         struct mgmt_cp_set_scan_params *cp = data;
4769         __u16 interval, window;
4770         int err;
4771
4772         BT_DBG("%s", hdev->name);
4773
4774         if (!lmp_le_capable(hdev))
4775                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4776                                        MGMT_STATUS_NOT_SUPPORTED);
4777
4778         interval = __le16_to_cpu(cp->interval);
4779
4780         if (interval < 0x0004 || interval > 0x4000)
4781                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4782                                        MGMT_STATUS_INVALID_PARAMS);
4783
4784         window = __le16_to_cpu(cp->window);
4785
4786         if (window < 0x0004 || window > 0x4000)
4787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4788                                        MGMT_STATUS_INVALID_PARAMS);
4789
4790         if (window > interval)
4791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4792                                        MGMT_STATUS_INVALID_PARAMS);
4793
4794         hci_dev_lock(hdev);
4795
4796         hdev->le_scan_interval = interval;
4797         hdev->le_scan_window = window;
4798
4799         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4800                                 NULL, 0);
4801
4802         /* If background scan is running, restart it so new parameters are
4803          * loaded.
4804          */
4805         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4806             hdev->discovery.state == DISCOVERY_STOPPED) {
4807                 struct hci_request req;
4808
4809                 hci_req_init(&req, hdev);
4810
4811                 hci_req_add_le_scan_disable(&req);
4812                 hci_req_add_le_passive_scan(&req);
4813
4814                 hci_req_run(&req, NULL);
4815         }
4816
4817         hci_dev_unlock(hdev);
4818
4819         return err;
4820 }
4821
4822 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4823                                       u16 opcode)
4824 {
4825         struct mgmt_pending_cmd *cmd;
4826
4827         BT_DBG("status 0x%02x", status);
4828
4829         hci_dev_lock(hdev);
4830
4831         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4832         if (!cmd)
4833                 goto unlock;
4834
4835         if (status) {
4836                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4837                                 mgmt_status(status));
4838         } else {
4839                 struct mgmt_mode *cp = cmd->param;
4840
4841                 if (cp->val)
4842                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4843                 else
4844                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4845
4846                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4847                 new_settings(hdev, cmd->sk);
4848         }
4849
4850         mgmt_pending_remove(cmd);
4851
4852 unlock:
4853         hci_dev_unlock(hdev);
4854 }
4855
4856 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4857                                 void *data, u16 len)
4858 {
4859         struct mgmt_mode *cp = data;
4860         struct mgmt_pending_cmd *cmd;
4861         struct hci_request req;
4862         int err;
4863
4864         BT_DBG("%s", hdev->name);
4865
4866         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4867             hdev->hci_ver < BLUETOOTH_VER_1_2)
4868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4869                                        MGMT_STATUS_NOT_SUPPORTED);
4870
4871         if (cp->val != 0x00 && cp->val != 0x01)
4872                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4873                                        MGMT_STATUS_INVALID_PARAMS);
4874
4875         hci_dev_lock(hdev);
4876
4877         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4878                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4879                                       MGMT_STATUS_BUSY);
4880                 goto unlock;
4881         }
4882
4883         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4884                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4885                                         hdev);
4886                 goto unlock;
4887         }
4888
4889         if (!hdev_is_powered(hdev)) {
4890                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4891                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4892                                         hdev);
4893                 new_settings(hdev, sk);
4894                 goto unlock;
4895         }
4896
4897         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4898                                data, len);
4899         if (!cmd) {
4900                 err = -ENOMEM;
4901                 goto unlock;
4902         }
4903
4904         hci_req_init(&req, hdev);
4905
4906         write_fast_connectable(&req, cp->val);
4907
4908         err = hci_req_run(&req, fast_connectable_complete);
4909         if (err < 0) {
4910                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4911                                       MGMT_STATUS_FAILED);
4912                 mgmt_pending_remove(cmd);
4913         }
4914
4915 unlock:
4916         hci_dev_unlock(hdev);
4917
4918         return err;
4919 }
4920
4921 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4922 {
4923         struct mgmt_pending_cmd *cmd;
4924
4925         BT_DBG("status 0x%02x", status);
4926
4927         hci_dev_lock(hdev);
4928
4929         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4930         if (!cmd)
4931                 goto unlock;
4932
4933         if (status) {
4934                 u8 mgmt_err = mgmt_status(status);
4935
4936                 /* We need to restore the flag if related HCI commands
4937                  * failed.
4938                  */
4939                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4940
4941                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4942         } else {
4943                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4944                 new_settings(hdev, cmd->sk);
4945         }
4946
4947         mgmt_pending_remove(cmd);
4948
4949 unlock:
4950         hci_dev_unlock(hdev);
4951 }
4952
4953 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4954 {
4955         struct mgmt_mode *cp = data;
4956         struct mgmt_pending_cmd *cmd;
4957         struct hci_request req;
4958         int err;
4959
4960         BT_DBG("request for %s", hdev->name);
4961
4962         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4964                                        MGMT_STATUS_NOT_SUPPORTED);
4965
4966         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4967                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4968                                        MGMT_STATUS_REJECTED);
4969
4970         if (cp->val != 0x00 && cp->val != 0x01)
4971                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4972                                        MGMT_STATUS_INVALID_PARAMS);
4973
4974         hci_dev_lock(hdev);
4975
4976         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4977                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4978                 goto unlock;
4979         }
4980
4981         if (!hdev_is_powered(hdev)) {
4982                 if (!cp->val) {
4983                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4984                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4985                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4986                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4987                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4988                 }
4989
4990                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4991
4992                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4993                 if (err < 0)
4994                         goto unlock;
4995
4996                 err = new_settings(hdev, sk);
4997                 goto unlock;
4998         }
4999
5000         /* Reject disabling when powered on */
5001         if (!cp->val) {
5002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5003                                       MGMT_STATUS_REJECTED);
5004                 goto unlock;
5005         } else {
5006                 /* When configuring a dual-mode controller to operate
5007                  * with LE only and using a static address, then switching
5008                  * BR/EDR back on is not allowed.
5009                  *
5010                  * Dual-mode controllers shall operate with the public
5011                  * address as its identity address for BR/EDR and LE. So
5012                  * reject the attempt to create an invalid configuration.
5013                  *
5014                  * The same restrictions applies when secure connections
5015                  * has been enabled. For BR/EDR this is a controller feature
5016                  * while for LE it is a host stack feature. This means that
5017                  * switching BR/EDR back on when secure connections has been
5018                  * enabled is not a supported transaction.
5019                  */
5020                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5021                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5022                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5023                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5024                                               MGMT_STATUS_REJECTED);
5025                         goto unlock;
5026                 }
5027         }
5028
5029         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5030                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5031                                       MGMT_STATUS_BUSY);
5032                 goto unlock;
5033         }
5034
5035         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5036         if (!cmd) {
5037                 err = -ENOMEM;
5038                 goto unlock;
5039         }
5040
5041         /* We need to flip the bit already here so that update_adv_data
5042          * generates the correct flags.
5043          */
5044         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5045
5046         hci_req_init(&req, hdev);
5047
5048         write_fast_connectable(&req, false);
5049         __hci_update_page_scan(&req);
5050
5051         /* Since only the advertising data flags will change, there
5052          * is no need to update the scan response data.
5053          */
5054         update_adv_data(&req);
5055
5056         err = hci_req_run(&req, set_bredr_complete);
5057         if (err < 0)
5058                 mgmt_pending_remove(cmd);
5059
5060 unlock:
5061         hci_dev_unlock(hdev);
5062         return err;
5063 }
5064
5065 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5066 {
5067         struct mgmt_pending_cmd *cmd;
5068         struct mgmt_mode *cp;
5069
5070         BT_DBG("%s status %u", hdev->name, status);
5071
5072         hci_dev_lock(hdev);
5073
5074         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5075         if (!cmd)
5076                 goto unlock;
5077
5078         if (status) {
5079                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5080                                 mgmt_status(status));
5081                 goto remove;
5082         }
5083
5084         cp = cmd->param;
5085
5086         switch (cp->val) {
5087         case 0x00:
5088                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5089                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5090                 break;
5091         case 0x01:
5092                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5093                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5094                 break;
5095         case 0x02:
5096                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5097                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5098                 break;
5099         }
5100
5101         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5102         new_settings(hdev, cmd->sk);
5103
5104 remove:
5105         mgmt_pending_remove(cmd);
5106 unlock:
5107         hci_dev_unlock(hdev);
5108 }
5109
5110 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5111                            void *data, u16 len)
5112 {
5113         struct mgmt_mode *cp = data;
5114         struct mgmt_pending_cmd *cmd;
5115         struct hci_request req;
5116         u8 val;
5117         int err;
5118
5119         BT_DBG("request for %s", hdev->name);
5120
5121         if (!lmp_sc_capable(hdev) &&
5122             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5123                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5124                                        MGMT_STATUS_NOT_SUPPORTED);
5125
5126         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5127             lmp_sc_capable(hdev) &&
5128             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5129                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5130                                        MGMT_STATUS_REJECTED);
5131
5132         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5133                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5134                                   MGMT_STATUS_INVALID_PARAMS);
5135
5136         hci_dev_lock(hdev);
5137
5138         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5139             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5140                 bool changed;
5141
5142                 if (cp->val) {
5143                         changed = !hci_dev_test_and_set_flag(hdev,
5144                                                              HCI_SC_ENABLED);
5145                         if (cp->val == 0x02)
5146                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5147                         else
5148                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5149                 } else {
5150                         changed = hci_dev_test_and_clear_flag(hdev,
5151                                                               HCI_SC_ENABLED);
5152                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5153                 }
5154
5155                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5156                 if (err < 0)
5157                         goto failed;
5158
5159                 if (changed)
5160                         err = new_settings(hdev, sk);
5161
5162                 goto failed;
5163         }
5164
5165         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5166                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5167                                       MGMT_STATUS_BUSY);
5168                 goto failed;
5169         }
5170
5171         val = !!cp->val;
5172
5173         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5174             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5175                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5176                 goto failed;
5177         }
5178
5179         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5180         if (!cmd) {
5181                 err = -ENOMEM;
5182                 goto failed;
5183         }
5184
5185         hci_req_init(&req, hdev);
5186         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5187         err = hci_req_run(&req, sc_enable_complete);
5188         if (err < 0) {
5189                 mgmt_pending_remove(cmd);
5190                 goto failed;
5191         }
5192
5193 failed:
5194         hci_dev_unlock(hdev);
5195         return err;
5196 }
5197
5198 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5199                           void *data, u16 len)
5200 {
5201         struct mgmt_mode *cp = data;
5202         bool changed, use_changed;
5203         int err;
5204
5205         BT_DBG("request for %s", hdev->name);
5206
5207         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5209                                        MGMT_STATUS_INVALID_PARAMS);
5210
5211         hci_dev_lock(hdev);
5212
5213         if (cp->val)
5214                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5215         else
5216                 changed = hci_dev_test_and_clear_flag(hdev,
5217                                                       HCI_KEEP_DEBUG_KEYS);
