net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   9
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = cpu_to_le16(MGMT_REVISION);
 280
 281         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 282                                  &rp, sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         u16 num_commands, num_events;
 290         size_t rp_size;
 291         int i, err;
 292
 293         BT_DBG("sock %p", sk);
 294
 295         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 296                 num_commands = ARRAY_SIZE(mgmt_commands);
 297                 num_events = ARRAY_SIZE(mgmt_events);
 298         } else {
 299                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 300                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 301         }
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 313                 __le16 *opcode = rp->opcodes;
 314
 315                 for (i = 0; i < num_commands; i++, opcode++)
 316                         put_unaligned_le16(mgmt_commands[i], opcode);
 317
 318                 for (i = 0; i < num_events; i++, opcode++)
 319                         put_unaligned_le16(mgmt_events[i], opcode);
 320         } else {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 328         }
 329
 330         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 331                                 rp, rp_size);
 332         kfree(rp);
 333
 334         return err;
 335 }
 336
 337 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 338                            u16 data_len)
 339 {
 340         struct mgmt_rp_read_index_list *rp;
 341         struct hci_dev *d;
 342         size_t rp_len;
 343         u16 count;
 344         int err;
 345
 346         BT_DBG("sock %p", sk);
 347
 348         read_lock(&hci_dev_list_lock);
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (d->dev_type == HCI_BREDR &&
 353                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 354                         count++;
 355         }
 356
 357         rp_len = sizeof(*rp) + (2 * count);
 358         rp = kmalloc(rp_len, GFP_ATOMIC);
 359         if (!rp) {
 360                 read_unlock(&hci_dev_list_lock);
 361                 return -ENOMEM;
 362         }
 363
 364         count = 0;
 365         list_for_each_entry(d, &hci_dev_list, list) {
 366                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 367                     hci_dev_test_flag(d, HCI_CONFIG) ||
 368                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 369                         continue;
 370
 371                 /* Devices marked as raw-only are neither configured
 372                  * nor unconfigured controllers.
 373                  */
 374                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 375                         continue;
 376
 377                 if (d->dev_type == HCI_BREDR &&
 378                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 379                         rp->index[count++] = cpu_to_le16(d->id);
 380                         BT_DBG("Added hci%u", d->id);
 381                 }
 382         }
 383
 384         rp->num_controllers = cpu_to_le16(count);
 385         rp_len = sizeof(*rp) + (2 * count);
 386
 387         read_unlock(&hci_dev_list_lock);
 388
 389         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 390                                 0, rp, rp_len);
 391
 392         kfree(rp);
 393
 394         return err;
 395 }
 396
 397 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 398                                   void *data, u16 data_len)
 399 {
 400         struct mgmt_rp_read_unconf_index_list *rp;
 401         struct hci_dev *d;
 402         size_t rp_len;
 403         u16 count;
 404         int err;
 405
 406         BT_DBG("sock %p", sk);
 407
 408         read_lock(&hci_dev_list_lock);
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (d->dev_type == HCI_BREDR &&
 413                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 414                         count++;
 415         }
 416
 417         rp_len = sizeof(*rp) + (2 * count);
 418         rp = kmalloc(rp_len, GFP_ATOMIC);
 419         if (!rp) {
 420                 read_unlock(&hci_dev_list_lock);
 421                 return -ENOMEM;
 422         }
 423
 424         count = 0;
 425         list_for_each_entry(d, &hci_dev_list, list) {
 426                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 427                     hci_dev_test_flag(d, HCI_CONFIG) ||
 428                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 429                         continue;
 430
 431                 /* Devices marked as raw-only are neither configured
 432                  * nor unconfigured controllers.
 433                  */
 434                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 435                         continue;
 436
 437                 if (d->dev_type == HCI_BREDR &&
 438                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 439                         rp->index[count++] = cpu_to_le16(d->id);
 440                         BT_DBG("Added hci%u", d->id);
 441                 }
 442         }
 443
 444         rp->num_controllers = cpu_to_le16(count);
 445         rp_len = sizeof(*rp) + (2 * count);
 446
 447         read_unlock(&hci_dev_list_lock);
 448
 449         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 450                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 451
 452         kfree(rp);
 453
 454         return err;
 455 }
 456
 457 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 458                                void *data, u16 data_len)
 459 {
 460         struct mgmt_rp_read_ext_index_list *rp;
 461         struct hci_dev *d;
 462         size_t rp_len;
 463         u16 count;
 464         int err;
 465
 466         BT_DBG("sock %p", sk);
 467
 468         read_lock(&hci_dev_list_lock);
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 473                         count++;
 474         }
 475
 476         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 477         rp = kmalloc(rp_len, GFP_ATOMIC);
 478         if (!rp) {
 479                 read_unlock(&hci_dev_list_lock);
 480                 return -ENOMEM;
 481         }
 482
 483         count = 0;
 484         list_for_each_entry(d, &hci_dev_list, list) {
 485                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 486                     hci_dev_test_flag(d, HCI_CONFIG) ||
 487                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 488                         continue;
 489
 490                 /* Devices marked as raw-only are neither configured
 491                  * nor unconfigured controllers.
 492                  */
 493                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 494                         continue;
 495
 496                 if (d->dev_type == HCI_BREDR) {
 497                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 498                                 rp->entry[count].type = 0x01;
 499                         else
 500                                 rp->entry[count].type = 0x00;
 501                 } else if (d->dev_type == HCI_AMP) {
 502                         rp->entry[count].type = 0x02;
 503                 } else {
 504                         continue;
 505                 }
 506
 507                 rp->entry[count].bus = d->bus;
 508                 rp->entry[count++].index = cpu_to_le16(d->id);
 509                 BT_DBG("Added hci%u", d->id);
 510         }
 511
 512         rp->num_controllers = cpu_to_le16(count);
 513         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 514
 515         read_unlock(&hci_dev_list_lock);
 516
 517         /* If this command is called at least once, then all the
 518          * default index and unconfigured index events are disabled
 519          * and from now on only extended index events are used.
 520          */
 521         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 522         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 523         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 524
 525         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 526                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 527
 528         kfree(rp);
 529
 530         return err;
 531 }
 532
 533 static bool is_configured(struct hci_dev *hdev)
 534 {
 535         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 536             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 537                 return false;
 538
 539         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 540             !bacmp(&hdev->public_addr, BDADDR_ANY))
 541                 return false;
 542
 543         return true;
 544 }
 545
 546 static __le32 get_missing_options(struct hci_dev *hdev)
 547 {
 548         u32 options = 0;
 549
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 557
 558         return cpu_to_le32(options);
 559 }
 560
 561 static int new_options(struct hci_dev *hdev, struct sock *skip)
 562 {
 563         __le32 options = get_missing_options(hdev);
 564
 565         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 566                                   sizeof(options), skip);
 567 }
 568
 569 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 574                                  sizeof(options));
 575 }
 576
 577 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 578                             void *data, u16 data_len)
 579 {
 580         struct mgmt_rp_read_config_info rp;
 581         u32 options = 0;
 582
 583         BT_DBG("sock %p %s", sk, hdev->name);
 584
 585         hci_dev_lock(hdev);
 586
 587         memset(&rp, 0, sizeof(rp));
 588         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 589
 590         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 591                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 592
 593         if (hdev->set_bdaddr)
 594                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 595
 596         rp.supported_options = cpu_to_le32(options);
 597         rp.missing_options = get_missing_options(hdev);
 598
 599         hci_dev_unlock(hdev);
 600
 601         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 602                                  &rp, sizeof(rp));
 603 }
 604
 605 static u32 get_supported_settings(struct hci_dev *hdev)
 606 {
 607         u32 settings = 0;
 608
 609         settings |= MGMT_SETTING_POWERED;
 610         settings |= MGMT_SETTING_BONDABLE;
 611         settings |= MGMT_SETTING_DEBUG_KEYS;
 612         settings |= MGMT_SETTING_CONNECTABLE;
 613         settings |= MGMT_SETTING_DISCOVERABLE;
 614
 615         if (lmp_bredr_capable(hdev)) {
 616                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 617                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 618                 settings |= MGMT_SETTING_BREDR;
 619                 settings |= MGMT_SETTING_LINK_SECURITY;
 620
 621                 if (lmp_ssp_capable(hdev)) {
 622                         settings |= MGMT_SETTING_SSP;
 623                         settings |= MGMT_SETTING_HS;
 624                 }
 625
 626                 if (lmp_sc_capable(hdev))
 627                         settings |= MGMT_SETTING_SECURE_CONN;
 628         }
 629
 630         if (lmp_le_capable(hdev)) {
 631                 settings |= MGMT_SETTING_LE;
 632                 settings |= MGMT_SETTING_ADVERTISING;
 633                 settings |= MGMT_SETTING_SECURE_CONN;
 634                 settings |= MGMT_SETTING_PRIVACY;
 635                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 636         }
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 639             hdev->set_bdaddr)
 640                 settings |= MGMT_SETTING_CONFIGURATION;
 641
 642         return settings;
 643 }
 644
 645 static u32 get_current_settings(struct hci_dev *hdev)
 646 {
 647         u32 settings = 0;
 648
 649         if (hdev_is_powered(hdev))
 650                 settings |= MGMT_SETTING_POWERED;
 651
 652         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 653                 settings |= MGMT_SETTING_CONNECTABLE;
 654
 655         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 656                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 657
 658         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 659                 settings |= MGMT_SETTING_DISCOVERABLE;
 660
 661         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 662                 settings |= MGMT_SETTING_BONDABLE;
 663
 664         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 665                 settings |= MGMT_SETTING_BREDR;
 666
 667         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 668                 settings |= MGMT_SETTING_LE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 671                 settings |= MGMT_SETTING_LINK_SECURITY;
 672
 673         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 674                 settings |= MGMT_SETTING_SSP;
 675
 676         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 677                 settings |= MGMT_SETTING_HS;
 678
 679         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 680                 settings |= MGMT_SETTING_ADVERTISING;
 681
 682         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 683                 settings |= MGMT_SETTING_SECURE_CONN;
 684
 685         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 686                 settings |= MGMT_SETTING_DEBUG_KEYS;
 687
 688         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 689                 settings |= MGMT_SETTING_PRIVACY;
 690
 691         /* The current setting for static address has two purposes. The
 692          * first is to indicate if the static address will be used and
 693          * the second is to indicate if it is actually set.
 694          *
 695          * This means if the static address is not configured, this flag
 696          * will never be set. If the address is configured, then if the
 697          * address is actually used decides if the flag is set or not.
 698          *
 699          * For single mode LE only controllers and dual-mode controllers
 700          * with BR/EDR disabled, the existence of the static address will
 701          * be evaluated.
 702          */
 703         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 704             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 705             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 706                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 707                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 708         }
 709
 710         return settings;
 711 }
 712
 713 #define PNP_INFO_SVCLASS_ID             0x1200
 714
 715 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 716 {
 717         u8 *ptr = data, *uuids_start = NULL;
 718         struct bt_uuid *uuid;
 719
 720         if (len < 4)
 721                 return ptr;
 722
 723         list_for_each_entry(uuid, &hdev->uuids, list) {
 724                 u16 uuid16;
 725
 726                 if (uuid->size != 16)
 727                         continue;
 728
 729                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 730                 if (uuid16 < 0x1100)
 731                         continue;
 732
 733                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 734                         continue;
 735
 736                 if (!uuids_start) {
 737                         uuids_start = ptr;
 738                         uuids_start[0] = 1;
 739                         uuids_start[1] = EIR_UUID16_ALL;
 740                         ptr += 2;
 741                 }
 742
 743                 /* Stop if not enough space to put next UUID */
 744                 if ((ptr - data) + sizeof(u16) > len) {
 745                         uuids_start[1] = EIR_UUID16_SOME;
 746                         break;
 747                 }
 748
 749                 *ptr++ = (uuid16 & 0x00ff);
 750                 *ptr++ = (uuid16 & 0xff00) >> 8;
 751                 uuids_start[0] += sizeof(uuid16);
 752         }
 753
 754         return ptr;
 755 }
 756
 757 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 758 {
 759         u8 *ptr = data, *uuids_start = NULL;
 760         struct bt_uuid *uuid;
 761
 762         if (len < 6)
 763                 return ptr;
 764
 765         list_for_each_entry(uuid, &hdev->uuids, list) {
 766                 if (uuid->size != 32)
 767                         continue;
 768
 769                 if (!uuids_start) {
 770                         uuids_start = ptr;
 771                         uuids_start[0] = 1;
 772                         uuids_start[1] = EIR_UUID32_ALL;
 773                         ptr += 2;
 774                 }
 775
 776                 /* Stop if not enough space to put next UUID */
 777                 if ((ptr - data) + sizeof(u32) > len) {
 778                         uuids_start[1] = EIR_UUID32_SOME;
 779                         break;
 780                 }
 781
 782                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 783                 ptr += sizeof(u32);
 784                 uuids_start[0] += sizeof(u32);
 785         }
 786
 787         return ptr;
 788 }
 789
 790 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 791 {
 792         u8 *ptr = data, *uuids_start = NULL;
 793         struct bt_uuid *uuid;
 794
 795         if (len < 18)
 796                 return ptr;
 797
 798         list_for_each_entry(uuid, &hdev->uuids, list) {
 799                 if (uuid->size != 128)
 800                         continue;
 801
 802                 if (!uuids_start) {
 803                         uuids_start = ptr;
 804                         uuids_start[0] = 1;
 805                         uuids_start[1] = EIR_UUID128_ALL;
 806                         ptr += 2;
 807                 }
 808
 809                 /* Stop if not enough space to put next UUID */
 810                 if ((ptr - data) + 16 > len) {
 811                         uuids_start[1] = EIR_UUID128_SOME;
 812                         break;
 813                 }
 814
 815                 memcpy(ptr, uuid->uuid, 16);
 816                 ptr += 16;
 817                 uuids_start[0] += 16;
 818         }
 819
 820         return ptr;
 821 }
 822
 823 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 824 {
 825         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 826 }
 827
 828 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 829                                                   struct hci_dev *hdev,
 830                                                   const void *data)
 831 {
 832         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 833 }
 834
 835 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 836 {
 837         u8 ad_len = 0;
 838         size_t name_len;
 839
 840         name_len = strlen(hdev->dev_name);
 841         if (name_len > 0) {
 842                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 843
 844                 if (name_len > max_len) {
 845                         name_len = max_len;
 846                         ptr[1] = EIR_NAME_SHORT;
 847                 } else
 848                         ptr[1] = EIR_NAME_COMPLETE;
 849
 850                 ptr[0] = name_len + 1;
 851
 852                 memcpy(ptr + 2, hdev->dev_name, name_len);
 853
 854                 ad_len += (name_len + 2);
 855                 ptr += (name_len + 2);
 856         }
 857
 858         return ad_len;
 859 }
 860
 861 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 862 {
 863         /* TODO: Set the appropriate entries based on advertising instance flags
 864          * here once flags other than 0 are supported.
 865          */
 866         memcpy(ptr, hdev->adv_instance.scan_rsp_data,
 867                hdev->adv_instance.scan_rsp_len);
 868
 869         return hdev->adv_instance.scan_rsp_len;
 870 }
 871
 872 static void update_scan_rsp_data_for_instance(struct hci_request *req,
 873                                               u8 instance)
 874 {
 875         struct hci_dev *hdev = req->hdev;
 876         struct hci_cp_le_set_scan_rsp_data cp;
 877         u8 len;
 878
 879         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 return;
 881
 882         memset(&cp, 0, sizeof(cp));
 883
 884         if (instance)
 885                 len = create_instance_scan_rsp_data(hdev, cp.data);
 886         else
 887                 len = create_default_scan_rsp_data(hdev, cp.data);
 888
 889         if (hdev->scan_rsp_data_len == len &&
 890             !memcmp(cp.data, hdev->scan_rsp_data, len))
 891                 return;
 892
 893         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 894         hdev->scan_rsp_data_len = len;
 895
 896         cp.length = len;
 897
 898         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 899 }
 900
 901 static void update_scan_rsp_data(struct hci_request *req)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         u8 instance;
 905
 906         /* The "Set Advertising" setting supersedes the "Add Advertising"
 907          * setting. Here we set the scan response data based on which
 908          * setting was set. When neither apply, default to the global settings,
 909          * represented by instance "0".
 910          */
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 912             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 913                 instance = 0x01;
 914         else
 915                 instance = 0x00;
 916
 917         update_scan_rsp_data_for_instance(req, instance);
 918 }
 919
 920 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 921 {
 922         struct mgmt_pending_cmd *cmd;
 923
 924         /* If there's a pending mgmt command the flags will not yet have
 925          * their final values, so check for this first.
 926          */
 927         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 928         if (cmd) {
 929                 struct mgmt_mode *cp = cmd->param;
 930                 if (cp->val == 0x01)
 931                         return LE_AD_GENERAL;
 932                 else if (cp->val == 0x02)
 933                         return LE_AD_LIMITED;
 934         } else {
 935                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 936                         return LE_AD_LIMITED;
 937                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 938                         return LE_AD_GENERAL;
 939         }
 940
 941         return 0;
 942 }
 943
 944 static u8 get_current_adv_instance(struct hci_dev *hdev)
 945 {
 946         /* The "Set Advertising" setting supersedes the "Add Advertising"
 947          * setting. Here we set the advertising data based on which
 948          * setting was set. When neither apply, default to the global settings,
 949          * represented by instance "0".
 950          */
 951         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 952             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 953                 return 0x01;
 954
 955         return 0x00;
 956 }
 957
 958 static bool get_connectable(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flag will not yet have
 963          * it's final value, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968
 969                 return cp->val;
 970         }
 971
 972         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 973 }
 974
 975 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
 976 {
 977         u32 flags;
 978
 979         if (instance > 0x01)
 980                 return 0;
 981
 982         if (instance == 0x01)
 983                 return hdev->adv_instance.flags;
 984
 985         /* Instance 0 always manages the "Tx Power" and "Flags" fields */
 986         flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
 987
 988         /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting corresponds
 989          * to the "connectable" instance flag.
 990          */
 991         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
 992                 flags |= MGMT_ADV_FLAG_CONNECTABLE;
 993
 994         return flags;
 995 }
 996
 997 static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
 998 {
 999         /* Ignore instance 0 and other unsupported instances */
1000         if (instance != 0x01)
1001                 return 0;
1002
1003         /* TODO: Take into account the "appearance" and "local-name" flags here.
1004          * These are currently being ignored as they are not supported.
1005          */
1006         return hdev->adv_instance.scan_rsp_len;
1007 }
1008
1009 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1010 {
1011         u8 ad_len = 0, flags = 0;
1012         u32 instance_flags = get_adv_instance_flags(hdev, instance);
1013
1014         /* The Add Advertising command allows userspace to set both the general
1015          * and limited discoverable flags.
1016          */
1017         if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1018                 flags |= LE_AD_GENERAL;
1019
1020         if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1021                 flags |= LE_AD_LIMITED;
1022
1023         if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1024                 /* If a discovery flag wasn't provided, simply use the global
1025                  * settings.
1026                  */
1027                 if (!flags)
1028                         flags |= get_adv_discov_flags(hdev);
1029
1030                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1031                         flags |= LE_AD_NO_BREDR;
1032
1033                 /* If flags would still be empty, then there is no need to
1034                  * include the "Flags" AD field".
1035                  */
1036                 if (flags) {
1037                         ptr[0] = 0x02;
1038                         ptr[1] = EIR_FLAGS;
1039                         ptr[2] = flags;
1040
1041                         ad_len += 3;
1042                         ptr += 3;
1043                 }
1044         }
1045
1046         /* Provide Tx Power only if we can provide a valid value for it */
1047         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1048             (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1049                 ptr[0] = 0x02;
1050                 ptr[1] = EIR_TX_POWER;
1051                 ptr[2] = (u8)hdev->adv_tx_power;
1052
1053                 ad_len += 3;
1054                 ptr += 3;
1055         }
1056
1057         if (instance) {
1058                 memcpy(ptr, hdev->adv_instance.adv_data,
1059                        hdev->adv_instance.adv_data_len);
1060                 ad_len += hdev->adv_instance.adv_data_len;
1061         }
1062
1063         return ad_len;
1064 }
1065
1066 static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
1067 {
1068         struct hci_dev *hdev = req->hdev;
1069         struct hci_cp_le_set_adv_data cp;
1070         u8 len;
1071
1072         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1073                 return;
1074
1075         memset(&cp, 0, sizeof(cp));
1076
1077         len = create_instance_adv_data(hdev, instance, cp.data);
1078
1079         /* There's nothing to do if the data hasn't changed */
1080         if (hdev->adv_data_len == len &&
1081             memcmp(cp.data, hdev->adv_data, len) == 0)
1082                 return;
1083
1084         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1085         hdev->adv_data_len = len;
1086
1087         cp.length = len;
1088
1089         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1090 }
1091
1092 static void update_adv_data(struct hci_request *req)
1093 {
1094         struct hci_dev *hdev = req->hdev;
1095         u8 instance = get_current_adv_instance(hdev);
1096
1097         update_adv_data_for_instance(req, instance);
1098 }
1099
1100 int mgmt_update_adv_data(struct hci_dev *hdev)
1101 {
1102         struct hci_request req;
1103
1104         hci_req_init(&req, hdev);
1105         update_adv_data(&req);
1106
1107         return hci_req_run(&req, NULL);
1108 }
1109
1110 static void create_eir(struct hci_dev *hdev, u8 *data)
1111 {
1112         u8 *ptr = data;
1113         size_t name_len;
1114
1115         name_len = strlen(hdev->dev_name);
1116
1117         if (name_len > 0) {
1118                 /* EIR Data type */
1119                 if (name_len > 48) {
1120                         name_len = 48;
1121                         ptr[1] = EIR_NAME_SHORT;
1122                 } else
1123                         ptr[1] = EIR_NAME_COMPLETE;
1124
1125                 /* EIR Data length */
1126                 ptr[0] = name_len + 1;
1127
1128                 memcpy(ptr + 2, hdev->dev_name, name_len);
1129
1130                 ptr += (name_len + 2);
1131         }
1132
1133         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1134                 ptr[0] = 2;
1135                 ptr[1] = EIR_TX_POWER;
1136                 ptr[2] = (u8) hdev->inq_tx_power;
1137
1138                 ptr += 3;
1139         }
1140
1141         if (hdev->devid_source > 0) {
1142                 ptr[0] = 9;
1143                 ptr[1] = EIR_DEVICE_ID;
1144
1145                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1146                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1147                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1148                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1149
1150                 ptr += 10;
1151         }
1152
1153         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1154         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1155         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1156 }
1157
1158 static void update_eir(struct hci_request *req)
1159 {
1160         struct hci_dev *hdev = req->hdev;
1161         struct hci_cp_write_eir cp;
1162
1163         if (!hdev_is_powered(hdev))
1164                 return;
1165
1166         if (!lmp_ext_inq_capable(hdev))
1167                 return;
1168
1169         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1170                 return;
1171
1172         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1173                 return;
1174
1175         memset(&cp, 0, sizeof(cp));
1176
1177         create_eir(hdev, cp.data);
1178
1179         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1180                 return;
1181
1182         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1183
1184         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1185 }
1186
1187 static u8 get_service_classes(struct hci_dev *hdev)
1188 {
1189         struct bt_uuid *uuid;
1190         u8 val = 0;
1191
1192         list_for_each_entry(uuid, &hdev->uuids, list)
1193                 val |= uuid->svc_hint;
1194
1195         return val;
1196 }
1197
1198 static void update_class(struct hci_request *req)
1199 {
1200         struct hci_dev *hdev = req->hdev;
1201         u8 cod[3];
1202
1203         BT_DBG("%s", hdev->name);
1204
1205         if (!hdev_is_powered(hdev))
1206                 return;
1207
1208         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1209                 return;
1210
1211         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1212                 return;
1213
1214         cod[0] = hdev->minor_class;
1215         cod[1] = hdev->major_class;
1216         cod[2] = get_service_classes(hdev);
1217
1218         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1219                 cod[1] |= 0x20;
1220
1221         if (memcmp(cod, hdev->dev_class, 3) == 0)
1222                 return;
1223
1224         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1225 }
1226
1227 static void disable_advertising(struct hci_request *req)
1228 {
1229         u8 enable = 0x00;
1230
1231         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1232 }
1233
1234 static void enable_advertising(struct hci_request *req)
1235 {
1236         struct hci_dev *hdev = req->hdev;
1237         struct hci_cp_le_set_adv_param cp;
1238         u8 own_addr_type, enable = 0x01;
1239         bool connectable;
1240         u8 instance;
1241         u32 flags;
1242
1243         if (hci_conn_num(hdev, LE_LINK) > 0)
1244                 return;
1245
1246         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1247                 disable_advertising(req);
1248
1249         /* Clear the HCI_LE_ADV bit temporarily so that the
1250          * hci_update_random_address knows that it's safe to go ahead
1251          * and write a new random address. The flag will be set back on
1252          * as soon as the SET_ADV_ENABLE HCI command completes.
1253          */
1254         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1255
1256         instance = get_current_adv_instance(hdev);
1257         flags = get_adv_instance_flags(hdev, instance);
1258
1259         /* If the "connectable" instance flag was not set, then choose between
1260          * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1261          */
1262         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1263                       get_connectable(hdev);
1264
1265         /* Set require_privacy to true only when non-connectable
1266          * advertising is used. In that case it is fine to use a
1267          * non-resolvable private address.
