net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_FAILED,             /* Reserved for future use */
 223         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 224         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 225         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 226         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 227         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 228         MGMT_STATUS_FAILED,             /* Reserved for future use */
 229         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 230         MGMT_STATUS_FAILED,             /* Reserved for future use */
 231         MGMT_STATUS_FAILED,             /* Slot Violation */
 232         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 233         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 234         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 235         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 236         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 237         MGMT_STATUS_BUSY,               /* Controller Busy */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 239         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 240         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 241         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 242         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 243 };
 244
 245 static u8 mgmt_status(u8 hci_status)
 246 {
 247         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 248                 return mgmt_status_table[hci_status];
 249
 250         return MGMT_STATUS_FAILED;
 251 }
 252
 253 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 254                             u16 len, int flag)
 255 {
 256         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 257                                flag, NULL);
 258 }
 259
 260 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 261                               u16 len, int flag, struct sock *skip_sk)
 262 {
 263         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 264                                flag, skip_sk);
 265 }
 266
 267 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 268                       struct sock *skip_sk)
 269 {
 270         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 271                                HCI_SOCK_TRUSTED, skip_sk);
 272 }
 273
 274 static u8 le_addr_type(u8 mgmt_addr_type)
 275 {
 276         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 277                 return ADDR_LE_DEV_PUBLIC;
 278         else
 279                 return ADDR_LE_DEV_RANDOM;
 280 }
 281
 282 void mgmt_fill_version_info(void *ver)
 283 {
 284         struct mgmt_rp_read_version *rp = ver;
 285
 286         rp->version = MGMT_VERSION;
 287         rp->revision = cpu_to_le16(MGMT_REVISION);
 288 }
 289
 290 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 291                         u16 data_len)
 292 {
 293         struct mgmt_rp_read_version rp;
 294
 295         BT_DBG("sock %p", sk);
 296
 297         mgmt_fill_version_info(&rp);
 298
 299         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 300                                  &rp, sizeof(rp));
 301 }
 302
 303 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 304                          u16 data_len)
 305 {
 306         struct mgmt_rp_read_commands *rp;
 307         u16 num_commands, num_events;
 308         size_t rp_size;
 309         int i, err;
 310
 311         BT_DBG("sock %p", sk);
 312
 313         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 314                 num_commands = ARRAY_SIZE(mgmt_commands);
 315                 num_events = ARRAY_SIZE(mgmt_events);
 316         } else {
 317                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 318                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 319         }
 320
 321         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 322
 323         rp = kmalloc(rp_size, GFP_KERNEL);
 324         if (!rp)
 325                 return -ENOMEM;
 326
 327         rp->num_commands = cpu_to_le16(num_commands);
 328         rp->num_events = cpu_to_le16(num_events);
 329
 330         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 331                 __le16 *opcode = rp->opcodes;
 332
 333                 for (i = 0; i < num_commands; i++, opcode++)
 334                         put_unaligned_le16(mgmt_commands[i], opcode);
 335
 336                 for (i = 0; i < num_events; i++, opcode++)
 337                         put_unaligned_le16(mgmt_events[i], opcode);
 338         } else {
 339                 __le16 *opcode = rp->opcodes;
 340
 341                 for (i = 0; i < num_commands; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 343
 344                 for (i = 0; i < num_events; i++, opcode++)
 345                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 346         }
 347
 348         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 349                                 rp, rp_size);
 350         kfree(rp);
 351
 352         return err;
 353 }
 354
 355 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 356                            u16 data_len)
 357 {
 358         struct mgmt_rp_read_index_list *rp;
 359         struct hci_dev *d;
 360         size_t rp_len;
 361         u16 count;
 362         int err;
 363
 364         BT_DBG("sock %p", sk);
 365
 366         read_lock(&hci_dev_list_lock);
 367
 368         count = 0;
 369         list_for_each_entry(d, &hci_dev_list, list) {
 370                 if (d->dev_type == HCI_PRIMARY &&
 371                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 372                         count++;
 373         }
 374
 375         rp_len = sizeof(*rp) + (2 * count);
 376         rp = kmalloc(rp_len, GFP_ATOMIC);
 377         if (!rp) {
 378                 read_unlock(&hci_dev_list_lock);
 379                 return -ENOMEM;
 380         }
 381
 382         count = 0;
 383         list_for_each_entry(d, &hci_dev_list, list) {
 384                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 385                     hci_dev_test_flag(d, HCI_CONFIG) ||
 386                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 387                         continue;
 388
 389                 /* Devices marked as raw-only are neither configured
 390                  * nor unconfigured controllers.
 391                  */
 392                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 393                         continue;
 394
 395                 if (d->dev_type == HCI_PRIMARY &&
 396                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 397                         rp->index[count++] = cpu_to_le16(d->id);
 398                         BT_DBG("Added hci%u", d->id);
 399                 }
 400         }
 401
 402         rp->num_controllers = cpu_to_le16(count);
 403         rp_len = sizeof(*rp) + (2 * count);
 404
 405         read_unlock(&hci_dev_list_lock);
 406
 407         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 408                                 0, rp, rp_len);
 409
 410         kfree(rp);
 411
 412         return err;
 413 }
 414
 415 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 416                                   void *data, u16 data_len)
 417 {
 418         struct mgmt_rp_read_unconf_index_list *rp;
 419         struct hci_dev *d;
 420         size_t rp_len;
 421         u16 count;
 422         int err;
 423
 424         BT_DBG("sock %p", sk);
 425
 426         read_lock(&hci_dev_list_lock);
 427
 428         count = 0;
 429         list_for_each_entry(d, &hci_dev_list, list) {
 430                 if (d->dev_type == HCI_PRIMARY &&
 431                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 432                         count++;
 433         }
 434
 435         rp_len = sizeof(*rp) + (2 * count);
 436         rp = kmalloc(rp_len, GFP_ATOMIC);
 437         if (!rp) {
 438                 read_unlock(&hci_dev_list_lock);
 439                 return -ENOMEM;
 440         }
 441
 442         count = 0;
 443         list_for_each_entry(d, &hci_dev_list, list) {
 444                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 445                     hci_dev_test_flag(d, HCI_CONFIG) ||
 446                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 447                         continue;
 448
 449                 /* Devices marked as raw-only are neither configured
 450                  * nor unconfigured controllers.
