net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103 };
 104
 105 static const u16 mgmt_events[] = {
 106         MGMT_EV_CONTROLLER_ERROR,
 107         MGMT_EV_INDEX_ADDED,
 108         MGMT_EV_INDEX_REMOVED,
 109         MGMT_EV_NEW_SETTINGS,
 110         MGMT_EV_CLASS_OF_DEV_CHANGED,
 111         MGMT_EV_LOCAL_NAME_CHANGED,
 112         MGMT_EV_NEW_LINK_KEY,
 113         MGMT_EV_NEW_LONG_TERM_KEY,
 114         MGMT_EV_DEVICE_CONNECTED,
 115         MGMT_EV_DEVICE_DISCONNECTED,
 116         MGMT_EV_CONNECT_FAILED,
 117         MGMT_EV_PIN_CODE_REQUEST,
 118         MGMT_EV_USER_CONFIRM_REQUEST,
 119         MGMT_EV_USER_PASSKEY_REQUEST,
 120         MGMT_EV_AUTH_FAILED,
 121         MGMT_EV_DEVICE_FOUND,
 122         MGMT_EV_DISCOVERING,
 123         MGMT_EV_DEVICE_BLOCKED,
 124         MGMT_EV_DEVICE_UNBLOCKED,
 125         MGMT_EV_DEVICE_UNPAIRED,
 126         MGMT_EV_PASSKEY_NOTIFY,
 127         MGMT_EV_NEW_IRK,
 128         MGMT_EV_NEW_CSRK,
 129         MGMT_EV_DEVICE_ADDED,
 130         MGMT_EV_DEVICE_REMOVED,
 131         MGMT_EV_NEW_CONN_PARAM,
 132         MGMT_EV_UNCONF_INDEX_ADDED,
 133         MGMT_EV_UNCONF_INDEX_REMOVED,
 134         MGMT_EV_NEW_CONFIG_OPTIONS,
 135         MGMT_EV_EXT_INDEX_ADDED,
 136         MGMT_EV_EXT_INDEX_REMOVED,
 137         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 138 };
 139
 140 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 141
 142 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 143                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 144
 145 /* HCI to MGMT error code conversion table */
 146 static u8 mgmt_status_table[] = {
 147         MGMT_STATUS_SUCCESS,
 148         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 149         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 150         MGMT_STATUS_FAILED,             /* Hardware Failure */
 151         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 152         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 153         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 154         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 155         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 157         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 158         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 159         MGMT_STATUS_BUSY,               /* Command Disallowed */
 160         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 161         MGMT_STATUS_REJECTED,           /* Rejected Security */
 162         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 163         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 166         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 167         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 168         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 169         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 170         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 171         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 172         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 174         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 175         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 176         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 178         MGMT_STATUS_FAILED,             /* Unspecified Error */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 180         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 181         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 182         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 183         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 184         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 185         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 187         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 189         MGMT_STATUS_FAILED,             /* Transaction Collision */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 191         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 193         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 194         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 195         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 196         MGMT_STATUS_FAILED,             /* Slot Violation */
 197         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 198         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 200         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 201         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 202         MGMT_STATUS_BUSY,               /* Controller Busy */
 203         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 204         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 205         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 206         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 207         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 208 };
 209
 210 static u8 mgmt_status(u8 hci_status)
 211 {
 212         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 213                 return mgmt_status_table[hci_status];
 214
 215         return MGMT_STATUS_FAILED;
 216 }
 217
 218 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 219                             u16 len, int flag)
 220 {
 221         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 222                                flag, NULL);
 223 }
 224
 225 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 226                               u16 len, int flag, struct sock *skip_sk)
 227 {
 228         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 229                                flag, skip_sk);
 230 }
 231
 232 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 233                               u16 len, struct sock *skip_sk)
 234 {
 235         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 236                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 237 }
 238
 239 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 240                       struct sock *skip_sk)
 241 {
 242         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 243                                HCI_SOCK_TRUSTED, skip_sk);
 244 }
 245
 246 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 247                         u16 data_len)
 248 {
 249         struct mgmt_rp_read_version rp;
 250
 251         BT_DBG("sock %p", sk);
 252
 253         rp.version = MGMT_VERSION;
 254         rp.revision = cpu_to_le16(MGMT_REVISION);
 255
 256         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 257                                  &rp, sizeof(rp));
 258 }
 259
 260 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 261                          u16 data_len)
 262 {
 263         struct mgmt_rp_read_commands *rp;
 264         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 265         const u16 num_events = ARRAY_SIZE(mgmt_events);
 266         __le16 *opcode;
 267         size_t rp_size;
 268         int i, err;
 269
 270         BT_DBG("sock %p", sk);
 271
 272         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 273
 274         rp = kmalloc(rp_size, GFP_KERNEL);
 275         if (!rp)
 276                 return -ENOMEM;
 277
 278         rp->num_commands = cpu_to_le16(num_commands);
 279         rp->num_events = cpu_to_le16(num_events);
 280
 281         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 282                 put_unaligned_le16(mgmt_commands[i], opcode);
 283
 284         for (i = 0; i < num_events; i++, opcode++)
 285                 put_unaligned_le16(mgmt_events[i], opcode);
 286
 287         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 288                                 rp, rp_size);
 289         kfree(rp);
 290
 291         return err;
 292 }
 293
 294 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 295                            u16 data_len)
 296 {
 297         struct mgmt_rp_read_index_list *rp;
 298         struct hci_dev *d;
 299         size_t rp_len;
 300         u16 count;
 301         int err;
 302
 303         BT_DBG("sock %p", sk);
 304
 305         read_lock(&hci_dev_list_lock);
 306
 307         count = 0;
 308         list_for_each_entry(d, &hci_dev_list, list) {
 309                 if (d->dev_type == HCI_BREDR &&
 310                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 311                         count++;
 312         }
 313
 314         rp_len = sizeof(*rp) + (2 * count);
 315         rp = kmalloc(rp_len, GFP_ATOMIC);
 316         if (!rp) {
 317                 read_unlock(&hci_dev_list_lock);
 318                 return -ENOMEM;
 319         }
 320
 321         count = 0;
 322         list_for_each_entry(d, &hci_dev_list, list) {
 323                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 324                     hci_dev_test_flag(d, HCI_CONFIG) ||
 325                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 326                         continue;
 327
 328                 /* Devices marked as raw-only are neither configured
 329                  * nor unconfigured controllers.
 330                  */
 331                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 332                         continue;
 333
 334                 if (d->dev_type == HCI_BREDR &&
 335                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 336                         rp->index[count++] = cpu_to_le16(d->id);
 337                         BT_DBG("Added hci%u", d->id);
 338                 }
 339         }
 340
 341         rp->num_controllers = cpu_to_le16(count);
 342         rp_len = sizeof(*rp) + (2 * count);
 343
 344         read_unlock(&hci_dev_list_lock);
 345
 346         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 347                                 0, rp, rp_len);
 348
 349         kfree(rp);
 350
 351         return err;
 352 }
 353
 354 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 355                                   void *data, u16 data_len)
 356 {
 357         struct mgmt_rp_read_unconf_index_list *rp;
 358         struct hci_dev *d;
 359         size_t rp_len;
 360         u16 count;
 361         int err;
 362
 363         BT_DBG("sock %p", sk);
 364
 365         read_lock(&hci_dev_list_lock);
 366
 367         count = 0;
 368         list_for_each_entry(d, &hci_dev_list, list) {
 369                 if (d->dev_type == HCI_BREDR &&
 370                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 371                         count++;
 372         }
 373
 374         rp_len = sizeof(*rp) + (2 * count);
 375         rp = kmalloc(rp_len, GFP_ATOMIC);
 376         if (!rp) {
 377                 read_unlock(&hci_dev_list_lock);
 378                 return -ENOMEM;
 379         }
 380
 381         count = 0;
 382         list_for_each_entry(d, &hci_dev_list, list) {
 383                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 384                     hci_dev_test_flag(d, HCI_CONFIG) ||
 385                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 386                         continue;
 387
 388                 /* Devices marked as raw-only are neither configured
 389                  * nor unconfigured controllers.
 390                  */
 391                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 392                         continue;
 393
 394                 if (d->dev_type == HCI_BREDR &&
 395                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 396                         rp->index[count++] = cpu_to_le16(d->id);
 397                         BT_DBG("Added hci%u", d->id);
 398                 }
 399         }
 400
 401         rp->num_controllers = cpu_to_le16(count);
 402         rp_len = sizeof(*rp) + (2 * count);
 403
 404         read_unlock(&hci_dev_list_lock);
 405
 406         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 407                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 408
 409         kfree(rp);
 410
 411         return err;
 412 }
 413
 414 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 415                                void *data, u16 data_len)
 416 {
 417         struct mgmt_rp_read_ext_index_list *rp;
 418         struct hci_dev *d;
 419         size_t rp_len;
 420         u16 count;
 421         int err;
 422
 423         BT_DBG("sock %p", sk);
 424
 425         read_lock(&hci_dev_list_lock);
 426
 427         count = 0;
 428         list_for_each_entry(d, &hci_dev_list, list) {
 429                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 430                         count++;
 431         }
 432
 433         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 434         rp = kmalloc(rp_len, GFP_ATOMIC);
 435         if (!rp) {
 436                 read_unlock(&hci_dev_list_lock);
 437                 return -ENOMEM;
 438         }
 439
 440         count = 0;
 441         list_for_each_entry(d, &hci_dev_list, list) {
 442                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 443                     hci_dev_test_flag(d, HCI_CONFIG) ||
 444                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 445                         continue;
 446
 447                 /* Devices marked as raw-only are neither configured
 448                  * nor unconfigured controllers.
 449                  */
 450                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 451                         continue;
 452
 453                 if (d->dev_type == HCI_BREDR) {
 454                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 455                                 rp->entry[count].type = 0x01;
 456                         else
 457                                 rp->entry[count].type = 0x00;
 458                 } else if (d->dev_type == HCI_AMP) {
 459                         rp->entry[count].type = 0x02;
 460                 } else {
 461                         continue;
 462                 }
 463
 464                 rp->entry[count].bus = d->bus;
 465                 rp->entry[count++].index = cpu_to_le16(d->id);
 466                 BT_DBG("Added hci%u", d->id);
 467         }
 468
 469         rp->num_controllers = cpu_to_le16(count);
 470         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 471
 472         read_unlock(&hci_dev_list_lock);
 473
 474         /* If this command is called at least once, then all the
 475          * default index and unconfigured index events are disabled
 476          * and from now on only extended index events are used.
 477          */
 478         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 479         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 480         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 481
 482         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 483                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 484
 485         kfree(rp);
 486
 487         return err;
 488 }
 489
 490 static bool is_configured(struct hci_dev *hdev)
 491 {
 492         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 493             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 494                 return false;
 495
 496         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 497             !bacmp(&hdev->public_addr, BDADDR_ANY))
 498                 return false;
 499
 500         return true;
 501 }
 502
 503 static __le32 get_missing_options(struct hci_dev *hdev)
 504 {
 505         u32 options = 0;
 506
 507         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 508             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 509                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 510
 511         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 512             !bacmp(&hdev->public_addr, BDADDR_ANY))
 513                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 514
 515         return cpu_to_le32(options);
 516 }
 517
 518 static int new_options(struct hci_dev *hdev, struct sock *skip)
 519 {
 520         __le32 options = get_missing_options(hdev);
 521
 522         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 523                                   sizeof(options), skip);
 524 }
 525
 526 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 527 {
 528         __le32 options = get_missing_options(hdev);
 529
 530         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 531                                  sizeof(options));
 532 }
 533
 534 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 535                             void *data, u16 data_len)
 536 {
 537         struct mgmt_rp_read_config_info rp;
 538         u32 options = 0;
 539
 540         BT_DBG("sock %p %s", sk, hdev->name);
 541
 542         hci_dev_lock(hdev);
 543
 544         memset(&rp, 0, sizeof(rp));
 545         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 546
 547         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 548                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 549
 550         if (hdev->set_bdaddr)
 551                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 552
 553         rp.supported_options = cpu_to_le32(options);
 554         rp.missing_options = get_missing_options(hdev);
 555
 556         hci_dev_unlock(hdev);
 557
 558         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 559                                  &rp, sizeof(rp));
 560 }
 561
 562 static u32 get_supported_settings(struct hci_dev *hdev)
 563 {
 564         u32 settings = 0;
 565
 566         settings |= MGMT_SETTING_POWERED;
 567         settings |= MGMT_SETTING_BONDABLE;
 568         settings |= MGMT_SETTING_DEBUG_KEYS;
 569         settings |= MGMT_SETTING_CONNECTABLE;
 570         settings |= MGMT_SETTING_DISCOVERABLE;
 571
 572         if (lmp_bredr_capable(hdev)) {
 573                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 574                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 575                 settings |= MGMT_SETTING_BREDR;
 576                 settings |= MGMT_SETTING_LINK_SECURITY;
 577
 578                 if (lmp_ssp_capable(hdev)) {
 579                         settings |= MGMT_SETTING_SSP;
 580                         settings |= MGMT_SETTING_HS;
 581                 }
 582
 583                 if (lmp_sc_capable(hdev))
 584                         settings |= MGMT_SETTING_SECURE_CONN;
 585         }
 586
 587         if (lmp_le_capable(hdev)) {
 588                 settings |= MGMT_SETTING_LE;
 589                 settings |= MGMT_SETTING_ADVERTISING;
 590                 settings |= MGMT_SETTING_SECURE_CONN;
 591                 settings |= MGMT_SETTING_PRIVACY;
 592                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 593         }
 594
 595         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 596             hdev->set_bdaddr)
 597                 settings |= MGMT_SETTING_CONFIGURATION;
 598
 599         return settings;
 600 }
 601
 602 static u32 get_current_settings(struct hci_dev *hdev)
 603 {
 604         u32 settings = 0;
 605
 606         if (hdev_is_powered(hdev))
 607                 settings |= MGMT_SETTING_POWERED;
 608
 609         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 610                 settings |= MGMT_SETTING_CONNECTABLE;
 611
 612         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 613                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 614
 615         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 616                 settings |= MGMT_SETTING_DISCOVERABLE;
 617
 618         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 619                 settings |= MGMT_SETTING_BONDABLE;
 620
 621         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 622                 settings |= MGMT_SETTING_BREDR;
 623
 624         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 625                 settings |= MGMT_SETTING_LE;
 626
 627         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 628                 settings |= MGMT_SETTING_LINK_SECURITY;
 629
 630         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 631                 settings |= MGMT_SETTING_SSP;
 632
 633         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 634                 settings |= MGMT_SETTING_HS;
 635
 636         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 637                 settings |= MGMT_SETTING_ADVERTISING;
 638
 639         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 640                 settings |= MGMT_SETTING_SECURE_CONN;
 641
 642         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 643                 settings |= MGMT_SETTING_DEBUG_KEYS;
 644
 645         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 646                 settings |= MGMT_SETTING_PRIVACY;
 647
 648         /* The current setting for static address has two purposes. The
 649          * first is to indicate if the static address will be used and
 650          * the second is to indicate if it is actually set.
 651          *
 652          * This means if the static address is not configured, this flag
 653          * will never bet set. If the address is configured, then if the
 654          * address is actually used decides if the flag is set or not.
 655          *
 656          * For single mode LE only controllers and dual-mode controllers
 657          * with BR/EDR disabled, the existence of the static address will
 658          * be evaluated.
 659          */
 660         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 661             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 662             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 663                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 664                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 665         }
 666
 667         return settings;
 668 }
 669
 670 #define PNP_INFO_SVCLASS_ID             0x1200
 671
 672 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 673 {
 674         u8 *ptr = data, *uuids_start = NULL;
 675         struct bt_uuid *uuid;
 676
 677         if (len < 4)
 678                 return ptr;
 679
 680         list_for_each_entry(uuid, &hdev->uuids, list) {
 681                 u16 uuid16;
 682
 683                 if (uuid->size != 16)
 684                         continue;
 685
 686                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 687                 if (uuid16 < 0x1100)
 688                         continue;
 689
 690                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 691                         continue;
 692
 693                 if (!uuids_start) {
 694                         uuids_start = ptr;
 695                         uuids_start[0] = 1;
 696                         uuids_start[1] = EIR_UUID16_ALL;
 697                         ptr += 2;
 698                 }
 699
 700                 /* Stop if not enough space to put next UUID */
 701                 if ((ptr - data) + sizeof(u16) > len) {
 702                         uuids_start[1] = EIR_UUID16_SOME;
 703                         break;
 704                 }
 705
 706                 *ptr++ = (uuid16 & 0x00ff);
 707                 *ptr++ = (uuid16 & 0xff00) >> 8;
 708                 uuids_start[0] += sizeof(uuid16);
 709         }
 710
 711         return ptr;
 712 }
 713
 714 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 715 {
 716         u8 *ptr = data, *uuids_start = NULL;
 717         struct bt_uuid *uuid;
 718
 719         if (len < 6)
 720                 return ptr;
 721
 722         list_for_each_entry(uuid, &hdev->uuids, list) {
 723                 if (uuid->size != 32)
 724                         continue;
 725
 726                 if (!uuids_start) {
 727                         uuids_start = ptr;
 728                         uuids_start[0] = 1;
 729                         uuids_start[1] = EIR_UUID32_ALL;
 730                         ptr += 2;
 731                 }
 732
 733                 /* Stop if not enough space to put next UUID */
 734                 if ((ptr - data) + sizeof(u32) > len) {
 735                         uuids_start[1] = EIR_UUID32_SOME;
 736                         break;
 737                 }
 738
 739                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 740                 ptr += sizeof(u32);
 741                 uuids_start[0] += sizeof(u32);
 742         }
 743
 744         return ptr;
 745 }
 746
 747 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 748 {
 749         u8 *ptr = data, *uuids_start = NULL;
 750         struct bt_uuid *uuid;
 751
 752         if (len < 18)
 753                 return ptr;
 754
 755         list_for_each_entry(uuid, &hdev->uuids, list) {
 756                 if (uuid->size != 128)
 757                         continue;
 758
 759                 if (!uuids_start) {
 760                         uuids_start = ptr;
 761                         uuids_start[0] = 1;
 762                         uuids_start[1] = EIR_UUID128_ALL;
 763                         ptr += 2;
 764                 }
 765
 766                 /* Stop if not enough space to put next UUID */
 767                 if ((ptr - data) + 16 > len) {
 768                         uuids_start[1] = EIR_UUID128_SOME;
 769                         break;
 770                 }
 771
 772                 memcpy(ptr, uuid->uuid, 16);
 773                 ptr += 16;
 774                 uuids_start[0] += 16;
 775         }
 776
 777         return ptr;
 778 }
 779
 780 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 781 {
 782         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 783 }
 784
 785 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 786                                                   struct hci_dev *hdev,
 787                                                   const void *data)
 788 {
 789         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 790 }
 791
 792 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 793 {
 794         u8 ad_len = 0;
 795         size_t name_len;
 796
 797         name_len = strlen(hdev->dev_name);
 798         if (name_len > 0) {
 799                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 800
 801                 if (name_len > max_len) {
 802                         name_len = max_len;
 803                         ptr[1] = EIR_NAME_SHORT;
 804                 } else
 805                         ptr[1] = EIR_NAME_COMPLETE;
 806
 807                 ptr[0] = name_len + 1;
 808
 809                 memcpy(ptr + 2, hdev->dev_name, name_len);
 810
 811                 ad_len += (name_len + 2);
 812                 ptr += (name_len + 2);
 813         }
 814
 815         return ad_len;
 816 }
 817
 818 static void update_scan_rsp_data(struct hci_request *req)
 819 {
 820         struct hci_dev *hdev = req->hdev;
 821         struct hci_cp_le_set_scan_rsp_data cp;
 822         u8 len;
 823
 824         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 825                 return;
 826
 827         memset(&cp, 0, sizeof(cp));
 828
 829         len = create_scan_rsp_data(hdev, cp.data);
 830
 831         if (hdev->scan_rsp_data_len == len &&
 832             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 833                 return;
 834
 835         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 836         hdev->scan_rsp_data_len = len;
 837
 838         cp.length = len;
 839
 840         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 841 }
 842
 843 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 844 {
 845         struct mgmt_pending_cmd *cmd;
 846
 847         /* If there's a pending mgmt command the flags will not yet have
 848          * their final values, so check for this first.
 849          */
 850         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 851         if (cmd) {
 852                 struct mgmt_mode *cp = cmd->param;
 853                 if (cp->val == 0x01)
 854                         return LE_AD_GENERAL;
 855                 else if (cp->val == 0x02)
 856                         return LE_AD_LIMITED;
 857         } else {
 858                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 859                         return LE_AD_LIMITED;
 860                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 861                         return LE_AD_GENERAL;
 862         }
 863
 864         return 0;
 865 }
 866
 867 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 868 {
 869         u8 ad_len = 0, flags = 0;
 870
 871         flags |= get_adv_discov_flags(hdev);
 872
 873         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 874                 flags |= LE_AD_NO_BREDR;
 875
 876         if (flags) {
 877                 BT_DBG("adv flags 0x%02x", flags);
 878
 879                 ptr[0] = 2;
 880                 ptr[1] = EIR_FLAGS;
 881                 ptr[2] = flags;
 882
 883                 ad_len += 3;
 884                 ptr += 3;
 885         }
 886
 887         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 888                 ptr[0] = 2;
 889                 ptr[1] = EIR_TX_POWER;
 890                 ptr[2] = (u8) hdev->adv_tx_power;
 891
 892                 ad_len += 3;
 893                 ptr += 3;
 894         }
 895
 896         return ad_len;
 897 }
 898
 899 static void update_adv_data(struct hci_request *req)
 900 {
 901         struct hci_dev *hdev = req->hdev;
 902         struct hci_cp_le_set_adv_data cp;
 903         u8 len;
 904
 905         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 906                 return;
 907
 908         memset(&cp, 0, sizeof(cp));
 909
 910         len = create_adv_data(hdev, cp.data);
 911
 912         if (hdev->adv_data_len == len &&
 913             memcmp(cp.data, hdev->adv_data, len) == 0)
 914                 return;
 915
 916         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 917         hdev->adv_data_len = len;
 918
 919         cp.length = len;
 920
 921         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 922 }
 923
 924 int mgmt_update_adv_data(struct hci_dev *hdev)
 925 {
 926         struct hci_request req;
 927
 928         hci_req_init(&req, hdev);
 929         update_adv_data(&req);
 930
 931         return hci_req_run(&req, NULL);
 932 }
 933
 934 static void create_eir(struct hci_dev *hdev, u8 *data)
 935 {
 936         u8 *ptr = data;
 937         size_t name_len;
 938
 939         name_len = strlen(hdev->dev_name);
 940
 941         if (name_len > 0) {
 942                 /* EIR Data type */
 943                 if (name_len > 48) {
 944                         name_len = 48;
 945                         ptr[1] = EIR_NAME_SHORT;
 946                 } else
 947                         ptr[1] = EIR_NAME_COMPLETE;
 948
 949                 /* EIR Data length */
 950                 ptr[0] = name_len + 1;
 951
 952                 memcpy(ptr + 2, hdev->dev_name, name_len);
 953
 954                 ptr += (name_len + 2);
 955         }
 956
 957         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 958                 ptr[0] = 2;
 959                 ptr[1] = EIR_TX_POWER;
 960                 ptr[2] = (u8) hdev->inq_tx_power;
 961
 962                 ptr += 3;
 963         }
 964
 965         if (hdev->devid_source > 0) {
 966                 ptr[0] = 9;
 967                 ptr[1] = EIR_DEVICE_ID;
 968
 969                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 970                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 971                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 972                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 973
 974                 ptr += 10;
 975         }
 976
 977         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 978         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 979         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 980 }
 981
 982 static void update_eir(struct hci_request *req)
 983 {
 984         struct hci_dev *hdev = req->hdev;
 985         struct hci_cp_write_eir cp;
 986
 987         if (!hdev_is_powered(hdev))
 988                 return;
 989
 990         if (!lmp_ext_inq_capable(hdev))
 991                 return;
 992
 993         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 994                 return;
 995
 996         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
 997                 return;
 998
 999         memset(&cp, 0, sizeof(cp));
1000
1001         create_eir(hdev, cp.data);
1002
1003         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1004                 return;
1005
1006         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1007
1008         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1009 }
1010
1011 static u8 get_service_classes(struct hci_dev *hdev)
1012 {
1013         struct bt_uuid *uuid;
1014         u8 val = 0;
1015
1016         list_for_each_entry(uuid, &hdev->uuids, list)
1017                 val |= uuid->svc_hint;
1018
1019         return val;
1020 }
1021
1022 static void update_class(struct hci_request *req)
1023 {
1024         struct hci_dev *hdev = req->hdev;
1025         u8 cod[3];
1026
1027         BT_DBG("%s", hdev->name);
1028
1029         if (!hdev_is_powered(hdev))
1030                 return;
1031
1032         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1033                 return;
1034
1035         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1036                 return;
1037
1038         cod[0] = hdev->minor_class;
1039         cod[1] = hdev->major_class;
1040         cod[2] = get_service_classes(hdev);
1041
1042         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1043                 cod[1] |= 0x20;
1044
1045         if (memcmp(cod, hdev->dev_class, 3) == 0)
1046                 return;
1047
1048         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1049 }
1050
1051 static bool get_connectable(struct hci_dev *hdev)
1052 {
1053         struct mgmt_pending_cmd *cmd;
1054
1055         /* If there's a pending mgmt command the flag will not yet have
1056          * it's final value, so check for this first.