1268          */
1269         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1270                 return;
1271
1272         memset(&cp, 0, sizeof(cp));
1273         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1274         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1275
1276         if (connectable)
1277                 cp.type = LE_ADV_IND;
1278         else if (get_adv_instance_scan_rsp_len(hdev, instance))
1279                 cp.type = LE_ADV_SCAN_IND;
1280         else
1281                 cp.type = LE_ADV_NONCONN_IND;
1282
1283         cp.own_address_type = own_addr_type;
1284         cp.channel_map = hdev->le_adv_channel_map;
1285
1286         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1287
1288         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1289 }
1290
1291 static void service_cache_off(struct work_struct *work)
1292 {
1293         struct hci_dev *hdev = container_of(work, struct hci_dev,
1294                                             service_cache.work);
1295         struct hci_request req;
1296
1297         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1298                 return;
1299
1300         hci_req_init(&req, hdev);
1301
1302         hci_dev_lock(hdev);
1303
1304         update_eir(&req);
1305         update_class(&req);
1306
1307         hci_dev_unlock(hdev);
1308
1309         hci_req_run(&req, NULL);
1310 }
1311
1312 static void rpa_expired(struct work_struct *work)
1313 {
1314         struct hci_dev *hdev = container_of(work, struct hci_dev,
1315                                             rpa_expired.work);
1316         struct hci_request req;
1317
1318         BT_DBG("");
1319
1320         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1321
1322         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1323                 return;
1324
1325         /* The generation of a new RPA and programming it into the
1326          * controller happens in the enable_advertising() function.
1327          */
1328         hci_req_init(&req, hdev);
1329         enable_advertising(&req);
1330         hci_req_run(&req, NULL);
1331 }
1332
1333 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1334 {
1335         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1336                 return;
1337
1338         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1339         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1340
1341         /* Non-mgmt controlled devices get this bit set
1342          * implicitly so that pairing works for them, however
1343          * for mgmt we require user-space to explicitly enable
1344          * it
1345          */
1346         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1347 }
1348
1349 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1350                                 void *data, u16 data_len)
1351 {
1352         struct mgmt_rp_read_info rp;
1353
1354         BT_DBG("sock %p %s", sk, hdev->name);
1355
1356         hci_dev_lock(hdev);
1357
1358         memset(&rp, 0, sizeof(rp));
1359
1360         bacpy(&rp.bdaddr, &hdev->bdaddr);
1361
1362         rp.version = hdev->hci_ver;
1363         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1364
1365         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1366         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1367
1368         memcpy(rp.dev_class, hdev->dev_class, 3);
1369
1370         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1371         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1372
1373         hci_dev_unlock(hdev);
1374
1375         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1376                                  sizeof(rp));
1377 }
1378
1379 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1380 {
1381         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1382
1383         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1384                                  sizeof(settings));
1385 }
1386
1387 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1388 {
1389         BT_DBG("%s status 0x%02x", hdev->name, status);
1390
1391         if (hci_conn_count(hdev) == 0) {
1392                 cancel_delayed_work(&hdev->power_off);
1393                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1394         }
1395 }
1396
1397 static bool hci_stop_discovery(struct hci_request *req)
1398 {
1399         struct hci_dev *hdev = req->hdev;
1400         struct hci_cp_remote_name_req_cancel cp;
1401         struct inquiry_entry *e;
1402
1403         switch (hdev->discovery.state) {
1404         case DISCOVERY_FINDING:
1405                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1406                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1407
1408                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1409                         cancel_delayed_work(&hdev->le_scan_disable);
1410                         hci_req_add_le_scan_disable(req);
1411                 }
1412
1413                 return true;
1414
1415         case DISCOVERY_RESOLVING:
1416                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1417                                                      NAME_PENDING);
1418                 if (!e)
1419                         break;
1420
1421                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1422                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1423                             &cp);
1424
1425                 return true;
1426
1427         default:
1428                 /* Passive scanning */
1429                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1430                         hci_req_add_le_scan_disable(req);
1431                         return true;
1432                 }
1433
1434                 break;
1435         }
1436
1437         return false;
1438 }
1439
1440 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1441                               u8 instance)
1442 {
1443         struct mgmt_ev_advertising_added ev;
1444
1445         ev.instance = instance;
1446
1447         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1448 }
1449
1450 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1451                                 u8 instance)
1452 {
1453         struct mgmt_ev_advertising_removed ev;
1454
1455         ev.instance = instance;
1456
1457         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1458 }
1459
1460 static void clear_adv_instance(struct hci_dev *hdev)
1461 {
1462         struct hci_request req;
1463
1464         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1465                 return;
1466
1467         if (hdev->adv_instance.timeout)
1468                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1469
1470         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1471         advertising_removed(NULL, hdev, 1);
1472         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1473
1474         if (!hdev_is_powered(hdev) ||
1475             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1476                 return;
1477
1478         hci_req_init(&req, hdev);
1479         disable_advertising(&req);
1480         hci_req_run(&req, NULL);
1481 }
1482
1483 static int clean_up_hci_state(struct hci_dev *hdev)
1484 {
1485         struct hci_request req;
1486         struct hci_conn *conn;
1487         bool discov_stopped;
1488         int err;
1489
1490         hci_req_init(&req, hdev);
1491
1492         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1493             test_bit(HCI_PSCAN, &hdev->flags)) {
1494                 u8 scan = 0x00;
1495                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1496         }
1497
1498         if (hdev->adv_instance.timeout)
1499                 clear_adv_instance(hdev);
1500
1501         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1502                 disable_advertising(&req);
1503
1504         discov_stopped = hci_stop_discovery(&req);
1505
1506         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1507                 struct hci_cp_disconnect dc;
1508                 struct hci_cp_reject_conn_req rej;
1509
1510                 switch (conn->state) {
1511                 case BT_CONNECTED:
1512                 case BT_CONFIG:
1513                         dc.handle = cpu_to_le16(conn->handle);
1514                         dc.reason = 0x15; /* Terminated due to Power Off */
1515                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1516                         break;
1517                 case BT_CONNECT:
1518                         if (conn->type == LE_LINK)
1519                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1520                                             0, NULL);
1521                         else if (conn->type == ACL_LINK)
1522                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1523                                             6, &conn->dst);
1524                         break;
1525                 case BT_CONNECT2:
1526                         bacpy(&rej.bdaddr, &conn->dst);
1527                         rej.reason = 0x15; /* Terminated due to Power Off */
1528                         if (conn->type == ACL_LINK)
1529                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1530                                             sizeof(rej), &rej);
1531                         else if (conn->type == SCO_LINK)
1532                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1533                                             sizeof(rej), &rej);
1534                         break;
1535                 }
1536         }
1537
1538         err = hci_req_run(&req, clean_up_hci_complete);
1539         if (!err && discov_stopped)
1540                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1541
1542         return err;
1543 }
1544
1545 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1546                        u16 len)
1547 {
1548         struct mgmt_mode *cp = data;
1549         struct mgmt_pending_cmd *cmd;
1550         int err;
1551
1552         BT_DBG("request for %s", hdev->name);
1553
1554         if (cp->val != 0x00 && cp->val != 0x01)
1555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1556                                        MGMT_STATUS_INVALID_PARAMS);
1557
1558         hci_dev_lock(hdev);
1559
1560         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1561                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1562                                       MGMT_STATUS_BUSY);
1563                 goto failed;
1564         }
1565
1566         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1567                 cancel_delayed_work(&hdev->power_off);
1568
1569                 if (cp->val) {
1570                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1571                                          data, len);
1572                         err = mgmt_powered(hdev, 1);
1573                         goto failed;
1574                 }
1575         }
1576
1577         if (!!cp->val == hdev_is_powered(hdev)) {
1578                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1579                 goto failed;
1580         }
1581
1582         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1583         if (!cmd) {
1584                 err = -ENOMEM;
1585                 goto failed;
1586         }
1587
1588         if (cp->val) {
1589                 queue_work(hdev->req_workqueue, &hdev->power_on);
1590                 err = 0;
1591         } else {
1592                 /* Disconnect connections, stop scans, etc */
1593                 err = clean_up_hci_state(hdev);
1594                 if (!err)
1595                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1596                                            HCI_POWER_OFF_TIMEOUT);
1597
1598                 /* ENODATA means there were no HCI commands queued */
1599                 if (err == -ENODATA) {
1600                         cancel_delayed_work(&hdev->power_off);
1601                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1602                         err = 0;
1603                 }
1604         }
1605
1606 failed:
1607         hci_dev_unlock(hdev);
1608         return err;
1609 }
1610
1611 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1612 {
1613         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1614
1615         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1616                                   sizeof(ev), skip);
1617 }
1618
1619 int mgmt_new_settings(struct hci_dev *hdev)
1620 {
1621         return new_settings(hdev, NULL);
1622 }
1623
1624 struct cmd_lookup {
1625         struct sock *sk;
1626         struct hci_dev *hdev;
1627         u8 mgmt_status;
1628 };
1629
1630 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1631 {
1632         struct cmd_lookup *match = data;
1633
1634         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1635
1636         list_del(&cmd->list);
1637
1638         if (match->sk == NULL) {
1639                 match->sk = cmd->sk;
1640                 sock_hold(match->sk);
1641         }
1642
1643         mgmt_pending_free(cmd);
1644 }
1645
1646 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1647 {
1648         u8 *status = data;
1649
1650         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1651         mgmt_pending_remove(cmd);
1652 }
1653
1654 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1655 {
1656         if (cmd->cmd_complete) {
1657                 u8 *status = data;
1658
1659                 cmd->cmd_complete(cmd, *status);
1660                 mgmt_pending_remove(cmd);
1661
1662                 return;
1663         }
1664
1665         cmd_status_rsp(cmd, data);
1666 }
1667
1668 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1669 {
1670         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1671                                  cmd->param, cmd->param_len);
1672 }
1673
1674 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1675 {
1676         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1677                                  cmd->param, sizeof(struct mgmt_addr_info));
1678 }
1679
1680 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1681 {
1682         if (!lmp_bredr_capable(hdev))
1683                 return MGMT_STATUS_NOT_SUPPORTED;
1684         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1685                 return MGMT_STATUS_REJECTED;
1686         else
1687                 return MGMT_STATUS_SUCCESS;
1688 }
1689
1690 static u8 mgmt_le_support(struct hci_dev *hdev)
1691 {
1692         if (!lmp_le_capable(hdev))
1693                 return MGMT_STATUS_NOT_SUPPORTED;
1694         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1695                 return MGMT_STATUS_REJECTED;
1696         else
1697                 return MGMT_STATUS_SUCCESS;
1698 }
1699
1700 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1701                                       u16 opcode)
1702 {
1703         struct mgmt_pending_cmd *cmd;
1704         struct mgmt_mode *cp;
1705         struct hci_request req;
1706         bool changed;
1707
1708         BT_DBG("status 0x%02x", status);
1709
1710         hci_dev_lock(hdev);
1711
1712         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1713         if (!cmd)
1714                 goto unlock;
1715
1716         if (status) {
1717                 u8 mgmt_err = mgmt_status(status);
1718                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1719                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1720                 goto remove_cmd;
1721         }
1722
1723         cp = cmd->param;
1724         if (cp->val) {
1725                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1726
1727                 if (hdev->discov_timeout > 0) {
1728                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1729                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1730                                            to);
1731                 }
1732         } else {
1733                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1734         }
1735
1736         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1737
1738         if (changed)
1739                 new_settings(hdev, cmd->sk);
1740
1741         /* When the discoverable mode gets changed, make sure
1742          * that class of device has the limited discoverable
1743          * bit correctly set. Also update page scan based on whitelist
1744          * entries.
1745          */
1746         hci_req_init(&req, hdev);
1747         __hci_update_page_scan(&req);
1748         update_class(&req);
1749         hci_req_run(&req, NULL);
1750
1751 remove_cmd:
1752         mgmt_pending_remove(cmd);
1753
1754 unlock:
1755         hci_dev_unlock(hdev);
1756 }
1757
1758 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1759                             u16 len)
1760 {
1761         struct mgmt_cp_set_discoverable *cp = data;
1762         struct mgmt_pending_cmd *cmd;
1763         struct hci_request req;
1764         u16 timeout;
1765         u8 scan;
1766         int err;
1767
1768         BT_DBG("request for %s", hdev->name);
1769
1770         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1771             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1772                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1773                                        MGMT_STATUS_REJECTED);
1774
1775         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1776                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1777                                        MGMT_STATUS_INVALID_PARAMS);
1778
1779         timeout = __le16_to_cpu(cp->timeout);
1780
1781         /* Disabling discoverable requires that no timeout is set,
1782          * and enabling limited discoverable requires a timeout.
1783          */
1784         if ((cp->val == 0x00 && timeout > 0) ||
1785             (cp->val == 0x02 && timeout == 0))
1786                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1787                                        MGMT_STATUS_INVALID_PARAMS);
1788
1789         hci_dev_lock(hdev);
1790
1791         if (!hdev_is_powered(hdev) && timeout > 0) {
1792                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1793                                       MGMT_STATUS_NOT_POWERED);
1794                 goto failed;
1795         }
1796
1797         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1798             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1799                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1800                                       MGMT_STATUS_BUSY);
1801                 goto failed;
1802         }
1803
1804         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1805                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1806                                       MGMT_STATUS_REJECTED);
1807                 goto failed;
1808         }
1809
1810         if (!hdev_is_powered(hdev)) {
1811                 bool changed = false;
1812
1813                 /* Setting limited discoverable when powered off is
1814                  * not a valid operation since it requires a timeout
1815                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1816                  */
1817                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1818                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1819                         changed = true;
1820                 }
1821
1822                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1823                 if (err < 0)
1824                         goto failed;
1825
1826                 if (changed)
1827                         err = new_settings(hdev, sk);
1828
1829                 goto failed;
1830         }
1831
1832         /* If the current mode is the same, then just update the timeout
1833          * value with the new value. And if only the timeout gets updated,
1834          * then no need for any HCI transactions.
1835          */
1836         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1837             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1838                                                    HCI_LIMITED_DISCOVERABLE)) {
1839                 cancel_delayed_work(&hdev->discov_off);
1840                 hdev->discov_timeout = timeout;
1841
1842                 if (cp->val && hdev->discov_timeout > 0) {
1843                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1844                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1845                                            to);
1846                 }
1847
1848                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1849                 goto failed;
1850         }
1851
1852         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1853         if (!cmd) {
1854                 err = -ENOMEM;
1855                 goto failed;
1856         }
1857
1858         /* Cancel any potential discoverable timeout that might be
1859          * still active and store new timeout value. The arming of
1860          * the timeout happens in the complete handler.
1861          */
1862         cancel_delayed_work(&hdev->discov_off);
1863         hdev->discov_timeout = timeout;
1864
1865         /* Limited discoverable mode */
1866         if (cp->val == 0x02)
1867                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1868         else
1869                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1870
1871         hci_req_init(&req, hdev);
1872
1873         /* The procedure for LE-only controllers is much simpler - just
1874          * update the advertising data.
1875          */
1876         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1877                 goto update_ad;
1878
1879         scan = SCAN_PAGE;
1880
1881         if (cp->val) {
1882                 struct hci_cp_write_current_iac_lap hci_cp;
1883
1884                 if (cp->val == 0x02) {
1885                         /* Limited discoverable mode */
1886                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1887                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1888                         hci_cp.iac_lap[1] = 0x8b;
1889                         hci_cp.iac_lap[2] = 0x9e;
1890                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1891                         hci_cp.iac_lap[4] = 0x8b;
1892                         hci_cp.iac_lap[5] = 0x9e;
1893                 } else {
1894                         /* General discoverable mode */
1895                         hci_cp.num_iac = 1;
1896                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1897                         hci_cp.iac_lap[1] = 0x8b;
1898                         hci_cp.iac_lap[2] = 0x9e;
1899                 }
1900
1901                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1902                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1903
1904                 scan |= SCAN_INQUIRY;
1905         } else {
1906                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1907         }
1908
1909         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1910
1911 update_ad:
1912         update_adv_data(&req);
1913
1914         err = hci_req_run(&req, set_discoverable_complete);
1915         if (err < 0)
1916                 mgmt_pending_remove(cmd);
1917
1918 failed:
1919         hci_dev_unlock(hdev);
1920         return err;
1921 }
1922
1923 static void write_fast_connectable(struct hci_request *req, bool enable)
1924 {
1925         struct hci_dev *hdev = req->hdev;
1926         struct hci_cp_write_page_scan_activity acp;
1927         u8 type;
1928
1929         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1930                 return;
1931
1932         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1933                 return;
1934
1935         if (enable) {
1936                 type = PAGE_SCAN_TYPE_INTERLACED;
1937
1938                 /* 160 msec page scan interval */
1939                 acp.interval = cpu_to_le16(0x0100);
1940         } else {
1941                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1942
1943                 /* default 1.28 sec page scan */
1944                 acp.interval = cpu_to_le16(0x0800);
1945         }
1946
1947         acp.window = cpu_to_le16(0x0012);
1948
1949         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1950             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1951                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1952                             sizeof(acp), &acp);
1953
1954         if (hdev->page_scan_type != type)
1955                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1956 }
1957
1958 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1959                                      u16 opcode)
1960 {
1961         struct mgmt_pending_cmd *cmd;
1962         struct mgmt_mode *cp;
1963         bool conn_changed, discov_changed;
1964
1965         BT_DBG("status 0x%02x", status);
1966
1967         hci_dev_lock(hdev);
1968
1969         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1970         if (!cmd)
1971                 goto unlock;
1972
1973         if (status) {
1974                 u8 mgmt_err = mgmt_status(status);
1975                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1976                 goto remove_cmd;
1977         }
1978
1979         cp = cmd->param;
1980         if (cp->val) {
1981                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1982                                                           HCI_CONNECTABLE);
1983                 discov_changed = false;
1984         } else {
1985                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1986                                                            HCI_CONNECTABLE);
1987                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1988                                                              HCI_DISCOVERABLE);
1989         }
1990
1991         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1992
1993         if (conn_changed || discov_changed) {
1994                 new_settings(hdev, cmd->sk);
1995                 hci_update_page_scan(hdev);
1996                 if (discov_changed)
1997                         mgmt_update_adv_data(hdev);
1998                 hci_update_background_scan(hdev);
1999         }
2000
2001 remove_cmd:
2002         mgmt_pending_remove(cmd);
2003
2004 unlock:
2005         hci_dev_unlock(hdev);
2006 }
2007
2008 static int set_connectable_update_settings(struct hci_dev *hdev,
2009                                            struct sock *sk, u8 val)
2010 {
2011         bool changed = false;
2012         int err;
2013
2014         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
2015                 changed = true;
2016
2017         if (val) {
2018                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
2019         } else {
2020                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2021                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2022         }
2023
2024         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2025         if (err < 0)
2026                 return err;
2027
2028         if (changed) {
2029                 hci_update_page_scan(hdev);
2030                 hci_update_background_scan(hdev);
2031                 return new_settings(hdev, sk);
2032         }
2033
2034         return 0;
2035 }
2036
2037 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2038                            u16 len)
2039 {
2040         struct mgmt_mode *cp = data;
2041         struct mgmt_pending_cmd *cmd;
2042         struct hci_request req;
2043         u8 scan;
2044         int err;
2045
2046         BT_DBG("request for %s", hdev->name);
2047
2048         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2049             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2050                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2051                                        MGMT_STATUS_REJECTED);
2052
2053         if (cp->val != 0x00 && cp->val != 0x01)
2054                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2055                                        MGMT_STATUS_INVALID_PARAMS);
2056
2057         hci_dev_lock(hdev);
2058
2059         if (!hdev_is_powered(hdev)) {
2060                 err = set_connectable_update_settings(hdev, sk, cp->val);
2061                 goto failed;
2062         }
2063
2064         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2065             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2066                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2067                                       MGMT_STATUS_BUSY);
2068                 goto failed;
2069         }
2070
2071         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2072         if (!cmd) {
2073                 err = -ENOMEM;
2074                 goto failed;
2075         }
2076
2077         hci_req_init(&req, hdev);
2078
2079         /* If BR/EDR is not enabled and we disable advertising as a
2080          * by-product of disabling connectable, we need to update the
2081          * advertising flags.
2082          */
2083         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2084                 if (!cp->val) {
2085                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2086                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2087                 }
2088                 update_adv_data(&req);
2089         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2090                 if (cp->val) {
2091                         scan = SCAN_PAGE;
2092                 } else {
2093                         /* If we don't have any whitelist entries just
2094                          * disable all scanning. If there are entries
2095                          * and we had both page and inquiry scanning
2096                          * enabled then fall back to only page scanning.
2097                          * Otherwise no changes are needed.
2098                          */
2099                         if (list_empty(&hdev->whitelist))
2100                                 scan = SCAN_DISABLED;
2101                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2102                                 scan = SCAN_PAGE;
2103                         else
2104                                 goto no_scan_update;
2105
2106                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2107                             hdev->discov_timeout > 0)
2108                                 cancel_delayed_work(&hdev->discov_off);
2109                 }
2110
2111                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2112         }
2113
2114 no_scan_update:
2115         /* Update the advertising parameters if necessary */
2116         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2117             hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
2118                 enable_advertising(&req);
2119
2120         err = hci_req_run(&req, set_connectable_complete);
2121         if (err < 0) {
2122                 mgmt_pending_remove(cmd);
2123                 if (err == -ENODATA)
2124                         err = set_connectable_update_settings(hdev, sk,
2125                                                               cp->val);
2126                 goto failed;
2127         }
2128
2129 failed:
2130         hci_dev_unlock(hdev);
2131         return err;
2132 }
2133
2134 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2135                         u16 len)
2136 {
2137         struct mgmt_mode *cp = data;
2138         bool changed;
2139         int err;
2140
2141         BT_DBG("request for %s", hdev->name);
2142
2143         if (cp->val != 0x00 && cp->val != 0x01)
2144                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2145                                        MGMT_STATUS_INVALID_PARAMS);
2146
2147         hci_dev_lock(hdev);
2148
2149         if (cp->val)
2150                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2151         else
2152                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2153
2154         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2155         if (err < 0)
2156                 goto unlock;
2157
2158         if (changed)
2159                 err = new_settings(hdev, sk);
2160
2161 unlock:
2162         hci_dev_unlock(hdev);
2163         return err;
2164 }
2165
2166 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2167                              u16 len)
2168 {
2169         struct mgmt_mode *cp = data;
2170         struct mgmt_pending_cmd *cmd;
2171         u8 val, status;
2172         int err;
2173
2174         BT_DBG("request for %s", hdev->name);
2175
2176         status = mgmt_bredr_support(hdev);
2177         if (status)
2178                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2179                                        status);
2180
2181         if (cp->val != 0x00 && cp->val != 0x01)
2182                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2183                                        MGMT_STATUS_INVALID_PARAMS);
2184
2185         hci_dev_lock(hdev);
2186
2187         if (!hdev_is_powered(hdev)) {
2188                 bool changed = false;
2189
2190                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2191                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2192                         changed = true;
2193                 }
2194
2195                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2196                 if (err < 0)
2197                         goto failed;
2198
2199                 if (changed)
2200                         err = new_settings(hdev, sk);
2201
2202                 goto failed;
2203         }
2204
2205         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2206                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2207                                       MGMT_STATUS_BUSY);
2208                 goto failed;
2209         }
2210
2211         val = !!cp->val;
2212
2213         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2214                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2215                 goto failed;
2216         }
2217
2218         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2219         if (!cmd) {
2220                 err = -ENOMEM;
2221                 goto failed;
2222         }
2223
2224         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2225         if (err < 0) {
2226                 mgmt_pending_remove(cmd);
2227                 goto failed;
2228         }
2229
2230 failed:
2231         hci_dev_unlock(hdev);
2232         return err;
2233 }
2234
2235 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2236 {
2237         struct mgmt_mode *cp = data;
2238         struct mgmt_pending_cmd *cmd;
2239         u8 status;
2240         int err;
2241
2242         BT_DBG("request for %s", hdev->name);
2243
2244         status = mgmt_bredr_support(hdev);
2245         if (status)
2246                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2247
2248         if (!lmp_ssp_capable(hdev))
2249                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2250                                        MGMT_STATUS_NOT_SUPPORTED);
2251
2252         if (cp->val != 0x00 && cp->val != 0x01)
2253                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2254                                        MGMT_STATUS_INVALID_PARAMS);
2255
2256         hci_dev_lock(hdev);
2257
2258         if (!hdev_is_powered(hdev)) {
2259                 bool changed;
2260
2261                 if (cp->val) {
2262                         changed = !hci_dev_test_and_set_flag(hdev,
2263                                                              HCI_SSP_ENABLED);
2264                 } else {
2265                         changed = hci_dev_test_and_clear_flag(hdev,
2266                                                               HCI_SSP_ENABLED);
2267                         if (!changed)
2268                                 changed = hci_dev_test_and_clear_flag(hdev,
2269                                                                       HCI_HS_ENABLED);
2270                         else
2271                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2272                 }
2273
2274                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2275                 if (err < 0)
2276                         goto failed;
2277
2278                 if (changed)
2279                         err = new_settings(hdev, sk);
2280
2281                 goto failed;
2282         }
2283
2284         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2285                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2286                                       MGMT_STATUS_BUSY);
2287                 goto failed;
2288         }
2289
2290         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2291                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2292                 goto failed;
2293         }
2294
2295         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2296         if (!cmd) {
2297                 err = -ENOMEM;
2298                 goto failed;
2299         }
2300
2301         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2302                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2303                              sizeof(cp->val), &cp->val);
2304
2305         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2306         if (err < 0) {
2307                 mgmt_pending_remove(cmd);
2308                 goto failed;
2309         }
2310
2311 failed:
2312         hci_dev_unlock(hdev);
2313         return err;
2314 }
2315
2316 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2317 {
2318         struct mgmt_mode *cp = data;
2319         bool changed;
2320         u8 status;
2321         int err;
2322
2323         BT_DBG("request for %s", hdev->name);
2324
2325         status = mgmt_bredr_support(hdev);
2326         if (status)
2327                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2328
2329         if (!lmp_ssp_capable(hdev))
2330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2331                                        MGMT_STATUS_NOT_SUPPORTED);
2332
2333         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2334                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2335                                        MGMT_STATUS_REJECTED);
2336
2337         if (cp->val != 0x00 && cp->val != 0x01)
2338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2339                                        MGMT_STATUS_INVALID_PARAMS);
2340
2341         hci_dev_lock(hdev);
2342
2343         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2344                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2345                                       MGMT_STATUS_BUSY);
2346                 goto unlock;
2347         }
2348
2349         if (cp->val) {
2350                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2351         } else {
2352                 if (hdev_is_powered(hdev)) {
2353                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2354                                               MGMT_STATUS_REJECTED);
2355                         goto unlock;
2356                 }
2357
2358                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2359         }
2360
2361         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2362         if (err < 0)
2363                 goto unlock;
2364
2365         if (changed)
2366                 err = new_settings(hdev, sk);
2367
2368 unlock:
2369         hci_dev_unlock(hdev);
2370         return err;
2371 }
2372
2373 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2374 {
2375         struct cmd_lookup match = { NULL, hdev };
2376
2377         hci_dev_lock(hdev);
2378
2379         if (status) {
2380                 u8 mgmt_err = mgmt_status(status);
2381
2382                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2383                                      &mgmt_err);
2384                 goto unlock;
2385         }
2386
2387         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2388
2389         new_settings(hdev, match.sk);
2390
2391         if (match.sk)
2392                 sock_put(match.sk);
2393
2394         /* Make sure the controller has a good default for
2395          * advertising data. Restrict the update to when LE
2396          * has actually been enabled. During power on, the
2397          * update in powered_update_hci will take care of it.