 451                  */
 452                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 453                         continue;
 454
 455                 if (d->dev_type == HCI_PRIMARY &&
 456                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 457                         rp->index[count++] = cpu_to_le16(d->id);
 458                         BT_DBG("Added hci%u", d->id);
 459                 }
 460         }
 461
 462         rp->num_controllers = cpu_to_le16(count);
 463         rp_len = sizeof(*rp) + (2 * count);
 464
 465         read_unlock(&hci_dev_list_lock);
 466
 467         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 468                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 469
 470         kfree(rp);
 471
 472         return err;
 473 }
 474
 475 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 476                                void *data, u16 data_len)
 477 {
 478         struct mgmt_rp_read_ext_index_list *rp;
 479         struct hci_dev *d;
 480         size_t rp_len;
 481         u16 count;
 482         int err;
 483
 484         BT_DBG("sock %p", sk);
 485
 486         read_lock(&hci_dev_list_lock);
 487
 488         count = 0;
 489         list_for_each_entry(d, &hci_dev_list, list) {
 490                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 491                         count++;
 492         }
 493
 494         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 495         rp = kmalloc(rp_len, GFP_ATOMIC);
 496         if (!rp) {
 497                 read_unlock(&hci_dev_list_lock);
 498                 return -ENOMEM;
 499         }
 500
 501         count = 0;
 502         list_for_each_entry(d, &hci_dev_list, list) {
 503                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 504                     hci_dev_test_flag(d, HCI_CONFIG) ||
 505                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 506                         continue;
 507
 508                 /* Devices marked as raw-only are neither configured
 509                  * nor unconfigured controllers.
 510                  */
 511                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 512                         continue;
 513
 514                 if (d->dev_type == HCI_PRIMARY) {
 515                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 516                                 rp->entry[count].type = 0x01;
 517                         else
 518                                 rp->entry[count].type = 0x00;
 519                 } else if (d->dev_type == HCI_AMP) {
 520                         rp->entry[count].type = 0x02;
 521                 } else {
 522                         continue;
 523                 }
 524
 525                 rp->entry[count].bus = d->bus;
 526                 rp->entry[count++].index = cpu_to_le16(d->id);
 527                 BT_DBG("Added hci%u", d->id);
 528         }
 529
 530         rp->num_controllers = cpu_to_le16(count);
 531         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 532
 533         read_unlock(&hci_dev_list_lock);
 534
 535         /* If this command is called at least once, then all the
 536          * default index and unconfigured index events are disabled
 537          * and from now on only extended index events are used.
 538          */
 539         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 540         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 541         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 542
 543         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 544                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 545
 546         kfree(rp);
 547
 548         return err;
 549 }
 550
 551 static bool is_configured(struct hci_dev *hdev)
 552 {
 553         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 554             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 555                 return false;
 556
 557         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 558             !bacmp(&hdev->public_addr, BDADDR_ANY))
 559                 return false;
 560
 561         return true;
 562 }
 563
 564 static __le32 get_missing_options(struct hci_dev *hdev)
 565 {
 566         u32 options = 0;
 567
 568         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 569             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 570                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 571
 572         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 573             !bacmp(&hdev->public_addr, BDADDR_ANY))
 574                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 575
 576         return cpu_to_le32(options);
 577 }
 578
 579 static int new_options(struct hci_dev *hdev, struct sock *skip)
 580 {
 581         __le32 options = get_missing_options(hdev);
 582
 583         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 584                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 585 }
 586
 587 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 588 {
 589         __le32 options = get_missing_options(hdev);
 590
 591         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 592                                  sizeof(options));
 593 }
 594
 595 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 596                             void *data, u16 data_len)
 597 {
 598         struct mgmt_rp_read_config_info rp;
 599         u32 options = 0;
 600
 601         BT_DBG("sock %p %s", sk, hdev->name);
 602
 603         hci_dev_lock(hdev);
 604
 605         memset(&rp, 0, sizeof(rp));
 606         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 607
 608         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 609                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 610
 611         if (hdev->set_bdaddr)
 612                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 613
 614         rp.supported_options = cpu_to_le32(options);
 615         rp.missing_options = get_missing_options(hdev);
 616
 617         hci_dev_unlock(hdev);
 618
 619         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 620                                  &rp, sizeof(rp));
 621 }
 622
 623 static u32 get_supported_phys(struct hci_dev *hdev)
 624 {
 625         u32 supported_phys = 0;
 626
 627         if (lmp_bredr_capable(hdev)) {
 628                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_3SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 632
 633                 if (hdev->features[0][0] & LMP_5SLOT)
 634                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 635
 636                 if (lmp_edr_2m_capable(hdev)) {
 637                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 638
 639                         if (lmp_edr_3slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 641
 642                         if (lmp_edr_5slot_capable(hdev))
 643                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 644
 645                         if (lmp_edr_3m_capable(hdev)) {
 646                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 647
 648                                 if (lmp_edr_3slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 650
 651                                 if (lmp_edr_5slot_capable(hdev))
 652                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 653                         }
 654                 }
 655         }
 656
 657         if (lmp_le_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_LE_1M_TX;
 659                 supported_phys |= MGMT_PHY_LE_1M_RX;
 660
 661                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 662                         supported_phys |= MGMT_PHY_LE_2M_TX;
 663                         supported_phys |= MGMT_PHY_LE_2M_RX;
 664                 }
 665
 666                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 667                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 668                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 669                 }