5218
5219         if (cp->val == 0x02)
5220                 use_changed = !hci_dev_test_and_set_flag(hdev,
5221                                                          HCI_USE_DEBUG_KEYS);
5222         else
5223                 use_changed = hci_dev_test_and_clear_flag(hdev,
5224                                                           HCI_USE_DEBUG_KEYS);
5225
5226         if (hdev_is_powered(hdev) && use_changed &&
5227             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5228                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5229                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5230                              sizeof(mode), &mode);
5231         }
5232
5233         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5234         if (err < 0)
5235                 goto unlock;
5236
5237         if (changed)
5238                 err = new_settings(hdev, sk);
5239
5240 unlock:
5241         hci_dev_unlock(hdev);
5242         return err;
5243 }
5244
5245 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5246                        u16 len)
5247 {
5248         struct mgmt_cp_set_privacy *cp = cp_data;
5249         bool changed;
5250         int err;
5251
5252         BT_DBG("request for %s", hdev->name);
5253
5254         if (!lmp_le_capable(hdev))
5255                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5256                                        MGMT_STATUS_NOT_SUPPORTED);
5257
5258         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5259                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5260                                        MGMT_STATUS_INVALID_PARAMS);
5261
5262         if (hdev_is_powered(hdev))
5263                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5264                                        MGMT_STATUS_REJECTED);
5265
5266         hci_dev_lock(hdev);
5267
5268         /* If user space supports this command it is also expected to
5269          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5270          */
5271         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5272
5273         if (cp->privacy) {
5274                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5275                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5276                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5277         } else {
5278                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5279                 memset(hdev->irk, 0, sizeof(hdev->irk));
5280                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5281         }
5282
5283         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5284         if (err < 0)
5285                 goto unlock;
5286
5287         if (changed)
5288                 err = new_settings(hdev, sk);
5289
5290 unlock:
5291         hci_dev_unlock(hdev);
5292         return err;
5293 }
5294
5295 static bool irk_is_valid(struct mgmt_irk_info *irk)
5296 {
5297         switch (irk->addr.type) {
5298         case BDADDR_LE_PUBLIC:
5299                 return true;
5300
5301         case BDADDR_LE_RANDOM:
5302                 /* Two most significant bits shall be set */
5303                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5304                         return false;
5305                 return true;
5306         }
5307
5308         return false;
5309 }
5310
5311 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5312                      u16 len)
5313 {
5314         struct mgmt_cp_load_irks *cp = cp_data;
5315         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5316                                    sizeof(struct mgmt_irk_info));
5317         u16 irk_count, expected_len;
5318         int i, err;
5319
5320         BT_DBG("request for %s", hdev->name);
5321
5322         if (!lmp_le_capable(hdev))
5323                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5324                                        MGMT_STATUS_NOT_SUPPORTED);
5325
5326         irk_count = __le16_to_cpu(cp->irk_count);
5327         if (irk_count > max_irk_count) {
5328                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5330                                        MGMT_STATUS_INVALID_PARAMS);
5331         }
5332
5333         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5334         if (expected_len != len) {
5335                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5336                        expected_len, len);
5337                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5338                                        MGMT_STATUS_INVALID_PARAMS);
5339         }
5340
5341         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5342
5343         for (i = 0; i < irk_count; i++) {
5344                 struct mgmt_irk_info *key = &cp->irks[i];
5345
5346                 if (!irk_is_valid(key))
5347                         return mgmt_cmd_status(sk, hdev->id,
5348                                                MGMT_OP_LOAD_IRKS,
5349                                                MGMT_STATUS_INVALID_PARAMS);
5350         }
5351
5352         hci_dev_lock(hdev);
5353
5354         hci_smp_irks_clear(hdev);
5355
5356         for (i = 0; i < irk_count; i++) {
5357                 struct mgmt_irk_info *irk = &cp->irks[i];
5358                 u8 addr_type;
5359
5360                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5361                         addr_type = ADDR_LE_DEV_PUBLIC;
5362                 else
5363                         addr_type = ADDR_LE_DEV_RANDOM;
5364
5365                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5366                             BDADDR_ANY);
5367         }
5368
5369         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5370
5371         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5372
5373         hci_dev_unlock(hdev);
5374
5375         return err;
5376 }
5377
5378 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5379 {
5380         if (key->master != 0x00 && key->master != 0x01)
5381                 return false;
5382
5383         switch (key->addr.type) {
5384         case BDADDR_LE_PUBLIC:
5385                 return true;
5386
5387         case BDADDR_LE_RANDOM:
5388                 /* Two most significant bits shall be set */
5389                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5390                         return false;
5391                 return true;
5392         }
5393
5394         return false;
5395 }
5396
5397 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5398                                void *cp_data, u16 len)
5399 {
5400         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5401         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5402                                    sizeof(struct mgmt_ltk_info));
5403         u16 key_count, expected_len;
5404         int i, err;
5405
5406         BT_DBG("request for %s", hdev->name);
5407
5408         if (!lmp_le_capable(hdev))
5409                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5410                                        MGMT_STATUS_NOT_SUPPORTED);
5411
5412         key_count = __le16_to_cpu(cp->key_count);
5413         if (key_count > max_key_count) {
5414                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5415                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5416                                        MGMT_STATUS_INVALID_PARAMS);
5417         }
5418
5419         expected_len = sizeof(*cp) + key_count *
5420                                         sizeof(struct mgmt_ltk_info);
5421         if (expected_len != len) {
5422                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5423                        expected_len, len);
5424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5425                                        MGMT_STATUS_INVALID_PARAMS);
5426         }
5427
5428         BT_DBG("%s key_count %u", hdev->name, key_count);
5429
5430         for (i = 0; i < key_count; i++) {
5431                 struct mgmt_ltk_info *key = &cp->keys[i];
5432
5433                 if (!ltk_is_valid(key))
5434                         return mgmt_cmd_status(sk, hdev->id,
5435                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5436                                                MGMT_STATUS_INVALID_PARAMS);
5437         }
5438
5439         hci_dev_lock(hdev);
5440
5441         hci_smp_ltks_clear(hdev);
5442
5443         for (i = 0; i < key_count; i++) {
5444                 struct mgmt_ltk_info *key = &cp->keys[i];
5445                 u8 type, addr_type, authenticated;
5446
5447                 if (key->addr.type == BDADDR_LE_PUBLIC)
5448                         addr_type = ADDR_LE_DEV_PUBLIC;
5449                 else
5450                         addr_type = ADDR_LE_DEV_RANDOM;
5451
5452                 switch (key->type) {
5453                 case MGMT_LTK_UNAUTHENTICATED:
5454                         authenticated = 0x00;
5455                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5456                         break;
5457                 case MGMT_LTK_AUTHENTICATED:
5458                         authenticated = 0x01;
5459                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5460                         break;
5461                 case MGMT_LTK_P256_UNAUTH:
5462                         authenticated = 0x00;
5463                         type = SMP_LTK_P256;
5464                         break;
5465                 case MGMT_LTK_P256_AUTH:
5466                         authenticated = 0x01;
5467                         type = SMP_LTK_P256;
5468                         break;
5469                 case MGMT_LTK_P256_DEBUG:
5470                         authenticated = 0x00;
5471                         type = SMP_LTK_P256_DEBUG;
5472                 default:
5473                         continue;
5474                 }
5475
5476                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5477                             authenticated, key->val, key->enc_size, key->ediv,
5478                             key->rand);
5479         }
5480
5481         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5482                            NULL, 0);
5483
5484         hci_dev_unlock(hdev);
5485
5486         return err;
5487 }
5488
5489 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5490 {
5491         struct hci_conn *conn = cmd->user_data;
5492         struct mgmt_rp_get_conn_info rp;
5493         int err;
5494
5495         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5496
5497         if (status == MGMT_STATUS_SUCCESS) {
5498                 rp.rssi = conn->rssi;
5499                 rp.tx_power = conn->tx_power;
5500                 rp.max_tx_power = conn->max_tx_power;
5501         } else {
5502                 rp.rssi = HCI_RSSI_INVALID;
5503                 rp.tx_power = HCI_TX_POWER_INVALID;
5504                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5505         }
5506
5507         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5508                                 status, &rp, sizeof(rp));
5509
5510         hci_conn_drop(conn);
5511         hci_conn_put(conn);
5512
5513         return err;
5514 }
5515
5516 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5517                                        u16 opcode)
5518 {
5519         struct hci_cp_read_rssi *cp;
5520         struct mgmt_pending_cmd *cmd;
5521         struct hci_conn *conn;
5522         u16 handle;
5523         u8 status;
5524
5525         BT_DBG("status 0x%02x", hci_status);
5526
5527         hci_dev_lock(hdev);
5528
5529         /* Commands sent in request are either Read RSSI or Read Transmit Power
5530          * Level so we check which one was last sent to retrieve connection
5531          * handle.  Both commands have handle as first parameter so it's safe to
5532          * cast data on the same command struct.
5533          *
5534          * First command sent is always Read RSSI and we fail only if it fails.
5535          * In other case we simply override error to indicate success as we
5536          * already remembered if TX power value is actually valid.
5537          */
5538         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5539         if (!cp) {
5540                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5541                 status = MGMT_STATUS_SUCCESS;
5542         } else {
5543                 status = mgmt_status(hci_status);
5544         }
5545
5546         if (!cp) {
5547                 BT_ERR("invalid sent_cmd in conn_info response");
5548                 goto unlock;
5549         }
5550
5551         handle = __le16_to_cpu(cp->handle);
5552         conn = hci_conn_hash_lookup_handle(hdev, handle);
5553         if (!conn) {
5554                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5555                 goto unlock;
5556         }
5557
5558         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5559         if (!cmd)
5560                 goto unlock;
5561
5562         cmd->cmd_complete(cmd, status);
5563         mgmt_pending_remove(cmd);
5564
5565 unlock:
5566         hci_dev_unlock(hdev);
5567 }
5568
5569 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5570                          u16 len)
5571 {
5572         struct mgmt_cp_get_conn_info *cp = data;
5573         struct mgmt_rp_get_conn_info rp;
5574         struct hci_conn *conn;
5575         unsigned long conn_info_age;
5576         int err = 0;
5577
5578         BT_DBG("%s", hdev->name);
5579
5580         memset(&rp, 0, sizeof(rp));
5581         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5582         rp.addr.type = cp->addr.type;
5583
5584         if (!bdaddr_type_is_valid(cp->addr.type))
5585                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5586                                          MGMT_STATUS_INVALID_PARAMS,
5587                                          &rp, sizeof(rp));
5588
5589         hci_dev_lock(hdev);
5590
5591         if (!hdev_is_powered(hdev)) {
5592                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5593                                         MGMT_STATUS_NOT_POWERED, &rp,
5594                                         sizeof(rp));
5595                 goto unlock;
5596         }
5597
5598         if (cp->addr.type == BDADDR_BREDR)
5599                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5600                                                &cp->addr.bdaddr);
5601         else
5602                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5603
5604         if (!conn || conn->state != BT_CONNECTED) {
5605                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5606                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5607                                         sizeof(rp));
5608                 goto unlock;
5609         }
5610
5611         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5612                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5613                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5614                 goto unlock;
5615         }
5616
5617         /* To avoid client trying to guess when to poll again for information we
5618          * calculate conn info age as random value between min/max set in hdev.
5619          */
5620         conn_info_age = hdev->conn_info_min_age +
5621                         prandom_u32_max(hdev->conn_info_max_age -
5622                                         hdev->conn_info_min_age);
5623
5624         /* Query controller to refresh cached values if they are too old or were
5625          * never read.
5626          */
5627         if (time_after(jiffies, conn->conn_info_timestamp +
5628                        msecs_to_jiffies(conn_info_age)) ||
5629             !conn->conn_info_timestamp) {
5630                 struct hci_request req;
5631                 struct hci_cp_read_tx_power req_txp_cp;
5632                 struct hci_cp_read_rssi req_rssi_cp;
5633                 struct mgmt_pending_cmd *cmd;
5634
5635                 hci_req_init(&req, hdev);
5636                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5637                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5638                             &req_rssi_cp);
5639
5640                 /* For LE links TX power does not change thus we don't need to
5641                  * query for it once value is known.