2398          */
2399         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2400                 struct hci_request req;
2401
2402                 hci_req_init(&req, hdev);
2403                 update_adv_data(&req);
2404                 update_scan_rsp_data(&req);
2405                 __hci_update_background_scan(&req);
2406                 hci_req_run(&req, NULL);
2407         }
2408
2409 unlock:
2410         hci_dev_unlock(hdev);
2411 }
2412
2413 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2414 {
2415         struct mgmt_mode *cp = data;
2416         struct hci_cp_write_le_host_supported hci_cp;
2417         struct mgmt_pending_cmd *cmd;
2418         struct hci_request req;
2419         int err;
2420         u8 val, enabled;
2421
2422         BT_DBG("request for %s", hdev->name);
2423
2424         if (!lmp_le_capable(hdev))
2425                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2426                                        MGMT_STATUS_NOT_SUPPORTED);
2427
2428         if (cp->val != 0x00 && cp->val != 0x01)
2429                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2430                                        MGMT_STATUS_INVALID_PARAMS);
2431
2432         /* Bluetooth single mode LE only controllers or dual-mode
2433          * controllers configured as LE only devices, do not allow
2434          * switching LE off. These have either LE enabled explicitly
2435          * or BR/EDR has been previously switched off.
2436          *
2437          * When trying to enable an already enabled LE, then gracefully
2438          * send a positive response. Trying to disable it however will
2439          * result into rejection.
2440          */
2441         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2442                 if (cp->val == 0x01)
2443                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2444
2445                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2446                                        MGMT_STATUS_REJECTED);
2447         }
2448
2449         hci_dev_lock(hdev);
2450
2451         val = !!cp->val;
2452         enabled = lmp_host_le_capable(hdev);
2453
2454         if (!hdev_is_powered(hdev) || val == enabled) {
2455                 bool changed = false;
2456
2457                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2458                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2459                         changed = true;
2460                 }
2461
2462                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2463                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2464                         changed = true;
2465                 }
2466
2467                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2468                 if (err < 0)
2469                         goto unlock;
2470
2471                 if (changed)
2472                         err = new_settings(hdev, sk);
2473
2474                 goto unlock;
2475         }
2476
2477         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2478             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2479                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2480                                       MGMT_STATUS_BUSY);
2481                 goto unlock;
2482         }
2483
2484         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2485         if (!cmd) {
2486                 err = -ENOMEM;
2487                 goto unlock;
2488         }
2489
2490         hci_req_init(&req, hdev);
2491
2492         memset(&hci_cp, 0, sizeof(hci_cp));
2493
2494         if (val) {
2495                 hci_cp.le = val;
2496                 hci_cp.simul = 0x00;
2497         } else {
2498                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2499                         disable_advertising(&req);
2500         }
2501
2502         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2503                     &hci_cp);
2504
2505         err = hci_req_run(&req, le_enable_complete);
2506         if (err < 0)
2507                 mgmt_pending_remove(cmd);
2508
2509 unlock:
2510         hci_dev_unlock(hdev);
2511         return err;
2512 }
2513
2514 /* This is a helper function to test for pending mgmt commands that can
2515  * cause CoD or EIR HCI commands. We can only allow one such pending
2516  * mgmt command at a time since otherwise we cannot easily track what
2517  * the current values are, will be, and based on that calculate if a new
2518  * HCI command needs to be sent and if yes with what value.
2519  */
2520 static bool pending_eir_or_class(struct hci_dev *hdev)
2521 {
2522         struct mgmt_pending_cmd *cmd;
2523
2524         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2525                 switch (cmd->opcode) {
2526                 case MGMT_OP_ADD_UUID:
2527                 case MGMT_OP_REMOVE_UUID:
2528                 case MGMT_OP_SET_DEV_CLASS:
2529                 case MGMT_OP_SET_POWERED:
2530                         return true;
2531                 }
2532         }
2533
2534         return false;
2535 }
2536
2537 static const u8 bluetooth_base_uuid[] = {
2538                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2539                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2540 };
2541
2542 static u8 get_uuid_size(const u8 *uuid)
2543 {
2544         u32 val;
2545
2546         if (memcmp(uuid, bluetooth_base_uuid, 12))
2547                 return 128;
2548
2549         val = get_unaligned_le32(&uuid[12]);
2550         if (val > 0xffff)
2551                 return 32;
2552
2553         return 16;
2554 }
2555
2556 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2557 {
2558         struct mgmt_pending_cmd *cmd;
2559
2560         hci_dev_lock(hdev);
2561
2562         cmd = pending_find(mgmt_op, hdev);
2563         if (!cmd)
2564                 goto unlock;
2565
2566         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2567                           mgmt_status(status), hdev->dev_class, 3);
2568
2569         mgmt_pending_remove(cmd);
2570
2571 unlock:
2572         hci_dev_unlock(hdev);
2573 }
2574
2575 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2576 {
2577         BT_DBG("status 0x%02x", status);
2578
2579         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2580 }
2581
2582 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2583 {
2584         struct mgmt_cp_add_uuid *cp = data;
2585         struct mgmt_pending_cmd *cmd;
2586         struct hci_request req;
2587         struct bt_uuid *uuid;
2588         int err;
2589
2590         BT_DBG("request for %s", hdev->name);
2591
2592         hci_dev_lock(hdev);
2593
2594         if (pending_eir_or_class(hdev)) {
2595                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2596                                       MGMT_STATUS_BUSY);
2597                 goto failed;
2598         }
2599
2600         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2601         if (!uuid) {
2602                 err = -ENOMEM;
2603                 goto failed;
2604         }
2605
2606         memcpy(uuid->uuid, cp->uuid, 16);
2607         uuid->svc_hint = cp->svc_hint;
2608         uuid->size = get_uuid_size(cp->uuid);
2609
2610         list_add_tail(&uuid->list, &hdev->uuids);
2611
2612         hci_req_init(&req, hdev);
2613
2614         update_class(&req);
2615         update_eir(&req);
2616
2617         err = hci_req_run(&req, add_uuid_complete);
2618         if (err < 0) {
2619                 if (err != -ENODATA)
2620                         goto failed;
2621
2622                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2623                                         hdev->dev_class, 3);
2624                 goto failed;
2625         }
2626
2627         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2628         if (!cmd) {
2629                 err = -ENOMEM;
2630                 goto failed;
2631         }
2632
2633         err = 0;
2634
2635 failed:
2636         hci_dev_unlock(hdev);
2637         return err;
2638 }
2639
2640 static bool enable_service_cache(struct hci_dev *hdev)
2641 {
2642         if (!hdev_is_powered(hdev))
2643                 return false;
2644
2645         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2646                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2647                                    CACHE_TIMEOUT);
2648                 return true;
2649         }
2650
2651         return false;
2652 }
2653
2654 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2655 {
2656         BT_DBG("status 0x%02x", status);
2657
2658         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2659 }
2660
2661 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2662                        u16 len)
2663 {
2664         struct mgmt_cp_remove_uuid *cp = data;
2665         struct mgmt_pending_cmd *cmd;
2666         struct bt_uuid *match, *tmp;
2667         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2668         struct hci_request req;
2669         int err, found;
2670
2671         BT_DBG("request for %s", hdev->name);
2672
2673         hci_dev_lock(hdev);
2674
2675         if (pending_eir_or_class(hdev)) {
2676                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2677                                       MGMT_STATUS_BUSY);
2678                 goto unlock;
2679         }
2680
2681         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2682                 hci_uuids_clear(hdev);
2683
2684                 if (enable_service_cache(hdev)) {
2685                         err = mgmt_cmd_complete(sk, hdev->id,
2686                                                 MGMT_OP_REMOVE_UUID,
2687                                                 0, hdev->dev_class, 3);
2688                         goto unlock;
2689                 }
2690
2691                 goto update_class;
2692         }
2693
2694         found = 0;
2695
2696         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2697                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2698                         continue;
2699
2700                 list_del(&match->list);
2701                 kfree(match);
2702                 found++;
2703         }
2704
2705         if (found == 0) {
2706                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2707                                       MGMT_STATUS_INVALID_PARAMS);
2708                 goto unlock;
2709         }
2710
2711 update_class:
2712         hci_req_init(&req, hdev);
2713
2714         update_class(&req);
2715         update_eir(&req);
2716
2717         err = hci_req_run(&req, remove_uuid_complete);
2718         if (err < 0) {
2719                 if (err != -ENODATA)
2720                         goto unlock;
2721
2722                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2723                                         hdev->dev_class, 3);
2724                 goto unlock;
2725         }
2726
2727         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2728         if (!cmd) {
2729                 err = -ENOMEM;
2730                 goto unlock;
2731         }
2732
2733         err = 0;
2734
2735 unlock:
2736         hci_dev_unlock(hdev);
2737         return err;
2738 }
2739
2740 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2741 {
2742         BT_DBG("status 0x%02x", status);
2743
2744         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2745 }
2746
2747 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2748                          u16 len)
2749 {
2750         struct mgmt_cp_set_dev_class *cp = data;
2751         struct mgmt_pending_cmd *cmd;
2752         struct hci_request req;
2753         int err;
2754
2755         BT_DBG("request for %s", hdev->name);
2756
2757         if (!lmp_bredr_capable(hdev))
2758                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2759                                        MGMT_STATUS_NOT_SUPPORTED);
2760
2761         hci_dev_lock(hdev);
2762
2763         if (pending_eir_or_class(hdev)) {
2764                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2765                                       MGMT_STATUS_BUSY);
2766                 goto unlock;
2767         }
2768
2769         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2770                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2771                                       MGMT_STATUS_INVALID_PARAMS);
2772                 goto unlock;
2773         }
2774
2775         hdev->major_class = cp->major;
2776         hdev->minor_class = cp->minor;
2777
2778         if (!hdev_is_powered(hdev)) {
2779                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2780                                         hdev->dev_class, 3);
2781                 goto unlock;
2782         }
2783
2784         hci_req_init(&req, hdev);
2785
2786         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2787                 hci_dev_unlock(hdev);
2788                 cancel_delayed_work_sync(&hdev->service_cache);
2789                 hci_dev_lock(hdev);
2790                 update_eir(&req);
2791         }
2792
2793         update_class(&req);
2794
2795         err = hci_req_run(&req, set_class_complete);
2796         if (err < 0) {
2797                 if (err != -ENODATA)
2798                         goto unlock;
2799
2800                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2801                                         hdev->dev_class, 3);
2802                 goto unlock;
2803         }
2804
2805         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2806         if (!cmd) {
2807                 err = -ENOMEM;
2808                 goto unlock;
2809         }
2810
2811         err = 0;
2812
2813 unlock:
2814         hci_dev_unlock(hdev);
2815         return err;
2816 }
2817
2818 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2819                           u16 len)
2820 {
2821         struct mgmt_cp_load_link_keys *cp = data;
2822         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2823                                    sizeof(struct mgmt_link_key_info));
2824         u16 key_count, expected_len;
2825         bool changed;
2826         int i;
2827
2828         BT_DBG("request for %s", hdev->name);
2829
2830         if (!lmp_bredr_capable(hdev))
2831                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2832                                        MGMT_STATUS_NOT_SUPPORTED);
2833
2834         key_count = __le16_to_cpu(cp->key_count);
2835         if (key_count > max_key_count) {
2836                 BT_ERR("load_link_keys: too big key_count value %u",
2837                        key_count);
2838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2839                                        MGMT_STATUS_INVALID_PARAMS);
2840         }
2841
2842         expected_len = sizeof(*cp) + key_count *
2843                                         sizeof(struct mgmt_link_key_info);
2844         if (expected_len != len) {
2845                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2846                        expected_len, len);
2847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2848                                        MGMT_STATUS_INVALID_PARAMS);
2849         }
2850
2851         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2852                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2853                                        MGMT_STATUS_INVALID_PARAMS);
2854
2855         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2856                key_count);
2857
2858         for (i = 0; i < key_count; i++) {
2859                 struct mgmt_link_key_info *key = &cp->keys[i];
2860
2861                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2862                         return mgmt_cmd_status(sk, hdev->id,
2863                                                MGMT_OP_LOAD_LINK_KEYS,
2864                                                MGMT_STATUS_INVALID_PARAMS);
2865         }
2866
2867         hci_dev_lock(hdev);
2868
2869         hci_link_keys_clear(hdev);
2870
2871         if (cp->debug_keys)
2872                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2873         else
2874                 changed = hci_dev_test_and_clear_flag(hdev,
2875                                                       HCI_KEEP_DEBUG_KEYS);
2876
2877         if (changed)
2878                 new_settings(hdev, NULL);
2879
2880         for (i = 0; i < key_count; i++) {
2881                 struct mgmt_link_key_info *key = &cp->keys[i];
2882
2883                 /* Always ignore debug keys and require a new pairing if
2884                  * the user wants to use them.
2885                  */
2886                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2887                         continue;
2888
2889                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2890                                  key->type, key->pin_len, NULL);
2891         }
2892
2893         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2894
2895         hci_dev_unlock(hdev);
2896
2897         return 0;
2898 }
2899
2900 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2901                            u8 addr_type, struct sock *skip_sk)
2902 {
2903         struct mgmt_ev_device_unpaired ev;
2904
2905         bacpy(&ev.addr.bdaddr, bdaddr);
2906         ev.addr.type = addr_type;
2907
2908         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2909                           skip_sk);
2910 }
2911
2912 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2913                          u16 len)
2914 {
2915         struct mgmt_cp_unpair_device *cp = data;
2916         struct mgmt_rp_unpair_device rp;
2917         struct hci_cp_disconnect dc;
2918         struct mgmt_pending_cmd *cmd;
2919         struct hci_conn *conn;
2920         int err;
2921
2922         memset(&rp, 0, sizeof(rp));
2923         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924         rp.addr.type = cp->addr.type;
2925
2926         if (!bdaddr_type_is_valid(cp->addr.type))
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2932                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2933                                          MGMT_STATUS_INVALID_PARAMS,
2934                                          &rp, sizeof(rp));
2935
2936         hci_dev_lock(hdev);
2937
2938         if (!hdev_is_powered(hdev)) {
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2940                                         MGMT_STATUS_NOT_POWERED, &rp,
2941                                         sizeof(rp));
2942                 goto unlock;
2943         }
2944
2945         if (cp->addr.type == BDADDR_BREDR) {
2946                 /* If disconnection is requested, then look up the
2947                  * connection. If the remote device is connected, it
2948                  * will be later used to terminate the link.
2949                  *
2950                  * Setting it to NULL explicitly will cause no
2951                  * termination of the link.
2952                  */
2953                 if (cp->disconnect)
2954                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2955                                                        &cp->addr.bdaddr);
2956                 else
2957                         conn = NULL;
2958
2959                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2960         } else {
2961                 u8 addr_type;
2962
2963                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2964                                                &cp->addr.bdaddr);
2965                 if (conn) {
2966                         /* Defer clearing up the connection parameters
2967                          * until closing to give a chance of keeping
2968                          * them if a repairing happens.
2969                          */
2970                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2971
2972                         /* If disconnection is not requested, then
2973                          * clear the connection variable so that the
2974                          * link is not terminated.
2975                          */
2976                         if (!cp->disconnect)
2977                                 conn = NULL;
2978                 }
2979
2980                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2981                         addr_type = ADDR_LE_DEV_PUBLIC;
2982                 else
2983                         addr_type = ADDR_LE_DEV_RANDOM;
2984
2985                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2986
2987                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2988         }
2989
2990         if (err < 0) {
2991                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2992                                         MGMT_STATUS_NOT_PAIRED, &rp,
2993                                         sizeof(rp));
2994                 goto unlock;
2995         }
2996
2997         /* If the connection variable is set, then termination of the
2998          * link is requested.
2999          */
3000         if (!conn) {
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3002                                         &rp, sizeof(rp));
3003                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3004                 goto unlock;
3005         }
3006
3007         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3008                                sizeof(*cp));
3009         if (!cmd) {
3010                 err = -ENOMEM;
3011                 goto unlock;
3012         }
3013
3014         cmd->cmd_complete = addr_cmd_complete;
3015
3016         dc.handle = cpu_to_le16(conn->handle);
3017         dc.reason = 0x13; /* Remote User Terminated Connection */
3018         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3019         if (err < 0)
3020                 mgmt_pending_remove(cmd);
3021
3022 unlock:
3023         hci_dev_unlock(hdev);
3024         return err;
3025 }
3026
3027 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3028                       u16 len)
3029 {
3030         struct mgmt_cp_disconnect *cp = data;
3031         struct mgmt_rp_disconnect rp;
3032         struct mgmt_pending_cmd *cmd;
3033         struct hci_conn *conn;
3034         int err;
3035
3036         BT_DBG("");
3037
3038         memset(&rp, 0, sizeof(rp));
3039         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3040         rp.addr.type = cp->addr.type;
3041
3042         if (!bdaddr_type_is_valid(cp->addr.type))
3043                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3044                                          MGMT_STATUS_INVALID_PARAMS,
3045                                          &rp, sizeof(rp));
3046
3047         hci_dev_lock(hdev);
3048
3049         if (!test_bit(HCI_UP, &hdev->flags)) {
3050                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3051                                         MGMT_STATUS_NOT_POWERED, &rp,
3052                                         sizeof(rp));
3053                 goto failed;
3054         }
3055
3056         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3057                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3058                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3059                 goto failed;
3060         }
3061
3062         if (cp->addr.type == BDADDR_BREDR)
3063                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3064                                                &cp->addr.bdaddr);
3065         else
3066                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
3067
3068         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3069                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3070                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3071                                         sizeof(rp));
3072                 goto failed;
3073         }
3074
3075         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3076         if (!cmd) {
3077                 err = -ENOMEM;
3078                 goto failed;
3079         }
3080
3081         cmd->cmd_complete = generic_cmd_complete;
3082
3083         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3084         if (err < 0)
3085                 mgmt_pending_remove(cmd);
3086
3087 failed:
3088         hci_dev_unlock(hdev);
3089         return err;
3090 }
3091
3092 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3093 {
3094         switch (link_type) {
3095         case LE_LINK:
3096                 switch (addr_type) {
3097                 case ADDR_LE_DEV_PUBLIC:
3098                         return BDADDR_LE_PUBLIC;
3099
3100                 default:
3101                         /* Fallback to LE Random address type */
3102                         return BDADDR_LE_RANDOM;
3103                 }
3104
3105         default:
3106                 /* Fallback to BR/EDR type */
3107                 return BDADDR_BREDR;
3108         }
3109 }
3110
3111 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3112                            u16 data_len)
3113 {
3114         struct mgmt_rp_get_connections *rp;
3115         struct hci_conn *c;
3116         size_t rp_len;
3117         int err;
3118         u16 i;
3119
3120         BT_DBG("");
3121
3122         hci_dev_lock(hdev);
3123
3124         if (!hdev_is_powered(hdev)) {
3125                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3126                                       MGMT_STATUS_NOT_POWERED);
3127                 goto unlock;
3128         }
3129
3130         i = 0;
3131         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3132                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3133                         i++;
3134         }
3135
3136         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3137         rp = kmalloc(rp_len, GFP_KERNEL);
3138         if (!rp) {
3139                 err = -ENOMEM;
3140                 goto unlock;
3141         }
3142
3143         i = 0;
3144         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3145                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3146                         continue;
3147                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3148                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3149                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3150                         continue;
3151                 i++;
3152         }
3153
3154         rp->conn_count = cpu_to_le16(i);
3155
3156         /* Recalculate length in case of filtered SCO connections, etc */
3157         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3158
3159         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3160                                 rp_len);
3161
3162         kfree(rp);
3163
3164 unlock:
3165         hci_dev_unlock(hdev);
3166         return err;
3167 }
3168
3169 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3170                                    struct mgmt_cp_pin_code_neg_reply *cp)
3171 {
3172         struct mgmt_pending_cmd *cmd;
3173         int err;
3174
3175         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3176                                sizeof(*cp));
3177         if (!cmd)
3178                 return -ENOMEM;
3179
3180         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3181                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3182         if (err < 0)
3183                 mgmt_pending_remove(cmd);
3184
3185         return err;
3186 }
3187
3188 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3189                           u16 len)
3190 {
3191         struct hci_conn *conn;
3192         struct mgmt_cp_pin_code_reply *cp = data;
3193         struct hci_cp_pin_code_reply reply;
3194         struct mgmt_pending_cmd *cmd;
3195         int err;
3196
3197         BT_DBG("");
3198
3199         hci_dev_lock(hdev);
3200
3201         if (!hdev_is_powered(hdev)) {
3202                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3203                                       MGMT_STATUS_NOT_POWERED);
3204                 goto failed;
3205         }
3206
3207         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3208         if (!conn) {
3209                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3210                                       MGMT_STATUS_NOT_CONNECTED);
3211                 goto failed;
3212         }
3213
3214         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3215                 struct mgmt_cp_pin_code_neg_reply ncp;
3216
3217                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3218
3219                 BT_ERR("PIN code is not 16 bytes long");
3220
3221                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3222                 if (err >= 0)
3223                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3224                                               MGMT_STATUS_INVALID_PARAMS);
3225
3226                 goto failed;
3227         }
3228
3229         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3230         if (!cmd) {
3231                 err = -ENOMEM;
3232                 goto failed;
3233         }
3234
3235         cmd->cmd_complete = addr_cmd_complete;
3236
3237         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3238         reply.pin_len = cp->pin_len;
3239         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3240
3241         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3242         if (err < 0)
3243                 mgmt_pending_remove(cmd);
3244
3245 failed:
3246         hci_dev_unlock(hdev);
3247         return err;
3248 }
3249
3250 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3251                              u16 len)
3252 {
3253         struct mgmt_cp_set_io_capability *cp = data;
3254
3255         BT_DBG("");
3256
3257         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3258                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3259                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3260
3261         hci_dev_lock(hdev);
3262
3263         hdev->io_capability = cp->io_capability;
3264
3265         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3266                hdev->io_capability);
3267
3268         hci_dev_unlock(hdev);
3269
3270         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3271                                  NULL, 0);
3272 }
3273
3274 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3275 {
3276         struct hci_dev *hdev = conn->hdev;
3277         struct mgmt_pending_cmd *cmd;
3278
3279         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3280                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3281                         continue;
3282
3283                 if (cmd->user_data != conn)
3284                         continue;
3285
3286                 return cmd;
3287         }
3288
3289         return NULL;
3290 }
3291
3292 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3293 {
3294         struct mgmt_rp_pair_device rp;
3295         struct hci_conn *conn = cmd->user_data;
3296         int err;
3297
3298         bacpy(&rp.addr.bdaddr, &conn->dst);
3299         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3300
3301         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3302                                 status, &rp, sizeof(rp));
3303
3304         /* So we don't get further callbacks for this connection */
3305         conn->connect_cfm_cb = NULL;
3306         conn->security_cfm_cb = NULL;
3307         conn->disconn_cfm_cb = NULL;
3308
3309         hci_conn_drop(conn);
3310
3311         /* The device is paired so there is no need to remove
3312          * its connection parameters anymore.
3313          */
3314         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3315
3316         hci_conn_put(conn);
3317
3318         return err;
3319 }
3320
3321 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3322 {
3323         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3324         struct mgmt_pending_cmd *cmd;
3325
3326         cmd = find_pairing(conn);
3327         if (cmd) {
3328                 cmd->cmd_complete(cmd, status);
3329                 mgmt_pending_remove(cmd);
3330         }
3331 }
3332
3333 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3334 {
3335         struct mgmt_pending_cmd *cmd;
3336
3337         BT_DBG("status %u", status);
3338
3339         cmd = find_pairing(conn);
3340         if (!cmd) {
3341                 BT_DBG("Unable to find a pending command");
3342                 return;
3343         }
3344
3345         cmd->cmd_complete(cmd, mgmt_status(status));
3346         mgmt_pending_remove(cmd);
3347 }
3348
3349 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3350 {
3351         struct mgmt_pending_cmd *cmd;
3352
3353         BT_DBG("status %u", status);
3354
3355         if (!status)
3356                 return;
3357
3358         cmd = find_pairing(conn);
3359         if (!cmd) {
3360                 BT_DBG("Unable to find a pending command");
3361                 return;
3362         }
3363
3364         cmd->cmd_complete(cmd, mgmt_status(status));
3365         mgmt_pending_remove(cmd);
3366 }
3367
3368 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3369                        u16 len)
3370 {
3371         struct mgmt_cp_pair_device *cp = data;
3372         struct mgmt_rp_pair_device rp;
3373         struct mgmt_pending_cmd *cmd;
3374         u8 sec_level, auth_type;
3375         struct hci_conn *conn;
3376         int err;
3377
3378         BT_DBG("");
3379
3380         memset(&rp, 0, sizeof(rp));
3381         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3382         rp.addr.type = cp->addr.type;
3383
3384         if (!bdaddr_type_is_valid(cp->addr.type))
3385                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3386                                          MGMT_STATUS_INVALID_PARAMS,
3387                                          &rp, sizeof(rp));
3388
3389         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3390                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3391                                          MGMT_STATUS_INVALID_PARAMS,
3392                                          &rp, sizeof(rp));
3393
3394         hci_dev_lock(hdev);
3395
3396         if (!hdev_is_powered(hdev)) {
3397                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3398                                         MGMT_STATUS_NOT_POWERED, &rp,
3399                                         sizeof(rp));
3400                 goto unlock;
3401         }
3402
3403         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3404                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3405                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3406                                         sizeof(rp));
3407                 goto unlock;
3408         }
3409
3410         sec_level = BT_SECURITY_MEDIUM;
3411         auth_type = HCI_AT_DEDICATED_BONDING;
3412
3413         if (cp->addr.type == BDADDR_BREDR) {
3414                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3415                                        auth_type);
3416         } else {
3417                 u8 addr_type;
3418
3419                 /* Convert from L2CAP channel address type to HCI address type
3420                  */
3421                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3422                         addr_type = ADDR_LE_DEV_PUBLIC;
3423                 else
3424                         addr_type = ADDR_LE_DEV_RANDOM;
3425
3426                 /* When pairing a new device, it is expected to remember
3427                  * this device for future connections. Adding the connection
3428                  * parameter information ahead of time allows tracking
3429                  * of the slave preferred values and will speed up any
3430                  * further connection establishment.