 670         }
 671
 672         return supported_phys;
 673 }
 674
 675 static u32 get_selected_phys(struct hci_dev *hdev)
 676 {
 677         u32 selected_phys = 0;
 678
 679         if (lmp_bredr_capable(hdev)) {
 680                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 683                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 684
 685                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 686                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 687
 688                 if (lmp_edr_2m_capable(hdev)) {
 689                         if (!(hdev->pkt_type & HCI_2DH1))
 690                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 691
 692                         if (lmp_edr_3slot_capable(hdev) &&
 693                             !(hdev->pkt_type & HCI_2DH3))
 694                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 695
 696                         if (lmp_edr_5slot_capable(hdev) &&
 697                             !(hdev->pkt_type & HCI_2DH5))
 698                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 699
 700                         if (lmp_edr_3m_capable(hdev)) {
 701                                 if (!(hdev->pkt_type & HCI_3DH1))
 702                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 703
 704                                 if (lmp_edr_3slot_capable(hdev) &&
 705                                     !(hdev->pkt_type & HCI_3DH3))
 706                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 707
 708                                 if (lmp_edr_5slot_capable(hdev) &&
 709                                     !(hdev->pkt_type & HCI_3DH5))
 710                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 711                         }
 712                 }
 713         }
 714
 715         if (lmp_le_capable(hdev)) {
 716                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_TX;
 718
 719                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 720                         selected_phys |= MGMT_PHY_LE_1M_RX;
 721
 722                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_TX;
 724
 725                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 726                         selected_phys |= MGMT_PHY_LE_2M_RX;
 727
 728                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 730
 731                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 732                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 733         }
 734
 735         return selected_phys;
 736 }
 737
 738 static u32 get_configurable_phys(struct hci_dev *hdev)
 739 {
 740         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 741                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 742 }
 743
 744 static u32 get_supported_settings(struct hci_dev *hdev)
 745 {
 746         u32 settings = 0;
 747
 748         settings |= MGMT_SETTING_POWERED;
 749         settings |= MGMT_SETTING_BONDABLE;
 750         settings |= MGMT_SETTING_DEBUG_KEYS;
 751         settings |= MGMT_SETTING_CONNECTABLE;
 752         settings |= MGMT_SETTING_DISCOVERABLE;
 753
 754         if (lmp_bredr_capable(hdev)) {
 755                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 756                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 757                 settings |= MGMT_SETTING_BREDR;
 758                 settings |= MGMT_SETTING_LINK_SECURITY;
 759
 760                 if (lmp_ssp_capable(hdev)) {
 761                         settings |= MGMT_SETTING_SSP;
 762                         if (IS_ENABLED(CONFIG_BT_HS))
 763                                 settings |= MGMT_SETTING_HS;
 764                 }
 765
 766                 if (lmp_sc_capable(hdev))
 767                         settings |= MGMT_SETTING_SECURE_CONN;
 768         }
 769
 770         if (lmp_le_capable(hdev)) {
 771                 settings |= MGMT_SETTING_LE;
 772                 settings |= MGMT_SETTING_ADVERTISING;
 773                 settings |= MGMT_SETTING_SECURE_CONN;
 774                 settings |= MGMT_SETTING_PRIVACY;
 775                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 776         }
 777
 778         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 779             hdev->set_bdaddr)
 780                 settings |= MGMT_SETTING_CONFIGURATION;
 781
 782         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 783
 784         return settings;
 785 }
 786
 787 static u32 get_current_settings(struct hci_dev *hdev)
 788 {
 789         u32 settings = 0;
 790
 791         if (hdev_is_powered(hdev))
 792                 settings |= MGMT_SETTING_POWERED;
 793
 794         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 795                 settings |= MGMT_SETTING_CONNECTABLE;
 796
 797         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 798                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 799
 800         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 801                 settings |= MGMT_SETTING_DISCOVERABLE;
 802
 803         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 804                 settings |= MGMT_SETTING_BONDABLE;
 805
 806         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 807                 settings |= MGMT_SETTING_BREDR;
 808
 809         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 810                 settings |= MGMT_SETTING_LE;
 811
 812         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 813                 settings |= MGMT_SETTING_LINK_SECURITY;
 814
 815         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 816                 settings |= MGMT_SETTING_SSP;
 817
 818         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 819                 settings |= MGMT_SETTING_HS;
 820
 821         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 822                 settings |= MGMT_SETTING_ADVERTISING;
 823
 824         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 825                 settings |= MGMT_SETTING_SECURE_CONN;
 826
 827         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 828                 settings |= MGMT_SETTING_DEBUG_KEYS;
 829
 830         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 831                 settings |= MGMT_SETTING_PRIVACY;
 832
 833         /* The current setting for static address has two purposes. The
 834          * first is to indicate if the static address will be used and
 835          * the second is to indicate if it is actually set.
 836          *
 837          * This means if the static address is not configured, this flag
 838          * will never be set. If the address is configured, then if the
 839          * address is actually used decides if the flag is set or not.
 840          *
 841          * For single mode LE only controllers and dual-mode controllers
 842          * with BR/EDR disabled, the existence of the static address will
 843          * be evaluated.
 844          */
 845         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 846             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 847             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 848                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 849                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 850         }
 851
 852         return settings;
 853 }
 854
 855 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 856 {
 857         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 858 }
 859
 860 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 861                                                   struct hci_dev *hdev,
 862                                                   const void *data)
 863 {
 864         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 865 }
 866
 867 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 868 {
 869         struct mgmt_pending_cmd *cmd;
 870
 871         /* If there's a pending mgmt command the flags will not yet have
 872          * their final values, so check for this first.