5642                  */
5643                 if (!bdaddr_type_is_le(cp->addr.type) ||
5644                     conn->tx_power == HCI_TX_POWER_INVALID) {
5645                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5646                         req_txp_cp.type = 0x00;
5647                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5648                                     sizeof(req_txp_cp), &req_txp_cp);
5649                 }
5650
5651                 /* Max TX power needs to be read only once per connection */
5652                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5653                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5654                         req_txp_cp.type = 0x01;
5655                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5656                                     sizeof(req_txp_cp), &req_txp_cp);
5657                 }
5658
5659                 err = hci_req_run(&req, conn_info_refresh_complete);
5660                 if (err < 0)
5661                         goto unlock;
5662
5663                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5664                                        data, len);
5665                 if (!cmd) {
5666                         err = -ENOMEM;
5667                         goto unlock;
5668                 }
5669
5670                 hci_conn_hold(conn);
5671                 cmd->user_data = hci_conn_get(conn);
5672                 cmd->cmd_complete = conn_info_cmd_complete;
5673
5674                 conn->conn_info_timestamp = jiffies;
5675         } else {
5676                 /* Cache is valid, just reply with values cached in hci_conn */
5677                 rp.rssi = conn->rssi;
5678                 rp.tx_power = conn->tx_power;
5679                 rp.max_tx_power = conn->max_tx_power;
5680
5681                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5682                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5683         }
5684
5685 unlock:
5686         hci_dev_unlock(hdev);
5687         return err;
5688 }
5689
5690 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5691 {
5692         struct hci_conn *conn = cmd->user_data;
5693         struct mgmt_rp_get_clock_info rp;
5694         struct hci_dev *hdev;
5695         int err;
5696
5697         memset(&rp, 0, sizeof(rp));
5698         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5699
5700         if (status)
5701                 goto complete;
5702
5703         hdev = hci_dev_get(cmd->index);
5704         if (hdev) {
5705                 rp.local_clock = cpu_to_le32(hdev->clock);
5706                 hci_dev_put(hdev);
5707         }
5708
5709         if (conn) {
5710                 rp.piconet_clock = cpu_to_le32(conn->clock);
5711                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5712         }
5713
5714 complete:
5715         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5716                                 sizeof(rp));
5717
5718         if (conn) {
5719                 hci_conn_drop(conn);
5720                 hci_conn_put(conn);
5721         }
5722
5723         return err;
5724 }
5725
5726 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5727 {
5728         struct hci_cp_read_clock *hci_cp;
5729         struct mgmt_pending_cmd *cmd;
5730         struct hci_conn *conn;
5731
5732         BT_DBG("%s status %u", hdev->name, status);
5733
5734         hci_dev_lock(hdev);
5735
5736         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5737         if (!hci_cp)
5738                 goto unlock;
5739
5740         if (hci_cp->which) {
5741                 u16 handle = __le16_to_cpu(hci_cp->handle);
5742                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5743         } else {
5744                 conn = NULL;
5745         }
5746
5747         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5748         if (!cmd)
5749                 goto unlock;
5750
5751         cmd->cmd_complete(cmd, mgmt_status(status));
5752         mgmt_pending_remove(cmd);
5753
5754 unlock:
5755         hci_dev_unlock(hdev);
5756 }
5757
5758 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5759                          u16 len)
5760 {
5761         struct mgmt_cp_get_clock_info *cp = data;
5762         struct mgmt_rp_get_clock_info rp;
5763         struct hci_cp_read_clock hci_cp;
5764         struct mgmt_pending_cmd *cmd;
5765         struct hci_request req;
5766         struct hci_conn *conn;
5767         int err;
5768
5769         BT_DBG("%s", hdev->name);
5770
5771         memset(&rp, 0, sizeof(rp));
5772         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5773         rp.addr.type = cp->addr.type;
5774
5775         if (cp->addr.type != BDADDR_BREDR)
5776                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5777                                          MGMT_STATUS_INVALID_PARAMS,
5778                                          &rp, sizeof(rp));
5779
5780         hci_dev_lock(hdev);
5781
5782         if (!hdev_is_powered(hdev)) {
5783                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5784                                         MGMT_STATUS_NOT_POWERED, &rp,
5785                                         sizeof(rp));
5786                 goto unlock;
5787         }
5788
5789         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5790                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5791                                                &cp->addr.bdaddr);
5792                 if (!conn || conn->state != BT_CONNECTED) {
5793                         err = mgmt_cmd_complete(sk, hdev->id,
5794                                                 MGMT_OP_GET_CLOCK_INFO,
5795                                                 MGMT_STATUS_NOT_CONNECTED,
5796                                                 &rp, sizeof(rp));
5797                         goto unlock;
5798                 }
5799         } else {
5800                 conn = NULL;
5801         }
5802
5803         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5804         if (!cmd) {
5805                 err = -ENOMEM;
5806                 goto unlock;
5807         }
5808
5809         cmd->cmd_complete = clock_info_cmd_complete;
5810
5811         hci_req_init(&req, hdev);
5812
5813         memset(&hci_cp, 0, sizeof(hci_cp));
5814         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5815
5816         if (conn) {
5817                 hci_conn_hold(conn);
5818                 cmd->user_data = hci_conn_get(conn);
5819
5820                 hci_cp.handle = cpu_to_le16(conn->handle);
5821                 hci_cp.which = 0x01; /* Piconet clock */
5822                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5823         }
5824
5825         err = hci_req_run(&req, get_clock_info_complete);
5826         if (err < 0)
5827                 mgmt_pending_remove(cmd);
5828
5829 unlock:
5830         hci_dev_unlock(hdev);
5831         return err;
5832 }
5833
5834 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5835 {
5836         struct hci_conn *conn;
5837
5838         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5839         if (!conn)
5840                 return false;
5841
5842         if (conn->dst_type != type)
5843                 return false;
5844
5845         if (conn->state != BT_CONNECTED)
5846                 return false;
5847
5848         return true;
5849 }
5850
5851 /* This function requires the caller holds hdev->lock */
5852 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5853                                u8 addr_type, u8 auto_connect)
5854 {
5855         struct hci_dev *hdev = req->hdev;
5856         struct hci_conn_params *params;
5857
5858         params = hci_conn_params_add(hdev, addr, addr_type);
5859         if (!params)
5860                 return -EIO;
5861
5862         if (params->auto_connect == auto_connect)
5863                 return 0;
5864
5865         list_del_init(&params->action);
5866
5867         switch (auto_connect) {
5868         case HCI_AUTO_CONN_DISABLED:
5869         case HCI_AUTO_CONN_LINK_LOSS:
5870                 __hci_update_background_scan(req);
5871                 break;
5872         case HCI_AUTO_CONN_REPORT:
5873                 list_add(&params->action, &hdev->pend_le_reports);
5874                 __hci_update_background_scan(req);
5875                 break;
5876         case HCI_AUTO_CONN_DIRECT:
5877         case HCI_AUTO_CONN_ALWAYS:
5878                 if (!is_connected(hdev, addr, addr_type)) {
5879                         list_add(&params->action, &hdev->pend_le_conns);
5880                         __hci_update_background_scan(req);
5881                 }
5882                 break;
5883         }
5884
5885         params->auto_connect = auto_connect;
5886
5887         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5888                auto_connect);
5889
5890         return 0;
5891 }
5892
5893 static void device_added(struct sock *sk, struct hci_dev *hdev,
5894                          bdaddr_t *bdaddr, u8 type, u8 action)
5895 {
5896         struct mgmt_ev_device_added ev;
5897
5898         bacpy(&ev.addr.bdaddr, bdaddr);
5899         ev.addr.type = type;
5900         ev.action = action;
5901
5902         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5903 }
5904
5905 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5906 {
5907         struct mgmt_pending_cmd *cmd;
5908
5909         BT_DBG("status 0x%02x", status);
5910
5911         hci_dev_lock(hdev);
5912
5913         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5914         if (!cmd)
5915                 goto unlock;
5916
5917         cmd->cmd_complete(cmd, mgmt_status(status));
5918         mgmt_pending_remove(cmd);
5919
5920 unlock:
5921         hci_dev_unlock(hdev);
5922 }
5923
5924 static int add_device(struct sock *sk, struct hci_dev *hdev,
5925                       void *data, u16 len)
5926 {
5927         struct mgmt_cp_add_device *cp = data;
5928         struct mgmt_pending_cmd *cmd;
5929         struct hci_request req;
5930         u8 auto_conn, addr_type;
5931         int err;
5932
5933         BT_DBG("%s", hdev->name);
5934
5935         if (!bdaddr_type_is_valid(cp->addr.type) ||
5936             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5937                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5938                                          MGMT_STATUS_INVALID_PARAMS,
5939                                          &cp->addr, sizeof(cp->addr));
5940
5941         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5942                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5943                                          MGMT_STATUS_INVALID_PARAMS,
5944                                          &cp->addr, sizeof(cp->addr));
5945
5946         hci_req_init(&req, hdev);
5947
5948         hci_dev_lock(hdev);
5949
5950         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5951         if (!cmd) {
5952                 err = -ENOMEM;
5953                 goto unlock;
5954         }
5955
5956         cmd->cmd_complete = addr_cmd_complete;
5957
5958         if (cp->addr.type == BDADDR_BREDR) {
5959                 /* Only incoming connections action is supported for now */
5960                 if (cp->action != 0x01) {
5961                         err = cmd->cmd_complete(cmd,
5962                                                 MGMT_STATUS_INVALID_PARAMS);
5963                         mgmt_pending_remove(cmd);
5964                         goto unlock;
5965                 }
5966
5967                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5968                                           cp->addr.type);
5969                 if (err)
5970                         goto unlock;
5971
5972                 __hci_update_page_scan(&req);
5973
5974                 goto added;
5975         }
5976
5977         if (cp->addr.type == BDADDR_LE_PUBLIC)
5978                 addr_type = ADDR_LE_DEV_PUBLIC;
5979         else
5980                 addr_type = ADDR_LE_DEV_RANDOM;
5981
5982         if (cp->action == 0x02)
5983                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5984         else if (cp->action == 0x01)
5985                 auto_conn = HCI_AUTO_CONN_DIRECT;
5986         else
5987                 auto_conn = HCI_AUTO_CONN_REPORT;
5988
5989         /* If the connection parameters don't exist for this device,
5990          * they will be created and configured with defaults.
5991          */
5992         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5993                                 auto_conn) < 0) {
5994                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5995                 mgmt_pending_remove(cmd);
5996                 goto unlock;
5997         }
5998
5999 added:
6000         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6001
6002         err = hci_req_run(&req, add_device_complete);
6003         if (err < 0) {
6004                 /* ENODATA means no HCI commands were needed (e.g. if
6005                  * the adapter is powered off).