3431                  *
3432                  * If connection parameters already exist, then they
3433                  * will be kept and this function does nothing.
3434                  */
3435                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3436
3437                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3438                                       sec_level, HCI_LE_CONN_TIMEOUT,
3439                                       HCI_ROLE_MASTER);
3440         }
3441
3442         if (IS_ERR(conn)) {
3443                 int status;
3444
3445                 if (PTR_ERR(conn) == -EBUSY)
3446                         status = MGMT_STATUS_BUSY;
3447                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3448                         status = MGMT_STATUS_NOT_SUPPORTED;
3449                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3450                         status = MGMT_STATUS_REJECTED;
3451                 else
3452                         status = MGMT_STATUS_CONNECT_FAILED;
3453
3454                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3455                                         status, &rp, sizeof(rp));
3456                 goto unlock;
3457         }
3458
3459         if (conn->connect_cfm_cb) {
3460                 hci_conn_drop(conn);
3461                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3462                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3463                 goto unlock;
3464         }
3465
3466         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3467         if (!cmd) {
3468                 err = -ENOMEM;
3469                 hci_conn_drop(conn);
3470                 goto unlock;
3471         }
3472
3473         cmd->cmd_complete = pairing_complete;
3474
3475         /* For LE, just connecting isn't a proof that the pairing finished */
3476         if (cp->addr.type == BDADDR_BREDR) {
3477                 conn->connect_cfm_cb = pairing_complete_cb;
3478                 conn->security_cfm_cb = pairing_complete_cb;
3479                 conn->disconn_cfm_cb = pairing_complete_cb;
3480         } else {
3481                 conn->connect_cfm_cb = le_pairing_complete_cb;
3482                 conn->security_cfm_cb = le_pairing_complete_cb;
3483                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3484         }
3485
3486         conn->io_capability = cp->io_cap;
3487         cmd->user_data = hci_conn_get(conn);
3488
3489         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3490             hci_conn_security(conn, sec_level, auth_type, true)) {
3491                 cmd->cmd_complete(cmd, 0);
3492                 mgmt_pending_remove(cmd);
3493         }
3494
3495         err = 0;
3496
3497 unlock:
3498         hci_dev_unlock(hdev);
3499         return err;
3500 }
3501
3502 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3503                               u16 len)
3504 {
3505         struct mgmt_addr_info *addr = data;
3506         struct mgmt_pending_cmd *cmd;
3507         struct hci_conn *conn;
3508         int err;
3509
3510         BT_DBG("");
3511
3512         hci_dev_lock(hdev);
3513
3514         if (!hdev_is_powered(hdev)) {
3515                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3516                                       MGMT_STATUS_NOT_POWERED);
3517                 goto unlock;
3518         }
3519
3520         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3521         if (!cmd) {
3522                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3523                                       MGMT_STATUS_INVALID_PARAMS);
3524                 goto unlock;
3525         }
3526
3527         conn = cmd->user_data;
3528
3529         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3530                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3531                                       MGMT_STATUS_INVALID_PARAMS);
3532                 goto unlock;
3533         }
3534
3535         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3536         mgmt_pending_remove(cmd);
3537
3538         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3539                                 addr, sizeof(*addr));
3540 unlock:
3541         hci_dev_unlock(hdev);
3542         return err;
3543 }
3544
3545 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3546                              struct mgmt_addr_info *addr, u16 mgmt_op,
3547                              u16 hci_op, __le32 passkey)
3548 {
3549         struct mgmt_pending_cmd *cmd;
3550         struct hci_conn *conn;
3551         int err;
3552
3553         hci_dev_lock(hdev);
3554
3555         if (!hdev_is_powered(hdev)) {
3556                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3557                                         MGMT_STATUS_NOT_POWERED, addr,
3558                                         sizeof(*addr));
3559                 goto done;
3560         }
3561
3562         if (addr->type == BDADDR_BREDR)
3563                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3564         else
3565                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3566
3567         if (!conn) {
3568                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3569                                         MGMT_STATUS_NOT_CONNECTED, addr,
3570                                         sizeof(*addr));
3571                 goto done;
3572         }
3573
3574         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3575                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3576                 if (!err)
3577                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3578                                                 MGMT_STATUS_SUCCESS, addr,
3579                                                 sizeof(*addr));
3580                 else
3581                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3582                                                 MGMT_STATUS_FAILED, addr,
3583                                                 sizeof(*addr));
3584
3585                 goto done;
3586         }
3587
3588         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3589         if (!cmd) {
3590                 err = -ENOMEM;
3591                 goto done;
3592         }
3593
3594         cmd->cmd_complete = addr_cmd_complete;
3595
3596         /* Continue with pairing via HCI */
3597         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3598                 struct hci_cp_user_passkey_reply cp;
3599
3600                 bacpy(&cp.bdaddr, &addr->bdaddr);
3601                 cp.passkey = passkey;
3602                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3603         } else
3604                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3605                                    &addr->bdaddr);
3606
3607         if (err < 0)
3608                 mgmt_pending_remove(cmd);
3609
3610 done:
3611         hci_dev_unlock(hdev);
3612         return err;
3613 }
3614
3615 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3616                               void *data, u16 len)
3617 {
3618         struct mgmt_cp_pin_code_neg_reply *cp = data;
3619
3620         BT_DBG("");
3621
3622         return user_pairing_resp(sk, hdev, &cp->addr,
3623                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3624                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3625 }
3626
3627 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3628                               u16 len)
3629 {
3630         struct mgmt_cp_user_confirm_reply *cp = data;
3631
3632         BT_DBG("");
3633
3634         if (len != sizeof(*cp))
3635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3636                                        MGMT_STATUS_INVALID_PARAMS);
3637
3638         return user_pairing_resp(sk, hdev, &cp->addr,
3639                                  MGMT_OP_USER_CONFIRM_REPLY,
3640                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3641 }
3642
3643 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3644                                   void *data, u16 len)
3645 {
3646         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3647
3648         BT_DBG("");
3649
3650         return user_pairing_resp(sk, hdev, &cp->addr,
3651                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3652                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3653 }
3654
3655 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3656                               u16 len)
3657 {
3658         struct mgmt_cp_user_passkey_reply *cp = data;
3659
3660         BT_DBG("");
3661
3662         return user_pairing_resp(sk, hdev, &cp->addr,
3663                                  MGMT_OP_USER_PASSKEY_REPLY,
3664                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3665 }
3666
3667 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3668                                   void *data, u16 len)
3669 {
3670         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3671
3672         BT_DBG("");
3673
3674         return user_pairing_resp(sk, hdev, &cp->addr,
3675                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3676                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3677 }
3678
3679 static void update_name(struct hci_request *req)
3680 {
3681         struct hci_dev *hdev = req->hdev;
3682         struct hci_cp_write_local_name cp;
3683
3684         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3685
3686         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3687 }
3688
3689 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3690 {
3691         struct mgmt_cp_set_local_name *cp;
3692         struct mgmt_pending_cmd *cmd;
3693
3694         BT_DBG("status 0x%02x", status);
3695
3696         hci_dev_lock(hdev);
3697
3698         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3699         if (!cmd)
3700                 goto unlock;
3701
3702         cp = cmd->param;
3703
3704         if (status)
3705                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3706                                 mgmt_status(status));
3707         else
3708                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3709                                   cp, sizeof(*cp));
3710
3711         mgmt_pending_remove(cmd);
3712
3713 unlock:
3714         hci_dev_unlock(hdev);
3715 }
3716
3717 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3718                           u16 len)
3719 {
3720         struct mgmt_cp_set_local_name *cp = data;
3721         struct mgmt_pending_cmd *cmd;
3722         struct hci_request req;
3723         int err;
3724
3725         BT_DBG("");
3726
3727         hci_dev_lock(hdev);
3728
3729         /* If the old values are the same as the new ones just return a
3730          * direct command complete event.
3731          */
3732         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3733             !memcmp(hdev->short_name, cp->short_name,
3734                     sizeof(hdev->short_name))) {
3735                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3736                                         data, len);
3737                 goto failed;
3738         }
3739
3740         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3741
3742         if (!hdev_is_powered(hdev)) {
3743                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3744
3745                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3746                                         data, len);
3747                 if (err < 0)
3748                         goto failed;
3749
3750                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3751                                          data, len, sk);
3752
3753                 goto failed;
3754         }
3755
3756         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3757         if (!cmd) {
3758                 err = -ENOMEM;
3759                 goto failed;
3760         }
3761
3762         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3763
3764         hci_req_init(&req, hdev);
3765
3766         if (lmp_bredr_capable(hdev)) {
3767                 update_name(&req);
3768                 update_eir(&req);
3769         }
3770
3771         /* The name is stored in the scan response data and so
3772          * no need to udpate the advertising data here.
3773          */
3774         if (lmp_le_capable(hdev))
3775                 update_scan_rsp_data(&req);
3776
3777         err = hci_req_run(&req, set_name_complete);
3778         if (err < 0)
3779                 mgmt_pending_remove(cmd);
3780
3781 failed:
3782         hci_dev_unlock(hdev);
3783         return err;
3784 }
3785
3786 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3787                                          u16 opcode, struct sk_buff *skb)
3788 {
3789         struct mgmt_rp_read_local_oob_data mgmt_rp;
3790         size_t rp_size = sizeof(mgmt_rp);
3791         struct mgmt_pending_cmd *cmd;
3792
3793         BT_DBG("%s status %u", hdev->name, status);
3794
3795         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3796         if (!cmd)
3797                 return;
3798
3799         if (status || !skb) {
3800                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3801                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3802                 goto remove;
3803         }
3804
3805         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3806
3807         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3808                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3809
3810                 if (skb->len < sizeof(*rp)) {
3811                         mgmt_cmd_status(cmd->sk, hdev->id,
3812                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3813                                         MGMT_STATUS_FAILED);
3814                         goto remove;
3815                 }
3816
3817                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3818                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3819
3820                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3821         } else {
3822                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3823
3824                 if (skb->len < sizeof(*rp)) {
3825                         mgmt_cmd_status(cmd->sk, hdev->id,
3826                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3827                                         MGMT_STATUS_FAILED);
3828                         goto remove;
3829                 }
3830
3831                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3832                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3833
3834                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3835                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3836         }
3837
3838         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3839                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3840
3841 remove:
3842         mgmt_pending_remove(cmd);
3843 }
3844
3845 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3846                                void *data, u16 data_len)
3847 {
3848         struct mgmt_pending_cmd *cmd;
3849         struct hci_request req;
3850         int err;
3851
3852         BT_DBG("%s", hdev->name);
3853
3854         hci_dev_lock(hdev);
3855
3856         if (!hdev_is_powered(hdev)) {
3857                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3858                                       MGMT_STATUS_NOT_POWERED);
3859                 goto unlock;
3860         }
3861
3862         if (!lmp_ssp_capable(hdev)) {
3863                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3864                                       MGMT_STATUS_NOT_SUPPORTED);
3865                 goto unlock;
3866         }
3867
3868         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3869                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3870                                       MGMT_STATUS_BUSY);
3871                 goto unlock;
3872         }
3873
3874         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3875         if (!cmd) {
3876                 err = -ENOMEM;
3877                 goto unlock;
3878         }
3879
3880         hci_req_init(&req, hdev);
3881
3882         if (bredr_sc_enabled(hdev))
3883                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3884         else
3885                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3886
3887         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3888         if (err < 0)
3889                 mgmt_pending_remove(cmd);
3890
3891 unlock:
3892         hci_dev_unlock(hdev);
3893         return err;
3894 }
3895
3896 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3897                                void *data, u16 len)
3898 {
3899         struct mgmt_addr_info *addr = data;
3900         int err;
3901
3902         BT_DBG("%s ", hdev->name);
3903
3904         if (!bdaddr_type_is_valid(addr->type))
3905                 return mgmt_cmd_complete(sk, hdev->id,
3906                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3907                                          MGMT_STATUS_INVALID_PARAMS,
3908                                          addr, sizeof(*addr));
3909
3910         hci_dev_lock(hdev);
3911
3912         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3913                 struct mgmt_cp_add_remote_oob_data *cp = data;
3914                 u8 status;
3915
3916                 if (cp->addr.type != BDADDR_BREDR) {
3917                         err = mgmt_cmd_complete(sk, hdev->id,
3918                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3919                                                 MGMT_STATUS_INVALID_PARAMS,
3920                                                 &cp->addr, sizeof(cp->addr));
3921                         goto unlock;
3922                 }
3923
3924                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3925                                               cp->addr.type, cp->hash,
3926                                               cp->rand, NULL, NULL);
3927                 if (err < 0)
3928                         status = MGMT_STATUS_FAILED;
3929                 else
3930                         status = MGMT_STATUS_SUCCESS;
3931
3932                 err = mgmt_cmd_complete(sk, hdev->id,
3933                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3934                                         &cp->addr, sizeof(cp->addr));
3935         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3936                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3937                 u8 *rand192, *hash192, *rand256, *hash256;
3938                 u8 status;
3939
3940                 if (bdaddr_type_is_le(cp->addr.type)) {
3941                         /* Enforce zero-valued 192-bit parameters as
3942                          * long as legacy SMP OOB isn't implemented.
3943                          */
3944                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3945                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3946                                 err = mgmt_cmd_complete(sk, hdev->id,
3947                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3948                                                         MGMT_STATUS_INVALID_PARAMS,
3949                                                         addr, sizeof(*addr));
3950                                 goto unlock;
3951                         }
3952
3953                         rand192 = NULL;
3954                         hash192 = NULL;
3955                 } else {
3956                         /* In case one of the P-192 values is set to zero,
3957                          * then just disable OOB data for P-192.
3958                          */
3959                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3960                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3961                                 rand192 = NULL;
3962                                 hash192 = NULL;
3963                         } else {
3964                                 rand192 = cp->rand192;
3965                                 hash192 = cp->hash192;
3966                         }
3967                 }
3968
3969                 /* In case one of the P-256 values is set to zero, then just
3970                  * disable OOB data for P-256.
3971                  */
3972                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3973                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3974                         rand256 = NULL;
3975                         hash256 = NULL;
3976                 } else {
3977                         rand256 = cp->rand256;
3978                         hash256 = cp->hash256;
3979                 }
3980
3981                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3982                                               cp->addr.type, hash192, rand192,
3983                                               hash256, rand256);
3984                 if (err < 0)
3985                         status = MGMT_STATUS_FAILED;
3986                 else
3987                         status = MGMT_STATUS_SUCCESS;
3988
3989                 err = mgmt_cmd_complete(sk, hdev->id,
3990                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3991                                         status, &cp->addr, sizeof(cp->addr));
3992         } else {
3993                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3995                                       MGMT_STATUS_INVALID_PARAMS);
3996         }
3997
3998 unlock:
3999         hci_dev_unlock(hdev);
4000         return err;
4001 }
4002
4003 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4004                                   void *data, u16 len)
4005 {
4006         struct mgmt_cp_remove_remote_oob_data *cp = data;
4007         u8 status;
4008         int err;
4009
4010         BT_DBG("%s", hdev->name);
4011
4012         if (cp->addr.type != BDADDR_BREDR)
4013                 return mgmt_cmd_complete(sk, hdev->id,
4014                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4015                                          MGMT_STATUS_INVALID_PARAMS,
4016                                          &cp->addr, sizeof(cp->addr));
4017
4018         hci_dev_lock(hdev);
4019
4020         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4021                 hci_remote_oob_data_clear(hdev);
4022                 status = MGMT_STATUS_SUCCESS;
4023                 goto done;
4024         }
4025
4026         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4027         if (err < 0)
4028                 status = MGMT_STATUS_INVALID_PARAMS;
4029         else
4030                 status = MGMT_STATUS_SUCCESS;
4031
4032 done:
4033         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4034                                 status, &cp->addr, sizeof(cp->addr));
4035
4036         hci_dev_unlock(hdev);
4037         return err;
4038 }
4039
4040 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
4041 {
4042         struct hci_dev *hdev = req->hdev;
4043         struct hci_cp_inquiry cp;
4044         /* General inquiry access code (GIAC) */
4045         u8 lap[3] = { 0x33, 0x8b, 0x9e };
4046
4047         *status = mgmt_bredr_support(hdev);
4048         if (*status)
4049                 return false;
4050
4051         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4052                 *status = MGMT_STATUS_BUSY;
4053                 return false;
4054         }
4055
4056         hci_inquiry_cache_flush(hdev);
4057
4058         memset(&cp, 0, sizeof(cp));
4059         memcpy(&cp.lap, lap, sizeof(cp.lap));
4060         cp.length = DISCOV_BREDR_INQUIRY_LEN;
4061
4062         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4063
4064         return true;
4065 }
4066
4067 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4068 {
4069         struct hci_dev *hdev = req->hdev;
4070         struct hci_cp_le_set_scan_param param_cp;
4071         struct hci_cp_le_set_scan_enable enable_cp;
4072         u8 own_addr_type;
4073         int err;
4074
4075         *status = mgmt_le_support(hdev);
4076         if (*status)
4077                 return false;
4078
4079         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4080                 /* Don't let discovery abort an outgoing connection attempt
4081                  * that's using directed advertising.
4082                  */
4083                 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4084                         *status = MGMT_STATUS_REJECTED;
4085                         return false;
4086                 }
4087
4088                 disable_advertising(req);
4089         }
4090
4091         /* If controller is scanning, it means the background scanning is
4092          * running. Thus, we should temporarily stop it in order to set the
4093          * discovery scanning parameters.
4094          */
4095         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4096                 hci_req_add_le_scan_disable(req);
4097
4098         /* All active scans will be done with either a resolvable private
4099          * address (when privacy feature has been enabled) or non-resolvable
4100          * private address.
4101          */
4102         err = hci_update_random_address(req, true, &own_addr_type);
4103         if (err < 0) {
4104                 *status = MGMT_STATUS_FAILED;
4105                 return false;
4106         }
4107
4108         memset(&param_cp, 0, sizeof(param_cp));
4109         param_cp.type = LE_SCAN_ACTIVE;
4110         param_cp.interval = cpu_to_le16(interval);
4111         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4112         param_cp.own_address_type = own_addr_type;
4113
4114         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4115                     &param_cp);
4116
4117         memset(&enable_cp, 0, sizeof(enable_cp));
4118         enable_cp.enable = LE_SCAN_ENABLE;
4119         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4120
4121         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4122                     &enable_cp);
4123
4124         return true;
4125 }
4126
4127 static bool trigger_discovery(struct hci_request *req, u8 *status)
4128 {
4129         struct hci_dev *hdev = req->hdev;
4130
4131         switch (hdev->discovery.type) {
4132         case DISCOV_TYPE_BREDR:
4133                 if (!trigger_bredr_inquiry(req, status))
4134                         return false;
4135                 break;
4136
4137         case DISCOV_TYPE_INTERLEAVED:
4138                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4139                              &hdev->quirks)) {
4140                         /* During simultaneous discovery, we double LE scan
4141                          * interval. We must leave some time for the controller
4142                          * to do BR/EDR inquiry.
4143                          */
4144                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4145                                              status))
4146                                 return false;
4147
4148                         if (!trigger_bredr_inquiry(req, status))
4149                                 return false;
4150
4151                         return true;
4152                 }
4153
4154                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4155                         *status = MGMT_STATUS_NOT_SUPPORTED;
4156                         return false;
4157                 }
4158                 /* fall through */
4159
4160         case DISCOV_TYPE_LE:
4161                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4162                         return false;
4163                 break;
4164
4165         default:
4166                 *status = MGMT_STATUS_INVALID_PARAMS;
4167                 return false;
4168         }
4169
4170         return true;
4171 }
4172
4173 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4174                                      u16 opcode)
4175 {
4176         struct mgmt_pending_cmd *cmd;
4177         unsigned long timeout;
4178
4179         BT_DBG("status %d", status);
4180
4181         hci_dev_lock(hdev);
4182
4183         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4184         if (!cmd)
4185                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4186
4187         if (cmd) {
4188                 cmd->cmd_complete(cmd, mgmt_status(status));
4189                 mgmt_pending_remove(cmd);
4190         }
4191
4192         if (status) {
4193                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4194                 goto unlock;
4195         }
4196
4197         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4198
4199         /* If the scan involves LE scan, pick proper timeout to schedule
4200          * hdev->le_scan_disable that will stop it.
4201          */
4202         switch (hdev->discovery.type) {
4203         case DISCOV_TYPE_LE:
4204                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4205                 break;
4206         case DISCOV_TYPE_INTERLEAVED:
4207                  /* When running simultaneous discovery, the LE scanning time
4208                  * should occupy the whole discovery time sine BR/EDR inquiry
4209                  * and LE scanning are scheduled by the controller.
4210                  *
4211                  * For interleaving discovery in comparison, BR/EDR inquiry
4212                  * and LE scanning are done sequentially with separate
4213                  * timeouts.
4214                  */
4215                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4216                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4217                 else
4218                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4219                 break;
4220         case DISCOV_TYPE_BREDR:
4221                 timeout = 0;
4222                 break;
4223         default:
4224                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4225                 timeout = 0;
4226                 break;
4227         }
4228
4229         if (timeout) {
4230                 /* When service discovery is used and the controller has
4231                  * a strict duplicate filter, it is important to remember
4232                  * the start and duration of the scan. This is required
4233                  * for restarting scanning during the discovery phase.
4234                  */
4235                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4236                              &hdev->quirks) &&
4237                     hdev->discovery.result_filtering) {
4238                         hdev->discovery.scan_start = jiffies;
4239                         hdev->discovery.scan_duration = timeout;
4240                 }
4241
4242                 queue_delayed_work(hdev->workqueue,
4243                                    &hdev->le_scan_disable, timeout);
4244         }
4245
4246 unlock:
4247         hci_dev_unlock(hdev);
4248 }
4249
4250 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4251                            void *data, u16 len)
4252 {
4253         struct mgmt_cp_start_discovery *cp = data;
4254         struct mgmt_pending_cmd *cmd;
4255         struct hci_request req;
4256         u8 status;
4257         int err;
4258
4259         BT_DBG("%s", hdev->name);
4260
4261         hci_dev_lock(hdev);
4262
4263         if (!hdev_is_powered(hdev)) {
4264                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4265                                         MGMT_STATUS_NOT_POWERED,
4266                                         &cp->type, sizeof(cp->type));
4267                 goto failed;
4268         }
4269
4270         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4271             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4272                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4273                                         MGMT_STATUS_BUSY, &cp->type,
4274                                         sizeof(cp->type));
4275                 goto failed;
4276         }
4277
4278         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4279         if (!cmd) {
4280                 err = -ENOMEM;
4281                 goto failed;
4282         }
4283
4284         cmd->cmd_complete = generic_cmd_complete;
4285
4286         /* Clear the discovery filter first to free any previously
4287          * allocated memory for the UUID list.
4288          */
4289         hci_discovery_filter_clear(hdev);
4290
4291         hdev->discovery.type = cp->type;
4292         hdev->discovery.report_invalid_rssi = false;
4293
4294         hci_req_init(&req, hdev);
4295
4296         if (!trigger_discovery(&req, &status)) {
4297                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4298                                         status, &cp->type, sizeof(cp->type));
4299                 mgmt_pending_remove(cmd);
4300                 goto failed;
4301         }
4302
4303         err = hci_req_run(&req, start_discovery_complete);
4304         if (err < 0) {
4305                 mgmt_pending_remove(cmd);
4306                 goto failed;
4307         }
4308
4309         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4310
4311 failed:
4312         hci_dev_unlock(hdev);
4313         return err;
4314 }
4315
4316 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4317                                           u8 status)
4318 {
4319         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4320                                  cmd->param, 1);
4321 }
4322
4323 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4324                                    void *data, u16 len)
4325 {
4326         struct mgmt_cp_start_service_discovery *cp = data;
4327         struct mgmt_pending_cmd *cmd;
4328         struct hci_request req;
4329         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4330         u16 uuid_count, expected_len;
4331         u8 status;
4332         int err;
4333
4334         BT_DBG("%s", hdev->name);
4335
4336         hci_dev_lock(hdev);
4337
4338         if (!hdev_is_powered(hdev)) {
4339                 err = mgmt_cmd_complete(sk, hdev->id,
4340                                         MGMT_OP_START_SERVICE_DISCOVERY,
4341                                         MGMT_STATUS_NOT_POWERED,
4342                                         &cp->type, sizeof(cp->type));
4343                 goto failed;
4344         }
4345
4346         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4347             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4348                 err = mgmt_cmd_complete(sk, hdev->id,
4349                                         MGMT_OP_START_SERVICE_DISCOVERY,
4350                                         MGMT_STATUS_BUSY, &cp->type,
4351                                         sizeof(cp->type));
4352                 goto failed;
4353         }
4354
4355         uuid_count = __le16_to_cpu(cp->uuid_count);
4356         if (uuid_count > max_uuid_count) {
4357                 BT_ERR("service_discovery: too big uuid_count value %u",
4358                        uuid_count);
4359                 err = mgmt_cmd_complete(sk, hdev->id,
4360                                         MGMT_OP_START_SERVICE_DISCOVERY,
4361                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4362                                         sizeof(cp->type));
4363                 goto failed;
4364         }
4365
4366         expected_len = sizeof(*cp) + uuid_count * 16;
4367         if (expected_len != len) {
4368                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4369                        expected_len, len);
4370                 err = mgmt_cmd_complete(sk, hdev->id,
4371                                         MGMT_OP_START_SERVICE_DISCOVERY,
4372                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4373                                         sizeof(cp->type));
4374                 goto failed;
4375         }
4376
4377         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4378                                hdev, data, len);
4379         if (!cmd) {
4380                 err = -ENOMEM;
4381                 goto failed;
4382         }
4383
4384         cmd->cmd_complete = service_discovery_cmd_complete;
4385
4386         /* Clear the discovery filter first to free any previously
4387          * allocated memory for the UUID list.