1057          */
1058         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1059         if (cmd) {
1060                 struct mgmt_mode *cp = cmd->param;
1061                 return cp->val;
1062         }
1063
1064         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1065 }
1066
1067 static void disable_advertising(struct hci_request *req)
1068 {
1069         u8 enable = 0x00;
1070
1071         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1072 }
1073
1074 static void enable_advertising(struct hci_request *req)
1075 {
1076         struct hci_dev *hdev = req->hdev;
1077         struct hci_cp_le_set_adv_param cp;
1078         u8 own_addr_type, enable = 0x01;
1079         bool connectable;
1080
1081         if (hci_conn_num(hdev, LE_LINK) > 0)
1082                 return;
1083
1084         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1085                 disable_advertising(req);
1086
1087         /* Clear the HCI_LE_ADV bit temporarily so that the
1088          * hci_update_random_address knows that it's safe to go ahead
1089          * and write a new random address. The flag will be set back on
1090          * as soon as the SET_ADV_ENABLE HCI command completes.
1091          */
1092         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1093
1094         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1095                 connectable = true;
1096         else
1097                 connectable = get_connectable(hdev);
1098
1099         /* Set require_privacy to true only when non-connectable
1100          * advertising is used. In that case it is fine to use a
1101          * non-resolvable private address.
1102          */
1103         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1104                 return;
1105
1106         memset(&cp, 0, sizeof(cp));
1107         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1108         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1109         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1110         cp.own_address_type = own_addr_type;
1111         cp.channel_map = hdev->le_adv_channel_map;
1112
1113         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1114
1115         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1116 }
1117
1118 static void service_cache_off(struct work_struct *work)
1119 {
1120         struct hci_dev *hdev = container_of(work, struct hci_dev,
1121                                             service_cache.work);
1122         struct hci_request req;
1123
1124         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1125                 return;
1126
1127         hci_req_init(&req, hdev);
1128
1129         hci_dev_lock(hdev);
1130
1131         update_eir(&req);
1132         update_class(&req);
1133
1134         hci_dev_unlock(hdev);
1135
1136         hci_req_run(&req, NULL);
1137 }
1138
1139 static void rpa_expired(struct work_struct *work)
1140 {
1141         struct hci_dev *hdev = container_of(work, struct hci_dev,
1142                                             rpa_expired.work);
1143         struct hci_request req;
1144
1145         BT_DBG("");
1146
1147         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1148
1149         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1150                 return;
1151
1152         /* The generation of a new RPA and programming it into the
1153          * controller happens in the enable_advertising() function.
1154          */
1155         hci_req_init(&req, hdev);
1156         enable_advertising(&req);
1157         hci_req_run(&req, NULL);
1158 }
1159
1160 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1161 {
1162         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1163                 return;
1164
1165         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1166         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1167
1168         /* Non-mgmt controlled devices get this bit set
1169          * implicitly so that pairing works for them, however
1170          * for mgmt we require user-space to explicitly enable
1171          * it
1172          */
1173         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1174 }
1175
1176 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1177                                 void *data, u16 data_len)
1178 {
1179         struct mgmt_rp_read_info rp;
1180
1181         BT_DBG("sock %p %s", sk, hdev->name);
1182
1183         hci_dev_lock(hdev);
1184
1185         memset(&rp, 0, sizeof(rp));
1186
1187         bacpy(&rp.bdaddr, &hdev->bdaddr);
1188
1189         rp.version = hdev->hci_ver;
1190         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1191
1192         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1193         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1194
1195         memcpy(rp.dev_class, hdev->dev_class, 3);
1196
1197         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1198         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1199
1200         hci_dev_unlock(hdev);
1201
1202         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1203                                  sizeof(rp));
1204 }
1205
1206 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1207 {
1208         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1209
1210         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1211                                  sizeof(settings));
1212 }
1213
1214 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1215 {
1216         BT_DBG("%s status 0x%02x", hdev->name, status);
1217
1218         if (hci_conn_count(hdev) == 0) {
1219                 cancel_delayed_work(&hdev->power_off);
1220                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1221         }
1222 }
1223
1224 static bool hci_stop_discovery(struct hci_request *req)
1225 {
1226         struct hci_dev *hdev = req->hdev;
1227         struct hci_cp_remote_name_req_cancel cp;
1228         struct inquiry_entry *e;
1229
1230         switch (hdev->discovery.state) {
1231         case DISCOVERY_FINDING:
1232                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1233                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1234
1235                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1236                         cancel_delayed_work(&hdev->le_scan_disable);
1237                         hci_req_add_le_scan_disable(req);
1238                 }
1239
1240                 return true;
1241
1242         case DISCOVERY_RESOLVING:
1243                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1244                                                      NAME_PENDING);
1245                 if (!e)
1246                         break;
1247
1248                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1249                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1250                             &cp);
1251
1252                 return true;
1253
1254         default:
1255                 /* Passive scanning */
1256                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1257                         hci_req_add_le_scan_disable(req);
1258                         return true;
1259                 }
1260
1261                 break;
1262         }
1263
1264         return false;
1265 }
1266
1267 static int clean_up_hci_state(struct hci_dev *hdev)
1268 {
1269         struct hci_request req;
1270         struct hci_conn *conn;
1271         bool discov_stopped;
1272         int err;
1273
1274         hci_req_init(&req, hdev);
1275
1276         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1277             test_bit(HCI_PSCAN, &hdev->flags)) {
1278                 u8 scan = 0x00;
1279                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1280         }
1281
1282         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1283                 disable_advertising(&req);
1284
1285         discov_stopped = hci_stop_discovery(&req);
1286
1287         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1288                 struct hci_cp_disconnect dc;
1289                 struct hci_cp_reject_conn_req rej;
1290
1291                 switch (conn->state) {
1292                 case BT_CONNECTED:
1293                 case BT_CONFIG:
1294                         dc.handle = cpu_to_le16(conn->handle);
1295                         dc.reason = 0x15; /* Terminated due to Power Off */
1296                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1297                         break;
1298                 case BT_CONNECT:
1299                         if (conn->type == LE_LINK)
1300                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1301                                             0, NULL);
1302                         else if (conn->type == ACL_LINK)
1303                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1304                                             6, &conn->dst);
1305                         break;
1306                 case BT_CONNECT2:
1307                         bacpy(&rej.bdaddr, &conn->dst);
1308                         rej.reason = 0x15; /* Terminated due to Power Off */
1309                         if (conn->type == ACL_LINK)
1310                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1311                                             sizeof(rej), &rej);
1312                         else if (conn->type == SCO_LINK)
1313                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1314                                             sizeof(rej), &rej);
1315                         break;
1316                 }
1317         }
1318
1319         err = hci_req_run(&req, clean_up_hci_complete);
1320         if (!err && discov_stopped)
1321                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1322
1323         return err;
1324 }
1325
1326 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1327                        u16 len)
1328 {
1329         struct mgmt_mode *cp = data;
1330         struct mgmt_pending_cmd *cmd;
1331         int err;
1332
1333         BT_DBG("request for %s", hdev->name);
1334
1335         if (cp->val != 0x00 && cp->val != 0x01)
1336                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1337                                        MGMT_STATUS_INVALID_PARAMS);
1338
1339         hci_dev_lock(hdev);
1340
1341         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1342                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1343                                       MGMT_STATUS_BUSY);
1344                 goto failed;
1345         }
1346
1347         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1348                 cancel_delayed_work(&hdev->power_off);
1349
1350                 if (cp->val) {
1351                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1352                                          data, len);
1353                         err = mgmt_powered(hdev, 1);
1354                         goto failed;
1355                 }
1356         }
1357
1358         if (!!cp->val == hdev_is_powered(hdev)) {
1359                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1360                 goto failed;
1361         }
1362
1363         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1364         if (!cmd) {
1365                 err = -ENOMEM;
1366                 goto failed;
1367         }
1368
1369         if (cp->val) {
1370                 queue_work(hdev->req_workqueue, &hdev->power_on);
1371                 err = 0;
1372         } else {
1373                 /* Disconnect connections, stop scans, etc */
1374                 err = clean_up_hci_state(hdev);
1375                 if (!err)
1376                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1377                                            HCI_POWER_OFF_TIMEOUT);
1378
1379                 /* ENODATA means there were no HCI commands queued */
1380                 if (err == -ENODATA) {
1381                         cancel_delayed_work(&hdev->power_off);
1382                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1383                         err = 0;
1384                 }
1385         }
1386
1387 failed:
1388         hci_dev_unlock(hdev);
1389         return err;
1390 }
1391
1392 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1393 {
1394         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1395
1396         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1397                                   sizeof(ev), skip);
1398 }
1399
1400 int mgmt_new_settings(struct hci_dev *hdev)
1401 {
1402         return new_settings(hdev, NULL);
1403 }
1404
1405 struct cmd_lookup {
1406         struct sock *sk;
1407         struct hci_dev *hdev;
1408         u8 mgmt_status;
1409 };
1410
1411 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1412 {
1413         struct cmd_lookup *match = data;
1414
1415         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1416
1417         list_del(&cmd->list);
1418
1419         if (match->sk == NULL) {
1420                 match->sk = cmd->sk;
1421                 sock_hold(match->sk);
1422         }
1423
1424         mgmt_pending_free(cmd);
1425 }
1426
1427 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1428 {
1429         u8 *status = data;
1430
1431         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1432         mgmt_pending_remove(cmd);
1433 }
1434
1435 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1436 {
1437         if (cmd->cmd_complete) {
1438                 u8 *status = data;
1439
1440                 cmd->cmd_complete(cmd, *status);
1441                 mgmt_pending_remove(cmd);
1442
1443                 return;
1444         }
1445
1446         cmd_status_rsp(cmd, data);
1447 }
1448
1449 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1450 {
1451         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1452                                  cmd->param, cmd->param_len);
1453 }
1454
1455 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1456 {
1457         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1458                                  cmd->param, sizeof(struct mgmt_addr_info));
1459 }
1460
1461 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1462 {
1463         if (!lmp_bredr_capable(hdev))
1464                 return MGMT_STATUS_NOT_SUPPORTED;
1465         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1466                 return MGMT_STATUS_REJECTED;
1467         else
1468                 return MGMT_STATUS_SUCCESS;
1469 }
1470
1471 static u8 mgmt_le_support(struct hci_dev *hdev)
1472 {
1473         if (!lmp_le_capable(hdev))
1474                 return MGMT_STATUS_NOT_SUPPORTED;
1475         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1476                 return MGMT_STATUS_REJECTED;
1477         else
1478                 return MGMT_STATUS_SUCCESS;
1479 }
1480
1481 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1482                                       u16 opcode)
1483 {
1484         struct mgmt_pending_cmd *cmd;
1485         struct mgmt_mode *cp;
1486         struct hci_request req;
1487         bool changed;
1488
1489         BT_DBG("status 0x%02x", status);
1490
1491         hci_dev_lock(hdev);
1492
1493         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1494         if (!cmd)
1495                 goto unlock;
1496
1497         if (status) {
1498                 u8 mgmt_err = mgmt_status(status);
1499                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1500                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1501                 goto remove_cmd;
1502         }
1503
1504         cp = cmd->param;
1505         if (cp->val) {
1506                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1507
1508                 if (hdev->discov_timeout > 0) {
1509                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1510                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1511                                            to);
1512                 }
1513         } else {
1514                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1515         }
1516
1517         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1518
1519         if (changed)
1520                 new_settings(hdev, cmd->sk);
1521
1522         /* When the discoverable mode gets changed, make sure
1523          * that class of device has the limited discoverable
1524          * bit correctly set. Also update page scan based on whitelist
1525          * entries.
1526          */
1527         hci_req_init(&req, hdev);
1528         __hci_update_page_scan(&req);
1529         update_class(&req);
1530         hci_req_run(&req, NULL);
1531
1532 remove_cmd:
1533         mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537 }
1538
1539 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1540                             u16 len)
1541 {
1542         struct mgmt_cp_set_discoverable *cp = data;
1543         struct mgmt_pending_cmd *cmd;
1544         struct hci_request req;
1545         u16 timeout;
1546         u8 scan;
1547         int err;
1548
1549         BT_DBG("request for %s", hdev->name);
1550
1551         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1552             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1553                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1554                                        MGMT_STATUS_REJECTED);
1555
1556         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1557                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1558                                        MGMT_STATUS_INVALID_PARAMS);
1559
1560         timeout = __le16_to_cpu(cp->timeout);
1561
1562         /* Disabling discoverable requires that no timeout is set,
1563          * and enabling limited discoverable requires a timeout.
1564          */
1565         if ((cp->val == 0x00 && timeout > 0) ||
1566             (cp->val == 0x02 && timeout == 0))
1567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1568                                        MGMT_STATUS_INVALID_PARAMS);
1569
1570         hci_dev_lock(hdev);
1571
1572         if (!hdev_is_powered(hdev) && timeout > 0) {
1573                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1574                                       MGMT_STATUS_NOT_POWERED);
1575                 goto failed;
1576         }
1577
1578         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1579             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1580                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1581                                       MGMT_STATUS_BUSY);
1582                 goto failed;
1583         }
1584
1585         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1587                                       MGMT_STATUS_REJECTED);
1588                 goto failed;
1589         }
1590
1591         if (!hdev_is_powered(hdev)) {
1592                 bool changed = false;
1593
1594                 /* Setting limited discoverable when powered off is
1595                  * not a valid operation since it requires a timeout
1596                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1597                  */
1598                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1599                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1600                         changed = true;
1601                 }
1602
1603                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1604                 if (err < 0)
1605                         goto failed;
1606
1607                 if (changed)
1608                         err = new_settings(hdev, sk);
1609
1610                 goto failed;
1611         }
1612
1613         /* If the current mode is the same, then just update the timeout
1614          * value with the new value. And if only the timeout gets updated,
1615          * then no need for any HCI transactions.
1616          */
1617         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1618             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1619                                                    HCI_LIMITED_DISCOVERABLE)) {
1620                 cancel_delayed_work(&hdev->discov_off);
1621                 hdev->discov_timeout = timeout;
1622
1623                 if (cp->val && hdev->discov_timeout > 0) {
1624                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1625                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1626                                            to);
1627                 }
1628
1629                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1630                 goto failed;
1631         }
1632
1633         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1634         if (!cmd) {
1635                 err = -ENOMEM;
1636                 goto failed;
1637         }
1638
1639         /* Cancel any potential discoverable timeout that might be
1640          * still active and store new timeout value. The arming of
1641          * the timeout happens in the complete handler.
1642          */
1643         cancel_delayed_work(&hdev->discov_off);
1644         hdev->discov_timeout = timeout;
1645
1646         /* Limited discoverable mode */
1647         if (cp->val == 0x02)
1648                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1649         else
1650                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1651
1652         hci_req_init(&req, hdev);
1653
1654         /* The procedure for LE-only controllers is much simpler - just
1655          * update the advertising data.
1656          */
1657         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1658                 goto update_ad;
1659
1660         scan = SCAN_PAGE;
1661
1662         if (cp->val) {
1663                 struct hci_cp_write_current_iac_lap hci_cp;
1664
1665                 if (cp->val == 0x02) {
1666                         /* Limited discoverable mode */
1667                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1668                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1669                         hci_cp.iac_lap[1] = 0x8b;
1670                         hci_cp.iac_lap[2] = 0x9e;
1671                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1672                         hci_cp.iac_lap[4] = 0x8b;
1673                         hci_cp.iac_lap[5] = 0x9e;
1674                 } else {
1675                         /* General discoverable mode */
1676                         hci_cp.num_iac = 1;
1677                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1678                         hci_cp.iac_lap[1] = 0x8b;
1679                         hci_cp.iac_lap[2] = 0x9e;
1680                 }
1681
1682                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1683                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1684
1685                 scan |= SCAN_INQUIRY;
1686         } else {
1687                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1688         }
1689
1690         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1691
1692 update_ad:
1693         update_adv_data(&req);
1694
1695         err = hci_req_run(&req, set_discoverable_complete);
1696         if (err < 0)
1697                 mgmt_pending_remove(cmd);
1698
1699 failed:
1700         hci_dev_unlock(hdev);
1701         return err;
1702 }
1703
1704 static void write_fast_connectable(struct hci_request *req, bool enable)
1705 {
1706         struct hci_dev *hdev = req->hdev;
1707         struct hci_cp_write_page_scan_activity acp;
1708         u8 type;
1709
1710         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1711                 return;
1712
1713         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1714                 return;
1715
1716         if (enable) {
1717                 type = PAGE_SCAN_TYPE_INTERLACED;
1718
1719                 /* 160 msec page scan interval */
1720                 acp.interval = cpu_to_le16(0x0100);
1721         } else {
1722                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1723
1724                 /* default 1.28 sec page scan */
1725                 acp.interval = cpu_to_le16(0x0800);
1726         }
1727
1728         acp.window = cpu_to_le16(0x0012);
1729
1730         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1731             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1732                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1733                             sizeof(acp), &acp);
1734
1735         if (hdev->page_scan_type != type)
1736                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1737 }
1738
1739 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1740                                      u16 opcode)
1741 {
1742         struct mgmt_pending_cmd *cmd;
1743         struct mgmt_mode *cp;
1744         bool conn_changed, discov_changed;
1745
1746         BT_DBG("status 0x%02x", status);
1747
1748         hci_dev_lock(hdev);
1749
1750         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1751         if (!cmd)
1752                 goto unlock;
1753
1754         if (status) {
1755                 u8 mgmt_err = mgmt_status(status);
1756                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1757                 goto remove_cmd;
1758         }
1759
1760         cp = cmd->param;
1761         if (cp->val) {
1762                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1763                                                           HCI_CONNECTABLE);
1764                 discov_changed = false;
1765         } else {
1766                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1767                                                            HCI_CONNECTABLE);
1768                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1769                                                              HCI_DISCOVERABLE);
1770         }
1771
1772         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1773
1774         if (conn_changed || discov_changed) {
1775                 new_settings(hdev, cmd->sk);
1776                 hci_update_page_scan(hdev);
1777                 if (discov_changed)
1778                         mgmt_update_adv_data(hdev);
1779                 hci_update_background_scan(hdev);
1780         }
1781
1782 remove_cmd:
1783         mgmt_pending_remove(cmd);
1784
1785 unlock:
1786         hci_dev_unlock(hdev);
1787 }
1788
1789 static int set_connectable_update_settings(struct hci_dev *hdev,
1790                                            struct sock *sk, u8 val)
1791 {
1792         bool changed = false;
1793         int err;
1794
1795         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1796                 changed = true;
1797
1798         if (val) {
1799                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1800         } else {
1801                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1802                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1803         }
1804
1805         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1806         if (err < 0)
1807                 return err;
1808
1809         if (changed) {
1810                 hci_update_page_scan(hdev);
1811                 hci_update_background_scan(hdev);
1812                 return new_settings(hdev, sk);
1813         }
1814
1815         return 0;
1816 }
1817
1818 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1819                            u16 len)
1820 {
1821         struct mgmt_mode *cp = data;
1822         struct mgmt_pending_cmd *cmd;
1823         struct hci_request req;
1824         u8 scan;
1825         int err;
1826
1827         BT_DBG("request for %s", hdev->name);
1828
1829         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1830             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1831                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1832                                        MGMT_STATUS_REJECTED);
1833
1834         if (cp->val != 0x00 && cp->val != 0x01)
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1836                                        MGMT_STATUS_INVALID_PARAMS);
1837
1838         hci_dev_lock(hdev);
1839
1840         if (!hdev_is_powered(hdev)) {
1841                 err = set_connectable_update_settings(hdev, sk, cp->val);
1842                 goto failed;
1843         }
1844
1845         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1846             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1847                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1848                                       MGMT_STATUS_BUSY);
1849                 goto failed;
1850         }
1851
1852         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1853         if (!cmd) {
1854                 err = -ENOMEM;
1855                 goto failed;
1856         }
1857
1858         hci_req_init(&req, hdev);
1859
1860         /* If BR/EDR is not enabled and we disable advertising as a
1861          * by-product of disabling connectable, we need to update the
1862          * advertising flags.
1863          */
1864         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1865                 if (!cp->val) {
1866                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1867                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1868                 }
1869                 update_adv_data(&req);
1870         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1871                 if (cp->val) {
1872                         scan = SCAN_PAGE;
1873                 } else {
1874                         /* If we don't have any whitelist entries just
1875                          * disable all scanning. If there are entries
1876                          * and we had both page and inquiry scanning
1877                          * enabled then fall back to only page scanning.
1878                          * Otherwise no changes are needed.