6006                  */
6007                 if (err == -ENODATA)
6008                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6009                 mgmt_pending_remove(cmd);
6010         }
6011
6012 unlock:
6013         hci_dev_unlock(hdev);
6014         return err;
6015 }
6016
6017 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6018                            bdaddr_t *bdaddr, u8 type)
6019 {
6020         struct mgmt_ev_device_removed ev;
6021
6022         bacpy(&ev.addr.bdaddr, bdaddr);
6023         ev.addr.type = type;
6024
6025         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6026 }
6027
6028 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6029 {
6030         struct mgmt_pending_cmd *cmd;
6031
6032         BT_DBG("status 0x%02x", status);
6033
6034         hci_dev_lock(hdev);
6035
6036         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6037         if (!cmd)
6038                 goto unlock;
6039
6040         cmd->cmd_complete(cmd, mgmt_status(status));
6041         mgmt_pending_remove(cmd);
6042
6043 unlock:
6044         hci_dev_unlock(hdev);
6045 }
6046
6047 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6048                          void *data, u16 len)
6049 {
6050         struct mgmt_cp_remove_device *cp = data;
6051         struct mgmt_pending_cmd *cmd;
6052         struct hci_request req;
6053         int err;
6054
6055         BT_DBG("%s", hdev->name);
6056
6057         hci_req_init(&req, hdev);
6058
6059         hci_dev_lock(hdev);
6060
6061         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6062         if (!cmd) {
6063                 err = -ENOMEM;
6064                 goto unlock;
6065         }
6066
6067         cmd->cmd_complete = addr_cmd_complete;
6068
6069         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6070                 struct hci_conn_params *params;
6071                 u8 addr_type;
6072
6073                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6074                         err = cmd->cmd_complete(cmd,
6075                                                 MGMT_STATUS_INVALID_PARAMS);
6076                         mgmt_pending_remove(cmd);
6077                         goto unlock;
6078                 }
6079
6080                 if (cp->addr.type == BDADDR_BREDR) {
6081                         err = hci_bdaddr_list_del(&hdev->whitelist,
6082                                                   &cp->addr.bdaddr,
6083                                                   cp->addr.type);
6084                         if (err) {
6085                                 err = cmd->cmd_complete(cmd,
6086                                                         MGMT_STATUS_INVALID_PARAMS);
6087                                 mgmt_pending_remove(cmd);
6088                                 goto unlock;
6089                         }
6090
6091                         __hci_update_page_scan(&req);
6092
6093                         device_removed(sk, hdev, &cp->addr.bdaddr,
6094                                        cp->addr.type);
6095                         goto complete;
6096                 }
6097
6098                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6099                         addr_type = ADDR_LE_DEV_PUBLIC;
6100                 else
6101                         addr_type = ADDR_LE_DEV_RANDOM;
6102
6103                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6104                                                 addr_type);
6105                 if (!params) {
6106                         err = cmd->cmd_complete(cmd,
6107                                                 MGMT_STATUS_INVALID_PARAMS);
6108                         mgmt_pending_remove(cmd);
6109                         goto unlock;
6110                 }
6111
6112                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
6113                         err = cmd->cmd_complete(cmd,
6114                                                 MGMT_STATUS_INVALID_PARAMS);
6115                         mgmt_pending_remove(cmd);
6116                         goto unlock;
6117                 }
6118
6119                 list_del(&params->action);
6120                 list_del(&params->list);
6121                 kfree(params);
6122                 __hci_update_background_scan(&req);
6123
6124                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6125         } else {
6126                 struct hci_conn_params *p, *tmp;
6127                 struct bdaddr_list *b, *btmp;
6128
6129                 if (cp->addr.type) {
6130                         err = cmd->cmd_complete(cmd,
6131                                                 MGMT_STATUS_INVALID_PARAMS);
6132                         mgmt_pending_remove(cmd);
6133                         goto unlock;
6134                 }
6135
6136                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6137                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6138                         list_del(&b->list);
6139                         kfree(b);
6140                 }
6141
6142                 __hci_update_page_scan(&req);
6143
6144                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6145                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6146                                 continue;
6147                         device_removed(sk, hdev, &p->addr, p->addr_type);
6148                         list_del(&p->action);
6149                         list_del(&p->list);
6150                         kfree(p);
6151                 }
6152
6153                 BT_DBG("All LE connection parameters were removed");
6154
6155                 __hci_update_background_scan(&req);
6156         }
6157
6158 complete:
6159         err = hci_req_run(&req, remove_device_complete);
6160         if (err < 0) {
6161                 /* ENODATA means no HCI commands were needed (e.g. if
6162                  * the adapter is powered off).
6163                  */
6164                 if (err == -ENODATA)
6165                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6166                 mgmt_pending_remove(cmd);
6167         }
6168
6169 unlock:
6170         hci_dev_unlock(hdev);
6171         return err;
6172 }
6173
6174 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6175                            u16 len)
6176 {
6177         struct mgmt_cp_load_conn_param *cp = data;
6178         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6179                                      sizeof(struct mgmt_conn_param));
6180         u16 param_count, expected_len;
6181         int i;
6182
6183         if (!lmp_le_capable(hdev))
6184                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6185                                        MGMT_STATUS_NOT_SUPPORTED);
6186
6187         param_count = __le16_to_cpu(cp->param_count);
6188         if (param_count > max_param_count) {
6189                 BT_ERR("load_conn_param: too big param_count value %u",
6190                        param_count);
6191                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6192                                        MGMT_STATUS_INVALID_PARAMS);
6193         }
6194
6195         expected_len = sizeof(*cp) + param_count *
6196                                         sizeof(struct mgmt_conn_param);
6197         if (expected_len != len) {
6198                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6199                        expected_len, len);
6200                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6201                                        MGMT_STATUS_INVALID_PARAMS);
6202         }
6203
6204         BT_DBG("%s param_count %u", hdev->name, param_count);
6205
6206         hci_dev_lock(hdev);
6207
6208         hci_conn_params_clear_disabled(hdev);
6209
6210         for (i = 0; i < param_count; i++) {
6211                 struct mgmt_conn_param *param = &cp->params[i];
6212                 struct hci_conn_params *hci_param;
6213                 u16 min, max, latency, timeout;
6214                 u8 addr_type;
6215
6216                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6217                        param->addr.type);
6218
6219                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6220                         addr_type = ADDR_LE_DEV_PUBLIC;
6221                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6222                         addr_type = ADDR_LE_DEV_RANDOM;
6223                 } else {
6224                         BT_ERR("Ignoring invalid connection parameters");
6225                         continue;
6226                 }
6227
6228                 min = le16_to_cpu(param->min_interval);
6229                 max = le16_to_cpu(param->max_interval);
6230                 latency = le16_to_cpu(param->latency);
6231                 timeout = le16_to_cpu(param->timeout);
6232
6233                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6234                        min, max, latency, timeout);
6235
6236                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6237                         BT_ERR("Ignoring invalid connection parameters");
6238                         continue;
6239                 }
6240
6241                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6242                                                 addr_type);
6243                 if (!hci_param) {
6244                         BT_ERR("Failed to add connection parameters");
6245                         continue;
6246                 }
6247
6248                 hci_param->conn_min_interval = min;
6249                 hci_param->conn_max_interval = max;
6250                 hci_param->conn_latency = latency;
6251                 hci_param->supervision_timeout = timeout;
6252         }
6253
6254         hci_dev_unlock(hdev);
6255
6256         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6257                                  NULL, 0);
6258 }
6259
6260 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6261                                void *data, u16 len)
6262 {
6263         struct mgmt_cp_set_external_config *cp = data;
6264         bool changed;
6265         int err;
6266
6267         BT_DBG("%s", hdev->name);
6268
6269         if (hdev_is_powered(hdev))
6270                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6271                                        MGMT_STATUS_REJECTED);
6272
6273         if (cp->config != 0x00 && cp->config != 0x01)
6274                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6275                                          MGMT_STATUS_INVALID_PARAMS);
6276
6277         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6278                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6279                                        MGMT_STATUS_NOT_SUPPORTED);
6280
6281         hci_dev_lock(hdev);
6282
6283         if (cp->config)
6284                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6285         else
6286                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6287
6288         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6289         if (err < 0)
6290                 goto unlock;
6291
6292         if (!changed)
6293                 goto unlock;
6294
6295         err = new_options(hdev, sk);
6296
6297         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6298                 mgmt_index_removed(hdev);
6299
6300                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6301                         hci_dev_set_flag(hdev, HCI_CONFIG);
6302                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6303
6304                         queue_work(hdev->req_workqueue, &hdev->power_on);
6305                 } else {
6306                         set_bit(HCI_RAW, &hdev->flags);
6307                         mgmt_index_added(hdev);
6308                 }
6309         }
6310
6311 unlock:
6312         hci_dev_unlock(hdev);
6313         return err;
6314 }
6315
6316 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6317                               void *data, u16 len)
6318 {
6319         struct mgmt_cp_set_public_address *cp = data;
6320         bool changed;
6321         int err;
6322
6323         BT_DBG("%s", hdev->name);
6324
6325         if (hdev_is_powered(hdev))
6326                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6327                                        MGMT_STATUS_REJECTED);
6328
6329         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6331                                        MGMT_STATUS_INVALID_PARAMS);
6332
6333         if (!hdev->set_bdaddr)
6334                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6335                                        MGMT_STATUS_NOT_SUPPORTED);
6336
6337         hci_dev_lock(hdev);
6338
6339         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6340         bacpy(&hdev->public_addr, &cp->bdaddr);
6341
6342         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6343         if (err < 0)
6344                 goto unlock;
6345
6346         if (!changed)
6347                 goto unlock;
6348
6349         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6350                 err = new_options(hdev, sk);
6351
6352         if (is_configured(hdev)) {
6353                 mgmt_index_removed(hdev);
6354
6355                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6356
6357                 hci_dev_set_flag(hdev, HCI_CONFIG);
6358                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6359
6360                 queue_work(hdev->req_workqueue, &hdev->power_on);
6361         }
6362
6363 unlock:
6364         hci_dev_unlock(hdev);
6365         return err;
6366 }
6367
6368 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6369                                   u8 data_len)
6370 {
6371         eir[eir_len++] = sizeof(type) + data_len;
6372         eir[eir_len++] = type;
6373         memcpy(&eir[eir_len], data, data_len);
6374         eir_len += data_len;
6375
6376         return eir_len;
6377 }
6378
6379 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6380                                    void *data, u16 data_len)
6381 {
6382         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6383         struct mgmt_rp_read_local_oob_ext_data *rp;
6384         size_t rp_len;
6385         u16 eir_len;
6386         u8 status, flags, role, addr[7], hash[16], rand[16];
6387         int err;
6388
6389         BT_DBG("%s", hdev->name);
6390
6391         if (!hdev_is_powered(hdev))
6392                 return mgmt_cmd_complete(sk, hdev->id,
6393                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6394                                          MGMT_STATUS_NOT_POWERED,
6395                                          &cp->type, sizeof(cp->type));
6396
6397         switch (cp->type) {
6398         case BIT(BDADDR_BREDR):
6399                 status = mgmt_bredr_support(hdev);
6400                 if (status)
6401                         return mgmt_cmd_complete(sk, hdev->id,
6402                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6403                                                  status, &cp->type,
6404                                                  sizeof(cp->type));
6405                 eir_len = 5;
6406                 break;
6407         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6408                 status = mgmt_le_support(hdev);
6409                 if (status)
6410                         return mgmt_cmd_complete(sk, hdev->id,
6411                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6412                                                  status, &cp->type,
6413                                                  sizeof(cp->type));
6414                 eir_len = 9 + 3 + 18 + 18 + 3;
6415                 break;
6416         default:
6417                 return mgmt_cmd_complete(sk, hdev->id,
6418                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6419                                          MGMT_STATUS_INVALID_PARAMS,
6420                                          &cp->type, sizeof(cp->type));
6421         }
6422
6423         hci_dev_lock(hdev);
6424
6425         rp_len = sizeof(*rp) + eir_len;
6426         rp = kmalloc(rp_len, GFP_ATOMIC);
6427         if (!rp) {
6428                 hci_dev_unlock(hdev);
6429                 return -ENOMEM;
6430         }
6431
6432         eir_len = 0;
6433         switch (cp->type) {
6434         case BIT(BDADDR_BREDR):
6435                 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6436                                           hdev->dev_class, 3);
6437                 break;
6438         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6439                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6440                     smp_generate_oob(hdev, hash, rand) < 0) {
6441                         hci_dev_unlock(hdev);
6442                         err = mgmt_cmd_complete(sk, hdev->id,
6443                                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6444                                                 MGMT_STATUS_FAILED,
6445                                                 &cp->type, sizeof(cp->type));
6446                         goto done;
6447                 }
6448
6449                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6450                         memcpy(addr, &hdev->rpa, 6);
6451                         addr[6] = 0x01;
6452                 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6453                            !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6454                            (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6455                             bacmp(&hdev->static_addr, BDADDR_ANY))) {
6456                         memcpy(addr, &hdev->static_addr, 6);
6457                         addr[6] = 0x01;
6458                 } else {
6459                         memcpy(addr, &hdev->bdaddr, 6);
6460                         addr[6] = 0x00;
6461                 }
6462
6463                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6464                                           addr, sizeof(addr));
6465
6466                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6467                         role = 0x02;
6468                 else
6469                         role = 0x01;
6470
6471                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6472                                           &role, sizeof(role));
6473
6474                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6475                         eir_len = eir_append_data(rp->eir, eir_len,
6476                                                   EIR_LE_SC_CONFIRM,
6477                                                   hash, sizeof(hash));
6478
6479                         eir_len = eir_append_data(rp->eir, eir_len,
6480                                                   EIR_LE_SC_RANDOM,
6481                                                   rand, sizeof(rand));
6482                 }
6483
6484                 flags = get_adv_discov_flags(hdev);
6485
6486                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6487                         flags |= LE_AD_NO_BREDR;
6488
6489                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6490                                           &flags, sizeof(flags));
6491                 break;
6492         }
6493
6494         rp->type = cp->type;
6495         rp->eir_len = cpu_to_le16(eir_len);
6496
6497         hci_dev_unlock(hdev);
6498
6499         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6500
6501         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6502                                 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
6503         if (err < 0)
6504                 goto done;
6505
6506         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6507                                  rp, sizeof(*rp) + eir_len,
6508                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6509
6510 done:
6511         kfree(rp);
6512
6513         return err;
6514 }
6515
6516 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6517 {
6518         u32 flags = 0;
6519
6520         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6521         flags |= MGMT_ADV_FLAG_DISCOV;
6522         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6523         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6524
6525         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6526                 flags |= MGMT_ADV_FLAG_TX_POWER;
6527
6528         return flags;
6529 }
6530
6531 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6532                              void *data, u16 data_len)
6533 {
6534         struct mgmt_rp_read_adv_features *rp;
6535         size_t rp_len;
6536         int err;
6537         bool instance;
6538         u32 supported_flags;
6539
6540         BT_DBG("%s", hdev->name);
6541
6542         if (!lmp_le_capable(hdev))
6543                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6544                                        MGMT_STATUS_REJECTED);
6545
6546         hci_dev_lock(hdev);
6547
6548         rp_len = sizeof(*rp);
6549
6550         /* Currently only one instance is supported, so just add 1 to the
6551          * response length.