4388          */
4389         hci_discovery_filter_clear(hdev);
4390
4391         hdev->discovery.result_filtering = true;
4392         hdev->discovery.type = cp->type;
4393         hdev->discovery.rssi = cp->rssi;
4394         hdev->discovery.uuid_count = uuid_count;
4395
4396         if (uuid_count > 0) {
4397                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4398                                                 GFP_KERNEL);
4399                 if (!hdev->discovery.uuids) {
4400                         err = mgmt_cmd_complete(sk, hdev->id,
4401                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4402                                                 MGMT_STATUS_FAILED,
4403                                                 &cp->type, sizeof(cp->type));
4404                         mgmt_pending_remove(cmd);
4405                         goto failed;
4406                 }
4407         }
4408
4409         hci_req_init(&req, hdev);
4410
4411         if (!trigger_discovery(&req, &status)) {
4412                 err = mgmt_cmd_complete(sk, hdev->id,
4413                                         MGMT_OP_START_SERVICE_DISCOVERY,
4414                                         status, &cp->type, sizeof(cp->type));
4415                 mgmt_pending_remove(cmd);
4416                 goto failed;
4417         }
4418
4419         err = hci_req_run(&req, start_discovery_complete);
4420         if (err < 0) {
4421                 mgmt_pending_remove(cmd);
4422                 goto failed;
4423         }
4424
4425         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4426
4427 failed:
4428         hci_dev_unlock(hdev);
4429         return err;
4430 }
4431
4432 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4433 {
4434         struct mgmt_pending_cmd *cmd;
4435
4436         BT_DBG("status %d", status);
4437
4438         hci_dev_lock(hdev);
4439
4440         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4441         if (cmd) {
4442                 cmd->cmd_complete(cmd, mgmt_status(status));
4443                 mgmt_pending_remove(cmd);
4444         }
4445
4446         if (!status)
4447                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4448
4449         hci_dev_unlock(hdev);
4450 }
4451
4452 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4453                           u16 len)
4454 {
4455         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4456         struct mgmt_pending_cmd *cmd;
4457         struct hci_request req;
4458         int err;
4459
4460         BT_DBG("%s", hdev->name);
4461
4462         hci_dev_lock(hdev);
4463
4464         if (!hci_discovery_active(hdev)) {
4465                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4466                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4467                                         sizeof(mgmt_cp->type));
4468                 goto unlock;
4469         }
4470
4471         if (hdev->discovery.type != mgmt_cp->type) {
4472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4473                                         MGMT_STATUS_INVALID_PARAMS,
4474                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4475                 goto unlock;
4476         }
4477
4478         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4479         if (!cmd) {
4480                 err = -ENOMEM;
4481                 goto unlock;
4482         }
4483
4484         cmd->cmd_complete = generic_cmd_complete;
4485
4486         hci_req_init(&req, hdev);
4487
4488         hci_stop_discovery(&req);
4489
4490         err = hci_req_run(&req, stop_discovery_complete);
4491         if (!err) {
4492                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4493                 goto unlock;
4494         }
4495
4496         mgmt_pending_remove(cmd);
4497
4498         /* If no HCI commands were sent we're done */
4499         if (err == -ENODATA) {
4500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4501                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4502                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4503         }
4504
4505 unlock:
4506         hci_dev_unlock(hdev);
4507         return err;
4508 }
4509
4510 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4511                         u16 len)
4512 {
4513         struct mgmt_cp_confirm_name *cp = data;
4514         struct inquiry_entry *e;
4515         int err;
4516
4517         BT_DBG("%s", hdev->name);
4518
4519         hci_dev_lock(hdev);
4520
4521         if (!hci_discovery_active(hdev)) {
4522                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4523                                         MGMT_STATUS_FAILED, &cp->addr,
4524                                         sizeof(cp->addr));
4525                 goto failed;
4526         }
4527
4528         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4529         if (!e) {
4530                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4531                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4532                                         sizeof(cp->addr));
4533                 goto failed;
4534         }
4535
4536         if (cp->name_known) {
4537                 e->name_state = NAME_KNOWN;
4538                 list_del(&e->list);
4539         } else {
4540                 e->name_state = NAME_NEEDED;
4541                 hci_inquiry_cache_update_resolve(hdev, e);
4542         }
4543
4544         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4545                                 &cp->addr, sizeof(cp->addr));
4546
4547 failed:
4548         hci_dev_unlock(hdev);
4549         return err;
4550 }
4551
4552 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4553                         u16 len)
4554 {
4555         struct mgmt_cp_block_device *cp = data;
4556         u8 status;
4557         int err;
4558
4559         BT_DBG("%s", hdev->name);
4560
4561         if (!bdaddr_type_is_valid(cp->addr.type))
4562                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4563                                          MGMT_STATUS_INVALID_PARAMS,
4564                                          &cp->addr, sizeof(cp->addr));
4565
4566         hci_dev_lock(hdev);
4567
4568         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4569                                   cp->addr.type);
4570         if (err < 0) {
4571                 status = MGMT_STATUS_FAILED;
4572                 goto done;
4573         }
4574
4575         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4576                    sk);
4577         status = MGMT_STATUS_SUCCESS;
4578
4579 done:
4580         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4581                                 &cp->addr, sizeof(cp->addr));
4582
4583         hci_dev_unlock(hdev);
4584
4585         return err;
4586 }
4587
4588 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4589                           u16 len)
4590 {
4591         struct mgmt_cp_unblock_device *cp = data;
4592         u8 status;
4593         int err;
4594
4595         BT_DBG("%s", hdev->name);
4596
4597         if (!bdaddr_type_is_valid(cp->addr.type))
4598                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4599                                          MGMT_STATUS_INVALID_PARAMS,
4600                                          &cp->addr, sizeof(cp->addr));
4601
4602         hci_dev_lock(hdev);
4603
4604         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4605                                   cp->addr.type);
4606         if (err < 0) {
4607                 status = MGMT_STATUS_INVALID_PARAMS;
4608                 goto done;
4609         }
4610
4611         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4612                    sk);
4613         status = MGMT_STATUS_SUCCESS;
4614
4615 done:
4616         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4617                                 &cp->addr, sizeof(cp->addr));
4618
4619         hci_dev_unlock(hdev);
4620
4621         return err;
4622 }
4623
4624 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4625                          u16 len)
4626 {
4627         struct mgmt_cp_set_device_id *cp = data;
4628         struct hci_request req;
4629         int err;
4630         __u16 source;
4631
4632         BT_DBG("%s", hdev->name);
4633
4634         source = __le16_to_cpu(cp->source);
4635
4636         if (source > 0x0002)
4637                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4638                                        MGMT_STATUS_INVALID_PARAMS);
4639
4640         hci_dev_lock(hdev);
4641
4642         hdev->devid_source = source;
4643         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4644         hdev->devid_product = __le16_to_cpu(cp->product);
4645         hdev->devid_version = __le16_to_cpu(cp->version);
4646
4647         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4648                                 NULL, 0);
4649
4650         hci_req_init(&req, hdev);
4651         update_eir(&req);
4652         hci_req_run(&req, NULL);
4653
4654         hci_dev_unlock(hdev);
4655
4656         return err;
4657 }
4658
4659 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4660                                         u16 opcode)
4661 {
4662         BT_DBG("status %d", status);
4663 }
4664
4665 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4666                                      u16 opcode)
4667 {
4668         struct cmd_lookup match = { NULL, hdev };
4669         struct hci_request req;
4670
4671         hci_dev_lock(hdev);
4672
4673         if (status) {
4674                 u8 mgmt_err = mgmt_status(status);
4675
4676                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4677                                      cmd_status_rsp, &mgmt_err);
4678                 goto unlock;
4679         }
4680
4681         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4682                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4683         else
4684                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4685
4686         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4687                              &match);
4688
4689         new_settings(hdev, match.sk);
4690
4691         if (match.sk)
4692                 sock_put(match.sk);
4693
4694         /* If "Set Advertising" was just disabled and instance advertising was
4695          * set up earlier, then enable the advertising instance.
4696          */
4697         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4698             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4699                 goto unlock;
4700
4701         hci_req_init(&req, hdev);
4702
4703         update_adv_data(&req);
4704         enable_advertising(&req);
4705
4706         if (hci_req_run(&req, enable_advertising_instance) < 0)
4707                 BT_ERR("Failed to re-configure advertising");
4708
4709 unlock:
4710         hci_dev_unlock(hdev);
4711 }
4712
4713 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4714                            u16 len)
4715 {
4716         struct mgmt_mode *cp = data;
4717         struct mgmt_pending_cmd *cmd;
4718         struct hci_request req;
4719         u8 val, status;
4720         int err;
4721
4722         BT_DBG("request for %s", hdev->name);
4723
4724         status = mgmt_le_support(hdev);
4725         if (status)
4726                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4727                                        status);
4728
4729         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4730                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4731                                        MGMT_STATUS_INVALID_PARAMS);
4732
4733         hci_dev_lock(hdev);
4734
4735         val = !!cp->val;
4736
4737         /* The following conditions are ones which mean that we should
4738          * not do any HCI communication but directly send a mgmt
4739          * response to user space (after toggling the flag if
4740          * necessary).
4741          */
4742         if (!hdev_is_powered(hdev) ||
4743             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4744              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4745             hci_conn_num(hdev, LE_LINK) > 0 ||
4746             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4747              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4748                 bool changed;
4749
4750                 if (cp->val) {
4751                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4752                         if (cp->val == 0x02)
4753                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4754                         else
4755                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4756                 } else {
4757                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4758                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4759                 }
4760
4761                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4762                 if (err < 0)
4763                         goto unlock;
4764
4765                 if (changed)
4766                         err = new_settings(hdev, sk);
4767
4768                 goto unlock;
4769         }
4770
4771         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4772             pending_find(MGMT_OP_SET_LE, hdev)) {
4773                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4774                                       MGMT_STATUS_BUSY);
4775                 goto unlock;
4776         }
4777
4778         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4779         if (!cmd) {
4780                 err = -ENOMEM;
4781                 goto unlock;
4782         }
4783
4784         hci_req_init(&req, hdev);
4785
4786         if (cp->val == 0x02)
4787                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4788         else
4789                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4790
4791         if (val) {
4792                 /* Switch to instance "0" for the Set Advertising setting. */
4793                 update_adv_data_for_instance(&req, 0);
4794                 update_scan_rsp_data_for_instance(&req, 0);
4795                 enable_advertising(&req);
4796         } else {
4797                 disable_advertising(&req);
4798         }
4799
4800         err = hci_req_run(&req, set_advertising_complete);
4801         if (err < 0)
4802                 mgmt_pending_remove(cmd);
4803
4804 unlock:
4805         hci_dev_unlock(hdev);
4806         return err;
4807 }
4808
4809 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4810                               void *data, u16 len)
4811 {
4812         struct mgmt_cp_set_static_address *cp = data;
4813         int err;
4814
4815         BT_DBG("%s", hdev->name);
4816
4817         if (!lmp_le_capable(hdev))
4818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4819                                        MGMT_STATUS_NOT_SUPPORTED);
4820
4821         if (hdev_is_powered(hdev))
4822                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4823                                        MGMT_STATUS_REJECTED);
4824
4825         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4826                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4827                         return mgmt_cmd_status(sk, hdev->id,
4828                                                MGMT_OP_SET_STATIC_ADDRESS,
4829                                                MGMT_STATUS_INVALID_PARAMS);
4830
4831                 /* Two most significant bits shall be set */
4832                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4833                         return mgmt_cmd_status(sk, hdev->id,
4834                                                MGMT_OP_SET_STATIC_ADDRESS,
4835                                                MGMT_STATUS_INVALID_PARAMS);
4836         }
4837
4838         hci_dev_lock(hdev);
4839
4840         bacpy(&hdev->static_addr, &cp->bdaddr);
4841
4842         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4843         if (err < 0)
4844                 goto unlock;
4845
4846         err = new_settings(hdev, sk);
4847
4848 unlock:
4849         hci_dev_unlock(hdev);
4850         return err;
4851 }
4852
4853 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4854                            void *data, u16 len)
4855 {
4856         struct mgmt_cp_set_scan_params *cp = data;
4857         __u16 interval, window;
4858         int err;
4859
4860         BT_DBG("%s", hdev->name);
4861
4862         if (!lmp_le_capable(hdev))
4863                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4864                                        MGMT_STATUS_NOT_SUPPORTED);
4865
4866         interval = __le16_to_cpu(cp->interval);
4867
4868         if (interval < 0x0004 || interval > 0x4000)
4869                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4870                                        MGMT_STATUS_INVALID_PARAMS);
4871
4872         window = __le16_to_cpu(cp->window);
4873
4874         if (window < 0x0004 || window > 0x4000)
4875                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4876                                        MGMT_STATUS_INVALID_PARAMS);
4877
4878         if (window > interval)
4879                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4880                                        MGMT_STATUS_INVALID_PARAMS);
4881
4882         hci_dev_lock(hdev);
4883
4884         hdev->le_scan_interval = interval;
4885         hdev->le_scan_window = window;
4886
4887         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4888                                 NULL, 0);
4889
4890         /* If background scan is running, restart it so new parameters are
4891          * loaded.
4892          */
4893         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4894             hdev->discovery.state == DISCOVERY_STOPPED) {
4895                 struct hci_request req;
4896
4897                 hci_req_init(&req, hdev);
4898
4899                 hci_req_add_le_scan_disable(&req);
4900                 hci_req_add_le_passive_scan(&req);
4901
4902                 hci_req_run(&req, NULL);
4903         }
4904
4905         hci_dev_unlock(hdev);
4906
4907         return err;
4908 }
4909
4910 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4911                                       u16 opcode)
4912 {
4913         struct mgmt_pending_cmd *cmd;
4914
4915         BT_DBG("status 0x%02x", status);
4916
4917         hci_dev_lock(hdev);
4918
4919         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4920         if (!cmd)
4921                 goto unlock;
4922
4923         if (status) {
4924                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4925                                 mgmt_status(status));
4926         } else {
4927                 struct mgmt_mode *cp = cmd->param;
4928
4929                 if (cp->val)
4930                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4931                 else
4932                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4933
4934                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4935                 new_settings(hdev, cmd->sk);
4936         }
4937
4938         mgmt_pending_remove(cmd);
4939
4940 unlock:
4941         hci_dev_unlock(hdev);
4942 }
4943
4944 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4945                                 void *data, u16 len)
4946 {
4947         struct mgmt_mode *cp = data;
4948         struct mgmt_pending_cmd *cmd;
4949         struct hci_request req;
4950         int err;
4951
4952         BT_DBG("%s", hdev->name);
4953
4954         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4955             hdev->hci_ver < BLUETOOTH_VER_1_2)
4956                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4957                                        MGMT_STATUS_NOT_SUPPORTED);
4958
4959         if (cp->val != 0x00 && cp->val != 0x01)
4960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4961                                        MGMT_STATUS_INVALID_PARAMS);
4962
4963         hci_dev_lock(hdev);
4964
4965         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4966                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4967                                       MGMT_STATUS_BUSY);
4968                 goto unlock;
4969         }
4970
4971         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4972                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4973                                         hdev);
4974                 goto unlock;
4975         }
4976
4977         if (!hdev_is_powered(hdev)) {
4978                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4979                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4980                                         hdev);
4981                 new_settings(hdev, sk);
4982                 goto unlock;
4983         }
4984
4985         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4986                                data, len);
4987         if (!cmd) {
4988                 err = -ENOMEM;
4989                 goto unlock;
4990         }
4991
4992         hci_req_init(&req, hdev);
4993
4994         write_fast_connectable(&req, cp->val);
4995
4996         err = hci_req_run(&req, fast_connectable_complete);
4997         if (err < 0) {
4998                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4999                                       MGMT_STATUS_FAILED);
5000                 mgmt_pending_remove(cmd);
5001         }
5002
5003 unlock:
5004         hci_dev_unlock(hdev);
5005
5006         return err;
5007 }
5008
5009 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5010 {
5011         struct mgmt_pending_cmd *cmd;
5012
5013         BT_DBG("status 0x%02x", status);
5014
5015         hci_dev_lock(hdev);
5016
5017         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5018         if (!cmd)
5019                 goto unlock;
5020
5021         if (status) {
5022                 u8 mgmt_err = mgmt_status(status);
5023
5024                 /* We need to restore the flag if related HCI commands
5025                  * failed.
5026                  */
5027                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5028
5029                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5030         } else {
5031                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5032                 new_settings(hdev, cmd->sk);
5033         }
5034
5035         mgmt_pending_remove(cmd);
5036
5037 unlock:
5038         hci_dev_unlock(hdev);
5039 }
5040
5041 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5042 {
5043         struct mgmt_mode *cp = data;
5044         struct mgmt_pending_cmd *cmd;
5045         struct hci_request req;
5046         int err;
5047
5048         BT_DBG("request for %s", hdev->name);
5049
5050         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5051                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5052                                        MGMT_STATUS_NOT_SUPPORTED);
5053
5054         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5055                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5056                                        MGMT_STATUS_REJECTED);
5057
5058         if (cp->val != 0x00 && cp->val != 0x01)
5059                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5060                                        MGMT_STATUS_INVALID_PARAMS);
5061
5062         hci_dev_lock(hdev);
5063
5064         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5065                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5066                 goto unlock;
5067         }
5068
5069         if (!hdev_is_powered(hdev)) {
5070                 if (!cp->val) {
5071                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5072                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5073                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5074                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5075                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5076                 }
5077
5078                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5079
5080                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5081                 if (err < 0)
5082                         goto unlock;
5083
5084                 err = new_settings(hdev, sk);
5085                 goto unlock;
5086         }
5087
5088         /* Reject disabling when powered on */
5089         if (!cp->val) {
5090                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5091                                       MGMT_STATUS_REJECTED);
5092                 goto unlock;
5093         } else {
5094                 /* When configuring a dual-mode controller to operate
5095                  * with LE only and using a static address, then switching
5096                  * BR/EDR back on is not allowed.
5097                  *
5098                  * Dual-mode controllers shall operate with the public
5099                  * address as its identity address for BR/EDR and LE. So
5100                  * reject the attempt to create an invalid configuration.
5101                  *
5102                  * The same restrictions applies when secure connections
5103                  * has been enabled. For BR/EDR this is a controller feature
5104                  * while for LE it is a host stack feature. This means that
5105                  * switching BR/EDR back on when secure connections has been
5106                  * enabled is not a supported transaction.
5107                  */
5108                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5109                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5110                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5111                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5112                                               MGMT_STATUS_REJECTED);
5113                         goto unlock;
5114                 }
5115         }
5116
5117         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5119                                       MGMT_STATUS_BUSY);
5120                 goto unlock;
5121         }
5122
5123         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5124         if (!cmd) {
5125                 err = -ENOMEM;
5126                 goto unlock;
5127         }
5128
5129         /* We need to flip the bit already here so that update_adv_data
5130          * generates the correct flags.
5131          */
5132         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5133
5134         hci_req_init(&req, hdev);
5135
5136         write_fast_connectable(&req, false);
5137         __hci_update_page_scan(&req);
5138
5139         /* Since only the advertising data flags will change, there
5140          * is no need to update the scan response data.
5141          */
5142         update_adv_data(&req);
5143
5144         err = hci_req_run(&req, set_bredr_complete);
5145         if (err < 0)
5146                 mgmt_pending_remove(cmd);
5147
5148 unlock:
5149         hci_dev_unlock(hdev);
5150         return err;
5151 }
5152
5153 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5154 {
5155         struct mgmt_pending_cmd *cmd;
5156         struct mgmt_mode *cp;
5157
5158         BT_DBG("%s status %u", hdev->name, status);
5159
5160         hci_dev_lock(hdev);
5161
5162         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5163         if (!cmd)
5164                 goto unlock;
5165
5166         if (status) {
5167                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5168                                 mgmt_status(status));
5169                 goto remove;
5170         }
5171
5172         cp = cmd->param;
5173
5174         switch (cp->val) {
5175         case 0x00:
5176                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5177                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5178                 break;
5179         case 0x01:
5180                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5181                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5182                 break;
5183         case 0x02:
5184                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5185                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5186                 break;
5187         }
5188
5189         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5190         new_settings(hdev, cmd->sk);
5191
5192 remove:
5193         mgmt_pending_remove(cmd);
5194 unlock:
5195         hci_dev_unlock(hdev);
5196 }
5197
5198 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5199                            void *data, u16 len)
5200 {
5201         struct mgmt_mode *cp = data;
5202         struct mgmt_pending_cmd *cmd;
5203         struct hci_request req;
5204         u8 val;
5205         int err;
5206
5207         BT_DBG("request for %s", hdev->name);
5208
5209         if (!lmp_sc_capable(hdev) &&
5210             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5212                                        MGMT_STATUS_NOT_SUPPORTED);
5213
5214         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5215             lmp_sc_capable(hdev) &&
5216             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5218                                        MGMT_STATUS_REJECTED);
5219
5220         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5221                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5222                                   MGMT_STATUS_INVALID_PARAMS);
5223
5224         hci_dev_lock(hdev);
5225
5226         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5227             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5228                 bool changed;
5229
5230                 if (cp->val) {
5231                         changed = !hci_dev_test_and_set_flag(hdev,
5232                                                              HCI_SC_ENABLED);
5233                         if (cp->val == 0x02)
5234                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5235                         else
5236                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5237                 } else {
5238                         changed = hci_dev_test_and_clear_flag(hdev,
5239                                                               HCI_SC_ENABLED);
5240                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5241                 }
5242
5243                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5244                 if (err < 0)
5245                         goto failed;
5246
5247                 if (changed)
5248                         err = new_settings(hdev, sk);
5249
5250                 goto failed;
5251         }
5252
5253         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5254                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5255                                       MGMT_STATUS_BUSY);
5256                 goto failed;
5257         }
5258
5259         val = !!cp->val;
5260
5261         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5262             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5263                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5264                 goto failed;
5265         }
5266
5267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5268         if (!cmd) {
5269                 err = -ENOMEM;
5270                 goto failed;
5271         }
5272
5273         hci_req_init(&req, hdev);
5274         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5275         err = hci_req_run(&req, sc_enable_complete);
5276         if (err < 0) {
5277                 mgmt_pending_remove(cmd);
5278                 goto failed;
5279         }
5280
5281 failed:
5282         hci_dev_unlock(hdev);
5283         return err;
5284 }
5285
5286 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5287                           void *data, u16 len)
5288 {
5289         struct mgmt_mode *cp = data;
5290         bool changed, use_changed;
5291         int err;
5292
5293         BT_DBG("request for %s", hdev->name);
5294
5295         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5296                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5297                                        MGMT_STATUS_INVALID_PARAMS);
5298
5299         hci_dev_lock(hdev);
5300
5301         if (cp->val)
5302                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5303         else
5304                 changed = hci_dev_test_and_clear_flag(hdev,
5305                                                       HCI_KEEP_DEBUG_KEYS);
5306
5307         if (cp->val == 0x02)
5308                 use_changed = !hci_dev_test_and_set_flag(hdev,
5309                                                          HCI_USE_DEBUG_KEYS);
5310         else
5311                 use_changed = hci_dev_test_and_clear_flag(hdev,
5312                                                           HCI_USE_DEBUG_KEYS);
5313
5314         if (hdev_is_powered(hdev) && use_changed &&
5315             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5316                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5317                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5318                              sizeof(mode), &mode);
5319         }
5320
5321         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5322         if (err < 0)
5323                 goto unlock;
5324
5325         if (changed)
5326                 err = new_settings(hdev, sk);
5327
5328 unlock:
5329         hci_dev_unlock(hdev);
5330         return err;
5331 }
5332
5333 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5334                        u16 len)
5335 {
5336         struct mgmt_cp_set_privacy *cp = cp_data;
5337         bool changed;
5338         int err;
5339
5340         BT_DBG("request for %s", hdev->name);
5341
5342         if (!lmp_le_capable(hdev))
5343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5344                                        MGMT_STATUS_NOT_SUPPORTED);
5345
5346         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5347                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5348                                        MGMT_STATUS_INVALID_PARAMS);
5349
5350         if (hdev_is_powered(hdev))
5351                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5352                                        MGMT_STATUS_REJECTED);
5353
5354         hci_dev_lock(hdev);
5355
5356         /* If user space supports this command it is also expected to
5357          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5358          */
5359         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5360
5361         if (cp->privacy) {
5362                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5363                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5364                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5365         } else {
5366                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5367                 memset(hdev->irk, 0, sizeof(hdev->irk));
5368                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5369         }
5370
5371         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5372         if (err < 0)
5373                 goto unlock;
5374
5375         if (changed)
5376                 err = new_settings(hdev, sk);
5377
5378 unlock:
5379         hci_dev_unlock(hdev);
5380         return err;
5381 }
5382
5383 static bool irk_is_valid(struct mgmt_irk_info *irk)
5384 {
5385         switch (irk->addr.type) {
5386         case BDADDR_LE_PUBLIC:
5387                 return true;
5388
5389         case BDADDR_LE_RANDOM:
5390                 /* Two most significant bits shall be set */
5391                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5392                         return false;
5393                 return true;
5394         }
5395
5396         return false;
5397 }
5398
5399 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5400                      u16 len)
5401 {
5402         struct mgmt_cp_load_irks *cp = cp_data;
5403         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5404                                    sizeof(struct mgmt_irk_info));
5405         u16 irk_count, expected_len;
5406         int i, err;
5407
5408         BT_DBG("request for %s", hdev->name);
5409
5410         if (!lmp_le_capable(hdev))
5411                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5412                                        MGMT_STATUS_NOT_SUPPORTED);
5413
5414         irk_count = __le16_to_cpu(cp->irk_count);
5415         if (irk_count > max_irk_count) {
5416                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5417                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5418                                        MGMT_STATUS_INVALID_PARAMS);
5419         }
5420
5421         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5422         if (expected_len != len) {
5423                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5424                        expected_len, len);
5425                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5426                                        MGMT_STATUS_INVALID_PARAMS);
5427         }
5428
5429         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5430
5431         for (i = 0; i < irk_count; i++) {
5432                 struct mgmt_irk_info *key = &cp->irks[i];
5433
5434                 if (!irk_is_valid(key))
5435                         return mgmt_cmd_status(sk, hdev->id,
5436                                                MGMT_OP_LOAD_IRKS,
5437                                                MGMT_STATUS_INVALID_PARAMS);
5438         }
5439
5440         hci_dev_lock(hdev);
5441
5442         hci_smp_irks_clear(hdev);
5443
5444         for (i = 0; i < irk_count; i++) {
5445                 struct mgmt_irk_info *irk = &cp->irks[i];
5446                 u8 addr_type;
5447
5448                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5449                         addr_type = ADDR_LE_DEV_PUBLIC;
5450                 else
5451                         addr_type = ADDR_LE_DEV_RANDOM;
5452
5453                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5454                             BDADDR_ANY);
5455         }
5456
5457         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5458
5459         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5460
5461         hci_dev_unlock(hdev);
5462
5463         return err;
5464 }
5465
5466 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5467 {
5468         if (key->master != 0x00 && key->master != 0x01)
5469                 return false;
5470
5471         switch (key->addr.type) {
5472         case BDADDR_LE_PUBLIC:
5473                 return true;
5474
5475         case BDADDR_LE_RANDOM:
5476                 /* Two most significant bits shall be set */
5477                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5478                         return false;
5479                 return true;
5480         }
5481
5482         return false;
5483 }
5484
5485 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5486                                void *cp_data, u16 len)
5487 {
5488         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5489         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5490                                    sizeof(struct mgmt_ltk_info));
5491         u16 key_count, expected_len;
5492         int i, err;
5493
5494         BT_DBG("request for %s", hdev->name);
5495
5496         if (!lmp_le_capable(hdev))
5497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5498                                        MGMT_STATUS_NOT_SUPPORTED);
5499
5500         key_count = __le16_to_cpu(cp->key_count);
5501         if (key_count > max_key_count) {
5502                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5503                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5504                                        MGMT_STATUS_INVALID_PARAMS);
5505         }
5506
5507         expected_len = sizeof(*cp) + key_count *
5508                                         sizeof(struct mgmt_ltk_info);
5509         if (expected_len != len) {
5510                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5511                        expected_len, len);
5512                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5513                                        MGMT_STATUS_INVALID_PARAMS);
5514         }
5515
5516         BT_DBG("%s key_count %u", hdev->name, key_count);
5517
5518         for (i = 0; i < key_count; i++) {
5519                 struct mgmt_ltk_info *key = &cp->keys[i];
5520
5521                 if (!ltk_is_valid(key))
5522                         return mgmt_cmd_status(sk, hdev->id,
5523                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5524                                                MGMT_STATUS_INVALID_PARAMS);
5525         }
5526
5527         hci_dev_lock(hdev);
5528
5529         hci_smp_ltks_clear(hdev);
5530
5531         for (i = 0; i < key_count; i++) {
5532                 struct mgmt_ltk_info *key = &cp->keys[i];
5533                 u8 type, addr_type, authenticated;
5534
5535                 if (key->addr.type == BDADDR_LE_PUBLIC)
5536                         addr_type = ADDR_LE_DEV_PUBLIC;
5537                 else
5538                         addr_type = ADDR_LE_DEV_RANDOM;
5539
5540                 switch (key->type) {
5541                 case MGMT_LTK_UNAUTHENTICATED:
5542                         authenticated = 0x00;
5543                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5544                         break;
5545                 case MGMT_LTK_AUTHENTICATED:
5546                         authenticated = 0x01;
5547                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5548                         break;
5549                 case MGMT_LTK_P256_UNAUTH:
5550                         authenticated = 0x00;
5551                         type = SMP_LTK_P256;
5552                         break;
5553                 case MGMT_LTK_P256_AUTH:
5554                         authenticated = 0x01;
5555                         type = SMP_LTK_P256;
5556                         break;
5557                 case MGMT_LTK_P256_DEBUG:
5558                         authenticated = 0x00;
5559                         type = SMP_LTK_P256_DEBUG;
5560                 default:
5561                         continue;
5562                 }
5563
5564                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5565                             authenticated, key->val, key->enc_size, key->ediv,
5566                             key->rand);
5567         }
5568
5569         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5570                            NULL, 0);
5571
5572         hci_dev_unlock(hdev);
5573
5574         return err;
5575 }
5576
5577 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5578 {
5579         struct hci_conn *conn = cmd->user_data;
5580         struct mgmt_rp_get_conn_info rp;
5581         int err;
5582
5583         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5584
5585         if (status == MGMT_STATUS_SUCCESS) {
5586                 rp.rssi = conn->rssi;
5587                 rp.tx_power = conn->tx_power;
5588                 rp.max_tx_power = conn->max_tx_power;
5589         } else {
5590                 rp.rssi = HCI_RSSI_INVALID;
5591                 rp.tx_power = HCI_TX_POWER_INVALID;
5592                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5593         }
5594
5595         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5596                                 status, &rp, sizeof(rp));
5597
5598         hci_conn_drop(conn);
5599         hci_conn_put(conn);
5600
5601         return err;
5602 }
5603
5604 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5605                                        u16 opcode)
5606 {
5607         struct hci_cp_read_rssi *cp;
5608         struct mgmt_pending_cmd *cmd;
5609         struct hci_conn *conn;
5610         u16 handle;
5611         u8 status;
5612
5613         BT_DBG("status 0x%02x", hci_status);
5614
5615         hci_dev_lock(hdev);
5616
5617         /* Commands sent in request are either Read RSSI or Read Transmit Power
5618          * Level so we check which one was last sent to retrieve connection
5619          * handle.  Both commands have handle as first parameter so it's safe to
5620          * cast data on the same command struct.