1879                          */
1880                         if (list_empty(&hdev->whitelist))
1881                                 scan = SCAN_DISABLED;
1882                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1883                                 scan = SCAN_PAGE;
1884                         else
1885                                 goto no_scan_update;
1886
1887                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1888                             hdev->discov_timeout > 0)
1889                                 cancel_delayed_work(&hdev->discov_off);
1890                 }
1891
1892                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1893         }
1894
1895 no_scan_update:
1896         /* Update the advertising parameters if necessary */
1897         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
1898                 enable_advertising(&req);
1899
1900         err = hci_req_run(&req, set_connectable_complete);
1901         if (err < 0) {
1902                 mgmt_pending_remove(cmd);
1903                 if (err == -ENODATA)
1904                         err = set_connectable_update_settings(hdev, sk,
1905                                                               cp->val);
1906                 goto failed;
1907         }
1908
1909 failed:
1910         hci_dev_unlock(hdev);
1911         return err;
1912 }
1913
1914 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1915                         u16 len)
1916 {
1917         struct mgmt_mode *cp = data;
1918         bool changed;
1919         int err;
1920
1921         BT_DBG("request for %s", hdev->name);
1922
1923         if (cp->val != 0x00 && cp->val != 0x01)
1924                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1925                                        MGMT_STATUS_INVALID_PARAMS);
1926
1927         hci_dev_lock(hdev);
1928
1929         if (cp->val)
1930                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1931         else
1932                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1933
1934         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1935         if (err < 0)
1936                 goto unlock;
1937
1938         if (changed)
1939                 err = new_settings(hdev, sk);
1940
1941 unlock:
1942         hci_dev_unlock(hdev);
1943         return err;
1944 }
1945
1946 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1947                              u16 len)
1948 {
1949         struct mgmt_mode *cp = data;
1950         struct mgmt_pending_cmd *cmd;
1951         u8 val, status;
1952         int err;
1953
1954         BT_DBG("request for %s", hdev->name);
1955
1956         status = mgmt_bredr_support(hdev);
1957         if (status)
1958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1959                                        status);
1960
1961         if (cp->val != 0x00 && cp->val != 0x01)
1962                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1963                                        MGMT_STATUS_INVALID_PARAMS);
1964
1965         hci_dev_lock(hdev);
1966
1967         if (!hdev_is_powered(hdev)) {
1968                 bool changed = false;
1969
1970                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1971                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1972                         changed = true;
1973                 }
1974
1975                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1976                 if (err < 0)
1977                         goto failed;
1978
1979                 if (changed)
1980                         err = new_settings(hdev, sk);
1981
1982                 goto failed;
1983         }
1984
1985         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1986                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1987                                       MGMT_STATUS_BUSY);
1988                 goto failed;
1989         }
1990
1991         val = !!cp->val;
1992
1993         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1994                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1995                 goto failed;
1996         }
1997
1998         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1999         if (!cmd) {
2000                 err = -ENOMEM;
2001                 goto failed;
2002         }
2003
2004         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2005         if (err < 0) {
2006                 mgmt_pending_remove(cmd);
2007                 goto failed;
2008         }
2009
2010 failed:
2011         hci_dev_unlock(hdev);
2012         return err;
2013 }
2014
2015 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2016 {
2017         struct mgmt_mode *cp = data;
2018         struct mgmt_pending_cmd *cmd;
2019         u8 status;
2020         int err;
2021
2022         BT_DBG("request for %s", hdev->name);
2023
2024         status = mgmt_bredr_support(hdev);
2025         if (status)
2026                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2027
2028         if (!lmp_ssp_capable(hdev))
2029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2030                                        MGMT_STATUS_NOT_SUPPORTED);
2031
2032         if (cp->val != 0x00 && cp->val != 0x01)
2033                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2034                                        MGMT_STATUS_INVALID_PARAMS);
2035
2036         hci_dev_lock(hdev);
2037
2038         if (!hdev_is_powered(hdev)) {
2039                 bool changed;
2040
2041                 if (cp->val) {
2042                         changed = !hci_dev_test_and_set_flag(hdev,
2043                                                              HCI_SSP_ENABLED);
2044                 } else {
2045                         changed = hci_dev_test_and_clear_flag(hdev,
2046                                                               HCI_SSP_ENABLED);
2047                         if (!changed)
2048                                 changed = hci_dev_test_and_clear_flag(hdev,
2049                                                                       HCI_HS_ENABLED);
2050                         else
2051                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2052                 }
2053
2054                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2055                 if (err < 0)
2056                         goto failed;
2057
2058                 if (changed)
2059                         err = new_settings(hdev, sk);
2060
2061                 goto failed;
2062         }
2063
2064         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2065                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2066                                       MGMT_STATUS_BUSY);
2067                 goto failed;
2068         }
2069
2070         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2071                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2072                 goto failed;
2073         }
2074
2075         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2076         if (!cmd) {
2077                 err = -ENOMEM;
2078                 goto failed;
2079         }
2080
2081         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2082                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2083                              sizeof(cp->val), &cp->val);
2084
2085         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2086         if (err < 0) {
2087                 mgmt_pending_remove(cmd);
2088                 goto failed;
2089         }
2090
2091 failed:
2092         hci_dev_unlock(hdev);
2093         return err;
2094 }
2095
2096 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2097 {
2098         struct mgmt_mode *cp = data;
2099         bool changed;
2100         u8 status;
2101         int err;
2102
2103         BT_DBG("request for %s", hdev->name);
2104
2105         status = mgmt_bredr_support(hdev);
2106         if (status)
2107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2108
2109         if (!lmp_ssp_capable(hdev))
2110                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2111                                        MGMT_STATUS_NOT_SUPPORTED);
2112
2113         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2115                                        MGMT_STATUS_REJECTED);
2116
2117         if (cp->val != 0x00 && cp->val != 0x01)
2118                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2119                                        MGMT_STATUS_INVALID_PARAMS);
2120
2121         hci_dev_lock(hdev);
2122
2123         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2124                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2125                                       MGMT_STATUS_BUSY);
2126                 goto unlock;
2127         }
2128
2129         if (cp->val) {
2130                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2131         } else {
2132                 if (hdev_is_powered(hdev)) {
2133                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2134                                               MGMT_STATUS_REJECTED);
2135                         goto unlock;
2136                 }
2137
2138                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2139         }
2140
2141         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2142         if (err < 0)
2143                 goto unlock;
2144
2145         if (changed)
2146                 err = new_settings(hdev, sk);
2147
2148 unlock:
2149         hci_dev_unlock(hdev);
2150         return err;
2151 }
2152
2153 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2154 {
2155         struct cmd_lookup match = { NULL, hdev };
2156
2157         hci_dev_lock(hdev);
2158
2159         if (status) {
2160                 u8 mgmt_err = mgmt_status(status);
2161
2162                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2163                                      &mgmt_err);
2164                 goto unlock;
2165         }
2166
2167         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2168
2169         new_settings(hdev, match.sk);
2170
2171         if (match.sk)
2172                 sock_put(match.sk);
2173
2174         /* Make sure the controller has a good default for
2175          * advertising data. Restrict the update to when LE
2176          * has actually been enabled. During power on, the
2177          * update in powered_update_hci will take care of it.
2178          */
2179         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2180                 struct hci_request req;
2181
2182                 hci_req_init(&req, hdev);
2183                 update_adv_data(&req);
2184                 update_scan_rsp_data(&req);
2185                 __hci_update_background_scan(&req);
2186                 hci_req_run(&req, NULL);
2187         }
2188
2189 unlock:
2190         hci_dev_unlock(hdev);
2191 }
2192
2193 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2194 {
2195         struct mgmt_mode *cp = data;
2196         struct hci_cp_write_le_host_supported hci_cp;
2197         struct mgmt_pending_cmd *cmd;
2198         struct hci_request req;
2199         int err;
2200         u8 val, enabled;
2201
2202         BT_DBG("request for %s", hdev->name);
2203
2204         if (!lmp_le_capable(hdev))
2205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2206                                        MGMT_STATUS_NOT_SUPPORTED);
2207
2208         if (cp->val != 0x00 && cp->val != 0x01)
2209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2210                                        MGMT_STATUS_INVALID_PARAMS);
2211
2212         /* LE-only devices do not allow toggling LE on/off */
2213         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2214                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2215                                        MGMT_STATUS_REJECTED);
2216
2217         hci_dev_lock(hdev);
2218
2219         val = !!cp->val;
2220         enabled = lmp_host_le_capable(hdev);
2221
2222         if (!hdev_is_powered(hdev) || val == enabled) {
2223                 bool changed = false;
2224
2225                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2226                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2227                         changed = true;
2228                 }
2229
2230                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2231                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2232                         changed = true;
2233                 }
2234
2235                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2236                 if (err < 0)
2237                         goto unlock;
2238
2239                 if (changed)
2240                         err = new_settings(hdev, sk);
2241
2242                 goto unlock;
2243         }
2244
2245         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2246             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2247                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2248                                       MGMT_STATUS_BUSY);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         hci_req_init(&req, hdev);
2259
2260         memset(&hci_cp, 0, sizeof(hci_cp));
2261
2262         if (val) {
2263                 hci_cp.le = val;
2264                 hci_cp.simul = 0x00;
2265         } else {
2266                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2267                         disable_advertising(&req);
2268         }
2269
2270         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2271                     &hci_cp);
2272
2273         err = hci_req_run(&req, le_enable_complete);
2274         if (err < 0)
2275                 mgmt_pending_remove(cmd);
2276
2277 unlock:
2278         hci_dev_unlock(hdev);
2279         return err;
2280 }
2281
2282 /* This is a helper function to test for pending mgmt commands that can
2283  * cause CoD or EIR HCI commands. We can only allow one such pending
2284  * mgmt command at a time since otherwise we cannot easily track what
2285  * the current values are, will be, and based on that calculate if a new
2286  * HCI command needs to be sent and if yes with what value.
2287  */
2288 static bool pending_eir_or_class(struct hci_dev *hdev)
2289 {
2290         struct mgmt_pending_cmd *cmd;
2291
2292         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2293                 switch (cmd->opcode) {
2294                 case MGMT_OP_ADD_UUID:
2295                 case MGMT_OP_REMOVE_UUID:
2296                 case MGMT_OP_SET_DEV_CLASS:
2297                 case MGMT_OP_SET_POWERED:
2298                         return true;
2299                 }
2300         }
2301
2302         return false;
2303 }
2304
2305 static const u8 bluetooth_base_uuid[] = {
2306                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2307                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2308 };
2309
2310 static u8 get_uuid_size(const u8 *uuid)
2311 {
2312         u32 val;
2313
2314         if (memcmp(uuid, bluetooth_base_uuid, 12))
2315                 return 128;
2316
2317         val = get_unaligned_le32(&uuid[12]);
2318         if (val > 0xffff)
2319                 return 32;
2320
2321         return 16;
2322 }
2323
2324 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2325 {
2326         struct mgmt_pending_cmd *cmd;
2327
2328         hci_dev_lock(hdev);
2329
2330         cmd = pending_find(mgmt_op, hdev);
2331         if (!cmd)
2332                 goto unlock;
2333
2334         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2335                           mgmt_status(status), hdev->dev_class, 3);
2336
2337         mgmt_pending_remove(cmd);
2338
2339 unlock:
2340         hci_dev_unlock(hdev);
2341 }
2342
2343 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2344 {
2345         BT_DBG("status 0x%02x", status);
2346
2347         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2348 }
2349
2350 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2351 {
2352         struct mgmt_cp_add_uuid *cp = data;
2353         struct mgmt_pending_cmd *cmd;
2354         struct hci_request req;
2355         struct bt_uuid *uuid;
2356         int err;
2357
2358         BT_DBG("request for %s", hdev->name);
2359
2360         hci_dev_lock(hdev);
2361
2362         if (pending_eir_or_class(hdev)) {
2363                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2364                                       MGMT_STATUS_BUSY);
2365                 goto failed;
2366         }
2367
2368         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2369         if (!uuid) {
2370                 err = -ENOMEM;
2371                 goto failed;
2372         }
2373
2374         memcpy(uuid->uuid, cp->uuid, 16);
2375         uuid->svc_hint = cp->svc_hint;
2376         uuid->size = get_uuid_size(cp->uuid);
2377
2378         list_add_tail(&uuid->list, &hdev->uuids);
2379
2380         hci_req_init(&req, hdev);
2381
2382         update_class(&req);
2383         update_eir(&req);
2384
2385         err = hci_req_run(&req, add_uuid_complete);
2386         if (err < 0) {
2387                 if (err != -ENODATA)
2388                         goto failed;
2389
2390                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2391                                         hdev->dev_class, 3);
2392                 goto failed;
2393         }
2394
2395         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2396         if (!cmd) {
2397                 err = -ENOMEM;
2398                 goto failed;
2399         }
2400
2401         err = 0;
2402
2403 failed:
2404         hci_dev_unlock(hdev);
2405         return err;
2406 }
2407
2408 static bool enable_service_cache(struct hci_dev *hdev)
2409 {
2410         if (!hdev_is_powered(hdev))
2411                 return false;
2412
2413         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2414                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2415                                    CACHE_TIMEOUT);
2416                 return true;
2417         }
2418
2419         return false;
2420 }
2421
2422 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2423 {
2424         BT_DBG("status 0x%02x", status);
2425
2426         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2427 }
2428
2429 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2430                        u16 len)
2431 {
2432         struct mgmt_cp_remove_uuid *cp = data;
2433         struct mgmt_pending_cmd *cmd;
2434         struct bt_uuid *match, *tmp;
2435         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2436         struct hci_request req;
2437         int err, found;
2438
2439         BT_DBG("request for %s", hdev->name);
2440
2441         hci_dev_lock(hdev);
2442
2443         if (pending_eir_or_class(hdev)) {
2444                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2445                                       MGMT_STATUS_BUSY);
2446                 goto unlock;
2447         }
2448
2449         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2450                 hci_uuids_clear(hdev);
2451
2452                 if (enable_service_cache(hdev)) {
2453                         err = mgmt_cmd_complete(sk, hdev->id,
2454                                                 MGMT_OP_REMOVE_UUID,
2455                                                 0, hdev->dev_class, 3);
2456                         goto unlock;
2457                 }
2458
2459                 goto update_class;
2460         }
2461
2462         found = 0;
2463
2464         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2465                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2466                         continue;
2467
2468                 list_del(&match->list);
2469                 kfree(match);
2470                 found++;
2471         }
2472
2473         if (found == 0) {
2474                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2475                                       MGMT_STATUS_INVALID_PARAMS);
2476                 goto unlock;
2477         }
2478
2479 update_class:
2480         hci_req_init(&req, hdev);
2481
2482         update_class(&req);
2483         update_eir(&req);
2484
2485         err = hci_req_run(&req, remove_uuid_complete);
2486         if (err < 0) {
2487                 if (err != -ENODATA)
2488                         goto unlock;
2489
2490                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2491                                         hdev->dev_class, 3);
2492                 goto unlock;
2493         }
2494
2495         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2496         if (!cmd) {
2497                 err = -ENOMEM;
2498                 goto unlock;
2499         }
2500
2501         err = 0;
2502
2503 unlock:
2504         hci_dev_unlock(hdev);
2505         return err;
2506 }
2507
2508 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2509 {
2510         BT_DBG("status 0x%02x", status);
2511
2512         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2513 }
2514
2515 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2516                          u16 len)
2517 {
2518         struct mgmt_cp_set_dev_class *cp = data;
2519         struct mgmt_pending_cmd *cmd;
2520         struct hci_request req;
2521         int err;
2522
2523         BT_DBG("request for %s", hdev->name);
2524
2525         if (!lmp_bredr_capable(hdev))
2526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2527                                        MGMT_STATUS_NOT_SUPPORTED);
2528
2529         hci_dev_lock(hdev);
2530
2531         if (pending_eir_or_class(hdev)) {
2532                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2533                                       MGMT_STATUS_BUSY);
2534                 goto unlock;
2535         }
2536
2537         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2538                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2539                                       MGMT_STATUS_INVALID_PARAMS);
2540                 goto unlock;
2541         }
2542
2543         hdev->major_class = cp->major;
2544         hdev->minor_class = cp->minor;
2545
2546         if (!hdev_is_powered(hdev)) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2548                                         hdev->dev_class, 3);
2549                 goto unlock;
2550         }
2551
2552         hci_req_init(&req, hdev);
2553
2554         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2555                 hci_dev_unlock(hdev);
2556                 cancel_delayed_work_sync(&hdev->service_cache);
2557                 hci_dev_lock(hdev);
2558                 update_eir(&req);
2559         }
2560
2561         update_class(&req);
2562
2563         err = hci_req_run(&req, set_class_complete);
2564         if (err < 0) {
2565                 if (err != -ENODATA)
2566                         goto unlock;
2567
2568                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2569                                         hdev->dev_class, 3);
2570                 goto unlock;
2571         }
2572
2573         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2574         if (!cmd) {
2575                 err = -ENOMEM;
2576                 goto unlock;
2577         }
2578
2579         err = 0;
2580
2581 unlock:
2582         hci_dev_unlock(hdev);
2583         return err;
2584 }
2585
2586 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2587                           u16 len)
2588 {
2589         struct mgmt_cp_load_link_keys *cp = data;
2590         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2591                                    sizeof(struct mgmt_link_key_info));
2592         u16 key_count, expected_len;
2593         bool changed;
2594         int i;
2595
2596         BT_DBG("request for %s", hdev->name);
2597
2598         if (!lmp_bredr_capable(hdev))
2599                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2600                                        MGMT_STATUS_NOT_SUPPORTED);
2601
2602         key_count = __le16_to_cpu(cp->key_count);
2603         if (key_count > max_key_count) {
2604                 BT_ERR("load_link_keys: too big key_count value %u",
2605                        key_count);
2606                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2607                                        MGMT_STATUS_INVALID_PARAMS);
2608         }
2609
2610         expected_len = sizeof(*cp) + key_count *
2611                                         sizeof(struct mgmt_link_key_info);
2612         if (expected_len != len) {
2613                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2614                        expected_len, len);
2615                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2616                                        MGMT_STATUS_INVALID_PARAMS);
2617         }
2618
2619         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2620                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2621                                        MGMT_STATUS_INVALID_PARAMS);
2622
2623         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2624                key_count);
2625
2626         for (i = 0; i < key_count; i++) {
2627                 struct mgmt_link_key_info *key = &cp->keys[i];
2628
2629                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2630                         return mgmt_cmd_status(sk, hdev->id,
2631                                                MGMT_OP_LOAD_LINK_KEYS,
2632                                                MGMT_STATUS_INVALID_PARAMS);
2633         }
2634
2635         hci_dev_lock(hdev);
2636
2637         hci_link_keys_clear(hdev);
2638
2639         if (cp->debug_keys)
2640                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2641         else
2642                 changed = hci_dev_test_and_clear_flag(hdev,
2643                                                       HCI_KEEP_DEBUG_KEYS);
2644
2645         if (changed)
2646                 new_settings(hdev, NULL);
2647
2648         for (i = 0; i < key_count; i++) {
2649                 struct mgmt_link_key_info *key = &cp->keys[i];
2650
2651                 /* Always ignore debug keys and require a new pairing if
2652                  * the user wants to use them.
2653                  */
2654                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2655                         continue;
2656
2657                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2658                                  key->type, key->pin_len, NULL);
2659         }
2660
2661         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2662
2663         hci_dev_unlock(hdev);
2664
2665         return 0;
2666 }
2667
2668 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2669                            u8 addr_type, struct sock *skip_sk)
2670 {
2671         struct mgmt_ev_device_unpaired ev;
2672
2673         bacpy(&ev.addr.bdaddr, bdaddr);
2674         ev.addr.type = addr_type;
2675
2676         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2677                           skip_sk);
2678 }
2679
2680 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2681                          u16 len)
2682 {
2683         struct mgmt_cp_unpair_device *cp = data;
2684         struct mgmt_rp_unpair_device rp;
2685         struct hci_cp_disconnect dc;
2686         struct mgmt_pending_cmd *cmd;
2687         struct hci_conn *conn;
2688         int err;
2689
2690         memset(&rp, 0, sizeof(rp));
2691         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2692         rp.addr.type = cp->addr.type;
2693
2694         if (!bdaddr_type_is_valid(cp->addr.type))
2695                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2696                                          MGMT_STATUS_INVALID_PARAMS,
2697                                          &rp, sizeof(rp));
2698
2699         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2700                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2701                                          MGMT_STATUS_INVALID_PARAMS,
2702                                          &rp, sizeof(rp));
2703
2704         hci_dev_lock(hdev);
2705
2706         if (!hdev_is_powered(hdev)) {
2707                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2708                                         MGMT_STATUS_NOT_POWERED, &rp,
2709                                         sizeof(rp));
2710                 goto unlock;
2711         }
2712
2713         if (cp->addr.type == BDADDR_BREDR) {
2714                 /* If disconnection is requested, then look up the
2715                  * connection. If the remote device is connected, it
2716                  * will be later used to terminate the link.
2717                  *
2718                  * Setting it to NULL explicitly will cause no
2719                  * termination of the link.
2720                  */
2721                 if (cp->disconnect)
2722                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2723                                                        &cp->addr.bdaddr);
2724                 else
2725                         conn = NULL;
2726
2727                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2728         } else {
2729                 u8 addr_type;
2730
2731                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2732                                                &cp->addr.bdaddr);
2733                 if (conn) {
2734                         /* Defer clearing up the connection parameters
2735                          * until closing to give a chance of keeping
2736                          * them if a repairing happens.
2737                          */
2738                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2739
2740                         /* If disconnection is not requested, then
2741                          * clear the connection variable so that the
2742                          * link is not terminated.
2743                          */
2744                         if (!cp->disconnect)
2745                                 conn = NULL;
2746                 }
2747
2748                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2749                         addr_type = ADDR_LE_DEV_PUBLIC;
2750                 else
2751                         addr_type = ADDR_LE_DEV_RANDOM;
2752
2753                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2754
2755                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2756         }
2757
2758         if (err < 0) {
2759                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2760                                         MGMT_STATUS_NOT_PAIRED, &rp,
2761                                         sizeof(rp));
2762                 goto unlock;
2763         }
2764
2765         /* If the connection variable is set, then termination of the
2766          * link is requested.
2767          */
2768         if (!conn) {
2769                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2770                                         &rp, sizeof(rp));
2771                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2772                 goto unlock;
2773         }
2774
2775         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2776                                sizeof(*cp));
2777         if (!cmd) {
2778                 err = -ENOMEM;
2779                 goto unlock;
2780         }
2781
2782         cmd->cmd_complete = addr_cmd_complete;
2783
2784         dc.handle = cpu_to_le16(conn->handle);
2785         dc.reason = 0x13; /* Remote User Terminated Connection */
2786         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2787         if (err < 0)
2788                 mgmt_pending_remove(cmd);
2789
2790 unlock:
2791         hci_dev_unlock(hdev);
2792         return err;
2793 }
2794
2795 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2796                       u16 len)
2797 {
2798         struct mgmt_cp_disconnect *cp = data;
2799         struct mgmt_rp_disconnect rp;
2800         struct mgmt_pending_cmd *cmd;
2801         struct hci_conn *conn;
2802         int err;
2803
2804         BT_DBG("");
2805
2806         memset(&rp, 0, sizeof(rp));
2807         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2808         rp.addr.type = cp->addr.type;
2809
2810         if (!bdaddr_type_is_valid(cp->addr.type))
2811                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2812                                          MGMT_STATUS_INVALID_PARAMS,
2813                                          &rp, sizeof(rp));
2814
2815         hci_dev_lock(hdev);
2816
2817         if (!test_bit(HCI_UP, &hdev->flags)) {
2818                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2819                                         MGMT_STATUS_NOT_POWERED, &rp,
2820                                         sizeof(rp));
2821                 goto failed;
2822         }
2823
2824         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2825                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2826                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2827                 goto failed;
2828         }
2829
2830         if (cp->addr.type == BDADDR_BREDR)
2831                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2832                                                &cp->addr.bdaddr);
2833         else
2834                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2835
2836         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2837                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2838                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2839                                         sizeof(rp));
2840                 goto failed;
2841         }
2842
2843         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2844         if (!cmd) {
2845                 err = -ENOMEM;
2846                 goto failed;
2847         }
2848
2849         cmd->cmd_complete = generic_cmd_complete;
2850
2851         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2852         if (err < 0)
2853                 mgmt_pending_remove(cmd);
2854
2855 failed:
2856         hci_dev_unlock(hdev);
2857         return err;
2858 }
2859
2860 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2861 {
2862         switch (link_type) {
2863         case LE_LINK:
2864                 switch (addr_type) {
2865                 case ADDR_LE_DEV_PUBLIC:
2866                         return BDADDR_LE_PUBLIC;
2867
2868                 default:
2869                         /* Fallback to LE Random address type */
2870                         return BDADDR_LE_RANDOM;
2871                 }
2872
2873         default:
2874                 /* Fallback to BR/EDR type */
2875                 return BDADDR_BREDR;
2876         }
2877 }
2878
2879 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2880                            u16 data_len)
2881 {
2882         struct mgmt_rp_get_connections *rp;
2883         struct hci_conn *c;
2884         size_t rp_len;
2885         int err;
2886         u16 i;
2887
2888         BT_DBG("");
2889
2890         hci_dev_lock(hdev);
2891
2892         if (!hdev_is_powered(hdev)) {
2893                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2894                                       MGMT_STATUS_NOT_POWERED);
2895                 goto unlock;
2896         }
2897
2898         i = 0;
2899         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2900                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2901                         i++;
2902         }
2903
2904         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2905         rp = kmalloc(rp_len, GFP_KERNEL);
2906         if (!rp) {
2907                 err = -ENOMEM;
2908                 goto unlock;
2909         }
2910
2911         i = 0;
2912         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2913                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2914                         continue;
2915                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2916                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2917                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2918                         continue;
2919                 i++;
2920         }
2921
2922         rp->conn_count = cpu_to_le16(i);
2923
2924         /* Recalculate length in case of filtered SCO connections, etc */
2925         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2926
2927         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2928                                 rp_len);
2929
2930         kfree(rp);
2931
2932 unlock:
2933         hci_dev_unlock(hdev);
2934         return err;
2935 }
2936
2937 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2938                                    struct mgmt_cp_pin_code_neg_reply *cp)
2939 {
2940         struct mgmt_pending_cmd *cmd;
2941         int err;
2942
2943         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2944                                sizeof(*cp));
2945         if (!cmd)
2946                 return -ENOMEM;
2947
2948         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2949                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2950         if (err < 0)
2951                 mgmt_pending_remove(cmd);
2952
2953         return err;
2954 }
2955
2956 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2957                           u16 len)
2958 {
2959         struct hci_conn *conn;
2960         struct mgmt_cp_pin_code_reply *cp = data;
2961         struct hci_cp_pin_code_reply reply;
2962         struct mgmt_pending_cmd *cmd;
2963         int err;
2964
2965         BT_DBG("");
2966
2967         hci_dev_lock(hdev);
2968
2969         if (!hdev_is_powered(hdev)) {
2970                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2971                                       MGMT_STATUS_NOT_POWERED);
2972                 goto failed;
2973         }
2974
2975         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2976         if (!conn) {
2977                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2978                                       MGMT_STATUS_NOT_CONNECTED);
2979                 goto failed;
2980         }
2981
2982         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2983                 struct mgmt_cp_pin_code_neg_reply ncp;
2984
2985                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2986
2987                 BT_ERR("PIN code is not 16 bytes long");
2988
2989                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2990                 if (err >= 0)
2991                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2992                                               MGMT_STATUS_INVALID_PARAMS);
2993
2994                 goto failed;
2995         }
2996
2997         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2998         if (!cmd) {
2999                 err = -ENOMEM;
3000                 goto failed;
3001         }
3002
3003         cmd->cmd_complete = addr_cmd_complete;
3004
3005         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3006         reply.pin_len = cp->pin_len;
3007         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3008
3009         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3010         if (err < 0)
3011                 mgmt_pending_remove(cmd);
3012
3013 failed:
3014         hci_dev_unlock(hdev);
3015         return err;
3016 }
3017
3018 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3019                              u16 len)
3020 {
3021         struct mgmt_cp_set_io_capability *cp = data;
3022
3023         BT_DBG("");
3024
3025         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3026                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3027                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3028
3029         hci_dev_lock(hdev);
3030
3031         hdev->io_capability = cp->io_capability;
3032
3033         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3034                hdev->io_capability);
3035
3036         hci_dev_unlock(hdev);
3037
3038         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3039                                  NULL, 0);
3040 }
3041
3042 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3043 {
3044         struct hci_dev *hdev = conn->hdev;
3045         struct mgmt_pending_cmd *cmd;
3046
3047         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3048                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3049                         continue;
3050
3051                 if (cmd->user_data != conn)
3052                         continue;
3053
3054                 return cmd;
3055         }
3056
3057         return NULL;
3058 }
3059
3060 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3061 {
3062         struct mgmt_rp_pair_device rp;
3063         struct hci_conn *conn = cmd->user_data;
3064         int err;
3065
3066         bacpy(&rp.addr.bdaddr, &conn->dst);
3067         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3068
3069         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3070                                 status, &rp, sizeof(rp));
3071
3072         /* So we don't get further callbacks for this connection */
3073         conn->connect_cfm_cb = NULL;
3074         conn->security_cfm_cb = NULL;
3075         conn->disconn_cfm_cb = NULL;
3076
3077         hci_conn_drop(conn);
3078
3079         /* The device is paired so there is no need to remove
3080          * its connection parameters anymore.