6552          */
6553         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6554         if (instance)
6555                 rp_len++;
6556
6557         rp = kmalloc(rp_len, GFP_ATOMIC);
6558         if (!rp) {
6559                 hci_dev_unlock(hdev);
6560                 return -ENOMEM;
6561         }
6562
6563         supported_flags = get_supported_adv_flags(hdev);
6564
6565         rp->supported_flags = cpu_to_le32(supported_flags);
6566         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6567         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6568         rp->max_instances = 1;
6569
6570         /* Currently only one instance is supported, so simply return the
6571          * current instance number.
6572          */
6573         if (instance) {
6574                 rp->num_instances = 1;
6575                 rp->instance[0] = 1;
6576         } else {
6577                 rp->num_instances = 0;
6578         }
6579
6580         hci_dev_unlock(hdev);
6581
6582         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6583                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6584
6585         kfree(rp);
6586
6587         return err;
6588 }
6589
6590 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6591                               u8 len, bool is_adv_data)
6592 {
6593         u8 max_len = HCI_MAX_AD_LENGTH;
6594         int i, cur_len;
6595         bool flags_managed = false;
6596         bool tx_power_managed = false;
6597         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6598                            MGMT_ADV_FLAG_MANAGED_FLAGS;
6599
6600         if (is_adv_data && (adv_flags & flags_params)) {
6601                 flags_managed = true;
6602                 max_len -= 3;
6603         }
6604
6605         if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6606                 tx_power_managed = true;
6607                 max_len -= 3;
6608         }
6609
6610         if (len > max_len)
6611                 return false;
6612
6613         /* Make sure that the data is correctly formatted. */
6614         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6615                 cur_len = data[i];
6616
6617                 if (flags_managed && data[i + 1] == EIR_FLAGS)
6618                         return false;
6619
6620                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6621                         return false;
6622
6623                 /* If the current field length would exceed the total data
6624                  * length, then it's invalid.
6625                  */
6626                 if (i + cur_len >= len)
6627                         return false;
6628         }
6629
6630         return true;
6631 }
6632
6633 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6634                                      u16 opcode)
6635 {
6636         struct mgmt_pending_cmd *cmd;
6637         struct mgmt_rp_add_advertising rp;
6638
6639         BT_DBG("status %d", status);
6640
6641         hci_dev_lock(hdev);
6642
6643         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6644
6645         if (status) {
6646                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6647                 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6648                 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6649         }
6650
6651         if (!cmd)
6652                 goto unlock;
6653
6654         rp.instance = 0x01;
6655
6656         if (status)
6657                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6658                                 mgmt_status(status));
6659         else
6660                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6661                                   mgmt_status(status), &rp, sizeof(rp));
6662
6663         mgmt_pending_remove(cmd);
6664
6665 unlock:
6666         hci_dev_unlock(hdev);
6667 }
6668
6669 static void adv_timeout_expired(struct work_struct *work)
6670 {
6671         struct hci_dev *hdev = container_of(work, struct hci_dev,
6672                                             adv_instance.timeout_exp.work);
6673
6674         hdev->adv_instance.timeout = 0;
6675
6676         hci_dev_lock(hdev);
6677         clear_adv_instance(hdev);
6678         hci_dev_unlock(hdev);
6679 }
6680
6681 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6682                            void *data, u16 data_len)
6683 {
6684         struct mgmt_cp_add_advertising *cp = data;
6685         struct mgmt_rp_add_advertising rp;
6686         u32 flags;
6687         u32 supported_flags;
6688         u8 status;
6689         u16 timeout;
6690         int err;
6691         struct mgmt_pending_cmd *cmd;
6692         struct hci_request req;
6693
6694         BT_DBG("%s", hdev->name);
6695
6696         status = mgmt_le_support(hdev);
6697         if (status)
6698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6699                                        status);
6700
6701         flags = __le32_to_cpu(cp->flags);
6702         timeout = __le16_to_cpu(cp->timeout);
6703
6704         /* The current implementation only supports adding one instance and only
6705          * a subset of the specified flags.
6706          */
6707         supported_flags = get_supported_adv_flags(hdev);
6708         if (cp->instance != 0x01 || (flags & ~supported_flags))
6709                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6710                                        MGMT_STATUS_INVALID_PARAMS);
6711
6712         hci_dev_lock(hdev);
6713
6714         if (timeout && !hdev_is_powered(hdev)) {
6715                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6716                                       MGMT_STATUS_REJECTED);
6717                 goto unlock;
6718         }
6719
6720         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6721             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6722             pending_find(MGMT_OP_SET_LE, hdev)) {
6723                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6724                                       MGMT_STATUS_BUSY);
6725                 goto unlock;
6726         }
6727
6728         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6729             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6730                                cp->scan_rsp_len, false)) {
6731                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6732                                       MGMT_STATUS_INVALID_PARAMS);
6733                 goto unlock;
6734         }
6735
6736         INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6737
6738         hdev->adv_instance.flags = flags;
6739         hdev->adv_instance.adv_data_len = cp->adv_data_len;
6740         hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6741
6742         if (cp->adv_data_len)
6743                 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6744
6745         if (cp->scan_rsp_len)
6746                 memcpy(hdev->adv_instance.scan_rsp_data,
6747                        cp->data + cp->adv_data_len, cp->scan_rsp_len);
6748
6749         if (hdev->adv_instance.timeout)
6750                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6751
6752         hdev->adv_instance.timeout = timeout;
6753
6754         if (timeout)
6755                 queue_delayed_work(hdev->workqueue,
6756                                    &hdev->adv_instance.timeout_exp,
6757                                    msecs_to_jiffies(timeout * 1000));
6758
6759         if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6760                 advertising_added(sk, hdev, 1);
6761
6762         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6763          * we have no HCI communication to make. Simply return.
6764          */
6765         if (!hdev_is_powered(hdev) ||
6766             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6767                 rp.instance = 0x01;
6768                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6769                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6770                 goto unlock;
6771         }
6772
6773         /* We're good to go, update advertising data, parameters, and start
6774          * advertising.
6775          */
6776         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6777                                data_len);
6778         if (!cmd) {
6779                 err = -ENOMEM;
6780                 goto unlock;
6781         }
6782
6783         hci_req_init(&req, hdev);
6784
6785         update_adv_data(&req);
6786         update_scan_rsp_data(&req);
6787         enable_advertising(&req);
6788
6789         err = hci_req_run(&req, add_advertising_complete);
6790         if (err < 0)
6791                 mgmt_pending_remove(cmd);
6792
6793 unlock:
6794         hci_dev_unlock(hdev);
6795
6796         return err;
6797 }
6798
6799 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6800                                         u16 opcode)
6801 {
6802         struct mgmt_pending_cmd *cmd;
6803         struct mgmt_rp_remove_advertising rp;
6804
6805         BT_DBG("status %d", status);
6806
6807         hci_dev_lock(hdev);
6808
6809         /* A failure status here only means that we failed to disable
6810          * advertising. Otherwise, the advertising instance has been removed,
6811          * so report success.
6812          */
6813         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6814         if (!cmd)
6815                 goto unlock;
6816
6817         rp.instance = 1;
6818
6819         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6820                           &rp, sizeof(rp));
6821         mgmt_pending_remove(cmd);
6822
6823 unlock:
6824         hci_dev_unlock(hdev);
6825 }
6826
6827 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6828                               void *data, u16 data_len)
6829 {
6830         struct mgmt_cp_remove_advertising *cp = data;
6831         struct mgmt_rp_remove_advertising rp;
6832         int err;
6833         struct mgmt_pending_cmd *cmd;
6834         struct hci_request req;
6835
6836         BT_DBG("%s", hdev->name);
6837
6838         /* The current implementation only allows modifying instance no 1. A
6839          * value of 0 indicates that all instances should be cleared.
6840          */
6841         if (cp->instance > 1)
6842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6843                                        MGMT_STATUS_INVALID_PARAMS);
6844
6845         hci_dev_lock(hdev);
6846
6847         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6848             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6849             pending_find(MGMT_OP_SET_LE, hdev)) {
6850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6851                                       MGMT_STATUS_BUSY);
6852                 goto unlock;
6853         }
6854
6855         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6857                                       MGMT_STATUS_INVALID_PARAMS);
6858                 goto unlock;
6859         }
6860
6861         if (hdev->adv_instance.timeout)
6862                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6863
6864         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6865
6866         advertising_removed(sk, hdev, 1);
6867
6868         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6869
6870         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6871          * we have no HCI communication to make. Simply return.