 873          */
 874         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 875         if (cmd) {
 876                 struct mgmt_mode *cp = cmd->param;
 877                 if (cp->val == 0x01)
 878                         return LE_AD_GENERAL;
 879                 else if (cp->val == 0x02)
 880                         return LE_AD_LIMITED;
 881         } else {
 882                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 883                         return LE_AD_LIMITED;
 884                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 885                         return LE_AD_GENERAL;
 886         }
 887
 888         return 0;
 889 }
 890
 891 bool mgmt_get_connectable(struct hci_dev *hdev)
 892 {
 893         struct mgmt_pending_cmd *cmd;
 894
 895         /* If there's a pending mgmt command the flag will not yet have
 896          * it's final value, so check for this first.
 897          */
 898         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 899         if (cmd) {
 900                 struct mgmt_mode *cp = cmd->param;
 901
 902                 return cp->val;
 903         }
 904
 905         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 906 }
 907
 908 static void service_cache_off(struct work_struct *work)
 909 {
 910         struct hci_dev *hdev = container_of(work, struct hci_dev,
 911                                             service_cache.work);
 912         struct hci_request req;
 913
 914         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 915                 return;
 916
 917         hci_req_init(&req, hdev);
 918
 919         hci_dev_lock(hdev);
 920
 921         __hci_req_update_eir(&req);
 922         __hci_req_update_class(&req);
 923
 924         hci_dev_unlock(hdev);
 925
 926         hci_req_run(&req, NULL);
 927 }
 928
 929 static void rpa_expired(struct work_struct *work)
 930 {
 931         struct hci_dev *hdev = container_of(work, struct hci_dev,
 932                                             rpa_expired.work);
 933         struct hci_request req;
 934
 935         BT_DBG("");
 936
 937         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 938
 939         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 940                 return;
 941
 942         /* The generation of a new RPA and programming it into the
 943          * controller happens in the hci_req_enable_advertising()
 944          * function.
 945          */
 946         hci_req_init(&req, hdev);
 947         if (ext_adv_capable(hdev))
 948                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 949         else
 950                 __hci_req_enable_advertising(&req);
 951         hci_req_run(&req, NULL);
 952 }
 953
 954 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 955 {
 956         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 957                 return;
 958
 959         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 960         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 961
 962         /* Non-mgmt controlled devices get this bit set
 963          * implicitly so that pairing works for them, however
 964          * for mgmt we require user-space to explicitly enable
 965          * it
 966          */
 967         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 968 }
 969
 970 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 971                                 void *data, u16 data_len)
 972 {
 973         struct mgmt_rp_read_info rp;
 974
 975         BT_DBG("sock %p %s", sk, hdev->name);
 976
 977         hci_dev_lock(hdev);
 978
 979         memset(&rp, 0, sizeof(rp));
 980
 981         bacpy(&rp.bdaddr, &hdev->bdaddr);
 982
 983         rp.version = hdev->hci_ver;
 984         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 985
 986         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 987         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 988
 989         memcpy(rp.dev_class, hdev->dev_class, 3);
 990
 991         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 992         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 993
 994         hci_dev_unlock(hdev);
 995
 996         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 997                                  sizeof(rp));
 998 }
 999
1000 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1001 {
1002         u16 eir_len = 0;
1003         size_t name_len;
1004
1005         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1006                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1007                                           hdev->dev_class, 3);
1008
1009         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1010                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1011                                           hdev->appearance);
1012
1013         name_len = strlen(hdev->dev_name);
1014         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1015                                   hdev->dev_name, name_len);
1016
1017         name_len = strlen(hdev->short_name);
1018         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1019                                   hdev->short_name, name_len);
1020
1021         return eir_len;
1022 }
1023
1024 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1025                                     void *data, u16 data_len)
1026 {
1027         char buf[512];
1028         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1029         u16 eir_len;
1030
1031         BT_DBG("sock %p %s", sk, hdev->name);
1032
1033         memset(&buf, 0, sizeof(buf));
1034
1035         hci_dev_lock(hdev);
1036
1037         bacpy(&rp->bdaddr, &hdev->bdaddr);
1038
1039         rp->version = hdev->hci_ver;
1040         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1041
1042         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1043         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1044
1045
1046         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1047         rp->eir_len = cpu_to_le16(eir_len);
1048
1049         hci_dev_unlock(hdev);
1050
1051         /* If this command is called at least once, then the events
1052          * for class of device and local name changes are disabled
1053          * and only the new extended controller information event
1054          * is used.