3081          */
3082         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3083
3084         hci_conn_put(conn);
3085
3086         return err;
3087 }
3088
3089 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3090 {
3091         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3092         struct mgmt_pending_cmd *cmd;
3093
3094         cmd = find_pairing(conn);
3095         if (cmd) {
3096                 cmd->cmd_complete(cmd, status);
3097                 mgmt_pending_remove(cmd);
3098         }
3099 }
3100
3101 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104
3105         BT_DBG("status %u", status);
3106
3107         cmd = find_pairing(conn);
3108         if (!cmd) {
3109                 BT_DBG("Unable to find a pending command");
3110                 return;
3111         }
3112
3113         cmd->cmd_complete(cmd, mgmt_status(status));
3114         mgmt_pending_remove(cmd);
3115 }
3116
3117 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3118 {
3119         struct mgmt_pending_cmd *cmd;
3120
3121         BT_DBG("status %u", status);
3122
3123         if (!status)
3124                 return;
3125
3126         cmd = find_pairing(conn);
3127         if (!cmd) {
3128                 BT_DBG("Unable to find a pending command");
3129                 return;
3130         }
3131
3132         cmd->cmd_complete(cmd, mgmt_status(status));
3133         mgmt_pending_remove(cmd);
3134 }
3135
3136 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3137                        u16 len)
3138 {
3139         struct mgmt_cp_pair_device *cp = data;
3140         struct mgmt_rp_pair_device rp;
3141         struct mgmt_pending_cmd *cmd;
3142         u8 sec_level, auth_type;
3143         struct hci_conn *conn;
3144         int err;
3145
3146         BT_DBG("");
3147
3148         memset(&rp, 0, sizeof(rp));
3149         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3150         rp.addr.type = cp->addr.type;
3151
3152         if (!bdaddr_type_is_valid(cp->addr.type))
3153                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3154                                          MGMT_STATUS_INVALID_PARAMS,
3155                                          &rp, sizeof(rp));
3156
3157         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3158                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3159                                          MGMT_STATUS_INVALID_PARAMS,
3160                                          &rp, sizeof(rp));
3161
3162         hci_dev_lock(hdev);
3163
3164         if (!hdev_is_powered(hdev)) {
3165                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3166                                         MGMT_STATUS_NOT_POWERED, &rp,
3167                                         sizeof(rp));
3168                 goto unlock;
3169         }
3170
3171         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3172                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3173                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3174                                         sizeof(rp));
3175                 goto unlock;
3176         }
3177
3178         sec_level = BT_SECURITY_MEDIUM;
3179         auth_type = HCI_AT_DEDICATED_BONDING;
3180
3181         if (cp->addr.type == BDADDR_BREDR) {
3182                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3183                                        auth_type);
3184         } else {
3185                 u8 addr_type;
3186
3187                 /* Convert from L2CAP channel address type to HCI address type
3188                  */
3189                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3190                         addr_type = ADDR_LE_DEV_PUBLIC;
3191                 else
3192                         addr_type = ADDR_LE_DEV_RANDOM;
3193
3194                 /* When pairing a new device, it is expected to remember
3195                  * this device for future connections. Adding the connection
3196                  * parameter information ahead of time allows tracking
3197                  * of the slave preferred values and will speed up any
3198                  * further connection establishment.
3199                  *
3200                  * If connection parameters already exist, then they
3201                  * will be kept and this function does nothing.
3202                  */
3203                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3204
3205                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3206                                       sec_level, HCI_LE_CONN_TIMEOUT,
3207                                       HCI_ROLE_MASTER);
3208         }
3209
3210         if (IS_ERR(conn)) {
3211                 int status;
3212
3213                 if (PTR_ERR(conn) == -EBUSY)
3214                         status = MGMT_STATUS_BUSY;
3215                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3216                         status = MGMT_STATUS_NOT_SUPPORTED;
3217                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3218                         status = MGMT_STATUS_REJECTED;
3219                 else
3220                         status = MGMT_STATUS_CONNECT_FAILED;
3221
3222                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3223                                         status, &rp, sizeof(rp));
3224                 goto unlock;
3225         }
3226
3227         if (conn->connect_cfm_cb) {
3228                 hci_conn_drop(conn);
3229                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3230                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3231                 goto unlock;
3232         }
3233
3234         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3235         if (!cmd) {
3236                 err = -ENOMEM;
3237                 hci_conn_drop(conn);
3238                 goto unlock;
3239         }
3240
3241         cmd->cmd_complete = pairing_complete;
3242
3243         /* For LE, just connecting isn't a proof that the pairing finished */
3244         if (cp->addr.type == BDADDR_BREDR) {
3245                 conn->connect_cfm_cb = pairing_complete_cb;
3246                 conn->security_cfm_cb = pairing_complete_cb;
3247                 conn->disconn_cfm_cb = pairing_complete_cb;
3248         } else {
3249                 conn->connect_cfm_cb = le_pairing_complete_cb;
3250                 conn->security_cfm_cb = le_pairing_complete_cb;
3251                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3252         }
3253
3254         conn->io_capability = cp->io_cap;
3255         cmd->user_data = hci_conn_get(conn);
3256
3257         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3258             hci_conn_security(conn, sec_level, auth_type, true)) {
3259                 cmd->cmd_complete(cmd, 0);
3260                 mgmt_pending_remove(cmd);
3261         }
3262
3263         err = 0;
3264
3265 unlock:
3266         hci_dev_unlock(hdev);
3267         return err;
3268 }
3269
3270 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3271                               u16 len)
3272 {
3273         struct mgmt_addr_info *addr = data;
3274         struct mgmt_pending_cmd *cmd;
3275         struct hci_conn *conn;
3276         int err;
3277
3278         BT_DBG("");
3279
3280         hci_dev_lock(hdev);
3281
3282         if (!hdev_is_powered(hdev)) {
3283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3284                                       MGMT_STATUS_NOT_POWERED);
3285                 goto unlock;
3286         }
3287
3288         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3289         if (!cmd) {
3290                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3291                                       MGMT_STATUS_INVALID_PARAMS);
3292                 goto unlock;
3293         }
3294
3295         conn = cmd->user_data;
3296
3297         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3298                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3299                                       MGMT_STATUS_INVALID_PARAMS);
3300                 goto unlock;
3301         }
3302
3303         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3304         mgmt_pending_remove(cmd);
3305
3306         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3307                                 addr, sizeof(*addr));
3308 unlock:
3309         hci_dev_unlock(hdev);
3310         return err;
3311 }
3312
3313 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3314                              struct mgmt_addr_info *addr, u16 mgmt_op,
3315                              u16 hci_op, __le32 passkey)
3316 {
3317         struct mgmt_pending_cmd *cmd;
3318         struct hci_conn *conn;
3319         int err;
3320
3321         hci_dev_lock(hdev);
3322
3323         if (!hdev_is_powered(hdev)) {
3324                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3325                                         MGMT_STATUS_NOT_POWERED, addr,
3326                                         sizeof(*addr));
3327                 goto done;
3328         }
3329
3330         if (addr->type == BDADDR_BREDR)
3331                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3332         else
3333                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3334
3335         if (!conn) {
3336                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3337                                         MGMT_STATUS_NOT_CONNECTED, addr,
3338                                         sizeof(*addr));
3339                 goto done;
3340         }
3341
3342         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3343                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3344                 if (!err)
3345                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3346                                                 MGMT_STATUS_SUCCESS, addr,
3347                                                 sizeof(*addr));
3348                 else
3349                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3350                                                 MGMT_STATUS_FAILED, addr,
3351                                                 sizeof(*addr));
3352
3353                 goto done;
3354         }
3355
3356         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3357         if (!cmd) {
3358                 err = -ENOMEM;
3359                 goto done;
3360         }
3361
3362         cmd->cmd_complete = addr_cmd_complete;
3363
3364         /* Continue with pairing via HCI */
3365         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3366                 struct hci_cp_user_passkey_reply cp;
3367
3368                 bacpy(&cp.bdaddr, &addr->bdaddr);
3369                 cp.passkey = passkey;
3370                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3371         } else
3372                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3373                                    &addr->bdaddr);
3374
3375         if (err < 0)
3376                 mgmt_pending_remove(cmd);
3377
3378 done:
3379         hci_dev_unlock(hdev);
3380         return err;
3381 }
3382
3383 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3384                               void *data, u16 len)
3385 {
3386         struct mgmt_cp_pin_code_neg_reply *cp = data;
3387
3388         BT_DBG("");
3389
3390         return user_pairing_resp(sk, hdev, &cp->addr,
3391                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3392                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3393 }
3394
3395 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3396                               u16 len)
3397 {
3398         struct mgmt_cp_user_confirm_reply *cp = data;
3399
3400         BT_DBG("");
3401
3402         if (len != sizeof(*cp))
3403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3404                                        MGMT_STATUS_INVALID_PARAMS);
3405
3406         return user_pairing_resp(sk, hdev, &cp->addr,
3407                                  MGMT_OP_USER_CONFIRM_REPLY,
3408                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3409 }
3410
3411 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3412                                   void *data, u16 len)
3413 {
3414         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3415
3416         BT_DBG("");
3417
3418         return user_pairing_resp(sk, hdev, &cp->addr,
3419                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3420                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3421 }
3422
3423 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3424                               u16 len)
3425 {
3426         struct mgmt_cp_user_passkey_reply *cp = data;
3427
3428         BT_DBG("");
3429
3430         return user_pairing_resp(sk, hdev, &cp->addr,
3431                                  MGMT_OP_USER_PASSKEY_REPLY,
3432                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3433 }
3434
3435 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3436                                   void *data, u16 len)
3437 {
3438         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3439
3440         BT_DBG("");
3441
3442         return user_pairing_resp(sk, hdev, &cp->addr,
3443                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3444                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3445 }
3446
3447 static void update_name(struct hci_request *req)
3448 {
3449         struct hci_dev *hdev = req->hdev;
3450         struct hci_cp_write_local_name cp;
3451
3452         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3453
3454         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3455 }
3456
3457 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3458 {
3459         struct mgmt_cp_set_local_name *cp;
3460         struct mgmt_pending_cmd *cmd;
3461
3462         BT_DBG("status 0x%02x", status);
3463
3464         hci_dev_lock(hdev);
3465
3466         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3467         if (!cmd)
3468                 goto unlock;
3469
3470         cp = cmd->param;
3471
3472         if (status)
3473                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3474                                 mgmt_status(status));
3475         else
3476                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3477                                   cp, sizeof(*cp));
3478
3479         mgmt_pending_remove(cmd);
3480
3481 unlock:
3482         hci_dev_unlock(hdev);
3483 }
3484
3485 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3486                           u16 len)
3487 {
3488         struct mgmt_cp_set_local_name *cp = data;
3489         struct mgmt_pending_cmd *cmd;
3490         struct hci_request req;
3491         int err;
3492
3493         BT_DBG("");
3494
3495         hci_dev_lock(hdev);
3496
3497         /* If the old values are the same as the new ones just return a
3498          * direct command complete event.
3499          */
3500         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3501             !memcmp(hdev->short_name, cp->short_name,
3502                     sizeof(hdev->short_name))) {
3503                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3504                                         data, len);
3505                 goto failed;
3506         }
3507
3508         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3509
3510         if (!hdev_is_powered(hdev)) {
3511                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3512
3513                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3514                                         data, len);
3515                 if (err < 0)
3516                         goto failed;
3517
3518                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3519                                          data, len, sk);
3520
3521                 goto failed;
3522         }
3523
3524         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3525         if (!cmd) {
3526                 err = -ENOMEM;
3527                 goto failed;
3528         }
3529
3530         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3531
3532         hci_req_init(&req, hdev);
3533
3534         if (lmp_bredr_capable(hdev)) {
3535                 update_name(&req);
3536                 update_eir(&req);
3537         }
3538
3539         /* The name is stored in the scan response data and so
3540          * no need to udpate the advertising data here.
3541          */
3542         if (lmp_le_capable(hdev))
3543                 update_scan_rsp_data(&req);
3544
3545         err = hci_req_run(&req, set_name_complete);
3546         if (err < 0)
3547                 mgmt_pending_remove(cmd);
3548
3549 failed:
3550         hci_dev_unlock(hdev);
3551         return err;
3552 }
3553
3554 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3555                                void *data, u16 data_len)
3556 {
3557         struct mgmt_pending_cmd *cmd;
3558         int err;
3559
3560         BT_DBG("%s", hdev->name);
3561
3562         hci_dev_lock(hdev);
3563
3564         if (!hdev_is_powered(hdev)) {
3565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3566                                       MGMT_STATUS_NOT_POWERED);
3567                 goto unlock;
3568         }
3569
3570         if (!lmp_ssp_capable(hdev)) {
3571                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3572                                       MGMT_STATUS_NOT_SUPPORTED);
3573                 goto unlock;
3574         }
3575
3576         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3577                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3578                                       MGMT_STATUS_BUSY);
3579                 goto unlock;
3580         }
3581
3582         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3583         if (!cmd) {
3584                 err = -ENOMEM;
3585                 goto unlock;
3586         }
3587
3588         if (bredr_sc_enabled(hdev))
3589                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3590                                    0, NULL);
3591         else
3592                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3593
3594         if (err < 0)
3595                 mgmt_pending_remove(cmd);
3596
3597 unlock:
3598         hci_dev_unlock(hdev);
3599         return err;
3600 }
3601
3602 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3603                                void *data, u16 len)
3604 {
3605         struct mgmt_addr_info *addr = data;
3606         int err;
3607
3608         BT_DBG("%s ", hdev->name);
3609
3610         if (!bdaddr_type_is_valid(addr->type))
3611                 return mgmt_cmd_complete(sk, hdev->id,
3612                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3613                                          MGMT_STATUS_INVALID_PARAMS,
3614                                          addr, sizeof(*addr));
3615
3616         hci_dev_lock(hdev);
3617
3618         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3619                 struct mgmt_cp_add_remote_oob_data *cp = data;
3620                 u8 status;
3621
3622                 if (cp->addr.type != BDADDR_BREDR) {
3623                         err = mgmt_cmd_complete(sk, hdev->id,
3624                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3625                                                 MGMT_STATUS_INVALID_PARAMS,
3626                                                 &cp->addr, sizeof(cp->addr));
3627                         goto unlock;
3628                 }
3629
3630                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3631                                               cp->addr.type, cp->hash,
3632                                               cp->rand, NULL, NULL);
3633                 if (err < 0)
3634                         status = MGMT_STATUS_FAILED;
3635                 else
3636                         status = MGMT_STATUS_SUCCESS;
3637
3638                 err = mgmt_cmd_complete(sk, hdev->id,
3639                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3640                                         &cp->addr, sizeof(cp->addr));
3641         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3642                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3643                 u8 *rand192, *hash192, *rand256, *hash256;
3644                 u8 status;
3645
3646                 if (bdaddr_type_is_le(cp->addr.type)) {
3647                         /* Enforce zero-valued 192-bit parameters as
3648                          * long as legacy SMP OOB isn't implemented.
3649                          */
3650                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3651                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3652                                 err = mgmt_cmd_complete(sk, hdev->id,
3653                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3654                                                         MGMT_STATUS_INVALID_PARAMS,
3655                                                         addr, sizeof(*addr));
3656                                 goto unlock;
3657                         }
3658
3659                         rand192 = NULL;
3660                         hash192 = NULL;
3661                 } else {
3662                         /* In case one of the P-192 values is set to zero,
3663                          * then just disable OOB data for P-192.
3664                          */
3665                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3666                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3667                                 rand192 = NULL;
3668                                 hash192 = NULL;
3669                         } else {
3670                                 rand192 = cp->rand192;
3671                                 hash192 = cp->hash192;
3672                         }
3673                 }
3674
3675                 /* In case one of the P-256 values is set to zero, then just
3676                  * disable OOB data for P-256.
3677                  */
3678                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3679                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3680                         rand256 = NULL;
3681                         hash256 = NULL;
3682                 } else {
3683                         rand256 = cp->rand256;
3684                         hash256 = cp->hash256;
3685                 }
3686
3687                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3688                                               cp->addr.type, hash192, rand192,
3689                                               hash256, rand256);
3690                 if (err < 0)
3691                         status = MGMT_STATUS_FAILED;
3692                 else
3693                         status = MGMT_STATUS_SUCCESS;
3694
3695                 err = mgmt_cmd_complete(sk, hdev->id,
3696                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3697                                         status, &cp->addr, sizeof(cp->addr));
3698         } else {
3699                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3700                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3701                                       MGMT_STATUS_INVALID_PARAMS);
3702         }
3703
3704 unlock:
3705         hci_dev_unlock(hdev);
3706         return err;
3707 }
3708
3709 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3710                                   void *data, u16 len)
3711 {
3712         struct mgmt_cp_remove_remote_oob_data *cp = data;
3713         u8 status;
3714         int err;
3715
3716         BT_DBG("%s", hdev->name);
3717
3718         if (cp->addr.type != BDADDR_BREDR)
3719                 return mgmt_cmd_complete(sk, hdev->id,
3720                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3721                                          MGMT_STATUS_INVALID_PARAMS,
3722                                          &cp->addr, sizeof(cp->addr));
3723
3724         hci_dev_lock(hdev);
3725
3726         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3727                 hci_remote_oob_data_clear(hdev);
3728                 status = MGMT_STATUS_SUCCESS;
3729                 goto done;
3730         }
3731
3732         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3733         if (err < 0)
3734                 status = MGMT_STATUS_INVALID_PARAMS;
3735         else
3736                 status = MGMT_STATUS_SUCCESS;
3737
3738 done:
3739         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3740                                 status, &cp->addr, sizeof(cp->addr));
3741
3742         hci_dev_unlock(hdev);
3743         return err;
3744 }
3745
3746 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
3747 {
3748         struct hci_dev *hdev = req->hdev;
3749         struct hci_cp_inquiry cp;
3750         /* General inquiry access code (GIAC) */
3751         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3752
3753         *status = mgmt_bredr_support(hdev);
3754         if (*status)
3755                 return false;
3756
3757         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3758                 *status = MGMT_STATUS_BUSY;
3759                 return false;
3760         }
3761
3762         hci_inquiry_cache_flush(hdev);
3763
3764         memset(&cp, 0, sizeof(cp));
3765         memcpy(&cp.lap, lap, sizeof(cp.lap));
3766         cp.length = DISCOV_BREDR_INQUIRY_LEN;
3767
3768         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3769
3770         return true;
3771 }
3772
3773 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
3774 {
3775         struct hci_dev *hdev = req->hdev;
3776         struct hci_cp_le_set_scan_param param_cp;
3777         struct hci_cp_le_set_scan_enable enable_cp;
3778         u8 own_addr_type;
3779         int err;
3780
3781         *status = mgmt_le_support(hdev);
3782         if (*status)
3783                 return false;
3784
3785         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
3786                 /* Don't let discovery abort an outgoing connection attempt
3787                  * that's using directed advertising.
3788                  */
3789                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3790                         *status = MGMT_STATUS_REJECTED;
3791                         return false;
3792                 }
3793
3794                 disable_advertising(req);
3795         }
3796
3797         /* If controller is scanning, it means the background scanning is
3798          * running. Thus, we should temporarily stop it in order to set the
3799          * discovery scanning parameters.
3800          */
3801         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
3802                 hci_req_add_le_scan_disable(req);
3803
3804         /* All active scans will be done with either a resolvable private
3805          * address (when privacy feature has been enabled) or non-resolvable
3806          * private address.
3807          */
3808         err = hci_update_random_address(req, true, &own_addr_type);
3809         if (err < 0) {
3810                 *status = MGMT_STATUS_FAILED;
3811                 return false;
3812         }
3813
3814         memset(&param_cp, 0, sizeof(param_cp));
3815         param_cp.type = LE_SCAN_ACTIVE;
3816         param_cp.interval = cpu_to_le16(interval);
3817         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3818         param_cp.own_address_type = own_addr_type;
3819
3820         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3821                     &param_cp);
3822
3823         memset(&enable_cp, 0, sizeof(enable_cp));
3824         enable_cp.enable = LE_SCAN_ENABLE;
3825         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3826
3827         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3828                     &enable_cp);
3829
3830         return true;
3831 }
3832
3833 static bool trigger_discovery(struct hci_request *req, u8 *status)
3834 {
3835         struct hci_dev *hdev = req->hdev;
3836
3837         switch (hdev->discovery.type) {
3838         case DISCOV_TYPE_BREDR:
3839                 if (!trigger_bredr_inquiry(req, status))
3840                         return false;
3841                 break;
3842
3843         case DISCOV_TYPE_INTERLEAVED:
3844                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
3845                              &hdev->quirks)) {
3846                         /* During simultaneous discovery, we double LE scan
3847                          * interval. We must leave some time for the controller
3848                          * to do BR/EDR inquiry.
3849                          */
3850                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
3851                                              status))
3852                                 return false;
3853
3854                         if (!trigger_bredr_inquiry(req, status))
3855                                 return false;
3856
3857                         return true;
3858                 }
3859
3860                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
3861                         *status = MGMT_STATUS_NOT_SUPPORTED;
3862                         return false;
3863                 }
3864                 /* fall through */
3865
3866         case DISCOV_TYPE_LE:
3867                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
3868                         return false;
3869                 break;
3870
3871         default:
3872                 *status = MGMT_STATUS_INVALID_PARAMS;
3873                 return false;
3874         }
3875
3876         return true;
3877 }
3878
3879 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3880                                      u16 opcode)
3881 {
3882         struct mgmt_pending_cmd *cmd;
3883         unsigned long timeout;
3884
3885         BT_DBG("status %d", status);
3886
3887         hci_dev_lock(hdev);
3888
3889         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3890         if (!cmd)
3891                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3892
3893         if (cmd) {
3894                 cmd->cmd_complete(cmd, mgmt_status(status));
3895                 mgmt_pending_remove(cmd);
3896         }
3897
3898         if (status) {
3899                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3900                 goto unlock;
3901         }
3902
3903         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3904
3905         /* If the scan involves LE scan, pick proper timeout to schedule
3906          * hdev->le_scan_disable that will stop it.
3907          */
3908         switch (hdev->discovery.type) {
3909         case DISCOV_TYPE_LE:
3910                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3911                 break;
3912         case DISCOV_TYPE_INTERLEAVED:
3913                  /* When running simultaneous discovery, the LE scanning time
3914                  * should occupy the whole discovery time sine BR/EDR inquiry
3915                  * and LE scanning are scheduled by the controller.
3916                  *
3917                  * For interleaving discovery in comparison, BR/EDR inquiry
3918                  * and LE scanning are done sequentially with separate
3919                  * timeouts.
3920                  */
3921                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3922                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3923                 else
3924                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3925                 break;
3926         case DISCOV_TYPE_BREDR:
3927                 timeout = 0;
3928                 break;
3929         default:
3930                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3931                 timeout = 0;
3932                 break;
3933         }
3934
3935         if (timeout) {
3936                 /* When service discovery is used and the controller has
3937                  * a strict duplicate filter, it is important to remember
3938                  * the start and duration of the scan. This is required
3939                  * for restarting scanning during the discovery phase.