6872          */
6873         if (!hdev_is_powered(hdev) ||
6874             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6875                 rp.instance = 1;
6876                 err = mgmt_cmd_complete(sk, hdev->id,
6877                                         MGMT_OP_REMOVE_ADVERTISING,
6878                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6879                 goto unlock;
6880         }
6881
6882         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6883                                data_len);
6884         if (!cmd) {
6885                 err = -ENOMEM;
6886                 goto unlock;
6887         }
6888
6889         hci_req_init(&req, hdev);
6890         disable_advertising(&req);
6891
6892         err = hci_req_run(&req, remove_advertising_complete);
6893         if (err < 0)
6894                 mgmt_pending_remove(cmd);
6895
6896 unlock:
6897         hci_dev_unlock(hdev);
6898
6899         return err;
6900 }
6901
6902 static const struct hci_mgmt_handler mgmt_handlers[] = {
6903         { NULL }, /* 0x0000 (no command) */
6904         { read_version,            MGMT_READ_VERSION_SIZE,
6905                                                 HCI_MGMT_NO_HDEV |
6906                                                 HCI_MGMT_UNTRUSTED },
6907         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6908                                                 HCI_MGMT_NO_HDEV |
6909                                                 HCI_MGMT_UNTRUSTED },
6910         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6911                                                 HCI_MGMT_NO_HDEV |
6912                                                 HCI_MGMT_UNTRUSTED },
6913         { read_controller_info,    MGMT_READ_INFO_SIZE,
6914                                                 HCI_MGMT_UNTRUSTED },
6915         { set_powered,             MGMT_SETTING_SIZE },
6916         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6917         { set_connectable,         MGMT_SETTING_SIZE },
6918         { set_fast_connectable,    MGMT_SETTING_SIZE },
6919         { set_bondable,            MGMT_SETTING_SIZE },
6920         { set_link_security,       MGMT_SETTING_SIZE },
6921         { set_ssp,                 MGMT_SETTING_SIZE },
6922         { set_hs,                  MGMT_SETTING_SIZE },
6923         { set_le,                  MGMT_SETTING_SIZE },
6924         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6925         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6926         { add_uuid,                MGMT_ADD_UUID_SIZE },
6927         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6928         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6929                                                 HCI_MGMT_VAR_LEN },
6930         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6931                                                 HCI_MGMT_VAR_LEN },
6932         { disconnect,              MGMT_DISCONNECT_SIZE },
6933         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6934         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6935         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6936         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6937         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6938         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6939         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6940         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6941         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6942         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6943         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6944         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6945         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6946                                                 HCI_MGMT_VAR_LEN },
6947         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6948         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6949         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6950         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6951         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6952         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6953         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6954         { set_advertising,         MGMT_SETTING_SIZE },
6955         { set_bredr,               MGMT_SETTING_SIZE },
6956         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6957         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6958         { set_secure_conn,         MGMT_SETTING_SIZE },
6959         { set_debug_keys,          MGMT_SETTING_SIZE },
6960         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6961         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6962                                                 HCI_MGMT_VAR_LEN },
6963         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6964         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6965         { add_device,              MGMT_ADD_DEVICE_SIZE },
6966         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6967         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6968                                                 HCI_MGMT_VAR_LEN },
6969         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6970                                                 HCI_MGMT_NO_HDEV |
6971                                                 HCI_MGMT_UNTRUSTED },
6972         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6973                                                 HCI_MGMT_UNCONFIGURED |
6974                                                 HCI_MGMT_UNTRUSTED },
6975         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6976                                                 HCI_MGMT_UNCONFIGURED },
6977         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6978                                                 HCI_MGMT_UNCONFIGURED },
6979         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6980                                                 HCI_MGMT_VAR_LEN },
6981         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6982         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6983                                                 HCI_MGMT_NO_HDEV |
6984                                                 HCI_MGMT_UNTRUSTED },
6985         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6986         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6987                                                 HCI_MGMT_VAR_LEN },
6988         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6989 };
6990
6991 void mgmt_index_added(struct hci_dev *hdev)
6992 {
6993         struct mgmt_ev_ext_index ev;
6994
6995         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6996                 return;
6997
6998         switch (hdev->dev_type) {
6999         case HCI_BREDR:
7000                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7001                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7002                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7003                         ev.type = 0x01;
7004                 } else {
7005                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7006                                          HCI_MGMT_INDEX_EVENTS);
7007                         ev.type = 0x00;
7008                 }
7009                 break;
7010         case HCI_AMP:
7011                 ev.type = 0x02;
7012                 break;
7013         default:
7014                 return;
7015         }
7016
7017         ev.bus = hdev->bus;
7018
7019         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7020                          HCI_MGMT_EXT_INDEX_EVENTS);
7021 }
7022
7023 void mgmt_index_removed(struct hci_dev *hdev)
7024 {
7025         struct mgmt_ev_ext_index ev;
7026         u8 status = MGMT_STATUS_INVALID_INDEX;
7027
7028         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7029                 return;
7030
7031         switch (hdev->dev_type) {
7032         case HCI_BREDR:
7033                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7034
7035                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7036                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7037                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7038                         ev.type = 0x01;
7039                 } else {
7040                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7041                                          HCI_MGMT_INDEX_EVENTS);
7042                         ev.type = 0x00;
7043                 }
7044                 break;
7045         case HCI_AMP:
7046                 ev.type = 0x02;
7047                 break;
7048         default:
7049                 return;
7050         }
7051
7052         ev.bus = hdev->bus;
7053
7054         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7055                          HCI_MGMT_EXT_INDEX_EVENTS);
7056 }
7057
7058 /* This function requires the caller holds hdev->lock */
7059 static void restart_le_actions(struct hci_request *req)
7060 {
7061         struct hci_dev *hdev = req->hdev;
7062         struct hci_conn_params *p;
7063
7064         list_for_each_entry(p, &hdev->le_conn_params, list) {
7065                 /* Needed for AUTO_OFF case where might not "really"
7066                  * have been powered off.
7067                  */
7068                 list_del_init(&p->action);
7069
7070                 switch (p->auto_connect) {
7071                 case HCI_AUTO_CONN_DIRECT:
7072                 case HCI_AUTO_CONN_ALWAYS:
7073                         list_add(&p->action, &hdev->pend_le_conns);
7074                         break;
7075                 case HCI_AUTO_CONN_REPORT:
7076                         list_add(&p->action, &hdev->pend_le_reports);
7077                         break;
7078                 default:
7079                         break;
7080                 }
7081         }
7082
7083         __hci_update_background_scan(req);
7084 }
7085
7086 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7087 {
7088         struct cmd_lookup match = { NULL, hdev };
7089
7090         BT_DBG("status 0x%02x", status);
7091
7092         if (!status) {
7093                 /* Register the available SMP channels (BR/EDR and LE) only
7094                  * when successfully powering on the controller. This late
7095                  * registration is required so that LE SMP can clearly
7096                  * decide if the public address or static address is used.
7097                  */
7098                 smp_register(hdev);
7099         }
7100
7101         hci_dev_lock(hdev);
7102
7103         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7104
7105         new_settings(hdev, match.sk);
7106
7107         hci_dev_unlock(hdev);
7108
7109         if (match.sk)
7110                 sock_put(match.sk);
7111 }
7112
7113 static int powered_update_hci(struct hci_dev *hdev)
7114 {
7115         struct hci_request req;
7116         u8 link_sec;
7117
7118         hci_req_init(&req, hdev);
7119
7120         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7121             !lmp_host_ssp_capable(hdev)) {
7122                 u8 mode = 0x01;
7123
7124                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7125
7126                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7127                         u8 support = 0x01;
7128
7129                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7130                                     sizeof(support), &support);
7131                 }
7132         }
7133
7134         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7135             lmp_bredr_capable(hdev)) {
7136                 struct hci_cp_write_le_host_supported cp;
7137
7138                 cp.le = 0x01;
7139                 cp.simul = 0x00;
7140
7141                 /* Check first if we already have the right
7142                  * host state (host features set)
7143                  */
7144                 if (cp.le != lmp_host_le_capable(hdev) ||
7145                     cp.simul != lmp_host_le_br_capable(hdev))
7146                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7147                                     sizeof(cp), &cp);
7148         }
7149
7150         if (lmp_le_capable(hdev)) {
7151                 /* Make sure the controller has a good default for
7152                  * advertising data. This also applies to the case
7153                  * where BR/EDR was toggled during the AUTO_OFF phase.
7154                  */
7155                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
7156                         update_adv_data(&req);
7157                         update_scan_rsp_data(&req);
7158                 }
7159
7160                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7161                     hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
7162                         enable_advertising(&req);
7163
7164                 restart_le_actions(&req);
7165         }
7166
7167         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7168         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7169                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7170                             sizeof(link_sec), &link_sec);
7171
7172         if (lmp_bredr_capable(hdev)) {
7173                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7174                         write_fast_connectable(&req, true);
7175                 else
7176                         write_fast_connectable(&req, false);
7177                 __hci_update_page_scan(&req);
7178                 update_class(&req);
7179                 update_name(&req);
7180                 update_eir(&req);
7181         }
7182
7183         return hci_req_run(&req, powered_complete);
7184 }
7185
7186 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7187 {
7188         struct cmd_lookup match = { NULL, hdev };
7189         u8 status, zero_cod[] = { 0, 0, 0 };
7190         int err;
7191
7192         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7193                 return 0;
7194
7195         if (powered) {
7196                 if (powered_update_hci(hdev) == 0)
7197                         return 0;
7198
7199                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7200                                      &match);
7201                 goto new_settings;
7202         }
7203
7204         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7205
7206         /* If the power off is because of hdev unregistration let
7207          * use the appropriate INVALID_INDEX status. Otherwise use
7208          * NOT_POWERED. We cover both scenarios here since later in
7209          * mgmt_index_removed() any hci_conn callbacks will have already
7210          * been triggered, potentially causing misleading DISCONNECTED
7211          * status responses.
7212          */
7213         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7214                 status = MGMT_STATUS_INVALID_INDEX;
7215         else
7216                 status = MGMT_STATUS_NOT_POWERED;
7217
7218         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7219
7220         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7221                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7222                                    zero_cod, sizeof(zero_cod), NULL);
7223
7224 new_settings:
7225         err = new_settings(hdev, match.sk);
7226
7227         if (match.sk)
7228                 sock_put(match.sk);
7229
7230         return err;
7231 }
7232
7233 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7234 {
7235         struct mgmt_pending_cmd *cmd;
7236         u8 status;
7237
7238         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7239         if (!cmd)
7240                 return;
7241
7242         if (err == -ERFKILL)
7243                 status = MGMT_STATUS_RFKILLED;
7244         else
7245                 status = MGMT_STATUS_FAILED;
7246
7247         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7248
7249         mgmt_pending_remove(cmd);
7250 }
7251
7252 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7253 {
7254         struct hci_request req;
7255
7256         hci_dev_lock(hdev);
7257
7258         /* When discoverable timeout triggers, then just make sure
7259          * the limited discoverable flag is cleared. Even in the case
7260          * of a timeout triggered from general discoverable, it is
7261          * safe to unconditionally clear the flag.
7262          */
7263         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7264         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7265
7266         hci_req_init(&req, hdev);
7267         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7268                 u8 scan = SCAN_PAGE;
7269                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7270                             sizeof(scan), &scan);
7271         }
7272         update_class(&req);
7273
7274         /* Advertising instances don't use the global discoverable setting, so
7275          * only update AD if advertising was enabled using Set Advertising.
7276          */
7277         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7278                 update_adv_data(&req);
7279
7280         hci_req_run(&req, NULL);
7281
7282         hdev->discov_timeout = 0;
7283
7284         new_settings(hdev, NULL);
7285
7286         hci_dev_unlock(hdev);
7287 }
7288
7289 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7290                        bool persistent)
7291 {
7292         struct mgmt_ev_new_link_key ev;
7293
7294         memset(&ev, 0, sizeof(ev));
7295
7296         ev.store_hint = persistent;
7297         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7298         ev.key.addr.type = BDADDR_BREDR;
7299         ev.key.type = key->type;
7300         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7301         ev.key.pin_len = key->pin_len;
7302
7303         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7304 }
7305
7306 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7307 {
7308         switch (ltk->type) {
7309         case SMP_LTK:
7310         case SMP_LTK_SLAVE:
7311                 if (ltk->authenticated)
7312                         return MGMT_LTK_AUTHENTICATED;
7313                 return MGMT_LTK_UNAUTHENTICATED;
7314         case SMP_LTK_P256:
7315                 if (ltk->authenticated)
7316                         return MGMT_LTK_P256_AUTH;
7317                 return MGMT_LTK_P256_UNAUTH;
7318         case SMP_LTK_P256_DEBUG:
7319                 return MGMT_LTK_P256_DEBUG;
7320         }
7321
7322         return MGMT_LTK_UNAUTHENTICATED;
7323 }
7324
7325 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7326 {
7327         struct mgmt_ev_new_long_term_key ev;
7328
7329         memset(&ev, 0, sizeof(ev));
7330
7331         /* Devices using resolvable or non-resolvable random addresses
7332          * without providing an indentity resolving key don't require
7333          * to store long term keys. Their addresses will change the
7334          * next time around.