1055          */
1056         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1057         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1058         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1059
1060         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1061                                  sizeof(*rp) + eir_len);
1062 }
1063
1064 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1065 {
1066         char buf[512];
1067         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1068         u16 eir_len;
1069
1070         memset(buf, 0, sizeof(buf));
1071
1072         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1073         ev->eir_len = cpu_to_le16(eir_len);
1074
1075         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1076                                   sizeof(*ev) + eir_len,
1077                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1078 }
1079
1080 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1081 {
1082         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1083
1084         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1085                                  sizeof(settings));
1086 }
1087
1088 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1089 {
1090         BT_DBG("%s status 0x%02x", hdev->name, status);
1091
1092         if (hci_conn_count(hdev) == 0) {
1093                 cancel_delayed_work(&hdev->power_off);
1094                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1095         }
1096 }
1097
1098 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1099 {
1100         struct mgmt_ev_advertising_added ev;
1101
1102         ev.instance = instance;
1103
1104         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1105 }
1106
1107 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1108                               u8 instance)
1109 {
1110         struct mgmt_ev_advertising_removed ev;
1111
1112         ev.instance = instance;
1113
1114         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1115 }
1116
1117 static void cancel_adv_timeout(struct hci_dev *hdev)
1118 {
1119         if (hdev->adv_instance_timeout) {
1120                 hdev->adv_instance_timeout = 0;
1121                 cancel_delayed_work(&hdev->adv_instance_expire);
1122         }
1123 }
1124
1125 static int clean_up_hci_state(struct hci_dev *hdev)
1126 {
1127         struct hci_request req;
1128         struct hci_conn *conn;
1129         bool discov_stopped;
1130         int err;
1131
1132         hci_req_init(&req, hdev);
1133
1134         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1135             test_bit(HCI_PSCAN, &hdev->flags)) {
1136                 u8 scan = 0x00;
1137                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1138         }
1139
1140         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1141
1142         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1143                 __hci_req_disable_advertising(&req);
1144
1145         discov_stopped = hci_req_stop_discovery(&req);
1146
1147         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1148                 /* 0x15 == Terminated due to Power Off */
1149                 __hci_abort_conn(&req, conn, 0x15);
1150         }
1151
1152         err = hci_req_run(&req, clean_up_hci_complete);
1153         if (!err && discov_stopped)
1154                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1155
1156         return err;
1157 }
1158
1159 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1160                        u16 len)
1161 {
1162         struct mgmt_mode *cp = data;
1163         struct mgmt_pending_cmd *cmd;
1164         int err;
1165
1166         BT_DBG("request for %s", hdev->name);
1167
1168         if (cp->val != 0x00 && cp->val != 0x01)
1169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1170                                        MGMT_STATUS_INVALID_PARAMS);
1171
1172         hci_dev_lock(hdev);
1173
1174         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1176                                       MGMT_STATUS_BUSY);
1177                 goto failed;
1178         }
1179
1180         if (!!cp->val == hdev_is_powered(hdev)) {
1181                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1182                 goto failed;
1183         }
1184
1185         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1186         if (!cmd) {
1187                 err = -ENOMEM;
1188                 goto failed;
1189         }
1190
1191         if (cp->val) {
1192                 queue_work(hdev->req_workqueue, &hdev->power_on);
1193                 err = 0;
1194         } else {
1195                 /* Disconnect connections, stop scans, etc */
1196                 err = clean_up_hci_state(hdev);
1197                 if (!err)
1198                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1199                                            HCI_POWER_OFF_TIMEOUT);
1200
1201                 /* ENODATA means there were no HCI commands queued */
1202                 if (err == -ENODATA) {
1203                         cancel_delayed_work(&hdev->power_off);
1204                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1205                         err = 0;
1206                 }
1207         }
1208
1209 failed:
1210         hci_dev_unlock(hdev);
1211         return err;
1212 }
1213
1214 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1215 {
1216         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1217
1218         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1219                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1220 }
1221
1222 int mgmt_new_settings(struct hci_dev *hdev)
1223 {
1224         return new_settings(hdev, NULL);
1225 }
1226
1227 struct cmd_lookup {
1228         struct sock *sk;
1229         struct hci_dev *hdev;
1230         u8 mgmt_status;
1231 };
1232
1233 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1234 {
1235         struct cmd_lookup *match = data;
1236
1237         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1238
1239         list_del(&cmd->list);
1240
1241         if (match->sk == NULL) {
1242                 match->sk = cmd->sk;
1243                 sock_hold(match->sk);
1244         }
1245
1246         mgmt_pending_free(cmd);
1247 }
1248
1249 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1250 {
1251         u8 *status = data;
1252
1253         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1254         mgmt_pending_remove(cmd);
1255 }
1256
1257 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1258 {
1259         if (cmd->cmd_complete) {
1260                 u8 *status = data;
1261
1262                 cmd->cmd_complete(cmd, *status);
1263                 mgmt_pending_remove(cmd);
1264
1265                 return;
1266         }
1267
1268         cmd_status_rsp(cmd, data);
1269 }
1270
1271 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1272 {
1273         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1274                                  cmd->param, cmd->param_len);
1275 }
1276
1277 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1278 {
1279         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1280                                  cmd->param, sizeof(struct mgmt_addr_info));
1281 }
1282
1283 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1284 {
1285         if (!lmp_bredr_capable(hdev))
1286                 return MGMT_STATUS_NOT_SUPPORTED;
1287         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1288                 return MGMT_STATUS_REJECTED;
1289         else
1290                 return MGMT_STATUS_SUCCESS;
1291 }
1292
1293 static u8 mgmt_le_support(struct hci_dev *hdev)
1294 {
1295         if (!lmp_le_capable(hdev))
1296                 return MGMT_STATUS_NOT_SUPPORTED;
1297         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1298                 return MGMT_STATUS_REJECTED;
1299         else
1300                 return MGMT_STATUS_SUCCESS;
1301 }
1302
1303 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1304 {
1305         struct mgmt_pending_cmd *cmd;
1306
1307         BT_DBG("status 0x%02x", status);
1308
1309         hci_dev_lock(hdev);
1310
1311         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1312         if (!cmd)
1313                 goto unlock;
1314
1315         if (status) {
1316                 u8 mgmt_err = mgmt_status(status);
1317                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1318                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1319                 goto remove_cmd;
1320         }
1321
1322         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1323             hdev->discov_timeout > 0) {
1324                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1325                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1326         }
1327
1328         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1329         new_settings(hdev, cmd->sk);
1330
1331 remove_cmd:
1332         mgmt_pending_remove(cmd);
1333
1334 unlock:
1335         hci_dev_unlock(hdev);
1336 }
1337
1338 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1339                             u16 len)
1340 {
1341         struct mgmt_cp_set_discoverable *cp = data;
1342         struct mgmt_pending_cmd *cmd;
1343         u16 timeout;
1344         int err;
1345
1346         BT_DBG("request for %s", hdev->name);
1347
1348         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1349             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351                                        MGMT_STATUS_REJECTED);
1352
1353         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1355                                        MGMT_STATUS_INVALID_PARAMS);
1356
1357         timeout = __le16_to_cpu(cp->timeout);
1358
1359         /* Disabling discoverable requires that no timeout is set,
1360          * and enabling limited discoverable requires a timeout.