5621          *
5622          * First command sent is always Read RSSI and we fail only if it fails.
5623          * In other case we simply override error to indicate success as we
5624          * already remembered if TX power value is actually valid.
5625          */
5626         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5627         if (!cp) {
5628                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5629                 status = MGMT_STATUS_SUCCESS;
5630         } else {
5631                 status = mgmt_status(hci_status);
5632         }
5633
5634         if (!cp) {
5635                 BT_ERR("invalid sent_cmd in conn_info response");
5636                 goto unlock;
5637         }
5638
5639         handle = __le16_to_cpu(cp->handle);
5640         conn = hci_conn_hash_lookup_handle(hdev, handle);
5641         if (!conn) {
5642                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5643                 goto unlock;
5644         }
5645
5646         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5647         if (!cmd)
5648                 goto unlock;
5649
5650         cmd->cmd_complete(cmd, status);
5651         mgmt_pending_remove(cmd);
5652
5653 unlock:
5654         hci_dev_unlock(hdev);
5655 }
5656
5657 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5658                          u16 len)
5659 {
5660         struct mgmt_cp_get_conn_info *cp = data;
5661         struct mgmt_rp_get_conn_info rp;
5662         struct hci_conn *conn;
5663         unsigned long conn_info_age;
5664         int err = 0;
5665
5666         BT_DBG("%s", hdev->name);
5667
5668         memset(&rp, 0, sizeof(rp));
5669         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5670         rp.addr.type = cp->addr.type;
5671
5672         if (!bdaddr_type_is_valid(cp->addr.type))
5673                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5674                                          MGMT_STATUS_INVALID_PARAMS,
5675                                          &rp, sizeof(rp));
5676
5677         hci_dev_lock(hdev);
5678
5679         if (!hdev_is_powered(hdev)) {
5680                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5681                                         MGMT_STATUS_NOT_POWERED, &rp,
5682                                         sizeof(rp));
5683                 goto unlock;
5684         }
5685
5686         if (cp->addr.type == BDADDR_BREDR)
5687                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5688                                                &cp->addr.bdaddr);
5689         else
5690                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5691
5692         if (!conn || conn->state != BT_CONNECTED) {
5693                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5694                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5695                                         sizeof(rp));
5696                 goto unlock;
5697         }
5698
5699         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5700                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5701                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5702                 goto unlock;
5703         }
5704
5705         /* To avoid client trying to guess when to poll again for information we
5706          * calculate conn info age as random value between min/max set in hdev.
5707          */
5708         conn_info_age = hdev->conn_info_min_age +
5709                         prandom_u32_max(hdev->conn_info_max_age -
5710                                         hdev->conn_info_min_age);
5711
5712         /* Query controller to refresh cached values if they are too old or were
5713          * never read.
5714          */
5715         if (time_after(jiffies, conn->conn_info_timestamp +
5716                        msecs_to_jiffies(conn_info_age)) ||
5717             !conn->conn_info_timestamp) {
5718                 struct hci_request req;
5719                 struct hci_cp_read_tx_power req_txp_cp;
5720                 struct hci_cp_read_rssi req_rssi_cp;
5721                 struct mgmt_pending_cmd *cmd;
5722
5723                 hci_req_init(&req, hdev);
5724                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5725                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5726                             &req_rssi_cp);
5727
5728                 /* For LE links TX power does not change thus we don't need to
5729                  * query for it once value is known.
5730                  */
5731                 if (!bdaddr_type_is_le(cp->addr.type) ||
5732                     conn->tx_power == HCI_TX_POWER_INVALID) {
5733                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5734                         req_txp_cp.type = 0x00;
5735                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5736                                     sizeof(req_txp_cp), &req_txp_cp);
5737                 }
5738
5739                 /* Max TX power needs to be read only once per connection */
5740                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5741                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5742                         req_txp_cp.type = 0x01;
5743                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5744                                     sizeof(req_txp_cp), &req_txp_cp);
5745                 }
5746
5747                 err = hci_req_run(&req, conn_info_refresh_complete);
5748                 if (err < 0)
5749                         goto unlock;
5750
5751                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5752                                        data, len);
5753                 if (!cmd) {
5754                         err = -ENOMEM;
5755                         goto unlock;
5756                 }
5757
5758                 hci_conn_hold(conn);
5759                 cmd->user_data = hci_conn_get(conn);
5760                 cmd->cmd_complete = conn_info_cmd_complete;
5761
5762                 conn->conn_info_timestamp = jiffies;
5763         } else {
5764                 /* Cache is valid, just reply with values cached in hci_conn */
5765                 rp.rssi = conn->rssi;
5766                 rp.tx_power = conn->tx_power;
5767                 rp.max_tx_power = conn->max_tx_power;
5768
5769                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5770                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5771         }
5772
5773 unlock:
5774         hci_dev_unlock(hdev);
5775         return err;
5776 }
5777
5778 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5779 {
5780         struct hci_conn *conn = cmd->user_data;
5781         struct mgmt_rp_get_clock_info rp;
5782         struct hci_dev *hdev;
5783         int err;
5784
5785         memset(&rp, 0, sizeof(rp));
5786         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5787
5788         if (status)
5789                 goto complete;
5790
5791         hdev = hci_dev_get(cmd->index);
5792         if (hdev) {
5793                 rp.local_clock = cpu_to_le32(hdev->clock);
5794                 hci_dev_put(hdev);
5795         }
5796
5797         if (conn) {
5798                 rp.piconet_clock = cpu_to_le32(conn->clock);
5799                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5800         }
5801
5802 complete:
5803         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5804                                 sizeof(rp));
5805
5806         if (conn) {
5807                 hci_conn_drop(conn);
5808                 hci_conn_put(conn);
5809         }
5810
5811         return err;
5812 }
5813
5814 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5815 {
5816         struct hci_cp_read_clock *hci_cp;
5817         struct mgmt_pending_cmd *cmd;
5818         struct hci_conn *conn;
5819
5820         BT_DBG("%s status %u", hdev->name, status);
5821
5822         hci_dev_lock(hdev);
5823
5824         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5825         if (!hci_cp)
5826                 goto unlock;
5827
5828         if (hci_cp->which) {
5829                 u16 handle = __le16_to_cpu(hci_cp->handle);
5830                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5831         } else {
5832                 conn = NULL;
5833         }
5834
5835         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5836         if (!cmd)
5837                 goto unlock;
5838
5839         cmd->cmd_complete(cmd, mgmt_status(status));
5840         mgmt_pending_remove(cmd);
5841
5842 unlock:
5843         hci_dev_unlock(hdev);
5844 }
5845
5846 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5847                          u16 len)
5848 {
5849         struct mgmt_cp_get_clock_info *cp = data;
5850         struct mgmt_rp_get_clock_info rp;
5851         struct hci_cp_read_clock hci_cp;
5852         struct mgmt_pending_cmd *cmd;
5853         struct hci_request req;
5854         struct hci_conn *conn;
5855         int err;
5856
5857         BT_DBG("%s", hdev->name);
5858
5859         memset(&rp, 0, sizeof(rp));
5860         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5861         rp.addr.type = cp->addr.type;
5862
5863         if (cp->addr.type != BDADDR_BREDR)
5864                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5865                                          MGMT_STATUS_INVALID_PARAMS,
5866                                          &rp, sizeof(rp));
5867
5868         hci_dev_lock(hdev);
5869
5870         if (!hdev_is_powered(hdev)) {
5871                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5872                                         MGMT_STATUS_NOT_POWERED, &rp,
5873                                         sizeof(rp));
5874                 goto unlock;
5875         }
5876
5877         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5878                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5879                                                &cp->addr.bdaddr);
5880                 if (!conn || conn->state != BT_CONNECTED) {
5881                         err = mgmt_cmd_complete(sk, hdev->id,
5882                                                 MGMT_OP_GET_CLOCK_INFO,
5883                                                 MGMT_STATUS_NOT_CONNECTED,
5884                                                 &rp, sizeof(rp));
5885                         goto unlock;
5886                 }
5887         } else {
5888                 conn = NULL;
5889         }
5890
5891         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5892         if (!cmd) {
5893                 err = -ENOMEM;
5894                 goto unlock;
5895         }
5896
5897         cmd->cmd_complete = clock_info_cmd_complete;
5898
5899         hci_req_init(&req, hdev);
5900
5901         memset(&hci_cp, 0, sizeof(hci_cp));
5902         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5903
5904         if (conn) {
5905                 hci_conn_hold(conn);
5906                 cmd->user_data = hci_conn_get(conn);
5907
5908                 hci_cp.handle = cpu_to_le16(conn->handle);
5909                 hci_cp.which = 0x01; /* Piconet clock */
5910                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5911         }
5912
5913         err = hci_req_run(&req, get_clock_info_complete);
5914         if (err < 0)
5915                 mgmt_pending_remove(cmd);
5916
5917 unlock:
5918         hci_dev_unlock(hdev);
5919         return err;
5920 }
5921
5922 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5923 {
5924         struct hci_conn *conn;
5925
5926         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5927         if (!conn)
5928                 return false;
5929
5930         if (conn->dst_type != type)
5931                 return false;
5932
5933         if (conn->state != BT_CONNECTED)
5934                 return false;
5935
5936         return true;
5937 }
5938
5939 /* This function requires the caller holds hdev->lock */
5940 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5941                                u8 addr_type, u8 auto_connect)
5942 {
5943         struct hci_dev *hdev = req->hdev;
5944         struct hci_conn_params *params;
5945
5946         params = hci_conn_params_add(hdev, addr, addr_type);
5947         if (!params)
5948                 return -EIO;
5949
5950         if (params->auto_connect == auto_connect)
5951                 return 0;
5952
5953         list_del_init(&params->action);
5954
5955         switch (auto_connect) {
5956         case HCI_AUTO_CONN_DISABLED:
5957         case HCI_AUTO_CONN_LINK_LOSS:
5958                 __hci_update_background_scan(req);
5959                 break;
5960         case HCI_AUTO_CONN_REPORT:
5961                 list_add(&params->action, &hdev->pend_le_reports);
5962                 __hci_update_background_scan(req);
5963                 break;
5964         case HCI_AUTO_CONN_DIRECT:
5965         case HCI_AUTO_CONN_ALWAYS:
5966                 if (!is_connected(hdev, addr, addr_type)) {
5967                         list_add(&params->action, &hdev->pend_le_conns);
5968                         __hci_update_background_scan(req);
5969                 }
5970                 break;
5971         }
5972
5973         params->auto_connect = auto_connect;
5974
5975         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5976                auto_connect);
5977
5978         return 0;
5979 }
5980
5981 static void device_added(struct sock *sk, struct hci_dev *hdev,
5982                          bdaddr_t *bdaddr, u8 type, u8 action)
5983 {
5984         struct mgmt_ev_device_added ev;
5985
5986         bacpy(&ev.addr.bdaddr, bdaddr);
5987         ev.addr.type = type;
5988         ev.action = action;
5989
5990         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5991 }
5992
5993 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5994 {
5995         struct mgmt_pending_cmd *cmd;
5996
5997         BT_DBG("status 0x%02x", status);
5998
5999         hci_dev_lock(hdev);
6000
6001         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
6002         if (!cmd)
6003                 goto unlock;
6004
6005         cmd->cmd_complete(cmd, mgmt_status(status));
6006         mgmt_pending_remove(cmd);
6007
6008 unlock:
6009         hci_dev_unlock(hdev);
6010 }
6011
6012 static int add_device(struct sock *sk, struct hci_dev *hdev,
6013                       void *data, u16 len)
6014 {
6015         struct mgmt_cp_add_device *cp = data;
6016         struct mgmt_pending_cmd *cmd;
6017         struct hci_request req;
6018         u8 auto_conn, addr_type;
6019         int err;
6020
6021         BT_DBG("%s", hdev->name);
6022
6023         if (!bdaddr_type_is_valid(cp->addr.type) ||
6024             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6025                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6026                                          MGMT_STATUS_INVALID_PARAMS,
6027                                          &cp->addr, sizeof(cp->addr));
6028
6029         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6030                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6031                                          MGMT_STATUS_INVALID_PARAMS,
6032                                          &cp->addr, sizeof(cp->addr));
6033
6034         hci_req_init(&req, hdev);
6035
6036         hci_dev_lock(hdev);
6037
6038         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6039         if (!cmd) {
6040                 err = -ENOMEM;
6041                 goto unlock;
6042         }
6043
6044         cmd->cmd_complete = addr_cmd_complete;
6045
6046         if (cp->addr.type == BDADDR_BREDR) {
6047                 /* Only incoming connections action is supported for now */
6048                 if (cp->action != 0x01) {
6049                         err = cmd->cmd_complete(cmd,
6050                                                 MGMT_STATUS_INVALID_PARAMS);
6051                         mgmt_pending_remove(cmd);
6052                         goto unlock;
6053                 }
6054
6055                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6056                                           cp->addr.type);
6057                 if (err)
6058                         goto unlock;
6059
6060                 __hci_update_page_scan(&req);
6061
6062                 goto added;
6063         }
6064
6065         if (cp->addr.type == BDADDR_LE_PUBLIC)
6066                 addr_type = ADDR_LE_DEV_PUBLIC;
6067         else
6068                 addr_type = ADDR_LE_DEV_RANDOM;
6069
6070         if (cp->action == 0x02)
6071                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6072         else if (cp->action == 0x01)
6073                 auto_conn = HCI_AUTO_CONN_DIRECT;
6074         else
6075                 auto_conn = HCI_AUTO_CONN_REPORT;
6076
6077         /* If the connection parameters don't exist for this device,
6078          * they will be created and configured with defaults.
6079          */
6080         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
6081                                 auto_conn) < 0) {
6082                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
6083                 mgmt_pending_remove(cmd);
6084                 goto unlock;
6085         }
6086
6087 added:
6088         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6089
6090         err = hci_req_run(&req, add_device_complete);
6091         if (err < 0) {
6092                 /* ENODATA means no HCI commands were needed (e.g. if
6093                  * the adapter is powered off).
6094                  */
6095                 if (err == -ENODATA)
6096                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6097                 mgmt_pending_remove(cmd);
6098         }
6099
6100 unlock:
6101         hci_dev_unlock(hdev);
6102         return err;
6103 }
6104
6105 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6106                            bdaddr_t *bdaddr, u8 type)
6107 {
6108         struct mgmt_ev_device_removed ev;
6109
6110         bacpy(&ev.addr.bdaddr, bdaddr);
6111         ev.addr.type = type;
6112
6113         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6114 }
6115
6116 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6117 {
6118         struct mgmt_pending_cmd *cmd;
6119
6120         BT_DBG("status 0x%02x", status);
6121
6122         hci_dev_lock(hdev);
6123
6124         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6125         if (!cmd)
6126                 goto unlock;
6127
6128         cmd->cmd_complete(cmd, mgmt_status(status));
6129         mgmt_pending_remove(cmd);
6130
6131 unlock:
6132         hci_dev_unlock(hdev);
6133 }
6134
6135 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6136                          void *data, u16 len)
6137 {
6138         struct mgmt_cp_remove_device *cp = data;
6139         struct mgmt_pending_cmd *cmd;
6140         struct hci_request req;
6141         int err;
6142
6143         BT_DBG("%s", hdev->name);
6144
6145         hci_req_init(&req, hdev);
6146
6147         hci_dev_lock(hdev);
6148
6149         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6150         if (!cmd) {
6151                 err = -ENOMEM;
6152                 goto unlock;
6153         }
6154
6155         cmd->cmd_complete = addr_cmd_complete;
6156
6157         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6158                 struct hci_conn_params *params;
6159                 u8 addr_type;
6160
6161                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6162                         err = cmd->cmd_complete(cmd,
6163                                                 MGMT_STATUS_INVALID_PARAMS);
6164                         mgmt_pending_remove(cmd);
6165                         goto unlock;
6166                 }
6167
6168                 if (cp->addr.type == BDADDR_BREDR) {
6169                         err = hci_bdaddr_list_del(&hdev->whitelist,
6170                                                   &cp->addr.bdaddr,
6171                                                   cp->addr.type);
6172                         if (err) {
6173                                 err = cmd->cmd_complete(cmd,
6174                                                         MGMT_STATUS_INVALID_PARAMS);
6175                                 mgmt_pending_remove(cmd);
6176                                 goto unlock;
6177                         }
6178
6179                         __hci_update_page_scan(&req);
6180
6181                         device_removed(sk, hdev, &cp->addr.bdaddr,
6182                                        cp->addr.type);
6183                         goto complete;
6184                 }
6185
6186                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6187                         addr_type = ADDR_LE_DEV_PUBLIC;
6188                 else
6189                         addr_type = ADDR_LE_DEV_RANDOM;
6190
6191                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6192                                                 addr_type);
6193                 if (!params) {
6194                         err = cmd->cmd_complete(cmd,
6195                                                 MGMT_STATUS_INVALID_PARAMS);
6196                         mgmt_pending_remove(cmd);
6197                         goto unlock;
6198                 }
6199
6200                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
6201                         err = cmd->cmd_complete(cmd,
6202                                                 MGMT_STATUS_INVALID_PARAMS);
6203                         mgmt_pending_remove(cmd);
6204                         goto unlock;
6205                 }
6206
6207                 list_del(&params->action);
6208                 list_del(&params->list);
6209                 kfree(params);
6210                 __hci_update_background_scan(&req);
6211
6212                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6213         } else {
6214                 struct hci_conn_params *p, *tmp;
6215                 struct bdaddr_list *b, *btmp;
6216
6217                 if (cp->addr.type) {
6218                         err = cmd->cmd_complete(cmd,
6219                                                 MGMT_STATUS_INVALID_PARAMS);
6220                         mgmt_pending_remove(cmd);
6221                         goto unlock;
6222                 }
6223
6224                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6225                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6226                         list_del(&b->list);
6227                         kfree(b);
6228                 }
6229
6230                 __hci_update_page_scan(&req);
6231
6232                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6233                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6234                                 continue;
6235                         device_removed(sk, hdev, &p->addr, p->addr_type);
6236                         list_del(&p->action);
6237                         list_del(&p->list);
6238                         kfree(p);
6239                 }
6240
6241                 BT_DBG("All LE connection parameters were removed");
6242
6243                 __hci_update_background_scan(&req);
6244         }
6245
6246 complete:
6247         err = hci_req_run(&req, remove_device_complete);
6248         if (err < 0) {
6249                 /* ENODATA means no HCI commands were needed (e.g. if
6250                  * the adapter is powered off).