7335          *
7336          * Only when a remote device provides an identity address
7337          * make sure the long term key is stored. If the remote
7338          * identity is known, the long term keys are internally
7339          * mapped to the identity address. So allow static random
7340          * and public addresses here.
7341          */
7342         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7343             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7344                 ev.store_hint = 0x00;
7345         else
7346                 ev.store_hint = persistent;
7347
7348         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7349         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7350         ev.key.type = mgmt_ltk_type(key);
7351         ev.key.enc_size = key->enc_size;
7352         ev.key.ediv = key->ediv;
7353         ev.key.rand = key->rand;
7354
7355         if (key->type == SMP_LTK)
7356                 ev.key.master = 1;
7357
7358         memcpy(ev.key.val, key->val, sizeof(key->val));
7359
7360         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7361 }
7362
7363 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7364 {
7365         struct mgmt_ev_new_irk ev;
7366
7367         memset(&ev, 0, sizeof(ev));
7368
7369         /* For identity resolving keys from devices that are already
7370          * using a public address or static random address, do not
7371          * ask for storing this key. The identity resolving key really
7372          * is only mandatory for devices using resovlable random
7373          * addresses.
7374          *
7375          * Storing all identity resolving keys has the downside that
7376          * they will be also loaded on next boot of they system. More
7377          * identity resolving keys, means more time during scanning is
7378          * needed to actually resolve these addresses.
7379          */
7380         if (bacmp(&irk->rpa, BDADDR_ANY))
7381                 ev.store_hint = 0x01;
7382         else
7383                 ev.store_hint = 0x00;
7384
7385         bacpy(&ev.rpa, &irk->rpa);
7386         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7387         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7388         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7389
7390         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7391 }
7392
7393 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7394                    bool persistent)
7395 {
7396         struct mgmt_ev_new_csrk ev;
7397
7398         memset(&ev, 0, sizeof(ev));
7399
7400         /* Devices using resolvable or non-resolvable random addresses
7401          * without providing an indentity resolving key don't require
7402          * to store signature resolving keys. Their addresses will change
7403          * the next time around.
7404          *
7405          * Only when a remote device provides an identity address
7406          * make sure the signature resolving key is stored. So allow
7407          * static random and public addresses here.
7408          */
7409         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7410             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7411                 ev.store_hint = 0x00;
7412         else
7413                 ev.store_hint = persistent;
7414
7415         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7416         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7417         ev.key.type = csrk->type;
7418         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7419
7420         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7421 }
7422
7423 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7424                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7425                          u16 max_interval, u16 latency, u16 timeout)
7426 {
7427         struct mgmt_ev_new_conn_param ev;
7428
7429         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7430                 return;
7431
7432         memset(&ev, 0, sizeof(ev));
7433         bacpy(&ev.addr.bdaddr, bdaddr);
7434         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7435         ev.store_hint = store_hint;
7436         ev.min_interval = cpu_to_le16(min_interval);
7437         ev.max_interval = cpu_to_le16(max_interval);
7438         ev.latency = cpu_to_le16(latency);
7439         ev.timeout = cpu_to_le16(timeout);
7440
7441         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7442 }
7443
7444 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7445                            u32 flags, u8 *name, u8 name_len)
7446 {
7447         char buf[512];
7448         struct mgmt_ev_device_connected *ev = (void *) buf;
7449         u16 eir_len = 0;
7450
7451         bacpy(&ev->addr.bdaddr, &conn->dst);
7452         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7453
7454         ev->flags = __cpu_to_le32(flags);
7455
7456         /* We must ensure that the EIR Data fields are ordered and
7457          * unique. Keep it simple for now and avoid the problem by not
7458          * adding any BR/EDR data to the LE adv.
7459          */
7460         if (conn->le_adv_data_len > 0) {
7461                 memcpy(&ev->eir[eir_len],
7462                        conn->le_adv_data, conn->le_adv_data_len);
7463                 eir_len = conn->le_adv_data_len;
7464         } else {
7465                 if (name_len > 0)
7466                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7467                                                   name, name_len);
7468
7469                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7470                         eir_len = eir_append_data(ev->eir, eir_len,
7471                                                   EIR_CLASS_OF_DEV,
7472                                                   conn->dev_class, 3);
7473         }
7474
7475         ev->eir_len = cpu_to_le16(eir_len);
7476
7477         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7478                     sizeof(*ev) + eir_len, NULL);
7479 }
7480
7481 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7482 {
7483         struct sock **sk = data;
7484
7485         cmd->cmd_complete(cmd, 0);
7486
7487         *sk = cmd->sk;
7488         sock_hold(*sk);
7489
7490         mgmt_pending_remove(cmd);
7491 }
7492
7493 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7494 {
7495         struct hci_dev *hdev = data;
7496         struct mgmt_cp_unpair_device *cp = cmd->param;
7497
7498         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7499
7500         cmd->cmd_complete(cmd, 0);
7501         mgmt_pending_remove(cmd);
7502 }
7503
7504 bool mgmt_powering_down(struct hci_dev *hdev)
7505 {
7506         struct mgmt_pending_cmd *cmd;
7507         struct mgmt_mode *cp;
7508
7509         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7510         if (!cmd)
7511                 return false;
7512
7513         cp = cmd->param;
7514         if (!cp->val)
7515                 return true;
7516
7517         return false;
7518 }
7519
7520 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7521                               u8 link_type, u8 addr_type, u8 reason,
7522                               bool mgmt_connected)
7523 {
7524         struct mgmt_ev_device_disconnected ev;
7525         struct sock *sk = NULL;
7526
7527         /* The connection is still in hci_conn_hash so test for 1
7528          * instead of 0 to know if this is the last one.
7529          */
7530         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7531                 cancel_delayed_work(&hdev->power_off);
7532                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7533         }
7534
7535         if (!mgmt_connected)
7536                 return;
7537
7538         if (link_type != ACL_LINK && link_type != LE_LINK)
7539                 return;
7540
7541         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7542
7543         bacpy(&ev.addr.bdaddr, bdaddr);
7544         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7545         ev.reason = reason;
7546
7547         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7548
7549         if (sk)
7550                 sock_put(sk);
7551
7552         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7553                              hdev);
7554 }
7555
7556 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7557                             u8 link_type, u8 addr_type, u8 status)
7558 {
7559         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7560         struct mgmt_cp_disconnect *cp;
7561         struct mgmt_pending_cmd *cmd;
7562
7563         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7564                              hdev);
7565
7566         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7567         if (!cmd)
7568                 return;
7569
7570         cp = cmd->param;
7571
7572         if (bacmp(bdaddr, &cp->addr.bdaddr))
7573                 return;
7574
7575         if (cp->addr.type != bdaddr_type)
7576                 return;
7577
7578         cmd->cmd_complete(cmd, mgmt_status(status));
7579         mgmt_pending_remove(cmd);
7580 }
7581
7582 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7583                          u8 addr_type, u8 status)
7584 {
7585         struct mgmt_ev_connect_failed ev;
7586
7587         /* The connection is still in hci_conn_hash so test for 1
7588          * instead of 0 to know if this is the last one.
7589          */
7590         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7591                 cancel_delayed_work(&hdev->power_off);
7592                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7593         }
7594
7595         bacpy(&ev.addr.bdaddr, bdaddr);
7596         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7597         ev.status = mgmt_status(status);
7598
7599         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7600 }
7601
7602 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7603 {
7604         struct mgmt_ev_pin_code_request ev;
7605
7606         bacpy(&ev.addr.bdaddr, bdaddr);
7607         ev.addr.type = BDADDR_BREDR;
7608         ev.secure = secure;
7609
7610         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7611 }
7612
7613 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7614                                   u8 status)
7615 {
7616         struct mgmt_pending_cmd *cmd;
7617
7618         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7619         if (!cmd)
7620                 return;
7621
7622         cmd->cmd_complete(cmd, mgmt_status(status));
7623         mgmt_pending_remove(cmd);
7624 }
7625
7626 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7627                                       u8 status)
7628 {
7629         struct mgmt_pending_cmd *cmd;
7630
7631         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7632         if (!cmd)
7633                 return;
7634
7635         cmd->cmd_complete(cmd, mgmt_status(status));
7636         mgmt_pending_remove(cmd);
7637 }
7638
7639 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7640                               u8 link_type, u8 addr_type, u32 value,
7641                               u8 confirm_hint)
7642 {
7643         struct mgmt_ev_user_confirm_request ev;
7644
7645         BT_DBG("%s", hdev->name);
7646
7647         bacpy(&ev.addr.bdaddr, bdaddr);
7648         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7649         ev.confirm_hint = confirm_hint;
7650         ev.value = cpu_to_le32(value);
7651
7652         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7653                           NULL);
7654 }
7655
7656 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7657                               u8 link_type, u8 addr_type)
7658 {
7659         struct mgmt_ev_user_passkey_request ev;
7660
7661         BT_DBG("%s", hdev->name);
7662
7663         bacpy(&ev.addr.bdaddr, bdaddr);
7664         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7665
7666         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7667                           NULL);
7668 }
7669
7670 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7671                                       u8 link_type, u8 addr_type, u8 status,
7672                                       u8 opcode)
7673 {
7674         struct mgmt_pending_cmd *cmd;
7675
7676         cmd = pending_find(opcode, hdev);
7677         if (!cmd)
7678                 return -ENOENT;
7679
7680         cmd->cmd_complete(cmd, mgmt_status(status));
7681         mgmt_pending_remove(cmd);
7682
7683         return 0;
7684 }
7685
7686 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7687                                      u8 link_type, u8 addr_type, u8 status)
7688 {
7689         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7690                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7691 }
7692
7693 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7694                                          u8 link_type, u8 addr_type, u8 status)
7695 {
7696         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7697                                           status,
7698                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7699 }
7700
7701 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7702                                      u8 link_type, u8 addr_type, u8 status)
7703 {
7704         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7705                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7706 }
7707
7708 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7709                                          u8 link_type, u8 addr_type, u8 status)
7710 {
7711         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7712                                           status,
7713                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7714 }
7715
7716 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7717                              u8 link_type, u8 addr_type, u32 passkey,
7718                              u8 entered)
7719 {
7720         struct mgmt_ev_passkey_notify ev;
7721
7722         BT_DBG("%s", hdev->name);
7723
7724         bacpy(&ev.addr.bdaddr, bdaddr);
7725         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7726         ev.passkey = __cpu_to_le32(passkey);
7727         ev.entered = entered;
7728
7729         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7730 }
7731
7732 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7733 {
7734         struct mgmt_ev_auth_failed ev;
7735         struct mgmt_pending_cmd *cmd;
7736         u8 status = mgmt_status(hci_status);
7737
7738         bacpy(&ev.addr.bdaddr, &conn->dst);
7739         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7740         ev.status = status;
7741
7742         cmd = find_pairing(conn);
7743
7744         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7745                     cmd ? cmd->sk : NULL);
7746
7747         if (cmd) {
7748                 cmd->cmd_complete(cmd, status);
7749                 mgmt_pending_remove(cmd);
7750         }
7751 }
7752
7753 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7754 {
7755         struct cmd_lookup match = { NULL, hdev };
7756         bool changed;
7757
7758         if (status) {
7759                 u8 mgmt_err = mgmt_status(status);
7760                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7761                                      cmd_status_rsp, &mgmt_err);
7762                 return;
7763         }
7764
7765         if (test_bit(HCI_AUTH, &hdev->flags))
7766                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7767         else
7768                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7769
7770         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7771                              &match);
7772
7773         if (changed)
7774                 new_settings(hdev, match.sk);
7775
7776         if (match.sk)
7777                 sock_put(match.sk);
7778 }
7779
7780 static void clear_eir(struct hci_request *req)
7781 {
7782         struct hci_dev *hdev = req->hdev;
7783         struct hci_cp_write_eir cp;
7784
7785         if (!lmp_ext_inq_capable(hdev))
7786                 return;
7787
7788         memset(hdev->eir, 0, sizeof(hdev->eir));
7789
7790         memset(&cp, 0, sizeof(cp));
7791
7792         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7793 }
7794
7795 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7796 {
7797         struct cmd_lookup match = { NULL, hdev };
7798         struct hci_request req;
7799         bool changed = false;
7800
7801         if (status) {
7802                 u8 mgmt_err = mgmt_status(status);
7803
7804                 if (enable && hci_dev_test_and_clear_flag(hdev,
7805                                                           HCI_SSP_ENABLED)) {
7806                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7807                         new_settings(hdev, NULL);
7808                 }
7809
7810                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7811                                      &mgmt_err);
7812                 return;
7813         }
7814
7815         if (enable) {
7816                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7817         } else {
7818                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7819                 if (!changed)
7820                         changed = hci_dev_test_and_clear_flag(hdev,
7821                                                               HCI_HS_ENABLED);
7822                 else
7823                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7824         }
7825
7826         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7827
7828         if (changed)
7829                 new_settings(hdev, match.sk);
7830
7831         if (match.sk)
7832                 sock_put(match.sk);
7833
7834         hci_req_init(&req, hdev);
7835
7836         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7837                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7838                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7839                                     sizeof(enable), &enable);
7840                 update_eir(&req);
7841         } else {
7842                 clear_eir(&req);
7843         }
7844
7845         hci_req_run(&req, NULL);
7846 }
7847
7848 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7849 {
7850         struct cmd_lookup *match = data;
7851
7852         if (match->sk == NULL) {
7853                 match->sk = cmd->sk;
7854                 sock_hold(match->sk);
7855         }
7856 }
7857
7858 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7859                                     u8 status)
7860 {
7861         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7862
7863         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7864         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7865         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7866
7867         if (!status)
7868                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7869                                    dev_class, 3, NULL);
7870
7871         if (match.sk)
7872                 sock_put(match.sk);
7873 }
7874
7875 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7876 {
7877         struct mgmt_cp_set_local_name ev;
7878         struct mgmt_pending_cmd *cmd;
7879
7880         if (status)
7881                 return;
7882
7883         memset(&ev, 0, sizeof(ev));
7884         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7885         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7886
7887         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7888         if (!cmd) {
7889                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7890
7891                 /* If this is a HCI command related to powering on the
7892                  * HCI dev don't send any mgmt signals.