3940                  */
3941                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3942                              &hdev->quirks) &&
3943                     hdev->discovery.result_filtering) {
3944                         hdev->discovery.scan_start = jiffies;
3945                         hdev->discovery.scan_duration = timeout;
3946                 }
3947
3948                 queue_delayed_work(hdev->workqueue,
3949                                    &hdev->le_scan_disable, timeout);
3950         }
3951
3952 unlock:
3953         hci_dev_unlock(hdev);
3954 }
3955
3956 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3957                            void *data, u16 len)
3958 {
3959         struct mgmt_cp_start_discovery *cp = data;
3960         struct mgmt_pending_cmd *cmd;
3961         struct hci_request req;
3962         u8 status;
3963         int err;
3964
3965         BT_DBG("%s", hdev->name);
3966
3967         hci_dev_lock(hdev);
3968
3969         if (!hdev_is_powered(hdev)) {
3970                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3971                                         MGMT_STATUS_NOT_POWERED,
3972                                         &cp->type, sizeof(cp->type));
3973                 goto failed;
3974         }
3975
3976         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3977             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3978                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3979                                         MGMT_STATUS_BUSY, &cp->type,
3980                                         sizeof(cp->type));
3981                 goto failed;
3982         }
3983
3984         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3985         if (!cmd) {
3986                 err = -ENOMEM;
3987                 goto failed;
3988         }
3989
3990         cmd->cmd_complete = generic_cmd_complete;
3991
3992         /* Clear the discovery filter first to free any previously
3993          * allocated memory for the UUID list.
3994          */
3995         hci_discovery_filter_clear(hdev);
3996
3997         hdev->discovery.type = cp->type;
3998         hdev->discovery.report_invalid_rssi = false;
3999
4000         hci_req_init(&req, hdev);
4001
4002         if (!trigger_discovery(&req, &status)) {
4003                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4004                                         status, &cp->type, sizeof(cp->type));
4005                 mgmt_pending_remove(cmd);
4006                 goto failed;
4007         }
4008
4009         err = hci_req_run(&req, start_discovery_complete);
4010         if (err < 0) {
4011                 mgmt_pending_remove(cmd);
4012                 goto failed;
4013         }
4014
4015         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4016
4017 failed:
4018         hci_dev_unlock(hdev);
4019         return err;
4020 }
4021
4022 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4023                                           u8 status)
4024 {
4025         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4026                                  cmd->param, 1);
4027 }
4028
4029 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4030                                    void *data, u16 len)
4031 {
4032         struct mgmt_cp_start_service_discovery *cp = data;
4033         struct mgmt_pending_cmd *cmd;
4034         struct hci_request req;
4035         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4036         u16 uuid_count, expected_len;
4037         u8 status;
4038         int err;
4039
4040         BT_DBG("%s", hdev->name);
4041
4042         hci_dev_lock(hdev);
4043
4044         if (!hdev_is_powered(hdev)) {
4045                 err = mgmt_cmd_complete(sk, hdev->id,
4046                                         MGMT_OP_START_SERVICE_DISCOVERY,
4047                                         MGMT_STATUS_NOT_POWERED,
4048                                         &cp->type, sizeof(cp->type));
4049                 goto failed;
4050         }
4051
4052         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4053             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4054                 err = mgmt_cmd_complete(sk, hdev->id,
4055                                         MGMT_OP_START_SERVICE_DISCOVERY,
4056                                         MGMT_STATUS_BUSY, &cp->type,
4057                                         sizeof(cp->type));
4058                 goto failed;
4059         }
4060
4061         uuid_count = __le16_to_cpu(cp->uuid_count);
4062         if (uuid_count > max_uuid_count) {
4063                 BT_ERR("service_discovery: too big uuid_count value %u",
4064                        uuid_count);
4065                 err = mgmt_cmd_complete(sk, hdev->id,
4066                                         MGMT_OP_START_SERVICE_DISCOVERY,
4067                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4068                                         sizeof(cp->type));
4069                 goto failed;
4070         }
4071
4072         expected_len = sizeof(*cp) + uuid_count * 16;
4073         if (expected_len != len) {
4074                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4075                        expected_len, len);
4076                 err = mgmt_cmd_complete(sk, hdev->id,
4077                                         MGMT_OP_START_SERVICE_DISCOVERY,
4078                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4079                                         sizeof(cp->type));
4080                 goto failed;
4081         }
4082
4083         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4084                                hdev, data, len);
4085         if (!cmd) {
4086                 err = -ENOMEM;
4087                 goto failed;
4088         }
4089
4090         cmd->cmd_complete = service_discovery_cmd_complete;
4091
4092         /* Clear the discovery filter first to free any previously
4093          * allocated memory for the UUID list.
4094          */
4095         hci_discovery_filter_clear(hdev);
4096
4097         hdev->discovery.result_filtering = true;
4098         hdev->discovery.type = cp->type;
4099         hdev->discovery.rssi = cp->rssi;
4100         hdev->discovery.uuid_count = uuid_count;
4101
4102         if (uuid_count > 0) {
4103                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4104                                                 GFP_KERNEL);
4105                 if (!hdev->discovery.uuids) {
4106                         err = mgmt_cmd_complete(sk, hdev->id,
4107                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4108                                                 MGMT_STATUS_FAILED,
4109                                                 &cp->type, sizeof(cp->type));
4110                         mgmt_pending_remove(cmd);
4111                         goto failed;
4112                 }
4113         }
4114
4115         hci_req_init(&req, hdev);
4116
4117         if (!trigger_discovery(&req, &status)) {
4118                 err = mgmt_cmd_complete(sk, hdev->id,
4119                                         MGMT_OP_START_SERVICE_DISCOVERY,
4120                                         status, &cp->type, sizeof(cp->type));
4121                 mgmt_pending_remove(cmd);
4122                 goto failed;
4123         }
4124
4125         err = hci_req_run(&req, start_discovery_complete);
4126         if (err < 0) {
4127                 mgmt_pending_remove(cmd);
4128                 goto failed;
4129         }
4130
4131         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4132
4133 failed:
4134         hci_dev_unlock(hdev);
4135         return err;
4136 }
4137
4138 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4139 {
4140         struct mgmt_pending_cmd *cmd;
4141
4142         BT_DBG("status %d", status);
4143
4144         hci_dev_lock(hdev);
4145
4146         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4147         if (cmd) {
4148                 cmd->cmd_complete(cmd, mgmt_status(status));
4149                 mgmt_pending_remove(cmd);
4150         }
4151
4152         if (!status)
4153                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4154
4155         hci_dev_unlock(hdev);
4156 }
4157
4158 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4159                           u16 len)
4160 {
4161         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4162         struct mgmt_pending_cmd *cmd;
4163         struct hci_request req;
4164         int err;
4165
4166         BT_DBG("%s", hdev->name);
4167
4168         hci_dev_lock(hdev);
4169
4170         if (!hci_discovery_active(hdev)) {
4171                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4172                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4173                                         sizeof(mgmt_cp->type));
4174                 goto unlock;
4175         }
4176
4177         if (hdev->discovery.type != mgmt_cp->type) {
4178                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4179                                         MGMT_STATUS_INVALID_PARAMS,
4180                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4181                 goto unlock;
4182         }
4183
4184         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4185         if (!cmd) {
4186                 err = -ENOMEM;
4187                 goto unlock;
4188         }
4189
4190         cmd->cmd_complete = generic_cmd_complete;
4191
4192         hci_req_init(&req, hdev);
4193
4194         hci_stop_discovery(&req);
4195
4196         err = hci_req_run(&req, stop_discovery_complete);
4197         if (!err) {
4198                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4199                 goto unlock;
4200         }
4201
4202         mgmt_pending_remove(cmd);
4203
4204         /* If no HCI commands were sent we're done */
4205         if (err == -ENODATA) {
4206                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4207                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4208                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4209         }
4210
4211 unlock:
4212         hci_dev_unlock(hdev);
4213         return err;
4214 }
4215
4216 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4217                         u16 len)
4218 {
4219         struct mgmt_cp_confirm_name *cp = data;
4220         struct inquiry_entry *e;
4221         int err;
4222
4223         BT_DBG("%s", hdev->name);
4224
4225         hci_dev_lock(hdev);
4226
4227         if (!hci_discovery_active(hdev)) {
4228                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4229                                         MGMT_STATUS_FAILED, &cp->addr,
4230                                         sizeof(cp->addr));
4231                 goto failed;
4232         }
4233
4234         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4235         if (!e) {
4236                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4237                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4238                                         sizeof(cp->addr));
4239                 goto failed;
4240         }
4241
4242         if (cp->name_known) {
4243                 e->name_state = NAME_KNOWN;
4244                 list_del(&e->list);
4245         } else {
4246                 e->name_state = NAME_NEEDED;
4247                 hci_inquiry_cache_update_resolve(hdev, e);
4248         }
4249
4250         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4251                                 &cp->addr, sizeof(cp->addr));
4252
4253 failed:
4254         hci_dev_unlock(hdev);
4255         return err;
4256 }
4257
4258 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4259                         u16 len)
4260 {
4261         struct mgmt_cp_block_device *cp = data;
4262         u8 status;
4263         int err;
4264
4265         BT_DBG("%s", hdev->name);
4266
4267         if (!bdaddr_type_is_valid(cp->addr.type))
4268                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4269                                          MGMT_STATUS_INVALID_PARAMS,
4270                                          &cp->addr, sizeof(cp->addr));
4271
4272         hci_dev_lock(hdev);
4273
4274         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4275                                   cp->addr.type);
4276         if (err < 0) {
4277                 status = MGMT_STATUS_FAILED;
4278                 goto done;
4279         }
4280
4281         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4282                    sk);
4283         status = MGMT_STATUS_SUCCESS;
4284
4285 done:
4286         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4287                                 &cp->addr, sizeof(cp->addr));
4288
4289         hci_dev_unlock(hdev);
4290
4291         return err;
4292 }
4293
4294 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4295                           u16 len)
4296 {
4297         struct mgmt_cp_unblock_device *cp = data;
4298         u8 status;
4299         int err;
4300
4301         BT_DBG("%s", hdev->name);
4302
4303         if (!bdaddr_type_is_valid(cp->addr.type))
4304                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4305                                          MGMT_STATUS_INVALID_PARAMS,
4306                                          &cp->addr, sizeof(cp->addr));
4307
4308         hci_dev_lock(hdev);
4309
4310         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4311                                   cp->addr.type);
4312         if (err < 0) {
4313                 status = MGMT_STATUS_INVALID_PARAMS;
4314                 goto done;
4315         }
4316
4317         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4318                    sk);
4319         status = MGMT_STATUS_SUCCESS;
4320
4321 done:
4322         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4323                                 &cp->addr, sizeof(cp->addr));
4324
4325         hci_dev_unlock(hdev);
4326
4327         return err;
4328 }
4329
4330 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4331                          u16 len)
4332 {
4333         struct mgmt_cp_set_device_id *cp = data;
4334         struct hci_request req;
4335         int err;
4336         __u16 source;
4337
4338         BT_DBG("%s", hdev->name);
4339
4340         source = __le16_to_cpu(cp->source);
4341
4342         if (source > 0x0002)
4343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4344                                        MGMT_STATUS_INVALID_PARAMS);
4345
4346         hci_dev_lock(hdev);
4347
4348         hdev->devid_source = source;
4349         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4350         hdev->devid_product = __le16_to_cpu(cp->product);
4351         hdev->devid_version = __le16_to_cpu(cp->version);
4352
4353         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4354                                 NULL, 0);
4355
4356         hci_req_init(&req, hdev);
4357         update_eir(&req);
4358         hci_req_run(&req, NULL);
4359
4360         hci_dev_unlock(hdev);
4361
4362         return err;
4363 }
4364
4365 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4366                                      u16 opcode)
4367 {
4368         struct cmd_lookup match = { NULL, hdev };
4369
4370         hci_dev_lock(hdev);
4371
4372         if (status) {
4373                 u8 mgmt_err = mgmt_status(status);
4374
4375                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4376                                      cmd_status_rsp, &mgmt_err);
4377                 goto unlock;
4378         }
4379
4380         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4381                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4382         else
4383                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4384
4385         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4386                              &match);
4387
4388         new_settings(hdev, match.sk);
4389
4390         if (match.sk)
4391                 sock_put(match.sk);
4392
4393 unlock:
4394         hci_dev_unlock(hdev);
4395 }
4396
4397 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4398                            u16 len)
4399 {
4400         struct mgmt_mode *cp = data;
4401         struct mgmt_pending_cmd *cmd;
4402         struct hci_request req;
4403         u8 val, status;
4404         int err;
4405
4406         BT_DBG("request for %s", hdev->name);
4407
4408         status = mgmt_le_support(hdev);
4409         if (status)
4410                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4411                                        status);
4412
4413         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4415                                        MGMT_STATUS_INVALID_PARAMS);
4416
4417         hci_dev_lock(hdev);
4418
4419         val = !!cp->val;
4420
4421         /* The following conditions are ones which mean that we should
4422          * not do any HCI communication but directly send a mgmt
4423          * response to user space (after toggling the flag if
4424          * necessary).
4425          */
4426         if (!hdev_is_powered(hdev) ||
4427             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4428              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4429             hci_conn_num(hdev, LE_LINK) > 0 ||
4430             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4431              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4432                 bool changed;
4433
4434                 if (cp->val) {
4435                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4436                         if (cp->val == 0x02)
4437                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4438                         else
4439                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4440                 } else {
4441                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4442                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4443                 }
4444
4445                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4446                 if (err < 0)
4447                         goto unlock;
4448
4449                 if (changed)
4450                         err = new_settings(hdev, sk);
4451
4452                 goto unlock;
4453         }
4454
4455         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4456             pending_find(MGMT_OP_SET_LE, hdev)) {
4457                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4458                                       MGMT_STATUS_BUSY);
4459                 goto unlock;
4460         }
4461
4462         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4463         if (!cmd) {
4464                 err = -ENOMEM;
4465                 goto unlock;
4466         }
4467
4468         hci_req_init(&req, hdev);
4469
4470         if (cp->val == 0x02)
4471                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4472         else
4473                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4474
4475         if (val)
4476                 enable_advertising(&req);
4477         else
4478                 disable_advertising(&req);
4479
4480         err = hci_req_run(&req, set_advertising_complete);
4481         if (err < 0)
4482                 mgmt_pending_remove(cmd);
4483
4484 unlock:
4485         hci_dev_unlock(hdev);
4486         return err;
4487 }
4488
4489 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4490                               void *data, u16 len)
4491 {
4492         struct mgmt_cp_set_static_address *cp = data;
4493         int err;
4494
4495         BT_DBG("%s", hdev->name);
4496
4497         if (!lmp_le_capable(hdev))
4498                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4499                                        MGMT_STATUS_NOT_SUPPORTED);
4500
4501         if (hdev_is_powered(hdev))
4502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4503                                        MGMT_STATUS_REJECTED);
4504
4505         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4506                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4507                         return mgmt_cmd_status(sk, hdev->id,
4508                                                MGMT_OP_SET_STATIC_ADDRESS,
4509                                                MGMT_STATUS_INVALID_PARAMS);
4510
4511                 /* Two most significant bits shall be set */
4512                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4513                         return mgmt_cmd_status(sk, hdev->id,
4514                                                MGMT_OP_SET_STATIC_ADDRESS,
4515                                                MGMT_STATUS_INVALID_PARAMS);
4516         }
4517
4518         hci_dev_lock(hdev);
4519
4520         bacpy(&hdev->static_addr, &cp->bdaddr);
4521
4522         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4523         if (err < 0)
4524                 goto unlock;
4525
4526         err = new_settings(hdev, sk);
4527
4528 unlock:
4529         hci_dev_unlock(hdev);
4530         return err;
4531 }
4532
4533 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4534                            void *data, u16 len)
4535 {
4536         struct mgmt_cp_set_scan_params *cp = data;
4537         __u16 interval, window;
4538         int err;
4539
4540         BT_DBG("%s", hdev->name);
4541
4542         if (!lmp_le_capable(hdev))
4543                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4544                                        MGMT_STATUS_NOT_SUPPORTED);
4545
4546         interval = __le16_to_cpu(cp->interval);
4547
4548         if (interval < 0x0004 || interval > 0x4000)
4549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4550                                        MGMT_STATUS_INVALID_PARAMS);
4551
4552         window = __le16_to_cpu(cp->window);
4553
4554         if (window < 0x0004 || window > 0x4000)
4555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4556                                        MGMT_STATUS_INVALID_PARAMS);
4557
4558         if (window > interval)
4559                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4560                                        MGMT_STATUS_INVALID_PARAMS);
4561
4562         hci_dev_lock(hdev);
4563
4564         hdev->le_scan_interval = interval;
4565         hdev->le_scan_window = window;
4566
4567         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4568                                 NULL, 0);
4569
4570         /* If background scan is running, restart it so new parameters are
4571          * loaded.
4572          */
4573         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4574             hdev->discovery.state == DISCOVERY_STOPPED) {
4575                 struct hci_request req;
4576
4577                 hci_req_init(&req, hdev);
4578
4579                 hci_req_add_le_scan_disable(&req);
4580                 hci_req_add_le_passive_scan(&req);
4581
4582                 hci_req_run(&req, NULL);
4583         }
4584
4585         hci_dev_unlock(hdev);
4586
4587         return err;
4588 }
4589
4590 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4591                                       u16 opcode)
4592 {
4593         struct mgmt_pending_cmd *cmd;
4594
4595         BT_DBG("status 0x%02x", status);
4596
4597         hci_dev_lock(hdev);
4598
4599         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4600         if (!cmd)
4601                 goto unlock;
4602
4603         if (status) {
4604                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4605                                 mgmt_status(status));
4606         } else {
4607                 struct mgmt_mode *cp = cmd->param;
4608
4609                 if (cp->val)
4610                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4611                 else
4612                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4613
4614                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4615                 new_settings(hdev, cmd->sk);
4616         }
4617
4618         mgmt_pending_remove(cmd);
4619
4620 unlock:
4621         hci_dev_unlock(hdev);
4622 }
4623
4624 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4625                                 void *data, u16 len)
4626 {
4627         struct mgmt_mode *cp = data;
4628         struct mgmt_pending_cmd *cmd;
4629         struct hci_request req;
4630         int err;
4631
4632         BT_DBG("%s", hdev->name);
4633
4634         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4635             hdev->hci_ver < BLUETOOTH_VER_1_2)
4636                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4637                                        MGMT_STATUS_NOT_SUPPORTED);
4638
4639         if (cp->val != 0x00 && cp->val != 0x01)
4640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4641                                        MGMT_STATUS_INVALID_PARAMS);
4642
4643         hci_dev_lock(hdev);
4644
4645         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4646                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4647                                       MGMT_STATUS_BUSY);
4648                 goto unlock;
4649         }
4650
4651         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4652                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4653                                         hdev);
4654                 goto unlock;
4655         }
4656
4657         if (!hdev_is_powered(hdev)) {
4658                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4659                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4660                                         hdev);
4661                 new_settings(hdev, sk);
4662                 goto unlock;
4663         }
4664
4665         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4666                                data, len);
4667         if (!cmd) {
4668                 err = -ENOMEM;
4669                 goto unlock;
4670         }
4671
4672         hci_req_init(&req, hdev);
4673
4674         write_fast_connectable(&req, cp->val);
4675
4676         err = hci_req_run(&req, fast_connectable_complete);
4677         if (err < 0) {
4678                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4679                                       MGMT_STATUS_FAILED);
4680                 mgmt_pending_remove(cmd);
4681         }
4682
4683 unlock:
4684         hci_dev_unlock(hdev);
4685
4686         return err;
4687 }
4688
4689 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4690 {
4691         struct mgmt_pending_cmd *cmd;
4692
4693         BT_DBG("status 0x%02x", status);
4694
4695         hci_dev_lock(hdev);
4696
4697         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4698         if (!cmd)
4699                 goto unlock;
4700
4701         if (status) {
4702                 u8 mgmt_err = mgmt_status(status);
4703
4704                 /* We need to restore the flag if related HCI commands
4705                  * failed.
4706                  */
4707                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4708
4709                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4710         } else {
4711                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4712                 new_settings(hdev, cmd->sk);
4713         }
4714
4715         mgmt_pending_remove(cmd);
4716
4717 unlock:
4718         hci_dev_unlock(hdev);
4719 }
4720
4721 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4722 {
4723         struct mgmt_mode *cp = data;
4724         struct mgmt_pending_cmd *cmd;
4725         struct hci_request req;
4726         int err;
4727
4728         BT_DBG("request for %s", hdev->name);
4729
4730         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4731                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4732                                        MGMT_STATUS_NOT_SUPPORTED);
4733
4734         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4735                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4736                                        MGMT_STATUS_REJECTED);
4737
4738         if (cp->val != 0x00 && cp->val != 0x01)
4739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4740                                        MGMT_STATUS_INVALID_PARAMS);
4741
4742         hci_dev_lock(hdev);
4743
4744         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4745                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4746                 goto unlock;
4747         }
4748
4749         if (!hdev_is_powered(hdev)) {
4750                 if (!cp->val) {
4751                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4752                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4753                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4754                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4755                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4756                 }
4757
4758                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4759
4760                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4761                 if (err < 0)
4762                         goto unlock;
4763
4764                 err = new_settings(hdev, sk);
4765                 goto unlock;
4766         }
4767
4768         /* Reject disabling when powered on */
4769         if (!cp->val) {
4770                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4771                                       MGMT_STATUS_REJECTED);
4772                 goto unlock;
4773         } else {
4774                 /* When configuring a dual-mode controller to operate
4775                  * with LE only and using a static address, then switching
4776                  * BR/EDR back on is not allowed.
4777                  *
4778                  * Dual-mode controllers shall operate with the public
4779                  * address as its identity address for BR/EDR and LE. So
4780                  * reject the attempt to create an invalid configuration.
4781                  *
4782                  * The same restrictions applies when secure connections
4783                  * has been enabled. For BR/EDR this is a controller feature
4784                  * while for LE it is a host stack feature. This means that
4785                  * switching BR/EDR back on when secure connections has been
4786                  * enabled is not a supported transaction.
4787                  */
4788                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4789                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4790                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4791                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4792                                               MGMT_STATUS_REJECTED);
4793                         goto unlock;
4794                 }
4795         }
4796
4797         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4798                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4799                                       MGMT_STATUS_BUSY);
4800                 goto unlock;
4801         }
4802
4803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4804         if (!cmd) {
4805                 err = -ENOMEM;
4806                 goto unlock;
4807         }
4808
4809         /* We need to flip the bit already here so that update_adv_data
4810          * generates the correct flags.
4811          */
4812         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4813
4814         hci_req_init(&req, hdev);
4815
4816         write_fast_connectable(&req, false);
4817         __hci_update_page_scan(&req);
4818
4819         /* Since only the advertising data flags will change, there
4820          * is no need to update the scan response data.