6251                  */
6252                 if (err == -ENODATA)
6253                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6254                 mgmt_pending_remove(cmd);
6255         }
6256
6257 unlock:
6258         hci_dev_unlock(hdev);
6259         return err;
6260 }
6261
6262 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6263                            u16 len)
6264 {
6265         struct mgmt_cp_load_conn_param *cp = data;
6266         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6267                                      sizeof(struct mgmt_conn_param));
6268         u16 param_count, expected_len;
6269         int i;
6270
6271         if (!lmp_le_capable(hdev))
6272                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6273                                        MGMT_STATUS_NOT_SUPPORTED);
6274
6275         param_count = __le16_to_cpu(cp->param_count);
6276         if (param_count > max_param_count) {
6277                 BT_ERR("load_conn_param: too big param_count value %u",
6278                        param_count);
6279                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6280                                        MGMT_STATUS_INVALID_PARAMS);
6281         }
6282
6283         expected_len = sizeof(*cp) + param_count *
6284                                         sizeof(struct mgmt_conn_param);
6285         if (expected_len != len) {
6286                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6287                        expected_len, len);
6288                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6289                                        MGMT_STATUS_INVALID_PARAMS);
6290         }
6291
6292         BT_DBG("%s param_count %u", hdev->name, param_count);
6293
6294         hci_dev_lock(hdev);
6295
6296         hci_conn_params_clear_disabled(hdev);
6297
6298         for (i = 0; i < param_count; i++) {
6299                 struct mgmt_conn_param *param = &cp->params[i];
6300                 struct hci_conn_params *hci_param;
6301                 u16 min, max, latency, timeout;
6302                 u8 addr_type;
6303
6304                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6305                        param->addr.type);
6306
6307                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6308                         addr_type = ADDR_LE_DEV_PUBLIC;
6309                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6310                         addr_type = ADDR_LE_DEV_RANDOM;
6311                 } else {
6312                         BT_ERR("Ignoring invalid connection parameters");
6313                         continue;
6314                 }
6315
6316                 min = le16_to_cpu(param->min_interval);
6317                 max = le16_to_cpu(param->max_interval);
6318                 latency = le16_to_cpu(param->latency);
6319                 timeout = le16_to_cpu(param->timeout);
6320
6321                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6322                        min, max, latency, timeout);
6323
6324                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6325                         BT_ERR("Ignoring invalid connection parameters");
6326                         continue;
6327                 }
6328
6329                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6330                                                 addr_type);
6331                 if (!hci_param) {
6332                         BT_ERR("Failed to add connection parameters");
6333                         continue;
6334                 }
6335
6336                 hci_param->conn_min_interval = min;
6337                 hci_param->conn_max_interval = max;
6338                 hci_param->conn_latency = latency;
6339                 hci_param->supervision_timeout = timeout;
6340         }
6341
6342         hci_dev_unlock(hdev);
6343
6344         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6345                                  NULL, 0);
6346 }
6347
6348 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6349                                void *data, u16 len)
6350 {
6351         struct mgmt_cp_set_external_config *cp = data;
6352         bool changed;
6353         int err;
6354
6355         BT_DBG("%s", hdev->name);
6356
6357         if (hdev_is_powered(hdev))
6358                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6359                                        MGMT_STATUS_REJECTED);
6360
6361         if (cp->config != 0x00 && cp->config != 0x01)
6362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6363                                          MGMT_STATUS_INVALID_PARAMS);
6364
6365         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6366                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6367                                        MGMT_STATUS_NOT_SUPPORTED);
6368
6369         hci_dev_lock(hdev);
6370
6371         if (cp->config)
6372                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6373         else
6374                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6375
6376         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6377         if (err < 0)
6378                 goto unlock;
6379
6380         if (!changed)
6381                 goto unlock;
6382
6383         err = new_options(hdev, sk);
6384
6385         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6386                 mgmt_index_removed(hdev);
6387
6388                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6389                         hci_dev_set_flag(hdev, HCI_CONFIG);
6390                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6391
6392                         queue_work(hdev->req_workqueue, &hdev->power_on);
6393                 } else {
6394                         set_bit(HCI_RAW, &hdev->flags);
6395                         mgmt_index_added(hdev);
6396                 }
6397         }
6398
6399 unlock:
6400         hci_dev_unlock(hdev);
6401         return err;
6402 }
6403
6404 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6405                               void *data, u16 len)
6406 {
6407         struct mgmt_cp_set_public_address *cp = data;
6408         bool changed;
6409         int err;
6410
6411         BT_DBG("%s", hdev->name);
6412
6413         if (hdev_is_powered(hdev))
6414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6415                                        MGMT_STATUS_REJECTED);
6416
6417         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6418                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6419                                        MGMT_STATUS_INVALID_PARAMS);
6420
6421         if (!hdev->set_bdaddr)
6422                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6423                                        MGMT_STATUS_NOT_SUPPORTED);
6424
6425         hci_dev_lock(hdev);
6426
6427         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6428         bacpy(&hdev->public_addr, &cp->bdaddr);
6429
6430         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6431         if (err < 0)
6432                 goto unlock;
6433
6434         if (!changed)
6435                 goto unlock;
6436
6437         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6438                 err = new_options(hdev, sk);
6439
6440         if (is_configured(hdev)) {
6441                 mgmt_index_removed(hdev);
6442
6443                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6444
6445                 hci_dev_set_flag(hdev, HCI_CONFIG);
6446                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6447
6448                 queue_work(hdev->req_workqueue, &hdev->power_on);
6449         }
6450
6451 unlock:
6452         hci_dev_unlock(hdev);
6453         return err;
6454 }
6455
6456 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6457                                   u8 data_len)
6458 {
6459         eir[eir_len++] = sizeof(type) + data_len;
6460         eir[eir_len++] = type;
6461         memcpy(&eir[eir_len], data, data_len);
6462         eir_len += data_len;
6463
6464         return eir_len;
6465 }
6466
6467 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6468                                    void *data, u16 data_len)
6469 {
6470         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6471         struct mgmt_rp_read_local_oob_ext_data *rp;
6472         size_t rp_len;
6473         u16 eir_len;
6474         u8 status, flags, role, addr[7], hash[16], rand[16];
6475         int err;
6476
6477         BT_DBG("%s", hdev->name);
6478
6479         if (hdev_is_powered(hdev)) {
6480                 switch (cp->type) {
6481                 case BIT(BDADDR_BREDR):
6482                         status = mgmt_bredr_support(hdev);
6483                         if (status)
6484                                 eir_len = 0;
6485                         else
6486                                 eir_len = 5;
6487                         break;
6488                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6489                         status = mgmt_le_support(hdev);
6490                         if (status)
6491                                 eir_len = 0;
6492                         else
6493                                 eir_len = 9 + 3 + 18 + 18 + 3;
6494                         break;
6495                 default:
6496                         status = MGMT_STATUS_INVALID_PARAMS;
6497                         eir_len = 0;
6498                         break;
6499                 }
6500         } else {
6501                 status = MGMT_STATUS_NOT_POWERED;
6502                 eir_len = 0;
6503         }
6504
6505         rp_len = sizeof(*rp) + eir_len;
6506         rp = kmalloc(rp_len, GFP_ATOMIC);
6507         if (!rp)
6508                 return -ENOMEM;
6509
6510         if (status)
6511                 goto complete;
6512
6513         hci_dev_lock(hdev);
6514
6515         eir_len = 0;
6516         switch (cp->type) {
6517         case BIT(BDADDR_BREDR):
6518                 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6519                                           hdev->dev_class, 3);
6520                 break;
6521         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6522                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6523                     smp_generate_oob(hdev, hash, rand) < 0) {
6524                         hci_dev_unlock(hdev);
6525                         status = MGMT_STATUS_FAILED;
6526                         goto complete;
6527                 }
6528
6529                 /* This should return the active RPA, but since the RPA
6530                  * is only programmed on demand, it is really hard to fill
6531                  * this in at the moment. For now disallow retrieving
6532                  * local out-of-band data when privacy is in use.
6533                  *
6534                  * Returning the identity address will not help here since
6535                  * pairing happens before the identity resolving key is
6536                  * known and thus the connection establishment happens
6537                  * based on the RPA and not the identity address.
6538                  */
6539                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6540                         hci_dev_unlock(hdev);
6541                         status = MGMT_STATUS_REJECTED;
6542                         goto complete;
6543                 }
6544
6545                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6546                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6547                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6548                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6549                         memcpy(addr, &hdev->static_addr, 6);
6550                         addr[6] = 0x01;
6551                 } else {
6552                         memcpy(addr, &hdev->bdaddr, 6);
6553                         addr[6] = 0x00;
6554                 }
6555
6556                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6557                                           addr, sizeof(addr));
6558
6559                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6560                         role = 0x02;
6561                 else
6562                         role = 0x01;
6563
6564                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6565                                           &role, sizeof(role));
6566
6567                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6568                         eir_len = eir_append_data(rp->eir, eir_len,
6569                                                   EIR_LE_SC_CONFIRM,
6570                                                   hash, sizeof(hash));
6571
6572                         eir_len = eir_append_data(rp->eir, eir_len,
6573                                                   EIR_LE_SC_RANDOM,
6574                                                   rand, sizeof(rand));
6575                 }
6576
6577                 flags = get_adv_discov_flags(hdev);
6578
6579                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6580                         flags |= LE_AD_NO_BREDR;
6581
6582                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6583                                           &flags, sizeof(flags));
6584                 break;
6585         }
6586
6587         hci_dev_unlock(hdev);
6588
6589         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6590
6591         status = MGMT_STATUS_SUCCESS;
6592
6593 complete:
6594         rp->type = cp->type;
6595         rp->eir_len = cpu_to_le16(eir_len);
6596
6597         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6598                                 status, rp, sizeof(*rp) + eir_len);
6599         if (err < 0 || status)
6600                 goto done;
6601
6602         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6603                                  rp, sizeof(*rp) + eir_len,
6604                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6605
6606 done:
6607         kfree(rp);
6608
6609         return err;
6610 }
6611
6612 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6613 {
6614         u32 flags = 0;
6615
6616         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6617         flags |= MGMT_ADV_FLAG_DISCOV;
6618         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6619         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6620
6621         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6622                 flags |= MGMT_ADV_FLAG_TX_POWER;
6623
6624         return flags;
6625 }
6626
6627 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6628                              void *data, u16 data_len)
6629 {
6630         struct mgmt_rp_read_adv_features *rp;
6631         size_t rp_len;
6632         int err;
6633         bool instance;
6634         u32 supported_flags;
6635
6636         BT_DBG("%s", hdev->name);
6637
6638         if (!lmp_le_capable(hdev))
6639                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6640                                        MGMT_STATUS_REJECTED);
6641
6642         hci_dev_lock(hdev);
6643
6644         rp_len = sizeof(*rp);
6645
6646         /* Currently only one instance is supported, so just add 1 to the
6647          * response length.
6648          */
6649         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6650         if (instance)
6651                 rp_len++;
6652
6653         rp = kmalloc(rp_len, GFP_ATOMIC);
6654         if (!rp) {
6655                 hci_dev_unlock(hdev);
6656                 return -ENOMEM;
6657         }
6658
6659         supported_flags = get_supported_adv_flags(hdev);
6660
6661         rp->supported_flags = cpu_to_le32(supported_flags);
6662         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6663         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6664         rp->max_instances = 1;
6665
6666         /* Currently only one instance is supported, so simply return the
6667          * current instance number.
6668          */
6669         if (instance) {
6670                 rp->num_instances = 1;
6671                 rp->instance[0] = 1;
6672         } else {
6673                 rp->num_instances = 0;
6674         }
6675
6676         hci_dev_unlock(hdev);
6677
6678         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6679                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6680
6681         kfree(rp);
6682
6683         return err;
6684 }
6685
6686 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6687                               u8 len, bool is_adv_data)
6688 {
6689         u8 max_len = HCI_MAX_AD_LENGTH;
6690         int i, cur_len;
6691         bool flags_managed = false;
6692         bool tx_power_managed = false;
6693         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6694                            MGMT_ADV_FLAG_MANAGED_FLAGS;
6695
6696         if (is_adv_data && (adv_flags & flags_params)) {
6697                 flags_managed = true;
6698                 max_len -= 3;
6699         }
6700
6701         if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6702                 tx_power_managed = true;
6703                 max_len -= 3;
6704         }
6705
6706         if (len > max_len)
6707                 return false;
6708
6709         /* Make sure that the data is correctly formatted. */
6710         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6711                 cur_len = data[i];
6712
6713                 if (flags_managed && data[i + 1] == EIR_FLAGS)
6714                         return false;
6715
6716                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6717                         return false;
6718
6719                 /* If the current field length would exceed the total data
6720                  * length, then it's invalid.
6721                  */
6722                 if (i + cur_len >= len)
6723                         return false;
6724         }
6725
6726         return true;
6727 }
6728
6729 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6730                                      u16 opcode)
6731 {
6732         struct mgmt_pending_cmd *cmd;
6733         struct mgmt_rp_add_advertising rp;
6734
6735         BT_DBG("status %d", status);
6736
6737         hci_dev_lock(hdev);
6738
6739         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6740
6741         if (status) {
6742                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6743                 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6744                 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6745         }
6746
6747         if (!cmd)
6748                 goto unlock;
6749
6750         rp.instance = 0x01;
6751
6752         if (status)
6753                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6754                                 mgmt_status(status));
6755         else
6756                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6757                                   mgmt_status(status), &rp, sizeof(rp));
6758
6759         mgmt_pending_remove(cmd);
6760
6761 unlock:
6762         hci_dev_unlock(hdev);
6763 }
6764
6765 static void adv_timeout_expired(struct work_struct *work)
6766 {
6767         struct hci_dev *hdev = container_of(work, struct hci_dev,
6768                                             adv_instance.timeout_exp.work);
6769
6770         hdev->adv_instance.timeout = 0;
6771
6772         hci_dev_lock(hdev);
6773         clear_adv_instance(hdev);
6774         hci_dev_unlock(hdev);
6775 }
6776
6777 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6778                            void *data, u16 data_len)
6779 {
6780         struct mgmt_cp_add_advertising *cp = data;
6781         struct mgmt_rp_add_advertising rp;
6782         u32 flags;
6783         u32 supported_flags;
6784         u8 status;
6785         u16 timeout;
6786         int err;
6787         struct mgmt_pending_cmd *cmd;
6788         struct hci_request req;
6789
6790         BT_DBG("%s", hdev->name);
6791
6792         status = mgmt_le_support(hdev);
6793         if (status)
6794                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6795                                        status);
6796
6797         flags = __le32_to_cpu(cp->flags);
6798         timeout = __le16_to_cpu(cp->timeout);
6799
6800         /* The current implementation only supports adding one instance and only
6801          * a subset of the specified flags.
6802          */
6803         supported_flags = get_supported_adv_flags(hdev);
6804         if (cp->instance != 0x01 || (flags & ~supported_flags))
6805                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6806                                        MGMT_STATUS_INVALID_PARAMS);
6807
6808         hci_dev_lock(hdev);
6809
6810         if (timeout && !hdev_is_powered(hdev)) {
6811                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6812                                       MGMT_STATUS_REJECTED);
6813                 goto unlock;
6814         }
6815
6816         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6817             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6818             pending_find(MGMT_OP_SET_LE, hdev)) {
6819                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6820                                       MGMT_STATUS_BUSY);
6821                 goto unlock;
6822         }
6823
6824         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6825             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6826                                cp->scan_rsp_len, false)) {
6827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6828                                       MGMT_STATUS_INVALID_PARAMS);
6829                 goto unlock;
6830         }
6831
6832         INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6833
6834         hdev->adv_instance.flags = flags;
6835         hdev->adv_instance.adv_data_len = cp->adv_data_len;
6836         hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6837
6838         if (cp->adv_data_len)
6839                 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6840
6841         if (cp->scan_rsp_len)
6842                 memcpy(hdev->adv_instance.scan_rsp_data,
6843                        cp->data + cp->adv_data_len, cp->scan_rsp_len);
6844
6845         if (hdev->adv_instance.timeout)
6846                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6847
6848         hdev->adv_instance.timeout = timeout;
6849
6850         if (timeout)
6851                 queue_delayed_work(hdev->workqueue,
6852                                    &hdev->adv_instance.timeout_exp,
6853                                    msecs_to_jiffies(timeout * 1000));
6854
6855         if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6856                 advertising_added(sk, hdev, 1);
6857
6858         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6859          * we have no HCI communication to make. Simply return.
6860          */
6861         if (!hdev_is_powered(hdev) ||
6862             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6863                 rp.instance = 0x01;
6864                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6865                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6866                 goto unlock;
6867         }
6868
6869         /* We're good to go, update advertising data, parameters, and start
6870          * advertising.
6871          */
6872         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6873                                data_len);
6874         if (!cmd) {
6875                 err = -ENOMEM;
6876                 goto unlock;
6877         }
6878
6879         hci_req_init(&req, hdev);
6880
6881         update_adv_data(&req);
6882         update_scan_rsp_data(&req);
6883         enable_advertising(&req);
6884
6885         err = hci_req_run(&req, add_advertising_complete);
6886         if (err < 0)
6887                 mgmt_pending_remove(cmd);
6888
6889 unlock:
6890         hci_dev_unlock(hdev);
6891
6892         return err;
6893 }
6894
6895 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6896                                         u16 opcode)
6897 {
6898         struct mgmt_pending_cmd *cmd;
6899         struct mgmt_rp_remove_advertising rp;
6900
6901         BT_DBG("status %d", status);
6902
6903         hci_dev_lock(hdev);
6904
6905         /* A failure status here only means that we failed to disable
6906          * advertising. Otherwise, the advertising instance has been removed,
6907          * so report success.
6908          */
6909         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6910         if (!cmd)
6911                 goto unlock;
6912
6913         rp.instance = 1;
6914
6915         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6916                           &rp, sizeof(rp));
6917         mgmt_pending_remove(cmd);
6918
6919 unlock:
6920         hci_dev_unlock(hdev);
6921 }
6922
6923 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6924                               void *data, u16 data_len)
6925 {
6926         struct mgmt_cp_remove_advertising *cp = data;
6927         struct mgmt_rp_remove_advertising rp;
6928         int err;
6929         struct mgmt_pending_cmd *cmd;
6930         struct hci_request req;
6931
6932         BT_DBG("%s", hdev->name);
6933
6934         /* The current implementation only allows modifying instance no 1. A
6935          * value of 0 indicates that all instances should be cleared.
6936          */
6937         if (cp->instance > 1)
6938                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6939                                        MGMT_STATUS_INVALID_PARAMS);
6940
6941         hci_dev_lock(hdev);
6942
6943         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6944             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6945             pending_find(MGMT_OP_SET_LE, hdev)) {
6946                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6947                                       MGMT_STATUS_BUSY);
6948                 goto unlock;
6949         }
6950
6951         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6952                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6953                                       MGMT_STATUS_INVALID_PARAMS);
6954                 goto unlock;
6955         }
6956
6957         if (hdev->adv_instance.timeout)
6958                 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6959
6960         memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6961
6962         advertising_removed(sk, hdev, 1);
6963
6964         hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6965
6966         /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6967          * we have no HCI communication to make. Simply return.
6968          */
6969         if (!hdev_is_powered(hdev) ||
6970             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6971                 rp.instance = 1;
6972                 err = mgmt_cmd_complete(sk, hdev->id,
6973                                         MGMT_OP_REMOVE_ADVERTISING,
6974                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6975                 goto unlock;
6976         }
6977
6978         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6979                                data_len);
6980         if (!cmd) {
6981                 err = -ENOMEM;
6982                 goto unlock;
6983         }
6984
6985         hci_req_init(&req, hdev);
6986         disable_advertising(&req);
6987
6988         err = hci_req_run(&req, remove_advertising_complete);
6989         if (err < 0)
6990                 mgmt_pending_remove(cmd);
6991
6992 unlock:
6993         hci_dev_unlock(hdev);
6994
6995         return err;
6996 }
6997
6998 static const struct hci_mgmt_handler mgmt_handlers[] = {
6999         { NULL }, /* 0x0000 (no command) */
7000         { read_version,            MGMT_READ_VERSION_SIZE,
7001                                                 HCI_MGMT_NO_HDEV |
7002                                                 HCI_MGMT_UNTRUSTED },
7003         { read_commands,           MGMT_READ_COMMANDS_SIZE,
7004                                                 HCI_MGMT_NO_HDEV |
7005                                                 HCI_MGMT_UNTRUSTED },
7006         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
7007                                                 HCI_MGMT_NO_HDEV |
7008                                                 HCI_MGMT_UNTRUSTED },
7009         { read_controller_info,    MGMT_READ_INFO_SIZE,
7010                                                 HCI_MGMT_UNTRUSTED },
7011         { set_powered,             MGMT_SETTING_SIZE },
7012         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
7013         { set_connectable,         MGMT_SETTING_SIZE },
7014         { set_fast_connectable,    MGMT_SETTING_SIZE },
7015         { set_bondable,            MGMT_SETTING_SIZE },
7016         { set_link_security,       MGMT_SETTING_SIZE },
7017         { set_ssp,                 MGMT_SETTING_SIZE },
7018         { set_hs,                  MGMT_SETTING_SIZE },
7019         { set_le,                  MGMT_SETTING_SIZE },
7020         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
7021         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
7022         { add_uuid,                MGMT_ADD_UUID_SIZE },
7023         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
7024         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
7025                                                 HCI_MGMT_VAR_LEN },
7026         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7027                                                 HCI_MGMT_VAR_LEN },
7028         { disconnect,              MGMT_DISCONNECT_SIZE },
7029         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
7030         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
7031         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
7032         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
7033         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
7034         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
7035         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
7036         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
7037         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7038         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
7039         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7040         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
7041         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7042                                                 HCI_MGMT_VAR_LEN },
7043         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7044         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
7045         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
7046         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
7047         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
7048         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
7049         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
7050         { set_advertising,         MGMT_SETTING_SIZE },
7051         { set_bredr,               MGMT_SETTING_SIZE },
7052         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
7053         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
7054         { set_secure_conn,         MGMT_SETTING_SIZE },
7055         { set_debug_keys,          MGMT_SETTING_SIZE },
7056         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
7057         { load_irks,               MGMT_LOAD_IRKS_SIZE,
7058                                                 HCI_MGMT_VAR_LEN },
7059         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
7060         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
7061         { add_device,              MGMT_ADD_DEVICE_SIZE },
7062         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
7063         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
7064                                                 HCI_MGMT_VAR_LEN },
7065         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7066                                                 HCI_MGMT_NO_HDEV |
7067                                                 HCI_MGMT_UNTRUSTED },
7068         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
7069                                                 HCI_MGMT_UNCONFIGURED |
7070                                                 HCI_MGMT_UNTRUSTED },
7071         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
7072                                                 HCI_MGMT_UNCONFIGURED },
7073         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
7074                                                 HCI_MGMT_UNCONFIGURED },
7075         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7076                                                 HCI_MGMT_VAR_LEN },
7077         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7078         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
7079                                                 HCI_MGMT_NO_HDEV |
7080                                                 HCI_MGMT_UNTRUSTED },
7081         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
7082         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
7083                                                 HCI_MGMT_VAR_LEN },
7084         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
7085 };
7086
7087 void mgmt_index_added(struct hci_dev *hdev)
7088 {
7089         struct mgmt_ev_ext_index ev;
7090
7091         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7092                 return;
7093
7094         switch (hdev->dev_type) {
7095         case HCI_BREDR:
7096                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7097                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7098                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7099                         ev.type = 0x01;
7100                 } else {
7101                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7102                                          HCI_MGMT_INDEX_EVENTS);
7103                         ev.type = 0x00;
7104                 }
7105                 break;
7106         case HCI_AMP:
7107                 ev.type = 0x02;
7108                 break;
7109         default:
7110                 return;
7111         }
7112
7113         ev.bus = hdev->bus;
7114
7115         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7116                          HCI_MGMT_EXT_INDEX_EVENTS);
7117 }
7118
7119 void mgmt_index_removed(struct hci_dev *hdev)
7120 {
7121         struct mgmt_ev_ext_index ev;
7122         u8 status = MGMT_STATUS_INVALID_INDEX;
7123
7124         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7125                 return;
7126
7127         switch (hdev->dev_type) {
7128         case HCI_BREDR:
7129                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7130
7131                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7132                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7133                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7134                         ev.type = 0x01;
7135                 } else {
7136                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7137                                          HCI_MGMT_INDEX_EVENTS);
7138                         ev.type = 0x00;
7139                 }
7140                 break;
7141         case HCI_AMP:
7142                 ev.type = 0x02;
7143                 break;
7144         default:
7145                 return;
7146         }
7147
7148         ev.bus = hdev->bus;
7149
7150         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7151                          HCI_MGMT_EXT_INDEX_EVENTS);
7152 }
7153
7154 /* This function requires the caller holds hdev->lock */
7155 static void restart_le_actions(struct hci_request *req)
7156 {
7157         struct hci_dev *hdev = req->hdev;
7158         struct hci_conn_params *p;
7159
7160         list_for_each_entry(p, &hdev->le_conn_params, list) {
7161                 /* Needed for AUTO_OFF case where might not "really"
7162                  * have been powered off.
7163                  */
7164                 list_del_init(&p->action);
7165
7166                 switch (p->auto_connect) {
7167                 case HCI_AUTO_CONN_DIRECT:
7168                 case HCI_AUTO_CONN_ALWAYS:
7169                         list_add(&p->action, &hdev->pend_le_conns);
7170                         break;
7171                 case HCI_AUTO_CONN_REPORT:
7172                         list_add(&p->action, &hdev->pend_le_reports);
7173                         break;
7174                 default:
7175                         break;
7176                 }
7177         }
7178
7179         __hci_update_background_scan(req);
7180 }
7181
7182 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7183 {
7184         struct cmd_lookup match = { NULL, hdev };
7185
7186         BT_DBG("status 0x%02x", status);
7187
7188         if (!status) {
7189                 /* Register the available SMP channels (BR/EDR and LE) only
7190                  * when successfully powering on the controller. This late
7191                  * registration is required so that LE SMP can clearly
7192                  * decide if the public address or static address is used.
7193                  */
7194                 smp_register(hdev);
7195         }
7196
7197         hci_dev_lock(hdev);
7198
7199         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7200
7201         new_settings(hdev, match.sk);
7202
7203         hci_dev_unlock(hdev);
7204
7205         if (match.sk)
7206                 sock_put(match.sk);
7207 }
7208
7209 static int powered_update_hci(struct hci_dev *hdev)
7210 {
7211         struct hci_request req;
7212         u8 link_sec;
7213
7214         hci_req_init(&req, hdev);
7215
7216         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7217             !lmp_host_ssp_capable(hdev)) {
7218                 u8 mode = 0x01;
7219
7220                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7221
7222                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7223                         u8 support = 0x01;
7224
7225                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7226                                     sizeof(support), &support);
7227                 }
7228         }
7229
7230         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7231             lmp_bredr_capable(hdev)) {
7232                 struct hci_cp_write_le_host_supported cp;
7233
7234                 cp.le = 0x01;
7235                 cp.simul = 0x00;
7236
7237                 /* Check first if we already have the right
7238                  * host state (host features set)
7239                  */
7240                 if (cp.le != lmp_host_le_capable(hdev) ||
7241                     cp.simul != lmp_host_le_br_capable(hdev))
7242                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7243                                     sizeof(cp), &cp);
7244         }
7245
7246         if (lmp_le_capable(hdev)) {
7247                 /* Make sure the controller has a good default for
7248                  * advertising data. This also applies to the case
7249                  * where BR/EDR was toggled during the AUTO_OFF phase.