1361          */
1362         if ((cp->val == 0x00 && timeout > 0) ||
1363             (cp->val == 0x02 && timeout == 0))
1364                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1365                                        MGMT_STATUS_INVALID_PARAMS);
1366
1367         hci_dev_lock(hdev);
1368
1369         if (!hdev_is_powered(hdev) && timeout > 0) {
1370                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1371                                       MGMT_STATUS_NOT_POWERED);
1372                 goto failed;
1373         }
1374
1375         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1376             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1378                                       MGMT_STATUS_BUSY);
1379                 goto failed;
1380         }
1381
1382         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1383                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1384                                       MGMT_STATUS_REJECTED);
1385                 goto failed;
1386         }
1387
1388         if (!hdev_is_powered(hdev)) {
1389                 bool changed = false;
1390
1391                 /* Setting limited discoverable when powered off is
1392                  * not a valid operation since it requires a timeout
1393                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1394                  */
1395                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1396                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1397                         changed = true;
1398                 }
1399
1400                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1401                 if (err < 0)
1402                         goto failed;
1403
1404                 if (changed)
1405                         err = new_settings(hdev, sk);
1406
1407                 goto failed;
1408         }
1409
1410         /* If the current mode is the same, then just update the timeout
1411          * value with the new value. And if only the timeout gets updated,
1412          * then no need for any HCI transactions.
1413          */
1414         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1415             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1416                                                    HCI_LIMITED_DISCOVERABLE)) {
1417                 cancel_delayed_work(&hdev->discov_off);
1418                 hdev->discov_timeout = timeout;
1419
1420                 if (cp->val && hdev->discov_timeout > 0) {
1421                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1422                         queue_delayed_work(hdev->req_workqueue,
1423                                            &hdev->discov_off, to);
1424                 }
1425
1426                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1427                 goto failed;
1428         }
1429
1430         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1431         if (!cmd) {
1432                 err = -ENOMEM;
1433                 goto failed;
1434         }
1435
1436         /* Cancel any potential discoverable timeout that might be
1437          * still active and store new timeout value. The arming of
1438          * the timeout happens in the complete handler.
1439          */
1440         cancel_delayed_work(&hdev->discov_off);
1441         hdev->discov_timeout = timeout;
1442
1443         if (cp->val)
1444                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1445         else
1446                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1447
1448         /* Limited discoverable mode */
1449         if (cp->val == 0x02)
1450                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1451         else
1452                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1453
1454         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1455         err = 0;
1456
1457 failed:
1458         hci_dev_unlock(hdev);
1459         return err;
1460 }
1461
1462 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1463 {
1464         struct mgmt_pending_cmd *cmd;
1465
1466         BT_DBG("status 0x%02x", status);
1467
1468         hci_dev_lock(hdev);
1469
1470         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1471         if (!cmd)
1472                 goto unlock;
1473
1474         if (status) {
1475                 u8 mgmt_err = mgmt_status(status);
1476                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1477                 goto remove_cmd;
1478         }
1479
1480         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1481         new_settings(hdev, cmd->sk);
1482
1483 remove_cmd:
1484         mgmt_pending_remove(cmd);
1485
1486 unlock:
1487         hci_dev_unlock(hdev);
1488 }
1489
1490 static int set_connectable_update_settings(struct hci_dev *hdev,
1491                                            struct sock *sk, u8 val)
1492 {
1493         bool changed = false;
1494         int err;
1495
1496         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1497                 changed = true;
1498
1499         if (val) {
1500                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1501         } else {
1502                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1503                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1504         }
1505
1506         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1507         if (err < 0)
1508                 return err;
1509
1510         if (changed) {
1511                 hci_req_update_scan(hdev);
1512                 hci_update_background_scan(hdev);
1513                 return new_settings(hdev, sk);
1514         }
1515
1516         return 0;
1517 }
1518
1519 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1520                            u16 len)
1521 {
1522         struct mgmt_mode *cp = data;
1523         struct mgmt_pending_cmd *cmd;
1524         int err;
1525
1526         BT_DBG("request for %s", hdev->name);
1527
1528         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1529             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531                                        MGMT_STATUS_REJECTED);
1532
1533         if (cp->val != 0x00 && cp->val != 0x01)
1534                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1535                                        MGMT_STATUS_INVALID_PARAMS);
1536
1537         hci_dev_lock(hdev);
1538
1539         if (!hdev_is_powered(hdev)) {
1540                 err = set_connectable_update_settings(hdev, sk, cp->val);
1541                 goto failed;
1542         }
1543
1544         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1545             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1546                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1547                                       MGMT_STATUS_BUSY);
1548                 goto failed;
1549         }
1550
1551         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1552         if (!cmd) {
1553                 err = -ENOMEM;
1554                 goto failed;
1555         }
1556
1557         if (cp->val) {
1558                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1559         } else {
1560                 if (hdev->discov_timeout > 0)
1561                         cancel_delayed_work(&hdev->discov_off);
1562
1563                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1564                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1565                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1566         }
1567
1568         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1569         err = 0;
1570
1571 failed:
1572         hci_dev_unlock(hdev);
1573         return err;
1574 }
1575
1576 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1577                         u16 len)
1578 {
1579         struct mgmt_mode *cp = data;
1580         bool changed;
1581         int err;
1582
1583         BT_DBG("request for %s", hdev->name);
1584
1585         if (cp->val != 0x00 && cp->val != 0x01)
1586                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1587                                        MGMT_STATUS_INVALID_PARAMS);
1588
1589         hci_dev_lock(hdev);
1590
1591         if (cp->val)
1592                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1593         else
1594                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1595
1596         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1597         if (err < 0)
1598                 goto unlock;
1599
1600         if (changed) {
1601                 /* In limited privacy mode the change of bondable mode
1602                  * may affect the local advertising address.