4821          */
4822         update_adv_data(&req);
4823
4824         err = hci_req_run(&req, set_bredr_complete);
4825         if (err < 0)
4826                 mgmt_pending_remove(cmd);
4827
4828 unlock:
4829         hci_dev_unlock(hdev);
4830         return err;
4831 }
4832
4833 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4834 {
4835         struct mgmt_pending_cmd *cmd;
4836         struct mgmt_mode *cp;
4837
4838         BT_DBG("%s status %u", hdev->name, status);
4839
4840         hci_dev_lock(hdev);
4841
4842         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4843         if (!cmd)
4844                 goto unlock;
4845
4846         if (status) {
4847                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4848                                 mgmt_status(status));
4849                 goto remove;
4850         }
4851
4852         cp = cmd->param;
4853
4854         switch (cp->val) {
4855         case 0x00:
4856                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4857                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4858                 break;
4859         case 0x01:
4860                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4861                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4862                 break;
4863         case 0x02:
4864                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4865                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4866                 break;
4867         }
4868
4869         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4870         new_settings(hdev, cmd->sk);
4871
4872 remove:
4873         mgmt_pending_remove(cmd);
4874 unlock:
4875         hci_dev_unlock(hdev);
4876 }
4877
4878 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4879                            void *data, u16 len)
4880 {
4881         struct mgmt_mode *cp = data;
4882         struct mgmt_pending_cmd *cmd;
4883         struct hci_request req;
4884         u8 val;
4885         int err;
4886
4887         BT_DBG("request for %s", hdev->name);
4888
4889         if (!lmp_sc_capable(hdev) &&
4890             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4891                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4892                                        MGMT_STATUS_NOT_SUPPORTED);
4893
4894         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4895             lmp_sc_capable(hdev) &&
4896             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4897                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4898                                        MGMT_STATUS_REJECTED);
4899
4900         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4901                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4902                                   MGMT_STATUS_INVALID_PARAMS);
4903
4904         hci_dev_lock(hdev);
4905
4906         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4907             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4908                 bool changed;
4909
4910                 if (cp->val) {
4911                         changed = !hci_dev_test_and_set_flag(hdev,
4912                                                              HCI_SC_ENABLED);
4913                         if (cp->val == 0x02)
4914                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4915                         else
4916                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4917                 } else {
4918                         changed = hci_dev_test_and_clear_flag(hdev,
4919                                                               HCI_SC_ENABLED);
4920                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4921                 }
4922
4923                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4924                 if (err < 0)
4925                         goto failed;
4926
4927                 if (changed)
4928                         err = new_settings(hdev, sk);
4929
4930                 goto failed;
4931         }
4932
4933         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4934                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4935                                       MGMT_STATUS_BUSY);
4936                 goto failed;
4937         }
4938
4939         val = !!cp->val;
4940
4941         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4942             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4943                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4944                 goto failed;
4945         }
4946
4947         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4948         if (!cmd) {
4949                 err = -ENOMEM;
4950                 goto failed;
4951         }
4952
4953         hci_req_init(&req, hdev);
4954         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4955         err = hci_req_run(&req, sc_enable_complete);
4956         if (err < 0) {
4957                 mgmt_pending_remove(cmd);
4958                 goto failed;
4959         }
4960
4961 failed:
4962         hci_dev_unlock(hdev);
4963         return err;
4964 }
4965
4966 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4967                           void *data, u16 len)
4968 {
4969         struct mgmt_mode *cp = data;
4970         bool changed, use_changed;
4971         int err;
4972
4973         BT_DBG("request for %s", hdev->name);
4974
4975         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4976                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4977                                        MGMT_STATUS_INVALID_PARAMS);
4978
4979         hci_dev_lock(hdev);
4980
4981         if (cp->val)
4982                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4983         else
4984                 changed = hci_dev_test_and_clear_flag(hdev,
4985                                                       HCI_KEEP_DEBUG_KEYS);
4986
4987         if (cp->val == 0x02)
4988                 use_changed = !hci_dev_test_and_set_flag(hdev,
4989                                                          HCI_USE_DEBUG_KEYS);
4990         else
4991                 use_changed = hci_dev_test_and_clear_flag(hdev,
4992                                                           HCI_USE_DEBUG_KEYS);
4993
4994         if (hdev_is_powered(hdev) && use_changed &&
4995             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4996                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4997                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4998                              sizeof(mode), &mode);
4999         }
5000
5001         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5002         if (err < 0)
5003                 goto unlock;
5004
5005         if (changed)
5006                 err = new_settings(hdev, sk);
5007
5008 unlock:
5009         hci_dev_unlock(hdev);
5010         return err;
5011 }
5012
5013 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014                        u16 len)
5015 {
5016         struct mgmt_cp_set_privacy *cp = cp_data;
5017         bool changed;
5018         int err;
5019
5020         BT_DBG("request for %s", hdev->name);
5021
5022         if (!lmp_le_capable(hdev))
5023                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5024                                        MGMT_STATUS_NOT_SUPPORTED);
5025
5026         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5027                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5028                                        MGMT_STATUS_INVALID_PARAMS);
5029
5030         if (hdev_is_powered(hdev))
5031                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5032                                        MGMT_STATUS_REJECTED);
5033
5034         hci_dev_lock(hdev);
5035
5036         /* If user space supports this command it is also expected to
5037          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5038          */
5039         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5040
5041         if (cp->privacy) {
5042                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5043                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5044                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5045         } else {
5046                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5047                 memset(hdev->irk, 0, sizeof(hdev->irk));
5048                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5049         }
5050
5051         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5052         if (err < 0)
5053                 goto unlock;
5054
5055         if (changed)
5056                 err = new_settings(hdev, sk);
5057
5058 unlock:
5059         hci_dev_unlock(hdev);
5060         return err;
5061 }
5062
5063 static bool irk_is_valid(struct mgmt_irk_info *irk)
5064 {
5065         switch (irk->addr.type) {
5066         case BDADDR_LE_PUBLIC:
5067                 return true;
5068
5069         case BDADDR_LE_RANDOM:
5070                 /* Two most significant bits shall be set */
5071                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5072                         return false;
5073                 return true;
5074         }
5075
5076         return false;
5077 }
5078
5079 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5080                      u16 len)
5081 {
5082         struct mgmt_cp_load_irks *cp = cp_data;
5083         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5084                                    sizeof(struct mgmt_irk_info));
5085         u16 irk_count, expected_len;
5086         int i, err;
5087
5088         BT_DBG("request for %s", hdev->name);
5089
5090         if (!lmp_le_capable(hdev))
5091                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5092                                        MGMT_STATUS_NOT_SUPPORTED);
5093
5094         irk_count = __le16_to_cpu(cp->irk_count);
5095         if (irk_count > max_irk_count) {
5096                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5097                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5098                                        MGMT_STATUS_INVALID_PARAMS);
5099         }
5100
5101         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5102         if (expected_len != len) {
5103                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5104                        expected_len, len);
5105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5106                                        MGMT_STATUS_INVALID_PARAMS);
5107         }
5108
5109         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5110
5111         for (i = 0; i < irk_count; i++) {
5112                 struct mgmt_irk_info *key = &cp->irks[i];
5113
5114                 if (!irk_is_valid(key))
5115                         return mgmt_cmd_status(sk, hdev->id,
5116                                                MGMT_OP_LOAD_IRKS,
5117                                                MGMT_STATUS_INVALID_PARAMS);
5118         }
5119
5120         hci_dev_lock(hdev);
5121
5122         hci_smp_irks_clear(hdev);
5123
5124         for (i = 0; i < irk_count; i++) {
5125                 struct mgmt_irk_info *irk = &cp->irks[i];
5126                 u8 addr_type;
5127
5128                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5129                         addr_type = ADDR_LE_DEV_PUBLIC;
5130                 else
5131                         addr_type = ADDR_LE_DEV_RANDOM;
5132
5133                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5134                             BDADDR_ANY);
5135         }
5136
5137         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5138
5139         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5140
5141         hci_dev_unlock(hdev);
5142
5143         return err;
5144 }
5145
5146 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5147 {
5148         if (key->master != 0x00 && key->master != 0x01)
5149                 return false;
5150
5151         switch (key->addr.type) {
5152         case BDADDR_LE_PUBLIC:
5153                 return true;
5154
5155         case BDADDR_LE_RANDOM:
5156                 /* Two most significant bits shall be set */
5157                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5158                         return false;
5159                 return true;
5160         }
5161
5162         return false;
5163 }
5164
5165 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5166                                void *cp_data, u16 len)
5167 {
5168         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5169         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5170                                    sizeof(struct mgmt_ltk_info));
5171         u16 key_count, expected_len;
5172         int i, err;
5173
5174         BT_DBG("request for %s", hdev->name);
5175
5176         if (!lmp_le_capable(hdev))
5177                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5178                                        MGMT_STATUS_NOT_SUPPORTED);
5179
5180         key_count = __le16_to_cpu(cp->key_count);
5181         if (key_count > max_key_count) {
5182                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5184                                        MGMT_STATUS_INVALID_PARAMS);
5185         }
5186
5187         expected_len = sizeof(*cp) + key_count *
5188                                         sizeof(struct mgmt_ltk_info);
5189         if (expected_len != len) {
5190                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5191                        expected_len, len);
5192                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5193                                        MGMT_STATUS_INVALID_PARAMS);
5194         }
5195
5196         BT_DBG("%s key_count %u", hdev->name, key_count);
5197
5198         for (i = 0; i < key_count; i++) {
5199                 struct mgmt_ltk_info *key = &cp->keys[i];
5200
5201                 if (!ltk_is_valid(key))
5202                         return mgmt_cmd_status(sk, hdev->id,
5203                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5204                                                MGMT_STATUS_INVALID_PARAMS);
5205         }
5206
5207         hci_dev_lock(hdev);
5208
5209         hci_smp_ltks_clear(hdev);
5210
5211         for (i = 0; i < key_count; i++) {
5212                 struct mgmt_ltk_info *key = &cp->keys[i];
5213                 u8 type, addr_type, authenticated;
5214
5215                 if (key->addr.type == BDADDR_LE_PUBLIC)
5216                         addr_type = ADDR_LE_DEV_PUBLIC;
5217                 else
5218                         addr_type = ADDR_LE_DEV_RANDOM;
5219
5220                 switch (key->type) {
5221                 case MGMT_LTK_UNAUTHENTICATED:
5222                         authenticated = 0x00;
5223                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5224                         break;
5225                 case MGMT_LTK_AUTHENTICATED:
5226                         authenticated = 0x01;
5227                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5228                         break;
5229                 case MGMT_LTK_P256_UNAUTH:
5230                         authenticated = 0x00;
5231                         type = SMP_LTK_P256;
5232                         break;
5233                 case MGMT_LTK_P256_AUTH:
5234                         authenticated = 0x01;
5235                         type = SMP_LTK_P256;
5236                         break;
5237                 case MGMT_LTK_P256_DEBUG:
5238                         authenticated = 0x00;
5239                         type = SMP_LTK_P256_DEBUG;
5240                 default:
5241                         continue;
5242                 }
5243
5244                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5245                             authenticated, key->val, key->enc_size, key->ediv,
5246                             key->rand);
5247         }
5248
5249         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5250                            NULL, 0);
5251
5252         hci_dev_unlock(hdev);
5253
5254         return err;
5255 }
5256
5257 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5258 {
5259         struct hci_conn *conn = cmd->user_data;
5260         struct mgmt_rp_get_conn_info rp;
5261         int err;
5262
5263         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5264
5265         if (status == MGMT_STATUS_SUCCESS) {
5266                 rp.rssi = conn->rssi;
5267                 rp.tx_power = conn->tx_power;
5268                 rp.max_tx_power = conn->max_tx_power;
5269         } else {
5270                 rp.rssi = HCI_RSSI_INVALID;
5271                 rp.tx_power = HCI_TX_POWER_INVALID;
5272                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5273         }
5274
5275         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5276                                 status, &rp, sizeof(rp));
5277
5278         hci_conn_drop(conn);
5279         hci_conn_put(conn);
5280
5281         return err;
5282 }
5283
5284 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5285                                        u16 opcode)
5286 {
5287         struct hci_cp_read_rssi *cp;
5288         struct mgmt_pending_cmd *cmd;
5289         struct hci_conn *conn;
5290         u16 handle;
5291         u8 status;
5292
5293         BT_DBG("status 0x%02x", hci_status);
5294
5295         hci_dev_lock(hdev);
5296
5297         /* Commands sent in request are either Read RSSI or Read Transmit Power
5298          * Level so we check which one was last sent to retrieve connection
5299          * handle.  Both commands have handle as first parameter so it's safe to
5300          * cast data on the same command struct.
5301          *
5302          * First command sent is always Read RSSI and we fail only if it fails.
5303          * In other case we simply override error to indicate success as we
5304          * already remembered if TX power value is actually valid.
5305          */
5306         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5307         if (!cp) {
5308                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5309                 status = MGMT_STATUS_SUCCESS;
5310         } else {
5311                 status = mgmt_status(hci_status);
5312         }
5313
5314         if (!cp) {
5315                 BT_ERR("invalid sent_cmd in conn_info response");
5316                 goto unlock;
5317         }
5318
5319         handle = __le16_to_cpu(cp->handle);
5320         conn = hci_conn_hash_lookup_handle(hdev, handle);
5321         if (!conn) {
5322                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5323                 goto unlock;
5324         }
5325
5326         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5327         if (!cmd)
5328                 goto unlock;
5329
5330         cmd->cmd_complete(cmd, status);
5331         mgmt_pending_remove(cmd);
5332
5333 unlock:
5334         hci_dev_unlock(hdev);
5335 }
5336
5337 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5338                          u16 len)
5339 {
5340         struct mgmt_cp_get_conn_info *cp = data;
5341         struct mgmt_rp_get_conn_info rp;
5342         struct hci_conn *conn;
5343         unsigned long conn_info_age;
5344         int err = 0;
5345
5346         BT_DBG("%s", hdev->name);
5347
5348         memset(&rp, 0, sizeof(rp));
5349         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5350         rp.addr.type = cp->addr.type;
5351
5352         if (!bdaddr_type_is_valid(cp->addr.type))
5353                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5354                                          MGMT_STATUS_INVALID_PARAMS,
5355                                          &rp, sizeof(rp));
5356
5357         hci_dev_lock(hdev);
5358
5359         if (!hdev_is_powered(hdev)) {
5360                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5361                                         MGMT_STATUS_NOT_POWERED, &rp,
5362                                         sizeof(rp));
5363                 goto unlock;
5364         }
5365
5366         if (cp->addr.type == BDADDR_BREDR)
5367                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5368                                                &cp->addr.bdaddr);
5369         else
5370                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5371
5372         if (!conn || conn->state != BT_CONNECTED) {
5373                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5374                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5375                                         sizeof(rp));
5376                 goto unlock;
5377         }
5378
5379         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5380                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5381                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5382                 goto unlock;
5383         }
5384
5385         /* To avoid client trying to guess when to poll again for information we
5386          * calculate conn info age as random value between min/max set in hdev.
5387          */
5388         conn_info_age = hdev->conn_info_min_age +
5389                         prandom_u32_max(hdev->conn_info_max_age -
5390                                         hdev->conn_info_min_age);
5391
5392         /* Query controller to refresh cached values if they are too old or were
5393          * never read.
5394          */
5395         if (time_after(jiffies, conn->conn_info_timestamp +
5396                        msecs_to_jiffies(conn_info_age)) ||
5397             !conn->conn_info_timestamp) {
5398                 struct hci_request req;
5399                 struct hci_cp_read_tx_power req_txp_cp;
5400                 struct hci_cp_read_rssi req_rssi_cp;
5401                 struct mgmt_pending_cmd *cmd;
5402
5403                 hci_req_init(&req, hdev);
5404                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5405                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5406                             &req_rssi_cp);
5407
5408                 /* For LE links TX power does not change thus we don't need to
5409                  * query for it once value is known.
5410                  */
5411                 if (!bdaddr_type_is_le(cp->addr.type) ||
5412                     conn->tx_power == HCI_TX_POWER_INVALID) {
5413                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5414                         req_txp_cp.type = 0x00;
5415                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5416                                     sizeof(req_txp_cp), &req_txp_cp);
5417                 }
5418
5419                 /* Max TX power needs to be read only once per connection */
5420                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5421                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5422                         req_txp_cp.type = 0x01;
5423                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5424                                     sizeof(req_txp_cp), &req_txp_cp);
5425                 }
5426
5427                 err = hci_req_run(&req, conn_info_refresh_complete);
5428                 if (err < 0)
5429                         goto unlock;
5430
5431                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5432                                        data, len);
5433                 if (!cmd) {
5434                         err = -ENOMEM;
5435                         goto unlock;
5436                 }
5437
5438                 hci_conn_hold(conn);
5439                 cmd->user_data = hci_conn_get(conn);
5440                 cmd->cmd_complete = conn_info_cmd_complete;
5441
5442                 conn->conn_info_timestamp = jiffies;
5443         } else {
5444                 /* Cache is valid, just reply with values cached in hci_conn */
5445                 rp.rssi = conn->rssi;
5446                 rp.tx_power = conn->tx_power;
5447                 rp.max_tx_power = conn->max_tx_power;
5448
5449                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5450                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5451         }
5452
5453 unlock:
5454         hci_dev_unlock(hdev);
5455         return err;
5456 }
5457
5458 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5459 {
5460         struct hci_conn *conn = cmd->user_data;
5461         struct mgmt_rp_get_clock_info rp;
5462         struct hci_dev *hdev;
5463         int err;
5464
5465         memset(&rp, 0, sizeof(rp));
5466         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5467
5468         if (status)
5469                 goto complete;
5470
5471         hdev = hci_dev_get(cmd->index);
5472         if (hdev) {
5473                 rp.local_clock = cpu_to_le32(hdev->clock);
5474                 hci_dev_put(hdev);
5475         }
5476
5477         if (conn) {
5478                 rp.piconet_clock = cpu_to_le32(conn->clock);
5479                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5480         }
5481
5482 complete:
5483         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5484                                 sizeof(rp));
5485
5486         if (conn) {
5487                 hci_conn_drop(conn);
5488                 hci_conn_put(conn);
5489         }
5490
5491         return err;
5492 }
5493
5494 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5495 {
5496         struct hci_cp_read_clock *hci_cp;
5497         struct mgmt_pending_cmd *cmd;
5498         struct hci_conn *conn;
5499
5500         BT_DBG("%s status %u", hdev->name, status);
5501
5502         hci_dev_lock(hdev);
5503
5504         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5505         if (!hci_cp)
5506                 goto unlock;
5507
5508         if (hci_cp->which) {
5509                 u16 handle = __le16_to_cpu(hci_cp->handle);
5510                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5511         } else {
5512                 conn = NULL;
5513         }
5514
5515         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5516         if (!cmd)
5517                 goto unlock;
5518
5519         cmd->cmd_complete(cmd, mgmt_status(status));
5520         mgmt_pending_remove(cmd);
5521
5522 unlock:
5523         hci_dev_unlock(hdev);
5524 }
5525
5526 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5527                          u16 len)
5528 {
5529         struct mgmt_cp_get_clock_info *cp = data;
5530         struct mgmt_rp_get_clock_info rp;
5531         struct hci_cp_read_clock hci_cp;
5532         struct mgmt_pending_cmd *cmd;
5533         struct hci_request req;
5534         struct hci_conn *conn;
5535         int err;
5536
5537         BT_DBG("%s", hdev->name);
5538
5539         memset(&rp, 0, sizeof(rp));
5540         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5541         rp.addr.type = cp->addr.type;
5542
5543         if (cp->addr.type != BDADDR_BREDR)
5544                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5545                                          MGMT_STATUS_INVALID_PARAMS,
5546                                          &rp, sizeof(rp));
5547
5548         hci_dev_lock(hdev);
5549
5550         if (!hdev_is_powered(hdev)) {
5551                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5552                                         MGMT_STATUS_NOT_POWERED, &rp,
5553                                         sizeof(rp));
5554                 goto unlock;
5555         }
5556
5557         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5558                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5559                                                &cp->addr.bdaddr);
5560                 if (!conn || conn->state != BT_CONNECTED) {
5561                         err = mgmt_cmd_complete(sk, hdev->id,
5562                                                 MGMT_OP_GET_CLOCK_INFO,
5563                                                 MGMT_STATUS_NOT_CONNECTED,
5564                                                 &rp, sizeof(rp));
5565                         goto unlock;
5566                 }
5567         } else {
5568                 conn = NULL;
5569         }
5570
5571         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5572         if (!cmd) {
5573                 err = -ENOMEM;
5574                 goto unlock;
5575         }
5576
5577         cmd->cmd_complete = clock_info_cmd_complete;
5578
5579         hci_req_init(&req, hdev);
5580
5581         memset(&hci_cp, 0, sizeof(hci_cp));
5582         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5583
5584         if (conn) {
5585                 hci_conn_hold(conn);
5586                 cmd->user_data = hci_conn_get(conn);
5587
5588                 hci_cp.handle = cpu_to_le16(conn->handle);
5589                 hci_cp.which = 0x01; /* Piconet clock */
5590                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5591         }
5592
5593         err = hci_req_run(&req, get_clock_info_complete);
5594         if (err < 0)
5595                 mgmt_pending_remove(cmd);
5596
5597 unlock:
5598         hci_dev_unlock(hdev);
5599         return err;
5600 }
5601
5602 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5603 {
5604         struct hci_conn *conn;
5605
5606         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5607         if (!conn)
5608                 return false;
5609
5610         if (conn->dst_type != type)
5611                 return false;
5612
5613         if (conn->state != BT_CONNECTED)
5614                 return false;
5615
5616         return true;
5617 }
5618
5619 /* This function requires the caller holds hdev->lock */
5620 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5621                                u8 addr_type, u8 auto_connect)
5622 {
5623         struct hci_dev *hdev = req->hdev;
5624         struct hci_conn_params *params;
5625
5626         params = hci_conn_params_add(hdev, addr, addr_type);
5627         if (!params)
5628                 return -EIO;
5629
5630         if (params->auto_connect == auto_connect)
5631                 return 0;
5632
5633         list_del_init(&params->action);
5634
5635         switch (auto_connect) {
5636         case HCI_AUTO_CONN_DISABLED:
5637         case HCI_AUTO_CONN_LINK_LOSS:
5638                 __hci_update_background_scan(req);
5639                 break;
5640         case HCI_AUTO_CONN_REPORT:
5641                 list_add(&params->action, &hdev->pend_le_reports);
5642                 __hci_update_background_scan(req);
5643                 break;
5644         case HCI_AUTO_CONN_DIRECT:
5645         case HCI_AUTO_CONN_ALWAYS:
5646                 if (!is_connected(hdev, addr, addr_type)) {
5647                         list_add(&params->action, &hdev->pend_le_conns);
5648                         __hci_update_background_scan(req);
5649                 }
5650                 break;
5651         }
5652
5653         params->auto_connect = auto_connect;
5654
5655         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5656                auto_connect);
5657
5658         return 0;
5659 }
5660
5661 static void device_added(struct sock *sk, struct hci_dev *hdev,
5662                          bdaddr_t *bdaddr, u8 type, u8 action)
5663 {
5664         struct mgmt_ev_device_added ev;
5665
5666         bacpy(&ev.addr.bdaddr, bdaddr);
5667         ev.addr.type = type;
5668         ev.action = action;
5669
5670         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5671 }
5672
5673 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5674 {
5675         struct mgmt_pending_cmd *cmd;
5676
5677         BT_DBG("status 0x%02x", status);
5678
5679         hci_dev_lock(hdev);
5680
5681         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5682         if (!cmd)
5683                 goto unlock;
5684
5685         cmd->cmd_complete(cmd, mgmt_status(status));
5686         mgmt_pending_remove(cmd);
5687
5688 unlock:
5689         hci_dev_unlock(hdev);
5690 }
5691
5692 static int add_device(struct sock *sk, struct hci_dev *hdev,
5693                       void *data, u16 len)
5694 {
5695         struct mgmt_cp_add_device *cp = data;
5696         struct mgmt_pending_cmd *cmd;
5697         struct hci_request req;
5698         u8 auto_conn, addr_type;
5699         int err;
5700
5701         BT_DBG("%s", hdev->name);
5702
5703         if (!bdaddr_type_is_valid(cp->addr.type) ||
5704             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5705                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5706                                          MGMT_STATUS_INVALID_PARAMS,
5707                                          &cp->addr, sizeof(cp->addr));
5708
5709         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5710                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5711                                          MGMT_STATUS_INVALID_PARAMS,
5712                                          &cp->addr, sizeof(cp->addr));
5713
5714         hci_req_init(&req, hdev);
5715
5716         hci_dev_lock(hdev);
5717
5718         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5719         if (!cmd) {
5720                 err = -ENOMEM;
5721                 goto unlock;
5722         }
5723
5724         cmd->cmd_complete = addr_cmd_complete;
5725
5726         if (cp->addr.type == BDADDR_BREDR) {
5727                 /* Only incoming connections action is supported for now */
5728                 if (cp->action != 0x01) {
5729                         err = cmd->cmd_complete(cmd,
5730                                                 MGMT_STATUS_INVALID_PARAMS);
5731                         mgmt_pending_remove(cmd);
5732                         goto unlock;
5733                 }
5734
5735                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5736                                           cp->addr.type);
5737                 if (err)
5738                         goto unlock;
5739
5740                 __hci_update_page_scan(&req);
5741
5742                 goto added;
5743         }
5744
5745         if (cp->addr.type == BDADDR_LE_PUBLIC)
5746                 addr_type = ADDR_LE_DEV_PUBLIC;
5747         else
5748                 addr_type = ADDR_LE_DEV_RANDOM;
5749
5750         if (cp->action == 0x02)
5751                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5752         else if (cp->action == 0x01)
5753                 auto_conn = HCI_AUTO_CONN_DIRECT;
5754         else
5755                 auto_conn = HCI_AUTO_CONN_REPORT;
5756
5757         /* If the connection parameters don't exist for this device,
5758          * they will be created and configured with defaults.
5759          */
5760         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5761                                 auto_conn) < 0) {
5762                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5763                 mgmt_pending_remove(cmd);
5764                 goto unlock;
5765         }
5766
5767 added:
5768         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5769
5770         err = hci_req_run(&req, add_device_complete);
5771         if (err < 0) {
5772                 /* ENODATA means no HCI commands were needed (e.g. if
5773                  * the adapter is powered off).