7893                  */
7894                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7895                         return;
7896         }
7897
7898         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7899                            cmd ? cmd->sk : NULL);
7900 }
7901
7902 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7903                                        u8 *rand192, u8 *hash256, u8 *rand256,
7904                                        u8 status)
7905 {
7906         struct mgmt_pending_cmd *cmd;
7907
7908         BT_DBG("%s status %u", hdev->name, status);
7909
7910         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7911         if (!cmd)
7912                 return;
7913
7914         if (status) {
7915                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7916                                 mgmt_status(status));
7917         } else {
7918                 struct mgmt_rp_read_local_oob_data rp;
7919                 size_t rp_size = sizeof(rp);
7920
7921                 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7922                 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7923
7924                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7925                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7926                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7927                 } else {
7928                         rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
7929                 }
7930
7931                 mgmt_cmd_complete(cmd->sk, hdev->id,
7932                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7933                                   &rp, rp_size);
7934         }
7935
7936         mgmt_pending_remove(cmd);
7937 }
7938
7939 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7940 {
7941         int i;
7942
7943         for (i = 0; i < uuid_count; i++) {
7944                 if (!memcmp(uuid, uuids[i], 16))
7945                         return true;
7946         }
7947
7948         return false;
7949 }
7950
7951 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7952 {
7953         u16 parsed = 0;
7954
7955         while (parsed < eir_len) {
7956                 u8 field_len = eir[0];
7957                 u8 uuid[16];
7958                 int i;
7959
7960                 if (field_len == 0)
7961                         break;
7962
7963                 if (eir_len - parsed < field_len + 1)
7964                         break;
7965
7966                 switch (eir[1]) {
7967                 case EIR_UUID16_ALL:
7968                 case EIR_UUID16_SOME:
7969                         for (i = 0; i + 3 <= field_len; i += 2) {
7970                                 memcpy(uuid, bluetooth_base_uuid, 16);
7971                                 uuid[13] = eir[i + 3];
7972                                 uuid[12] = eir[i + 2];
7973                                 if (has_uuid(uuid, uuid_count, uuids))
7974                                         return true;
7975                         }
7976                         break;
7977                 case EIR_UUID32_ALL:
7978                 case EIR_UUID32_SOME:
7979                         for (i = 0; i + 5 <= field_len; i += 4) {
7980                                 memcpy(uuid, bluetooth_base_uuid, 16);
7981                                 uuid[15] = eir[i + 5];
7982                                 uuid[14] = eir[i + 4];
7983                                 uuid[13] = eir[i + 3];
7984                                 uuid[12] = eir[i + 2];
7985                                 if (has_uuid(uuid, uuid_count, uuids))
7986                                         return true;
7987                         }
7988                         break;
7989                 case EIR_UUID128_ALL:
7990                 case EIR_UUID128_SOME:
7991                         for (i = 0; i + 17 <= field_len; i += 16) {
7992                                 memcpy(uuid, eir + i + 2, 16);
7993                                 if (has_uuid(uuid, uuid_count, uuids))
7994                                         return true;
7995                         }
7996                         break;
7997                 }
7998
7999                 parsed += field_len + 1;
8000                 eir += field_len + 1;
8001         }
8002
8003         return false;
8004 }
8005
8006 static void restart_le_scan(struct hci_dev *hdev)
8007 {
8008         /* If controller is not scanning we are done. */
8009         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8010                 return;
8011
8012         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8013                        hdev->discovery.scan_start +
8014                        hdev->discovery.scan_duration))
8015                 return;
8016
8017         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8018                            DISCOV_LE_RESTART_DELAY);
8019 }
8020
8021 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8022                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8023 {
8024         /* If a RSSI threshold has been specified, and
8025          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8026          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8027          * is set, let it through for further processing, as we might need to
8028          * restart the scan.
8029          *
8030          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8031          * the results are also dropped.
8032          */
8033         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8034             (rssi == HCI_RSSI_INVALID ||
8035             (rssi < hdev->discovery.rssi &&
8036              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8037                 return  false;
8038
8039         if (hdev->discovery.uuid_count != 0) {
8040                 /* If a list of UUIDs is provided in filter, results with no
8041                  * matching UUID should be dropped.
8042                  */
8043                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8044                                    hdev->discovery.uuids) &&
8045                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8046                                    hdev->discovery.uuid_count,
8047                                    hdev->discovery.uuids))
8048                         return false;
8049         }
8050
8051         /* If duplicate filtering does not report RSSI changes, then restart
8052          * scanning to ensure updated result with updated RSSI values.
8053          */
8054         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8055                 restart_le_scan(hdev);
8056
8057                 /* Validate RSSI value against the RSSI threshold once more. */
8058                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8059                     rssi < hdev->discovery.rssi)
8060                         return false;
8061         }
8062
8063         return true;
8064 }
8065
8066 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8067                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8068                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8069 {
8070         char buf[512];
8071         struct mgmt_ev_device_found *ev = (void *)buf;
8072         size_t ev_size;
8073
8074         /* Don't send events for a non-kernel initiated discovery. With
8075          * LE one exception is if we have pend_le_reports > 0 in which
8076          * case we're doing passive scanning and want these events.
8077          */
8078         if (!hci_discovery_active(hdev)) {
8079                 if (link_type == ACL_LINK)
8080                         return;
8081                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8082                         return;
8083         }
8084
8085         if (hdev->discovery.result_filtering) {
8086                 /* We are using service discovery */
8087                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8088                                      scan_rsp_len))
8089                         return;
8090         }
8091
8092         /* Make sure that the buffer is big enough. The 5 extra bytes
8093          * are for the potential CoD field.
8094          */
8095         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8096                 return;
8097
8098         memset(buf, 0, sizeof(buf));
8099
8100         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8101          * RSSI value was reported as 0 when not available. This behavior
8102          * is kept when using device discovery. This is required for full
8103          * backwards compatibility with the API.
8104          *
8105          * However when using service discovery, the value 127 will be
8106          * returned when the RSSI is not available.
8107          */
8108         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8109             link_type == ACL_LINK)
8110                 rssi = 0;
8111
8112         bacpy(&ev->addr.bdaddr, bdaddr);
8113         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8114         ev->rssi = rssi;
8115         ev->flags = cpu_to_le32(flags);
8116
8117         if (eir_len > 0)
8118                 /* Copy EIR or advertising data into event */
8119                 memcpy(ev->eir, eir, eir_len);
8120
8121         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8122                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8123                                           dev_class, 3);
8124
8125         if (scan_rsp_len > 0)
8126                 /* Append scan response data to event */
8127                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8128
8129         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8130         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8131
8132         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8133 }
8134
8135 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8136                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8137 {
8138         struct mgmt_ev_device_found *ev;
8139         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8140         u16 eir_len;
8141
8142         ev = (struct mgmt_ev_device_found *) buf;
8143
8144         memset(buf, 0, sizeof(buf));
8145
8146         bacpy(&ev->addr.bdaddr, bdaddr);
8147         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8148         ev->rssi = rssi;
8149
8150         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8151                                   name_len);
8152
8153         ev->eir_len = cpu_to_le16(eir_len);
8154
8155         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8156 }
8157
8158 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8159 {
8160         struct mgmt_ev_discovering ev;
8161
8162         BT_DBG("%s discovering %u", hdev->name, discovering);
8163
8164         memset(&ev, 0, sizeof(ev));
8165         ev.type = hdev->discovery.type;
8166         ev.discovering = discovering;
8167
8168         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8169 }
8170
8171 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8172 {
8173         BT_DBG("%s status %u", hdev->name, status);
8174 }
8175
8176 void mgmt_reenable_advertising(struct hci_dev *hdev)
8177 {
8178         struct hci_request req;
8179
8180         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8181             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8182                 return;
8183
8184         hci_req_init(&req, hdev);
8185         enable_advertising(&req);
8186         hci_req_run(&req, adv_enable_complete);
8187 }
8188
8189 static struct hci_mgmt_chan chan = {
8190         .channel        = HCI_CHANNEL_CONTROL,
8191         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8192         .handlers       = mgmt_handlers,
8193         .hdev_init      = mgmt_init_hdev,
8194 };
8195
8196 int mgmt_init(void)
8197 {
8198         return hci_mgmt_chan_register(&chan);
8199 }
8200
8201 void mgmt_exit(void)
8202 {
8203         hci_mgmt_chan_unregister(&chan);
8204 }