1603                  */
1604                 if (hdev_is_powered(hdev) &&
1605                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1606                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1607                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1608                         queue_work(hdev->req_workqueue,
1609                                    &hdev->discoverable_update);
1610
1611                 err = new_settings(hdev, sk);
1612         }
1613
1614 unlock:
1615         hci_dev_unlock(hdev);
1616         return err;
1617 }
1618
1619 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1620                              u16 len)
1621 {
1622         struct mgmt_mode *cp = data;
1623         struct mgmt_pending_cmd *cmd;
1624         u8 val, status;
1625         int err;
1626
1627         BT_DBG("request for %s", hdev->name);
1628
1629         status = mgmt_bredr_support(hdev);
1630         if (status)
1631                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632                                        status);
1633
1634         if (cp->val != 0x00 && cp->val != 0x01)
1635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1636                                        MGMT_STATUS_INVALID_PARAMS);
1637
1638         hci_dev_lock(hdev);
1639
1640         if (!hdev_is_powered(hdev)) {
1641                 bool changed = false;
1642
1643                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1644                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1645                         changed = true;
1646                 }
1647
1648                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1649                 if (err < 0)
1650                         goto failed;
1651
1652                 if (changed)
1653                         err = new_settings(hdev, sk);
1654
1655                 goto failed;
1656         }
1657
1658         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1659                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1660                                       MGMT_STATUS_BUSY);
1661                 goto failed;
1662         }
1663
1664         val = !!cp->val;
1665
1666         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1667                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1668                 goto failed;
1669         }
1670
1671         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1672         if (!cmd) {
1673                 err = -ENOMEM;
1674                 goto failed;
1675         }
1676
1677         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1678         if (err < 0) {
1679                 mgmt_pending_remove(cmd);
1680                 goto failed;
1681         }
1682
1683 failed:
1684         hci_dev_unlock(hdev);
1685         return err;
1686 }
1687
1688 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1689 {
1690         struct mgmt_mode *cp = data;
1691         struct mgmt_pending_cmd *cmd;
1692         u8 status;
1693         int err;
1694
1695         BT_DBG("request for %s", hdev->name);
1696
1697         status = mgmt_bredr_support(hdev);
1698         if (status)
1699                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1700
1701         if (!lmp_ssp_capable(hdev))
1702                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703                                        MGMT_STATUS_NOT_SUPPORTED);
1704
1705         if (cp->val != 0x00 && cp->val != 0x01)
1706                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1707                                        MGMT_STATUS_INVALID_PARAMS);
1708
1709         hci_dev_lock(hdev);
1710
1711         if (!hdev_is_powered(hdev)) {
1712                 bool changed;
1713
1714                 if (cp->val) {
1715                         changed = !hci_dev_test_and_set_flag(hdev,
1716                                                              HCI_SSP_ENABLED);
1717                 } else {
1718                         changed = hci_dev_test_and_clear_flag(hdev,
1719                                                               HCI_SSP_ENABLED);
1720                         if (!changed)
1721                                 changed = hci_dev_test_and_clear_flag(hdev,
1722                                                                       HCI_HS_ENABLED);
1723                         else
1724                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1725                 }
1726
1727                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1728                 if (err < 0)
1729                         goto failed;
1730
1731                 if (changed)
1732                         err = new_settings(hdev, sk);
1733
1734                 goto failed;
1735         }
1736
1737         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1738                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1739                                       MGMT_STATUS_BUSY);
1740                 goto failed;
1741         }
1742
1743         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1744                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1745                 goto failed;
1746         }
1747
1748         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1749         if (!cmd) {
1750                 err = -ENOMEM;
1751                 goto failed;
1752         }
1753
1754         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1755                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1756                              sizeof(cp->val), &cp->val);
1757
1758         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1759         if (err < 0) {
1760                 mgmt_pending_remove(cmd);
1761                 goto failed;
1762         }
1763
1764 failed:
1765         hci_dev_unlock(hdev);
1766         return err;
1767 }
1768
1769 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1770 {
1771         struct mgmt_mode *cp = data;
1772         bool changed;
1773         u8 status;
1774         int err;
1775
1776         BT_DBG("request for %s", hdev->name);
1777
1778         if (!IS_ENABLED(CONFIG_BT_HS))
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780                                        MGMT_STATUS_NOT_SUPPORTED);
1781
1782         status = mgmt_bredr_support(hdev);
1783         if (status)
1784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1785
1786         if (!lmp_ssp_capable(hdev))
1787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788                                        MGMT_STATUS_NOT_SUPPORTED);
1789
1790         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1792                                        MGMT_STATUS_REJECTED);
1793
1794         if (cp->val != 0x00 && cp->val != 0x01)
1795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1796                                        MGMT_STATUS_INVALID_PARAMS);
1797
1798         hci_dev_lock(hdev);
1799
1800         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1801                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1802                                       MGMT_STATUS_BUSY);
1803                 goto unlock;
1804         }
1805
1806         if (cp->val) {
1807                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1808         } else {
1809                 if (hdev_is_powered(hdev)) {
1810                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1811                                               MGMT_STATUS_REJECTED);
1812                         goto unlock;
1813                 }
1814
1815                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1816         }
1817
1818         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1819         if (err < 0)
1820                 goto unlock;
1821
1822         if (changed)
1823                 err = new_settings(hdev, sk);
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827         return err;
1828 }
1829
1830 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1831 {
1832         struct cmd_lookup match = { NULL, hdev };
1833
1834         hci_dev_lock(hdev);
1835
1836         if (status) {
1837                 u8 mgmt_err = mgmt_status(status);
1838
1839                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1840                                      &mgmt_err);
1841                 goto unlock;
1842         }
1843
1844         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1845
1846         new_settings(hdev, match.sk);
1847
1848         if (match.sk)
1849                 sock_put(match.sk);
1850
1851         /* Make sure the controller has a good default for
1852          * advertising data. Restrict the update to when LE
1853          * has actually been enabled. During power on, the
1854          * update in powered_update_hci will take care of it.