5774                  */
5775                 if (err == -ENODATA)
5776                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5777                 mgmt_pending_remove(cmd);
5778         }
5779
5780 unlock:
5781         hci_dev_unlock(hdev);
5782         return err;
5783 }
5784
5785 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5786                            bdaddr_t *bdaddr, u8 type)
5787 {
5788         struct mgmt_ev_device_removed ev;
5789
5790         bacpy(&ev.addr.bdaddr, bdaddr);
5791         ev.addr.type = type;
5792
5793         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5794 }
5795
5796 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5797 {
5798         struct mgmt_pending_cmd *cmd;
5799
5800         BT_DBG("status 0x%02x", status);
5801
5802         hci_dev_lock(hdev);
5803
5804         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5805         if (!cmd)
5806                 goto unlock;
5807
5808         cmd->cmd_complete(cmd, mgmt_status(status));
5809         mgmt_pending_remove(cmd);
5810
5811 unlock:
5812         hci_dev_unlock(hdev);
5813 }
5814
5815 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5816                          void *data, u16 len)
5817 {
5818         struct mgmt_cp_remove_device *cp = data;
5819         struct mgmt_pending_cmd *cmd;
5820         struct hci_request req;
5821         int err;
5822
5823         BT_DBG("%s", hdev->name);
5824
5825         hci_req_init(&req, hdev);
5826
5827         hci_dev_lock(hdev);
5828
5829         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5830         if (!cmd) {
5831                 err = -ENOMEM;
5832                 goto unlock;
5833         }
5834
5835         cmd->cmd_complete = addr_cmd_complete;
5836
5837         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5838                 struct hci_conn_params *params;
5839                 u8 addr_type;
5840
5841                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5842                         err = cmd->cmd_complete(cmd,
5843                                                 MGMT_STATUS_INVALID_PARAMS);
5844                         mgmt_pending_remove(cmd);
5845                         goto unlock;
5846                 }
5847
5848                 if (cp->addr.type == BDADDR_BREDR) {
5849                         err = hci_bdaddr_list_del(&hdev->whitelist,
5850                                                   &cp->addr.bdaddr,
5851                                                   cp->addr.type);
5852                         if (err) {
5853                                 err = cmd->cmd_complete(cmd,
5854                                                         MGMT_STATUS_INVALID_PARAMS);
5855                                 mgmt_pending_remove(cmd);
5856                                 goto unlock;
5857                         }
5858
5859                         __hci_update_page_scan(&req);
5860
5861                         device_removed(sk, hdev, &cp->addr.bdaddr,
5862                                        cp->addr.type);
5863                         goto complete;
5864                 }
5865
5866                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5867                         addr_type = ADDR_LE_DEV_PUBLIC;
5868                 else
5869                         addr_type = ADDR_LE_DEV_RANDOM;
5870
5871                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5872                                                 addr_type);
5873                 if (!params) {
5874                         err = cmd->cmd_complete(cmd,
5875                                                 MGMT_STATUS_INVALID_PARAMS);
5876                         mgmt_pending_remove(cmd);
5877                         goto unlock;
5878                 }
5879
5880                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5881                         err = cmd->cmd_complete(cmd,
5882                                                 MGMT_STATUS_INVALID_PARAMS);
5883                         mgmt_pending_remove(cmd);
5884                         goto unlock;
5885                 }
5886
5887                 list_del(&params->action);
5888                 list_del(&params->list);
5889                 kfree(params);
5890                 __hci_update_background_scan(&req);
5891
5892                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5893         } else {
5894                 struct hci_conn_params *p, *tmp;
5895                 struct bdaddr_list *b, *btmp;
5896
5897                 if (cp->addr.type) {
5898                         err = cmd->cmd_complete(cmd,
5899                                                 MGMT_STATUS_INVALID_PARAMS);
5900                         mgmt_pending_remove(cmd);
5901                         goto unlock;
5902                 }
5903
5904                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5905                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5906                         list_del(&b->list);
5907                         kfree(b);
5908                 }
5909
5910                 __hci_update_page_scan(&req);
5911
5912                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5913                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5914                                 continue;
5915                         device_removed(sk, hdev, &p->addr, p->addr_type);
5916                         list_del(&p->action);
5917                         list_del(&p->list);
5918                         kfree(p);
5919                 }
5920
5921                 BT_DBG("All LE connection parameters were removed");
5922
5923                 __hci_update_background_scan(&req);
5924         }
5925
5926 complete:
5927         err = hci_req_run(&req, remove_device_complete);
5928         if (err < 0) {
5929                 /* ENODATA means no HCI commands were needed (e.g. if
5930                  * the adapter is powered off).
5931                  */
5932                 if (err == -ENODATA)
5933                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5934                 mgmt_pending_remove(cmd);
5935         }
5936
5937 unlock:
5938         hci_dev_unlock(hdev);
5939         return err;
5940 }
5941
5942 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5943                            u16 len)
5944 {
5945         struct mgmt_cp_load_conn_param *cp = data;
5946         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5947                                      sizeof(struct mgmt_conn_param));
5948         u16 param_count, expected_len;
5949         int i;
5950
5951         if (!lmp_le_capable(hdev))
5952                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5953                                        MGMT_STATUS_NOT_SUPPORTED);
5954
5955         param_count = __le16_to_cpu(cp->param_count);
5956         if (param_count > max_param_count) {
5957                 BT_ERR("load_conn_param: too big param_count value %u",
5958                        param_count);
5959                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5960                                        MGMT_STATUS_INVALID_PARAMS);
5961         }
5962
5963         expected_len = sizeof(*cp) + param_count *
5964                                         sizeof(struct mgmt_conn_param);
5965         if (expected_len != len) {
5966                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5967                        expected_len, len);
5968                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5969                                        MGMT_STATUS_INVALID_PARAMS);
5970         }
5971
5972         BT_DBG("%s param_count %u", hdev->name, param_count);
5973
5974         hci_dev_lock(hdev);
5975
5976         hci_conn_params_clear_disabled(hdev);
5977
5978         for (i = 0; i < param_count; i++) {
5979                 struct mgmt_conn_param *param = &cp->params[i];
5980                 struct hci_conn_params *hci_param;
5981                 u16 min, max, latency, timeout;
5982                 u8 addr_type;
5983
5984                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5985                        param->addr.type);
5986
5987                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5988                         addr_type = ADDR_LE_DEV_PUBLIC;
5989                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5990                         addr_type = ADDR_LE_DEV_RANDOM;
5991                 } else {
5992                         BT_ERR("Ignoring invalid connection parameters");
5993                         continue;
5994                 }
5995
5996                 min = le16_to_cpu(param->min_interval);
5997                 max = le16_to_cpu(param->max_interval);
5998                 latency = le16_to_cpu(param->latency);
5999                 timeout = le16_to_cpu(param->timeout);
6000
6001                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6002                        min, max, latency, timeout);
6003
6004                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6005                         BT_ERR("Ignoring invalid connection parameters");
6006                         continue;
6007                 }
6008
6009                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6010                                                 addr_type);
6011                 if (!hci_param) {
6012                         BT_ERR("Failed to add connection parameters");
6013                         continue;
6014                 }
6015
6016                 hci_param->conn_min_interval = min;
6017                 hci_param->conn_max_interval = max;
6018                 hci_param->conn_latency = latency;
6019                 hci_param->supervision_timeout = timeout;
6020         }
6021
6022         hci_dev_unlock(hdev);
6023
6024         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6025                                  NULL, 0);
6026 }
6027
6028 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6029                                void *data, u16 len)
6030 {
6031         struct mgmt_cp_set_external_config *cp = data;
6032         bool changed;
6033         int err;
6034
6035         BT_DBG("%s", hdev->name);
6036
6037         if (hdev_is_powered(hdev))
6038                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6039                                        MGMT_STATUS_REJECTED);
6040
6041         if (cp->config != 0x00 && cp->config != 0x01)
6042                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6043                                          MGMT_STATUS_INVALID_PARAMS);
6044
6045         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6046                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6047                                        MGMT_STATUS_NOT_SUPPORTED);
6048
6049         hci_dev_lock(hdev);
6050
6051         if (cp->config)
6052                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6053         else
6054                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6055
6056         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6057         if (err < 0)
6058                 goto unlock;
6059
6060         if (!changed)
6061                 goto unlock;
6062
6063         err = new_options(hdev, sk);
6064
6065         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6066                 mgmt_index_removed(hdev);
6067
6068                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6069                         hci_dev_set_flag(hdev, HCI_CONFIG);
6070                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6071
6072                         queue_work(hdev->req_workqueue, &hdev->power_on);
6073                 } else {
6074                         set_bit(HCI_RAW, &hdev->flags);
6075                         mgmt_index_added(hdev);
6076                 }
6077         }
6078
6079 unlock:
6080         hci_dev_unlock(hdev);
6081         return err;
6082 }
6083
6084 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6085                               void *data, u16 len)
6086 {
6087         struct mgmt_cp_set_public_address *cp = data;
6088         bool changed;
6089         int err;
6090
6091         BT_DBG("%s", hdev->name);
6092
6093         if (hdev_is_powered(hdev))
6094                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6095                                        MGMT_STATUS_REJECTED);
6096
6097         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6098                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6099                                        MGMT_STATUS_INVALID_PARAMS);
6100
6101         if (!hdev->set_bdaddr)
6102                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6103                                        MGMT_STATUS_NOT_SUPPORTED);
6104
6105         hci_dev_lock(hdev);
6106
6107         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6108         bacpy(&hdev->public_addr, &cp->bdaddr);
6109
6110         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6111         if (err < 0)
6112                 goto unlock;
6113
6114         if (!changed)
6115                 goto unlock;
6116
6117         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6118                 err = new_options(hdev, sk);
6119
6120         if (is_configured(hdev)) {
6121                 mgmt_index_removed(hdev);
6122
6123                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6124
6125                 hci_dev_set_flag(hdev, HCI_CONFIG);
6126                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6127
6128                 queue_work(hdev->req_workqueue, &hdev->power_on);
6129         }
6130
6131 unlock:
6132         hci_dev_unlock(hdev);
6133         return err;
6134 }
6135
6136 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6137                                   u8 data_len)
6138 {
6139         eir[eir_len++] = sizeof(type) + data_len;
6140         eir[eir_len++] = type;
6141         memcpy(&eir[eir_len], data, data_len);
6142         eir_len += data_len;
6143
6144         return eir_len;
6145 }
6146
6147 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6148                                    void *data, u16 data_len)
6149 {
6150         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6151         struct mgmt_rp_read_local_oob_ext_data *rp;
6152         size_t rp_len;
6153         u16 eir_len;
6154         u8 status, flags, role, addr[7], hash[16], rand[16];
6155         int err;
6156
6157         BT_DBG("%s", hdev->name);
6158
6159         if (!hdev_is_powered(hdev))
6160                 return mgmt_cmd_complete(sk, hdev->id,
6161                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6162                                          MGMT_STATUS_NOT_POWERED,
6163                                          &cp->type, sizeof(cp->type));
6164
6165         switch (cp->type) {
6166         case BIT(BDADDR_BREDR):
6167                 status = mgmt_bredr_support(hdev);
6168                 if (status)
6169                         return mgmt_cmd_complete(sk, hdev->id,
6170                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6171                                                  status, &cp->type,
6172                                                  sizeof(cp->type));
6173                 eir_len = 5;
6174                 break;
6175         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6176                 status = mgmt_le_support(hdev);
6177                 if (status)
6178                         return mgmt_cmd_complete(sk, hdev->id,
6179                                                  MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6180                                                  status, &cp->type,
6181                                                  sizeof(cp->type));
6182                 eir_len = 9 + 3 + 18 + 18 + 3;
6183                 break;
6184         default:
6185                 return mgmt_cmd_complete(sk, hdev->id,
6186                                          MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6187                                          MGMT_STATUS_INVALID_PARAMS,
6188                                          &cp->type, sizeof(cp->type));
6189         }
6190
6191         hci_dev_lock(hdev);
6192
6193         rp_len = sizeof(*rp) + eir_len;
6194         rp = kmalloc(rp_len, GFP_ATOMIC);
6195         if (!rp) {
6196                 hci_dev_unlock(hdev);
6197                 return -ENOMEM;
6198         }
6199
6200         eir_len = 0;
6201         switch (cp->type) {
6202         case BIT(BDADDR_BREDR):
6203                 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6204                                           hdev->dev_class, 3);
6205                 break;
6206         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6207                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6208                     smp_generate_oob(hdev, hash, rand) < 0) {
6209                         hci_dev_unlock(hdev);
6210                         err = mgmt_cmd_complete(sk, hdev->id,
6211                                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6212                                                 MGMT_STATUS_FAILED,
6213                                                 &cp->type, sizeof(cp->type));
6214                         goto done;
6215                 }
6216
6217                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6218                         memcpy(addr, &hdev->rpa, 6);
6219                         addr[6] = 0x01;
6220                 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6221                            !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6222                            (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6223                             bacmp(&hdev->static_addr, BDADDR_ANY))) {
6224                         memcpy(addr, &hdev->static_addr, 6);
6225                         addr[6] = 0x01;
6226                 } else {
6227                         memcpy(addr, &hdev->bdaddr, 6);
6228                         addr[6] = 0x00;
6229                 }
6230
6231                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6232                                           addr, sizeof(addr));
6233
6234                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6235                         role = 0x02;
6236                 else
6237                         role = 0x01;
6238
6239                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6240                                           &role, sizeof(role));
6241
6242                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6243                         eir_len = eir_append_data(rp->eir, eir_len,
6244                                                   EIR_LE_SC_CONFIRM,
6245                                                   hash, sizeof(hash));
6246
6247                         eir_len = eir_append_data(rp->eir, eir_len,
6248                                                   EIR_LE_SC_RANDOM,
6249                                                   rand, sizeof(rand));
6250                 }
6251
6252                 flags = get_adv_discov_flags(hdev);
6253
6254                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6255                         flags |= LE_AD_NO_BREDR;
6256
6257                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6258                                           &flags, sizeof(flags));
6259                 break;
6260         }
6261
6262         rp->type = cp->type;
6263         rp->eir_len = cpu_to_le16(eir_len);
6264
6265         hci_dev_unlock(hdev);
6266
6267         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6268
6269         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6270                                 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
6271         if (err < 0)
6272                 goto done;
6273
6274         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6275                                  rp, sizeof(*rp) + eir_len,
6276                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6277
6278 done:
6279         kfree(rp);
6280
6281         return err;
6282 }
6283
6284 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6285                              void *data, u16 data_len)
6286 {
6287         struct mgmt_rp_read_adv_features *rp;
6288         size_t rp_len;
6289         int err;
6290
6291         BT_DBG("%s", hdev->name);
6292
6293         hci_dev_lock(hdev);
6294
6295         rp_len = sizeof(*rp);
6296         rp = kmalloc(rp_len, GFP_ATOMIC);
6297         if (!rp) {
6298                 hci_dev_unlock(hdev);
6299                 return -ENOMEM;
6300         }
6301
6302         rp->supported_flags = cpu_to_le32(0);
6303         rp->max_adv_data_len = 31;
6304         rp->max_scan_rsp_len = 31;
6305         rp->max_instances = 0;
6306         rp->num_instances = 0;
6307
6308         hci_dev_unlock(hdev);
6309
6310         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6311                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6312
6313         kfree(rp);
6314
6315         return err;
6316 }
6317
6318 static const struct hci_mgmt_handler mgmt_handlers[] = {
6319         { NULL }, /* 0x0000 (no command) */
6320         { read_version,            MGMT_READ_VERSION_SIZE,
6321                                                 HCI_MGMT_NO_HDEV |
6322                                                 HCI_MGMT_UNTRUSTED },
6323         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6324                                                 HCI_MGMT_NO_HDEV |
6325                                                 HCI_MGMT_UNTRUSTED },
6326         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6327                                                 HCI_MGMT_NO_HDEV |
6328                                                 HCI_MGMT_UNTRUSTED },
6329         { read_controller_info,    MGMT_READ_INFO_SIZE,
6330                                                 HCI_MGMT_UNTRUSTED },
6331         { set_powered,             MGMT_SETTING_SIZE },
6332         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6333         { set_connectable,         MGMT_SETTING_SIZE },
6334         { set_fast_connectable,    MGMT_SETTING_SIZE },
6335         { set_bondable,            MGMT_SETTING_SIZE },
6336         { set_link_security,       MGMT_SETTING_SIZE },
6337         { set_ssp,                 MGMT_SETTING_SIZE },
6338         { set_hs,                  MGMT_SETTING_SIZE },
6339         { set_le,                  MGMT_SETTING_SIZE },
6340         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6341         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6342         { add_uuid,                MGMT_ADD_UUID_SIZE },
6343         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6344         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6345                                                 HCI_MGMT_VAR_LEN },
6346         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6347                                                 HCI_MGMT_VAR_LEN },
6348         { disconnect,              MGMT_DISCONNECT_SIZE },
6349         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6350         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6351         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6352         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6353         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6354         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6355         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6356         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6357         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6358         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6359         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6360         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6361         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6362                                                 HCI_MGMT_VAR_LEN },
6363         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6364         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6365         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6366         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6367         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6368         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6369         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6370         { set_advertising,         MGMT_SETTING_SIZE },
6371         { set_bredr,               MGMT_SETTING_SIZE },
6372         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6373         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6374         { set_secure_conn,         MGMT_SETTING_SIZE },
6375         { set_debug_keys,          MGMT_SETTING_SIZE },
6376         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6377         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6378                                                 HCI_MGMT_VAR_LEN },
6379         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6380         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6381         { add_device,              MGMT_ADD_DEVICE_SIZE },
6382         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6383         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6384                                                 HCI_MGMT_VAR_LEN },
6385         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6386                                                 HCI_MGMT_NO_HDEV |
6387                                                 HCI_MGMT_UNTRUSTED },
6388         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6389                                                 HCI_MGMT_UNCONFIGURED |
6390                                                 HCI_MGMT_UNTRUSTED },
6391         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6392                                                 HCI_MGMT_UNCONFIGURED },
6393         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6394                                                 HCI_MGMT_UNCONFIGURED },
6395         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6396                                                 HCI_MGMT_VAR_LEN },
6397         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6398         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6399                                                 HCI_MGMT_NO_HDEV |
6400                                                 HCI_MGMT_UNTRUSTED },
6401         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6402 };
6403
6404 void mgmt_index_added(struct hci_dev *hdev)
6405 {
6406         struct mgmt_ev_ext_index ev;
6407
6408         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6409                 return;
6410
6411         switch (hdev->dev_type) {
6412         case HCI_BREDR:
6413                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6414                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6415                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6416                         ev.type = 0x01;
6417                 } else {
6418                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6419                                          HCI_MGMT_INDEX_EVENTS);
6420                         ev.type = 0x00;
6421                 }
6422                 break;
6423         case HCI_AMP:
6424                 ev.type = 0x02;
6425                 break;
6426         default:
6427                 return;
6428         }
6429
6430         ev.bus = hdev->bus;
6431
6432         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6433                          HCI_MGMT_EXT_INDEX_EVENTS);
6434 }
6435
6436 void mgmt_index_removed(struct hci_dev *hdev)
6437 {
6438         struct mgmt_ev_ext_index ev;
6439         u8 status = MGMT_STATUS_INVALID_INDEX;
6440
6441         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6442                 return;
6443
6444         switch (hdev->dev_type) {
6445         case HCI_BREDR:
6446                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6447
6448                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6449                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6450                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6451                         ev.type = 0x01;
6452                 } else {
6453                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6454                                          HCI_MGMT_INDEX_EVENTS);
6455                         ev.type = 0x00;
6456                 }
6457                 break;
6458         case HCI_AMP:
6459                 ev.type = 0x02;
6460                 break;
6461         default:
6462                 return;
6463         }
6464
6465         ev.bus = hdev->bus;
6466
6467         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6468                          HCI_MGMT_EXT_INDEX_EVENTS);
6469 }
6470
6471 /* This function requires the caller holds hdev->lock */
6472 static void restart_le_actions(struct hci_request *req)
6473 {
6474         struct hci_dev *hdev = req->hdev;
6475         struct hci_conn_params *p;
6476
6477         list_for_each_entry(p, &hdev->le_conn_params, list) {
6478                 /* Needed for AUTO_OFF case where might not "really"
6479                  * have been powered off.
6480                  */
6481                 list_del_init(&p->action);
6482
6483                 switch (p->auto_connect) {
6484                 case HCI_AUTO_CONN_DIRECT:
6485                 case HCI_AUTO_CONN_ALWAYS:
6486                         list_add(&p->action, &hdev->pend_le_conns);
6487                         break;
6488                 case HCI_AUTO_CONN_REPORT:
6489                         list_add(&p->action, &hdev->pend_le_reports);
6490                         break;
6491                 default:
6492                         break;
6493                 }
6494         }
6495
6496         __hci_update_background_scan(req);
6497 }
6498
6499 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6500 {
6501         struct cmd_lookup match = { NULL, hdev };
6502
6503         BT_DBG("status 0x%02x", status);
6504
6505         if (!status) {
6506                 /* Register the available SMP channels (BR/EDR and LE) only
6507                  * when successfully powering on the controller. This late
6508                  * registration is required so that LE SMP can clearly
6509                  * decide if the public address or static address is used.
6510                  */
6511                 smp_register(hdev);
6512         }
6513
6514         hci_dev_lock(hdev);
6515
6516         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6517
6518         new_settings(hdev, match.sk);
6519
6520         hci_dev_unlock(hdev);
6521
6522         if (match.sk)
6523                 sock_put(match.sk);
6524 }
6525
6526 static int powered_update_hci(struct hci_dev *hdev)
6527 {
6528         struct hci_request req;
6529         u8 link_sec;
6530
6531         hci_req_init(&req, hdev);
6532
6533         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
6534             !lmp_host_ssp_capable(hdev)) {
6535                 u8 mode = 0x01;
6536
6537                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6538
6539                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6540                         u8 support = 0x01;
6541
6542                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6543                                     sizeof(support), &support);
6544                 }
6545         }
6546
6547         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
6548             lmp_bredr_capable(hdev)) {
6549                 struct hci_cp_write_le_host_supported cp;
6550
6551                 cp.le = 0x01;
6552                 cp.simul = 0x00;
6553
6554                 /* Check first if we already have the right
6555                  * host state (host features set)
6556                  */
6557                 if (cp.le != lmp_host_le_capable(hdev) ||
6558                     cp.simul != lmp_host_le_br_capable(hdev))
6559                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6560                                     sizeof(cp), &cp);
6561         }
6562
6563         if (lmp_le_capable(hdev)) {
6564                 /* Make sure the controller has a good default for
6565                  * advertising data. This also applies to the case
6566                  * where BR/EDR was toggled during the AUTO_OFF phase.
6567                  */
6568                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
6569                         update_adv_data(&req);
6570                         update_scan_rsp_data(&req);
6571                 }
6572
6573                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6574                         enable_advertising(&req);
6575
6576                 restart_le_actions(&req);
6577         }
6578
6579         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
6580         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6581                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6582                             sizeof(link_sec), &link_sec);
6583
6584         if (lmp_bredr_capable(hdev)) {
6585                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
6586                         write_fast_connectable(&req, true);
6587                 else
6588                         write_fast_connectable(&req, false);
6589                 __hci_update_page_scan(&req);
6590                 update_class(&req);
6591                 update_name(&req);
6592                 update_eir(&req);
6593         }
6594
6595         return hci_req_run(&req, powered_complete);
6596 }
6597
6598 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6599 {
6600         struct cmd_lookup match = { NULL, hdev };
6601         u8 status, zero_cod[] = { 0, 0, 0 };
6602         int err;
6603
6604         if (!hci_dev_test_flag(hdev, HCI_MGMT))
6605                 return 0;
6606
6607         if (powered) {
6608                 if (powered_update_hci(hdev) == 0)
6609                         return 0;
6610
6611                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6612                                      &match);
6613                 goto new_settings;
6614         }
6615
6616         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6617
6618         /* If the power off is because of hdev unregistration let
6619          * use the appropriate INVALID_INDEX status. Otherwise use
6620          * NOT_POWERED. We cover both scenarios here since later in
6621          * mgmt_index_removed() any hci_conn callbacks will have already
6622          * been triggered, potentially causing misleading DISCONNECTED
6623          * status responses.
6624          */
6625         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6626                 status = MGMT_STATUS_INVALID_INDEX;
6627         else
6628                 status = MGMT_STATUS_NOT_POWERED;
6629
6630         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6631
6632         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6633                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6634                                    zero_cod, sizeof(zero_cod), NULL);
6635
6636 new_settings:
6637         err = new_settings(hdev, match.sk);
6638
6639         if (match.sk)
6640                 sock_put(match.sk);
6641
6642         return err;
6643 }
6644
6645 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6646 {
6647         struct mgmt_pending_cmd *cmd;
6648         u8 status;
6649
6650         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6651         if (!cmd)
6652                 return;
6653
6654         if (err == -ERFKILL)
6655                 status = MGMT_STATUS_RFKILLED;
6656         else
6657                 status = MGMT_STATUS_FAILED;
6658
6659         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6660
6661         mgmt_pending_remove(cmd);
6662 }
6663
6664 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6665 {
6666         struct hci_request req;
6667
6668         hci_dev_lock(hdev);
6669
6670         /* When discoverable timeout triggers, then just make sure
6671          * the limited discoverable flag is cleared. Even in the case
6672          * of a timeout triggered from general discoverable, it is
6673          * safe to unconditionally clear the flag.