7250                  */
7251                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
7252                         update_adv_data(&req);
7253                         update_scan_rsp_data(&req);
7254                 }
7255
7256                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7257                     hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
7258                         enable_advertising(&req);
7259
7260                 restart_le_actions(&req);
7261         }
7262
7263         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7264         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7265                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7266                             sizeof(link_sec), &link_sec);
7267
7268         if (lmp_bredr_capable(hdev)) {
7269                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7270                         write_fast_connectable(&req, true);
7271                 else
7272                         write_fast_connectable(&req, false);
7273                 __hci_update_page_scan(&req);
7274                 update_class(&req);
7275                 update_name(&req);
7276                 update_eir(&req);
7277         }
7278
7279         return hci_req_run(&req, powered_complete);
7280 }
7281
7282 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7283 {
7284         struct cmd_lookup match = { NULL, hdev };
7285         u8 status, zero_cod[] = { 0, 0, 0 };
7286         int err;
7287
7288         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7289                 return 0;
7290
7291         if (powered) {
7292                 if (powered_update_hci(hdev) == 0)
7293                         return 0;
7294
7295                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7296                                      &match);
7297                 goto new_settings;
7298         }
7299
7300         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7301
7302         /* If the power off is because of hdev unregistration let
7303          * use the appropriate INVALID_INDEX status. Otherwise use
7304          * NOT_POWERED. We cover both scenarios here since later in
7305          * mgmt_index_removed() any hci_conn callbacks will have already
7306          * been triggered, potentially causing misleading DISCONNECTED
7307          * status responses.
7308          */
7309         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7310                 status = MGMT_STATUS_INVALID_INDEX;
7311         else
7312                 status = MGMT_STATUS_NOT_POWERED;
7313
7314         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7315
7316         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7317                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7318                                    zero_cod, sizeof(zero_cod), NULL);
7319
7320 new_settings:
7321         err = new_settings(hdev, match.sk);
7322
7323         if (match.sk)
7324                 sock_put(match.sk);
7325
7326         return err;
7327 }
7328
7329 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7330 {
7331         struct mgmt_pending_cmd *cmd;
7332         u8 status;
7333
7334         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7335         if (!cmd)
7336                 return;
7337
7338         if (err == -ERFKILL)
7339                 status = MGMT_STATUS_RFKILLED;
7340         else
7341                 status = MGMT_STATUS_FAILED;
7342
7343         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7344
7345         mgmt_pending_remove(cmd);
7346 }
7347
7348 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7349 {
7350         struct hci_request req;
7351
7352         hci_dev_lock(hdev);
7353
7354         /* When discoverable timeout triggers, then just make sure
7355          * the limited discoverable flag is cleared. Even in the case
7356          * of a timeout triggered from general discoverable, it is
7357          * safe to unconditionally clear the flag.
7358          */
7359         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7360         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7361
7362         hci_req_init(&req, hdev);
7363         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7364                 u8 scan = SCAN_PAGE;
7365                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7366                             sizeof(scan), &scan);
7367         }
7368         update_class(&req);
7369
7370         /* Advertising instances don't use the global discoverable setting, so
7371          * only update AD if advertising was enabled using Set Advertising.
7372          */
7373         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7374                 update_adv_data(&req);
7375
7376         hci_req_run(&req, NULL);
7377
7378         hdev->discov_timeout = 0;
7379
7380         new_settings(hdev, NULL);
7381
7382         hci_dev_unlock(hdev);
7383 }
7384
7385 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7386                        bool persistent)
7387 {
7388         struct mgmt_ev_new_link_key ev;
7389
7390         memset(&ev, 0, sizeof(ev));
7391
7392         ev.store_hint = persistent;
7393         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7394         ev.key.addr.type = BDADDR_BREDR;
7395         ev.key.type = key->type;
7396         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7397         ev.key.pin_len = key->pin_len;
7398
7399         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7400 }
7401
7402 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7403 {
7404         switch (ltk->type) {
7405         case SMP_LTK:
7406         case SMP_LTK_SLAVE:
7407                 if (ltk->authenticated)
7408                         return MGMT_LTK_AUTHENTICATED;
7409                 return MGMT_LTK_UNAUTHENTICATED;
7410         case SMP_LTK_P256:
7411                 if (ltk->authenticated)
7412                         return MGMT_LTK_P256_AUTH;
7413                 return MGMT_LTK_P256_UNAUTH;
7414         case SMP_LTK_P256_DEBUG:
7415                 return MGMT_LTK_P256_DEBUG;
7416         }
7417
7418         return MGMT_LTK_UNAUTHENTICATED;
7419 }
7420
7421 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7422 {
7423         struct mgmt_ev_new_long_term_key ev;
7424
7425         memset(&ev, 0, sizeof(ev));
7426
7427         /* Devices using resolvable or non-resolvable random addresses
7428          * without providing an indentity resolving key don't require
7429          * to store long term keys. Their addresses will change the
7430          * next time around.
7431          *
7432          * Only when a remote device provides an identity address
7433          * make sure the long term key is stored. If the remote
7434          * identity is known, the long term keys are internally
7435          * mapped to the identity address. So allow static random
7436          * and public addresses here.
7437          */
7438         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7439             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7440                 ev.store_hint = 0x00;
7441         else
7442                 ev.store_hint = persistent;
7443
7444         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7445         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7446         ev.key.type = mgmt_ltk_type(key);
7447         ev.key.enc_size = key->enc_size;
7448         ev.key.ediv = key->ediv;
7449         ev.key.rand = key->rand;
7450
7451         if (key->type == SMP_LTK)
7452                 ev.key.master = 1;
7453
7454         memcpy(ev.key.val, key->val, sizeof(key->val));
7455
7456         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7457 }
7458
7459 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7460 {
7461         struct mgmt_ev_new_irk ev;
7462
7463         memset(&ev, 0, sizeof(ev));
7464
7465         /* For identity resolving keys from devices that are already
7466          * using a public address or static random address, do not
7467          * ask for storing this key. The identity resolving key really
7468          * is only mandatory for devices using resovlable random
7469          * addresses.
7470          *
7471          * Storing all identity resolving keys has the downside that
7472          * they will be also loaded on next boot of they system. More
7473          * identity resolving keys, means more time during scanning is
7474          * needed to actually resolve these addresses.
7475          */
7476         if (bacmp(&irk->rpa, BDADDR_ANY))
7477                 ev.store_hint = 0x01;
7478         else
7479                 ev.store_hint = 0x00;
7480
7481         bacpy(&ev.rpa, &irk->rpa);
7482         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7483         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7484         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7485
7486         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7487 }
7488
7489 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7490                    bool persistent)
7491 {
7492         struct mgmt_ev_new_csrk ev;
7493
7494         memset(&ev, 0, sizeof(ev));
7495
7496         /* Devices using resolvable or non-resolvable random addresses
7497          * without providing an indentity resolving key don't require
7498          * to store signature resolving keys. Their addresses will change
7499          * the next time around.
7500          *
7501          * Only when a remote device provides an identity address
7502          * make sure the signature resolving key is stored. So allow
7503          * static random and public addresses here.
7504          */
7505         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7506             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7507                 ev.store_hint = 0x00;
7508         else
7509                 ev.store_hint = persistent;
7510
7511         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7512         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7513         ev.key.type = csrk->type;
7514         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7515
7516         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7517 }
7518
7519 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7520                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7521                          u16 max_interval, u16 latency, u16 timeout)
7522 {
7523         struct mgmt_ev_new_conn_param ev;
7524
7525         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7526                 return;
7527
7528         memset(&ev, 0, sizeof(ev));
7529         bacpy(&ev.addr.bdaddr, bdaddr);
7530         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7531         ev.store_hint = store_hint;
7532         ev.min_interval = cpu_to_le16(min_interval);
7533         ev.max_interval = cpu_to_le16(max_interval);
7534         ev.latency = cpu_to_le16(latency);
7535         ev.timeout = cpu_to_le16(timeout);
7536
7537         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7538 }
7539
7540 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7541                            u32 flags, u8 *name, u8 name_len)
7542 {
7543         char buf[512];
7544         struct mgmt_ev_device_connected *ev = (void *) buf;
7545         u16 eir_len = 0;
7546
7547         bacpy(&ev->addr.bdaddr, &conn->dst);
7548         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7549
7550         ev->flags = __cpu_to_le32(flags);
7551
7552         /* We must ensure that the EIR Data fields are ordered and
7553          * unique. Keep it simple for now and avoid the problem by not
7554          * adding any BR/EDR data to the LE adv.
7555          */
7556         if (conn->le_adv_data_len > 0) {
7557                 memcpy(&ev->eir[eir_len],
7558                        conn->le_adv_data, conn->le_adv_data_len);
7559                 eir_len = conn->le_adv_data_len;
7560         } else {
7561                 if (name_len > 0)
7562                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7563                                                   name, name_len);
7564
7565                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7566                         eir_len = eir_append_data(ev->eir, eir_len,
7567                                                   EIR_CLASS_OF_DEV,
7568                                                   conn->dev_class, 3);
7569         }
7570
7571         ev->eir_len = cpu_to_le16(eir_len);
7572
7573         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7574                     sizeof(*ev) + eir_len, NULL);
7575 }
7576
7577 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7578 {
7579         struct sock **sk = data;
7580
7581         cmd->cmd_complete(cmd, 0);
7582
7583         *sk = cmd->sk;
7584         sock_hold(*sk);
7585
7586         mgmt_pending_remove(cmd);
7587 }
7588
7589 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7590 {
7591         struct hci_dev *hdev = data;
7592         struct mgmt_cp_unpair_device *cp = cmd->param;
7593
7594         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7595
7596         cmd->cmd_complete(cmd, 0);
7597         mgmt_pending_remove(cmd);
7598 }
7599
7600 bool mgmt_powering_down(struct hci_dev *hdev)
7601 {
7602         struct mgmt_pending_cmd *cmd;
7603         struct mgmt_mode *cp;
7604
7605         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7606         if (!cmd)
7607                 return false;
7608
7609         cp = cmd->param;
7610         if (!cp->val)
7611                 return true;
7612
7613         return false;
7614 }
7615
7616 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7617                               u8 link_type, u8 addr_type, u8 reason,
7618                               bool mgmt_connected)
7619 {
7620         struct mgmt_ev_device_disconnected ev;
7621         struct sock *sk = NULL;
7622
7623         /* The connection is still in hci_conn_hash so test for 1
7624          * instead of 0 to know if this is the last one.
7625          */
7626         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7627                 cancel_delayed_work(&hdev->power_off);
7628                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7629         }
7630
7631         if (!mgmt_connected)
7632                 return;
7633
7634         if (link_type != ACL_LINK && link_type != LE_LINK)
7635                 return;
7636
7637         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7638
7639         bacpy(&ev.addr.bdaddr, bdaddr);
7640         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7641         ev.reason = reason;
7642
7643         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7644
7645         if (sk)
7646                 sock_put(sk);
7647
7648         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7649                              hdev);
7650 }
7651
7652 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7653                             u8 link_type, u8 addr_type, u8 status)
7654 {
7655         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7656         struct mgmt_cp_disconnect *cp;
7657         struct mgmt_pending_cmd *cmd;
7658
7659         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7660                              hdev);
7661
7662         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7663         if (!cmd)
7664                 return;
7665
7666         cp = cmd->param;
7667
7668         if (bacmp(bdaddr, &cp->addr.bdaddr))
7669                 return;
7670
7671         if (cp->addr.type != bdaddr_type)
7672                 return;
7673
7674         cmd->cmd_complete(cmd, mgmt_status(status));
7675         mgmt_pending_remove(cmd);
7676 }
7677
7678 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7679                          u8 addr_type, u8 status)
7680 {
7681         struct mgmt_ev_connect_failed ev;
7682
7683         /* The connection is still in hci_conn_hash so test for 1
7684          * instead of 0 to know if this is the last one.
7685          */
7686         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7687                 cancel_delayed_work(&hdev->power_off);
7688                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7689         }
7690
7691         bacpy(&ev.addr.bdaddr, bdaddr);
7692         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7693         ev.status = mgmt_status(status);
7694
7695         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7696 }
7697
7698 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7699 {
7700         struct mgmt_ev_pin_code_request ev;
7701
7702         bacpy(&ev.addr.bdaddr, bdaddr);
7703         ev.addr.type = BDADDR_BREDR;
7704         ev.secure = secure;
7705
7706         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7707 }
7708
7709 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7710                                   u8 status)
7711 {
7712         struct mgmt_pending_cmd *cmd;
7713
7714         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7715         if (!cmd)
7716                 return;
7717
7718         cmd->cmd_complete(cmd, mgmt_status(status));
7719         mgmt_pending_remove(cmd);
7720 }
7721
7722 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7723                                       u8 status)
7724 {
7725         struct mgmt_pending_cmd *cmd;
7726
7727         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7728         if (!cmd)
7729                 return;
7730
7731         cmd->cmd_complete(cmd, mgmt_status(status));
7732         mgmt_pending_remove(cmd);
7733 }
7734
7735 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7736                               u8 link_type, u8 addr_type, u32 value,
7737                               u8 confirm_hint)
7738 {
7739         struct mgmt_ev_user_confirm_request ev;
7740
7741         BT_DBG("%s", hdev->name);
7742
7743         bacpy(&ev.addr.bdaddr, bdaddr);
7744         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7745         ev.confirm_hint = confirm_hint;
7746         ev.value = cpu_to_le32(value);
7747
7748         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7749                           NULL);
7750 }
7751
7752 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7753                               u8 link_type, u8 addr_type)
7754 {
7755         struct mgmt_ev_user_passkey_request ev;
7756
7757         BT_DBG("%s", hdev->name);
7758
7759         bacpy(&ev.addr.bdaddr, bdaddr);
7760         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7761
7762         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7763                           NULL);
7764 }
7765
7766 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7767                                       u8 link_type, u8 addr_type, u8 status,
7768                                       u8 opcode)
7769 {
7770         struct mgmt_pending_cmd *cmd;
7771
7772         cmd = pending_find(opcode, hdev);
7773         if (!cmd)
7774                 return -ENOENT;
7775
7776         cmd->cmd_complete(cmd, mgmt_status(status));
7777         mgmt_pending_remove(cmd);
7778
7779         return 0;
7780 }
7781
7782 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7783                                      u8 link_type, u8 addr_type, u8 status)
7784 {
7785         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7786                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7787 }
7788
7789 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7790                                          u8 link_type, u8 addr_type, u8 status)
7791 {
7792         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7793                                           status,
7794                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7795 }
7796
7797 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7798                                      u8 link_type, u8 addr_type, u8 status)
7799 {
7800         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7801                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7802 }
7803
7804 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7805                                          u8 link_type, u8 addr_type, u8 status)
7806 {
7807         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7808                                           status,
7809                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7810 }
7811
7812 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7813                              u8 link_type, u8 addr_type, u32 passkey,
7814                              u8 entered)
7815 {
7816         struct mgmt_ev_passkey_notify ev;
7817
7818         BT_DBG("%s", hdev->name);
7819
7820         bacpy(&ev.addr.bdaddr, bdaddr);
7821         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7822         ev.passkey = __cpu_to_le32(passkey);
7823         ev.entered = entered;
7824
7825         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7826 }
7827
7828 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7829 {
7830         struct mgmt_ev_auth_failed ev;
7831         struct mgmt_pending_cmd *cmd;
7832         u8 status = mgmt_status(hci_status);
7833
7834         bacpy(&ev.addr.bdaddr, &conn->dst);
7835         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7836         ev.status = status;
7837
7838         cmd = find_pairing(conn);
7839
7840         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7841                     cmd ? cmd->sk : NULL);
7842
7843         if (cmd) {
7844                 cmd->cmd_complete(cmd, status);
7845                 mgmt_pending_remove(cmd);
7846         }
7847 }
7848
7849 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7850 {
7851         struct cmd_lookup match = { NULL, hdev };
7852         bool changed;
7853
7854         if (status) {
7855                 u8 mgmt_err = mgmt_status(status);
7856                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7857                                      cmd_status_rsp, &mgmt_err);
7858                 return;
7859         }
7860
7861         if (test_bit(HCI_AUTH, &hdev->flags))
7862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7863         else
7864                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7865
7866         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7867                              &match);
7868
7869         if (changed)
7870                 new_settings(hdev, match.sk);
7871
7872         if (match.sk)
7873                 sock_put(match.sk);
7874 }
7875
7876 static void clear_eir(struct hci_request *req)
7877 {
7878         struct hci_dev *hdev = req->hdev;
7879         struct hci_cp_write_eir cp;
7880
7881         if (!lmp_ext_inq_capable(hdev))
7882                 return;
7883
7884         memset(hdev->eir, 0, sizeof(hdev->eir));
7885
7886         memset(&cp, 0, sizeof(cp));
7887
7888         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7889 }
7890
7891 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7892 {
7893         struct cmd_lookup match = { NULL, hdev };
7894         struct hci_request req;
7895         bool changed = false;
7896
7897         if (status) {
7898                 u8 mgmt_err = mgmt_status(status);
7899
7900                 if (enable && hci_dev_test_and_clear_flag(hdev,
7901                                                           HCI_SSP_ENABLED)) {
7902                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7903                         new_settings(hdev, NULL);
7904                 }
7905
7906                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7907                                      &mgmt_err);
7908                 return;
7909         }
7910
7911         if (enable) {
7912                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7913         } else {
7914                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7915                 if (!changed)
7916                         changed = hci_dev_test_and_clear_flag(hdev,
7917                                                               HCI_HS_ENABLED);
7918                 else
7919                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7920         }
7921
7922         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7923
7924         if (changed)
7925                 new_settings(hdev, match.sk);
7926
7927         if (match.sk)
7928                 sock_put(match.sk);
7929
7930         hci_req_init(&req, hdev);
7931
7932         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7933                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7934                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7935                                     sizeof(enable), &enable);
7936                 update_eir(&req);
7937         } else {
7938                 clear_eir(&req);
7939         }
7940
7941         hci_req_run(&req, NULL);
7942 }
7943
7944 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7945 {
7946         struct cmd_lookup *match = data;
7947
7948         if (match->sk == NULL) {
7949                 match->sk = cmd->sk;
7950                 sock_hold(match->sk);
7951         }
7952 }
7953
7954 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7955                                     u8 status)
7956 {
7957         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7958
7959         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7960         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7961         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7962
7963         if (!status)
7964                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7965                                    dev_class, 3, NULL);
7966
7967         if (match.sk)
7968                 sock_put(match.sk);
7969 }
7970
7971 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7972 {
7973         struct mgmt_cp_set_local_name ev;
7974         struct mgmt_pending_cmd *cmd;
7975
7976         if (status)
7977                 return;
7978
7979         memset(&ev, 0, sizeof(ev));
7980         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7981         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7982
7983         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7984         if (!cmd) {
7985                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7986
7987                 /* If this is a HCI command related to powering on the
7988                  * HCI dev don't send any mgmt signals.
7989                  */
7990                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7991                         return;
7992         }
7993
7994         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7995                            cmd ? cmd->sk : NULL);
7996 }
7997
7998 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7999 {
8000         int i;
8001
8002         for (i = 0; i < uuid_count; i++) {
8003                 if (!memcmp(uuid, uuids[i], 16))
8004                         return true;
8005         }
8006
8007         return false;
8008 }
8009
8010 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8011 {
8012         u16 parsed = 0;
8013
8014         while (parsed < eir_len) {
8015                 u8 field_len = eir[0];
8016                 u8 uuid[16];
8017                 int i;
8018
8019                 if (field_len == 0)
8020                         break;
8021
8022                 if (eir_len - parsed < field_len + 1)
8023                         break;
8024
8025                 switch (eir[1]) {
8026                 case EIR_UUID16_ALL:
8027                 case EIR_UUID16_SOME:
8028                         for (i = 0; i + 3 <= field_len; i += 2) {
8029                                 memcpy(uuid, bluetooth_base_uuid, 16);
8030                                 uuid[13] = eir[i + 3];
8031                                 uuid[12] = eir[i + 2];
8032                                 if (has_uuid(uuid, uuid_count, uuids))
8033                                         return true;
8034                         }
8035                         break;
8036                 case EIR_UUID32_ALL:
8037                 case EIR_UUID32_SOME:
8038                         for (i = 0; i + 5 <= field_len; i += 4) {
8039                                 memcpy(uuid, bluetooth_base_uuid, 16);
8040                                 uuid[15] = eir[i + 5];
8041                                 uuid[14] = eir[i + 4];
8042                                 uuid[13] = eir[i + 3];
8043                                 uuid[12] = eir[i + 2];
8044                                 if (has_uuid(uuid, uuid_count, uuids))
8045                                         return true;
8046                         }
8047                         break;
8048                 case EIR_UUID128_ALL:
8049                 case EIR_UUID128_SOME:
8050                         for (i = 0; i + 17 <= field_len; i += 16) {
8051                                 memcpy(uuid, eir + i + 2, 16);
8052                                 if (has_uuid(uuid, uuid_count, uuids))
8053                                         return true;
8054                         }
8055                         break;
8056                 }
8057
8058                 parsed += field_len + 1;
8059                 eir += field_len + 1;
8060         }
8061
8062         return false;
8063 }
8064
8065 static void restart_le_scan(struct hci_dev *hdev)
8066 {
8067         /* If controller is not scanning we are done. */
8068         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8069                 return;
8070
8071         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8072                        hdev->discovery.scan_start +
8073                        hdev->discovery.scan_duration))
8074                 return;
8075
8076         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8077                            DISCOV_LE_RESTART_DELAY);
8078 }
8079
8080 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8081                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8082 {
8083         /* If a RSSI threshold has been specified, and
8084          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8085          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8086          * is set, let it through for further processing, as we might need to
8087          * restart the scan.
8088          *
8089          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8090          * the results are also dropped.
8091          */
8092         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8093             (rssi == HCI_RSSI_INVALID ||
8094             (rssi < hdev->discovery.rssi &&
8095              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8096                 return  false;
8097
8098         if (hdev->discovery.uuid_count != 0) {
8099                 /* If a list of UUIDs is provided in filter, results with no
8100                  * matching UUID should be dropped.
8101                  */
8102                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8103                                    hdev->discovery.uuids) &&
8104                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8105                                    hdev->discovery.uuid_count,
8106                                    hdev->discovery.uuids))
8107                         return false;
8108         }
8109
8110         /* If duplicate filtering does not report RSSI changes, then restart
8111          * scanning to ensure updated result with updated RSSI values.
8112          */
8113         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8114                 restart_le_scan(hdev);
8115
8116                 /* Validate RSSI value against the RSSI threshold once more. */
8117                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8118                     rssi < hdev->discovery.rssi)
8119                         return false;
8120         }
8121
8122         return true;
8123 }
8124
8125 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8126                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8127                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8128 {
8129         char buf[512];
8130         struct mgmt_ev_device_found *ev = (void *)buf;
8131         size_t ev_size;
8132
8133         /* Don't send events for a non-kernel initiated discovery. With
8134          * LE one exception is if we have pend_le_reports > 0 in which
8135          * case we're doing passive scanning and want these events.
8136          */
8137         if (!hci_discovery_active(hdev)) {
8138                 if (link_type == ACL_LINK)
8139                         return;
8140                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8141                         return;
8142         }
8143
8144         if (hdev->discovery.result_filtering) {
8145                 /* We are using service discovery */
8146                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8147                                      scan_rsp_len))
8148                         return;
8149         }
8150
8151         /* Make sure that the buffer is big enough. The 5 extra bytes
8152          * are for the potential CoD field.
8153          */
8154         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8155                 return;
8156
8157         memset(buf, 0, sizeof(buf));
8158
8159         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8160          * RSSI value was reported as 0 when not available. This behavior
8161          * is kept when using device discovery. This is required for full
8162          * backwards compatibility with the API.
8163          *
8164          * However when using service discovery, the value 127 will be
8165          * returned when the RSSI is not available.
8166          */
8167         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8168             link_type == ACL_LINK)
8169                 rssi = 0;
8170
8171         bacpy(&ev->addr.bdaddr, bdaddr);
8172         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8173         ev->rssi = rssi;
8174         ev->flags = cpu_to_le32(flags);
8175
8176         if (eir_len > 0)
8177                 /* Copy EIR or advertising data into event */
8178                 memcpy(ev->eir, eir, eir_len);
8179
8180         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8181                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8182                                           dev_class, 3);
8183
8184         if (scan_rsp_len > 0)
8185                 /* Append scan response data to event */
8186                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8187
8188         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8189         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8190
8191         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8192 }
8193
8194 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8195                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8196 {
8197         struct mgmt_ev_device_found *ev;
8198         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8199         u16 eir_len;
8200
8201         ev = (struct mgmt_ev_device_found *) buf;
8202
8203         memset(buf, 0, sizeof(buf));
8204
8205         bacpy(&ev->addr.bdaddr, bdaddr);
8206         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8207         ev->rssi = rssi;
8208
8209         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8210                                   name_len);
8211
8212         ev->eir_len = cpu_to_le16(eir_len);
8213
8214         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8215 }
8216
8217 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8218 {
8219         struct mgmt_ev_discovering ev;
8220
8221         BT_DBG("%s discovering %u", hdev->name, discovering);
8222
8223         memset(&ev, 0, sizeof(ev));
8224         ev.type = hdev->discovery.type;
8225         ev.discovering = discovering;
8226
8227         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8228 }
8229
8230 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8231 {
8232         BT_DBG("%s status %u", hdev->name, status);
8233 }
8234
8235 void mgmt_reenable_advertising(struct hci_dev *hdev)
8236 {
8237         struct hci_request req;
8238
8239         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8240             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8241                 return;
8242
8243         hci_req_init(&req, hdev);
8244         enable_advertising(&req);
8245         hci_req_run(&req, adv_enable_complete);
8246 }
8247
8248 static struct hci_mgmt_chan chan = {
8249         .channel        = HCI_CHANNEL_CONTROL,
8250         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8251         .handlers       = mgmt_handlers,
8252         .hdev_init      = mgmt_init_hdev,
8253 };
8254
8255 int mgmt_init(void)
8256 {
8257         return hci_mgmt_chan_register(&chan);
8258 }
8259
8260 void mgmt_exit(void)
8261 {
8262         hci_mgmt_chan_unregister(&chan);
8263 }