6674          */
6675         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
6676         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6677
6678         hci_req_init(&req, hdev);
6679         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6680                 u8 scan = SCAN_PAGE;
6681                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6682                             sizeof(scan), &scan);
6683         }
6684         update_class(&req);
6685         update_adv_data(&req);
6686         hci_req_run(&req, NULL);
6687
6688         hdev->discov_timeout = 0;
6689
6690         new_settings(hdev, NULL);
6691
6692         hci_dev_unlock(hdev);
6693 }
6694
6695 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6696                        bool persistent)
6697 {
6698         struct mgmt_ev_new_link_key ev;
6699
6700         memset(&ev, 0, sizeof(ev));
6701
6702         ev.store_hint = persistent;
6703         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6704         ev.key.addr.type = BDADDR_BREDR;
6705         ev.key.type = key->type;
6706         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6707         ev.key.pin_len = key->pin_len;
6708
6709         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6710 }
6711
6712 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6713 {
6714         switch (ltk->type) {
6715         case SMP_LTK:
6716         case SMP_LTK_SLAVE:
6717                 if (ltk->authenticated)
6718                         return MGMT_LTK_AUTHENTICATED;
6719                 return MGMT_LTK_UNAUTHENTICATED;
6720         case SMP_LTK_P256:
6721                 if (ltk->authenticated)
6722                         return MGMT_LTK_P256_AUTH;
6723                 return MGMT_LTK_P256_UNAUTH;
6724         case SMP_LTK_P256_DEBUG:
6725                 return MGMT_LTK_P256_DEBUG;
6726         }
6727
6728         return MGMT_LTK_UNAUTHENTICATED;
6729 }
6730
6731 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6732 {
6733         struct mgmt_ev_new_long_term_key ev;
6734
6735         memset(&ev, 0, sizeof(ev));
6736
6737         /* Devices using resolvable or non-resolvable random addresses
6738          * without providing an indentity resolving key don't require
6739          * to store long term keys. Their addresses will change the
6740          * next time around.
6741          *
6742          * Only when a remote device provides an identity address
6743          * make sure the long term key is stored. If the remote
6744          * identity is known, the long term keys are internally
6745          * mapped to the identity address. So allow static random
6746          * and public addresses here.
6747          */
6748         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6749             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6750                 ev.store_hint = 0x00;
6751         else
6752                 ev.store_hint = persistent;
6753
6754         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6755         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6756         ev.key.type = mgmt_ltk_type(key);
6757         ev.key.enc_size = key->enc_size;
6758         ev.key.ediv = key->ediv;
6759         ev.key.rand = key->rand;
6760
6761         if (key->type == SMP_LTK)
6762                 ev.key.master = 1;
6763
6764         memcpy(ev.key.val, key->val, sizeof(key->val));
6765
6766         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6767 }
6768
6769 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6770 {
6771         struct mgmt_ev_new_irk ev;
6772
6773         memset(&ev, 0, sizeof(ev));
6774
6775         /* For identity resolving keys from devices that are already
6776          * using a public address or static random address, do not
6777          * ask for storing this key. The identity resolving key really
6778          * is only mandatory for devices using resovlable random
6779          * addresses.
6780          *
6781          * Storing all identity resolving keys has the downside that
6782          * they will be also loaded on next boot of they system. More
6783          * identity resolving keys, means more time during scanning is
6784          * needed to actually resolve these addresses.
6785          */
6786         if (bacmp(&irk->rpa, BDADDR_ANY))
6787                 ev.store_hint = 0x01;
6788         else
6789                 ev.store_hint = 0x00;
6790
6791         bacpy(&ev.rpa, &irk->rpa);
6792         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6793         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6794         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6795
6796         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6797 }
6798
6799 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6800                    bool persistent)
6801 {
6802         struct mgmt_ev_new_csrk ev;
6803
6804         memset(&ev, 0, sizeof(ev));
6805
6806         /* Devices using resolvable or non-resolvable random addresses
6807          * without providing an indentity resolving key don't require
6808          * to store signature resolving keys. Their addresses will change
6809          * the next time around.
6810          *
6811          * Only when a remote device provides an identity address
6812          * make sure the signature resolving key is stored. So allow
6813          * static random and public addresses here.
6814          */
6815         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6816             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6817                 ev.store_hint = 0x00;
6818         else
6819                 ev.store_hint = persistent;
6820
6821         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6822         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6823         ev.key.type = csrk->type;
6824         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6825
6826         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6827 }
6828
6829 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6830                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6831                          u16 max_interval, u16 latency, u16 timeout)
6832 {
6833         struct mgmt_ev_new_conn_param ev;
6834
6835         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6836                 return;
6837
6838         memset(&ev, 0, sizeof(ev));
6839         bacpy(&ev.addr.bdaddr, bdaddr);
6840         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6841         ev.store_hint = store_hint;
6842         ev.min_interval = cpu_to_le16(min_interval);
6843         ev.max_interval = cpu_to_le16(max_interval);
6844         ev.latency = cpu_to_le16(latency);
6845         ev.timeout = cpu_to_le16(timeout);
6846
6847         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6848 }
6849
6850 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6851                            u32 flags, u8 *name, u8 name_len)
6852 {
6853         char buf[512];
6854         struct mgmt_ev_device_connected *ev = (void *) buf;
6855         u16 eir_len = 0;
6856
6857         bacpy(&ev->addr.bdaddr, &conn->dst);
6858         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6859
6860         ev->flags = __cpu_to_le32(flags);
6861
6862         /* We must ensure that the EIR Data fields are ordered and
6863          * unique. Keep it simple for now and avoid the problem by not
6864          * adding any BR/EDR data to the LE adv.
6865          */
6866         if (conn->le_adv_data_len > 0) {
6867                 memcpy(&ev->eir[eir_len],
6868                        conn->le_adv_data, conn->le_adv_data_len);
6869                 eir_len = conn->le_adv_data_len;
6870         } else {
6871                 if (name_len > 0)
6872                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6873                                                   name, name_len);
6874
6875                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6876                         eir_len = eir_append_data(ev->eir, eir_len,
6877                                                   EIR_CLASS_OF_DEV,
6878                                                   conn->dev_class, 3);
6879         }
6880
6881         ev->eir_len = cpu_to_le16(eir_len);
6882
6883         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6884                     sizeof(*ev) + eir_len, NULL);
6885 }
6886
6887 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6888 {
6889         struct sock **sk = data;
6890
6891         cmd->cmd_complete(cmd, 0);
6892
6893         *sk = cmd->sk;
6894         sock_hold(*sk);
6895
6896         mgmt_pending_remove(cmd);
6897 }
6898
6899 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6900 {
6901         struct hci_dev *hdev = data;
6902         struct mgmt_cp_unpair_device *cp = cmd->param;
6903
6904         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6905
6906         cmd->cmd_complete(cmd, 0);
6907         mgmt_pending_remove(cmd);
6908 }
6909
6910 bool mgmt_powering_down(struct hci_dev *hdev)
6911 {
6912         struct mgmt_pending_cmd *cmd;
6913         struct mgmt_mode *cp;
6914
6915         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6916         if (!cmd)
6917                 return false;
6918
6919         cp = cmd->param;
6920         if (!cp->val)
6921                 return true;
6922
6923         return false;
6924 }
6925
6926 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6927                               u8 link_type, u8 addr_type, u8 reason,
6928                               bool mgmt_connected)
6929 {
6930         struct mgmt_ev_device_disconnected ev;
6931         struct sock *sk = NULL;
6932
6933         /* The connection is still in hci_conn_hash so test for 1
6934          * instead of 0 to know if this is the last one.
6935          */
6936         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6937                 cancel_delayed_work(&hdev->power_off);
6938                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6939         }
6940
6941         if (!mgmt_connected)
6942                 return;
6943
6944         if (link_type != ACL_LINK && link_type != LE_LINK)
6945                 return;
6946
6947         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6948
6949         bacpy(&ev.addr.bdaddr, bdaddr);
6950         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6951         ev.reason = reason;
6952
6953         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6954
6955         if (sk)
6956                 sock_put(sk);
6957
6958         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6959                              hdev);
6960 }
6961
6962 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6963                             u8 link_type, u8 addr_type, u8 status)
6964 {
6965         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6966         struct mgmt_cp_disconnect *cp;
6967         struct mgmt_pending_cmd *cmd;
6968
6969         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6970                              hdev);
6971
6972         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6973         if (!cmd)
6974                 return;
6975
6976         cp = cmd->param;
6977
6978         if (bacmp(bdaddr, &cp->addr.bdaddr))
6979                 return;
6980
6981         if (cp->addr.type != bdaddr_type)
6982                 return;
6983
6984         cmd->cmd_complete(cmd, mgmt_status(status));
6985         mgmt_pending_remove(cmd);
6986 }
6987
6988 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6989                          u8 addr_type, u8 status)
6990 {
6991         struct mgmt_ev_connect_failed ev;
6992
6993         /* The connection is still in hci_conn_hash so test for 1
6994          * instead of 0 to know if this is the last one.
6995          */
6996         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6997                 cancel_delayed_work(&hdev->power_off);
6998                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6999         }
7000
7001         bacpy(&ev.addr.bdaddr, bdaddr);
7002         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7003         ev.status = mgmt_status(status);
7004
7005         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7006 }
7007
7008 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7009 {
7010         struct mgmt_ev_pin_code_request ev;
7011
7012         bacpy(&ev.addr.bdaddr, bdaddr);
7013         ev.addr.type = BDADDR_BREDR;
7014         ev.secure = secure;
7015
7016         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7017 }
7018
7019 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7020                                   u8 status)
7021 {
7022         struct mgmt_pending_cmd *cmd;
7023
7024         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7025         if (!cmd)
7026                 return;
7027
7028         cmd->cmd_complete(cmd, mgmt_status(status));
7029         mgmt_pending_remove(cmd);
7030 }
7031
7032 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7033                                       u8 status)
7034 {
7035         struct mgmt_pending_cmd *cmd;
7036
7037         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7038         if (!cmd)
7039                 return;
7040
7041         cmd->cmd_complete(cmd, mgmt_status(status));
7042         mgmt_pending_remove(cmd);
7043 }
7044
7045 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7046                               u8 link_type, u8 addr_type, u32 value,
7047                               u8 confirm_hint)
7048 {
7049         struct mgmt_ev_user_confirm_request ev;
7050
7051         BT_DBG("%s", hdev->name);
7052
7053         bacpy(&ev.addr.bdaddr, bdaddr);
7054         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7055         ev.confirm_hint = confirm_hint;
7056         ev.value = cpu_to_le32(value);
7057
7058         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7059                           NULL);
7060 }
7061
7062 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7063                               u8 link_type, u8 addr_type)
7064 {
7065         struct mgmt_ev_user_passkey_request ev;
7066
7067         BT_DBG("%s", hdev->name);
7068
7069         bacpy(&ev.addr.bdaddr, bdaddr);
7070         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7071
7072         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7073                           NULL);
7074 }
7075
7076 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7077                                       u8 link_type, u8 addr_type, u8 status,
7078                                       u8 opcode)
7079 {
7080         struct mgmt_pending_cmd *cmd;
7081
7082         cmd = pending_find(opcode, hdev);
7083         if (!cmd)
7084                 return -ENOENT;
7085
7086         cmd->cmd_complete(cmd, mgmt_status(status));
7087         mgmt_pending_remove(cmd);
7088
7089         return 0;
7090 }
7091
7092 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7093                                      u8 link_type, u8 addr_type, u8 status)
7094 {
7095         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7096                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7097 }
7098
7099 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7100                                          u8 link_type, u8 addr_type, u8 status)
7101 {
7102         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7103                                           status,
7104                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7105 }
7106
7107 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7108                                      u8 link_type, u8 addr_type, u8 status)
7109 {
7110         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7111                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7112 }
7113
7114 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7115                                          u8 link_type, u8 addr_type, u8 status)
7116 {
7117         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7118                                           status,
7119                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7120 }
7121
7122 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7123                              u8 link_type, u8 addr_type, u32 passkey,
7124                              u8 entered)
7125 {
7126         struct mgmt_ev_passkey_notify ev;
7127
7128         BT_DBG("%s", hdev->name);
7129
7130         bacpy(&ev.addr.bdaddr, bdaddr);
7131         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7132         ev.passkey = __cpu_to_le32(passkey);
7133         ev.entered = entered;
7134
7135         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7136 }
7137
7138 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7139 {
7140         struct mgmt_ev_auth_failed ev;
7141         struct mgmt_pending_cmd *cmd;
7142         u8 status = mgmt_status(hci_status);
7143
7144         bacpy(&ev.addr.bdaddr, &conn->dst);
7145         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7146         ev.status = status;
7147
7148         cmd = find_pairing(conn);
7149
7150         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7151                     cmd ? cmd->sk : NULL);
7152
7153         if (cmd) {
7154                 cmd->cmd_complete(cmd, status);
7155                 mgmt_pending_remove(cmd);
7156         }
7157 }
7158
7159 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7160 {
7161         struct cmd_lookup match = { NULL, hdev };
7162         bool changed;
7163
7164         if (status) {
7165                 u8 mgmt_err = mgmt_status(status);
7166                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7167                                      cmd_status_rsp, &mgmt_err);
7168                 return;
7169         }
7170
7171         if (test_bit(HCI_AUTH, &hdev->flags))
7172                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7173         else
7174                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7175
7176         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7177                              &match);
7178
7179         if (changed)
7180                 new_settings(hdev, match.sk);
7181
7182         if (match.sk)
7183                 sock_put(match.sk);
7184 }
7185
7186 static void clear_eir(struct hci_request *req)
7187 {
7188         struct hci_dev *hdev = req->hdev;
7189         struct hci_cp_write_eir cp;
7190
7191         if (!lmp_ext_inq_capable(hdev))
7192                 return;
7193
7194         memset(hdev->eir, 0, sizeof(hdev->eir));
7195
7196         memset(&cp, 0, sizeof(cp));
7197
7198         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7199 }
7200
7201 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7202 {
7203         struct cmd_lookup match = { NULL, hdev };
7204         struct hci_request req;
7205         bool changed = false;
7206
7207         if (status) {
7208                 u8 mgmt_err = mgmt_status(status);
7209
7210                 if (enable && hci_dev_test_and_clear_flag(hdev,
7211                                                           HCI_SSP_ENABLED)) {
7212                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7213                         new_settings(hdev, NULL);
7214                 }
7215
7216                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7217                                      &mgmt_err);
7218                 return;
7219         }
7220
7221         if (enable) {
7222                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7223         } else {
7224                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7225                 if (!changed)
7226                         changed = hci_dev_test_and_clear_flag(hdev,
7227                                                               HCI_HS_ENABLED);
7228                 else
7229                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7230         }
7231
7232         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7233
7234         if (changed)
7235                 new_settings(hdev, match.sk);
7236
7237         if (match.sk)
7238                 sock_put(match.sk);
7239
7240         hci_req_init(&req, hdev);
7241
7242         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7243                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7244                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7245                                     sizeof(enable), &enable);
7246                 update_eir(&req);
7247         } else {
7248                 clear_eir(&req);
7249         }
7250
7251         hci_req_run(&req, NULL);
7252 }
7253
7254 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7255 {
7256         struct cmd_lookup *match = data;
7257
7258         if (match->sk == NULL) {
7259                 match->sk = cmd->sk;
7260                 sock_hold(match->sk);
7261         }
7262 }
7263
7264 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7265                                     u8 status)
7266 {
7267         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7268
7269         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7270         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7271         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7272
7273         if (!status)
7274                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7275                                    dev_class, 3, NULL);
7276
7277         if (match.sk)
7278                 sock_put(match.sk);
7279 }
7280
7281 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7282 {
7283         struct mgmt_cp_set_local_name ev;
7284         struct mgmt_pending_cmd *cmd;
7285
7286         if (status)
7287                 return;
7288
7289         memset(&ev, 0, sizeof(ev));
7290         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7291         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7292
7293         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7294         if (!cmd) {
7295                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7296
7297                 /* If this is a HCI command related to powering on the
7298                  * HCI dev don't send any mgmt signals.
7299                  */
7300                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7301                         return;
7302         }
7303
7304         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7305                            cmd ? cmd->sk : NULL);
7306 }
7307
7308 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7309                                        u8 *rand192, u8 *hash256, u8 *rand256,
7310                                        u8 status)
7311 {
7312         struct mgmt_pending_cmd *cmd;
7313
7314         BT_DBG("%s status %u", hdev->name, status);
7315
7316         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7317         if (!cmd)
7318                 return;
7319
7320         if (status) {
7321                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7322                                 mgmt_status(status));
7323         } else {
7324                 struct mgmt_rp_read_local_oob_data rp;
7325                 size_t rp_size = sizeof(rp);
7326
7327                 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7328                 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7329
7330                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7331                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7332                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7333                 } else {
7334                         rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
7335                 }
7336
7337                 mgmt_cmd_complete(cmd->sk, hdev->id,
7338                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7339                                   &rp, rp_size);
7340         }
7341
7342         mgmt_pending_remove(cmd);
7343 }
7344
7345 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7346 {
7347         int i;
7348
7349         for (i = 0; i < uuid_count; i++) {
7350                 if (!memcmp(uuid, uuids[i], 16))
7351                         return true;
7352         }
7353
7354         return false;
7355 }
7356
7357 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7358 {
7359         u16 parsed = 0;
7360
7361         while (parsed < eir_len) {
7362                 u8 field_len = eir[0];
7363                 u8 uuid[16];
7364                 int i;
7365
7366                 if (field_len == 0)
7367                         break;
7368
7369                 if (eir_len - parsed < field_len + 1)
7370                         break;
7371
7372                 switch (eir[1]) {
7373                 case EIR_UUID16_ALL:
7374                 case EIR_UUID16_SOME:
7375                         for (i = 0; i + 3 <= field_len; i += 2) {
7376                                 memcpy(uuid, bluetooth_base_uuid, 16);
7377                                 uuid[13] = eir[i + 3];
7378                                 uuid[12] = eir[i + 2];
7379                                 if (has_uuid(uuid, uuid_count, uuids))
7380                                         return true;
7381                         }
7382                         break;
7383                 case EIR_UUID32_ALL:
7384                 case EIR_UUID32_SOME:
7385                         for (i = 0; i + 5 <= field_len; i += 4) {
7386                                 memcpy(uuid, bluetooth_base_uuid, 16);
7387                                 uuid[15] = eir[i + 5];
7388                                 uuid[14] = eir[i + 4];
7389                                 uuid[13] = eir[i + 3];
7390                                 uuid[12] = eir[i + 2];
7391                                 if (has_uuid(uuid, uuid_count, uuids))
7392                                         return true;
7393                         }
7394                         break;
7395                 case EIR_UUID128_ALL:
7396                 case EIR_UUID128_SOME:
7397                         for (i = 0; i + 17 <= field_len; i += 16) {
7398                                 memcpy(uuid, eir + i + 2, 16);
7399                                 if (has_uuid(uuid, uuid_count, uuids))
7400                                         return true;
7401                         }
7402                         break;
7403                 }
7404
7405                 parsed += field_len + 1;
7406                 eir += field_len + 1;
7407         }
7408
7409         return false;
7410 }
7411
7412 static void restart_le_scan(struct hci_dev *hdev)
7413 {
7414         /* If controller is not scanning we are done. */
7415         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7416                 return;
7417
7418         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7419                        hdev->discovery.scan_start +
7420                        hdev->discovery.scan_duration))
7421                 return;
7422
7423         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7424                            DISCOV_LE_RESTART_DELAY);
7425 }
7426
7427 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7428                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7429 {
7430         /* If a RSSI threshold has been specified, and
7431          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7432          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7433          * is set, let it through for further processing, as we might need to
7434          * restart the scan.
7435          *
7436          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7437          * the results are also dropped.
7438          */
7439         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7440             (rssi == HCI_RSSI_INVALID ||
7441             (rssi < hdev->discovery.rssi &&
7442              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7443                 return  false;
7444
7445         if (hdev->discovery.uuid_count != 0) {
7446                 /* If a list of UUIDs is provided in filter, results with no
7447                  * matching UUID should be dropped.
7448                  */
7449                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7450                                    hdev->discovery.uuids) &&
7451                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7452                                    hdev->discovery.uuid_count,
7453                                    hdev->discovery.uuids))
7454                         return false;
7455         }
7456
7457         /* If duplicate filtering does not report RSSI changes, then restart
7458          * scanning to ensure updated result with updated RSSI values.
7459          */
7460         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7461                 restart_le_scan(hdev);
7462
7463                 /* Validate RSSI value against the RSSI threshold once more. */
7464                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7465                     rssi < hdev->discovery.rssi)
7466                         return false;
7467         }
7468
7469         return true;
7470 }
7471
7472 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7473                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7474                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7475 {
7476         char buf[512];
7477         struct mgmt_ev_device_found *ev = (void *)buf;
7478         size_t ev_size;
7479
7480         /* Don't send events for a non-kernel initiated discovery. With
7481          * LE one exception is if we have pend_le_reports > 0 in which
7482          * case we're doing passive scanning and want these events.
7483          */
7484         if (!hci_discovery_active(hdev)) {
7485                 if (link_type == ACL_LINK)
7486                         return;
7487                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7488                         return;
7489         }
7490
7491         if (hdev->discovery.result_filtering) {
7492                 /* We are using service discovery */
7493                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7494                                      scan_rsp_len))
7495                         return;
7496         }
7497
7498         /* Make sure that the buffer is big enough. The 5 extra bytes
7499          * are for the potential CoD field.
7500          */
7501         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7502                 return;
7503
7504         memset(buf, 0, sizeof(buf));
7505
7506         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7507          * RSSI value was reported as 0 when not available. This behavior
7508          * is kept when using device discovery. This is required for full
7509          * backwards compatibility with the API.
7510          *
7511          * However when using service discovery, the value 127 will be
7512          * returned when the RSSI is not available.
7513          */
7514         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7515             link_type == ACL_LINK)
7516                 rssi = 0;
7517
7518         bacpy(&ev->addr.bdaddr, bdaddr);
7519         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7520         ev->rssi = rssi;
7521         ev->flags = cpu_to_le32(flags);
7522
7523         if (eir_len > 0)
7524                 /* Copy EIR or advertising data into event */
7525                 memcpy(ev->eir, eir, eir_len);
7526
7527         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7528                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7529                                           dev_class, 3);
7530
7531         if (scan_rsp_len > 0)
7532                 /* Append scan response data to event */
7533                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7534
7535         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7536         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7537
7538         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7539 }
7540
7541 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7542                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7543 {
7544         struct mgmt_ev_device_found *ev;
7545         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7546         u16 eir_len;
7547
7548         ev = (struct mgmt_ev_device_found *) buf;
7549
7550         memset(buf, 0, sizeof(buf));
7551
7552         bacpy(&ev->addr.bdaddr, bdaddr);
7553         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7554         ev->rssi = rssi;
7555
7556         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7557                                   name_len);
7558
7559         ev->eir_len = cpu_to_le16(eir_len);
7560
7561         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7562 }
7563
7564 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7565 {
7566         struct mgmt_ev_discovering ev;
7567
7568         BT_DBG("%s discovering %u", hdev->name, discovering);
7569
7570         memset(&ev, 0, sizeof(ev));
7571         ev.type = hdev->discovery.type;
7572         ev.discovering = discovering;
7573
7574         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7575 }
7576
7577 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7578 {
7579         BT_DBG("%s status %u", hdev->name, status);
7580 }
7581
7582 void mgmt_reenable_advertising(struct hci_dev *hdev)
7583 {
7584         struct hci_request req;
7585
7586         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
7587                 return;
7588
7589         hci_req_init(&req, hdev);
7590         enable_advertising(&req);
7591         hci_req_run(&req, adv_enable_complete);
7592 }
7593
7594 static struct hci_mgmt_chan chan = {
7595         .channel        = HCI_CHANNEL_CONTROL,
7596         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7597         .handlers       = mgmt_handlers,
7598         .hdev_init      = mgmt_init_hdev,
7599 };
7600
7601 int mgmt_init(void)
7602 {
7603         return hci_mgmt_chan_register(&chan);
7604 }
7605
7606 void mgmt_exit(void)
7607 {
7608         hci_mgmt_chan_unregister(&chan);
7609 }