1855          */
1856         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1857                 struct hci_request req;
1858                 hci_req_init(&req, hdev);
1859                 if (ext_adv_capable(hdev)) {
1860                         int err;
1861
1862                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1863                         if (!err)
1864                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1865                 } else {
1866                         __hci_req_update_adv_data(&req, 0x00);
1867                         __hci_req_update_scan_rsp_data(&req, 0x00);
1868                 }
1869                 hci_req_run(&req, NULL);
1870                 hci_update_background_scan(hdev);
1871         }
1872
1873 unlock:
1874         hci_dev_unlock(hdev);
1875 }
1876
1877 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1878 {
1879         struct mgmt_mode *cp = data;
1880         struct hci_cp_write_le_host_supported hci_cp;
1881         struct mgmt_pending_cmd *cmd;
1882         struct hci_request req;
1883         int err;
1884         u8 val, enabled;
1885
1886         BT_DBG("request for %s", hdev->name);
1887
1888         if (!lmp_le_capable(hdev))
1889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1890                                        MGMT_STATUS_NOT_SUPPORTED);
1891
1892         if (cp->val != 0x00 && cp->val != 0x01)
1893                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1894                                        MGMT_STATUS_INVALID_PARAMS);
1895
1896         /* Bluetooth single mode LE only controllers or dual-mode
1897          * controllers configured as LE only devices, do not allow
1898          * switching LE off. These have either LE enabled explicitly
1899          * or BR/EDR has been previously switched off.
1900          *
1901          * When trying to enable an already enabled LE, then gracefully
1902          * send a positive response. Trying to disable it however will
1903          * result into rejection.
1904          */
1905         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1906                 if (cp->val == 0x01)
1907                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1908
1909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1910                                        MGMT_STATUS_REJECTED);
1911         }
1912
1913         hci_dev_lock(hdev);
1914
1915         val = !!cp->val;
1916         enabled = lmp_host_le_capable(hdev);
1917
1918         if (!val)
1919                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1920
1921         if (!hdev_is_powered(hdev) || val == enabled) {
1922                 bool changed = false;
1923
1924                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1925                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1926                         changed = true;
1927                 }
1928
1929                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1930                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1931                         changed = true;
1932                 }
1933
1934                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1935                 if (err < 0)
1936                         goto unlock;
1937
1938                 if (changed)
1939                         err = new_settings(hdev, sk);
1940
1941                 goto unlock;
1942         }
1943
1944         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1945             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1946                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1947                                       MGMT_STATUS_BUSY);
1948                 goto unlock;
1949         }
1950
1951         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1952         if (!cmd) {
1953                 err = -ENOMEM;
1954                 goto unlock;
1955         }
1956
1957         hci_req_init(&req, hdev);
1958
1959         memset(&hci_cp, 0, sizeof(hci_cp));
1960
1961         if (val) {
1962                 hci_cp.le = val;
1963                 hci_cp.simul = 0x00;
1964         } else {
1965                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1966                         __hci_req_disable_advertising(&req);
1967
1968                 if (ext_adv_capable(hdev))
1969                         __hci_req_clear_ext_adv_sets(&req);
1970         }
1971
1972         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1973                     &hci_cp);
1974
1975         err = hci_req_run(&req, le_enable_complete);
1976         if (err < 0)
1977                 mgmt_pending_remove(cmd);
1978
1979 unlock:
1980         hci_dev_unlock(hdev);
1981         return err;
1982 }
1983
1984 /* This is a helper function to test for pending mgmt commands that can
1985  * cause CoD or EIR HCI commands. We can only allow one such pending
1986  * mgmt command at a time since otherwise we cannot easily track what
1987  * the current values are, will be, and based on that calculate if a new
1988  * HCI command needs to be sent and if yes with what value.
1989  */
1990 static bool pending_eir_or_class(struct hci_dev *hdev)
1991 {
1992         struct mgmt_pending_cmd *cmd;
1993
1994         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1995                 switch (cmd->opcode) {
1996                 case MGMT_OP_ADD_UUID:
1997                 case MGMT_OP_REMOVE_UUID:
1998                 case MGMT_OP_SET_DEV_CLASS:
1999                 case MGMT_OP_SET_POWERED:
2000                         return true;
2001                 }
2002         }
2003
2004         return false;
2005 }
2006
2007 static const u8 bluetooth_base_uuid[] = {
2008                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2009                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2010 };
2011
2012 static u8 get_uuid_size(const u8 *uuid)
2013 {
2014         u32 val;
2015
2016         if (memcmp(uuid, bluetooth_base_uuid, 12))
2017                 return 128;
2018
2019         val = get_unaligned_le32(&uuid[12]);
2020         if (val > 0xffff)
2021                 return 32;
2022
2023         return 16;
2024 }
2025
2026 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2027 {
2028         struct mgmt_pending_cmd *cmd;
2029
2030         hci_dev_lock(hdev);
2031
2032         cmd = pending_find(mgmt_op, hdev);
2033         if (!cmd)
2034                 goto unlock;
2035
2036         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2037                           mgmt_status(status), hdev->dev_class, 3);
2038
2039         mgmt_pending_remove(cmd);
2040
2041 unlock:
2042         hci_dev_unlock(hdev);
2043 }
2044
2045 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2046 {
2047         BT_DBG("status 0x%02x", status);
2048
2049         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2050 }
2051
2052 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2053 {
2054         struct mgmt_cp_add_uuid *cp = data;
2055         struct mgmt_pending_cmd *cmd;
2056         struct hci_request req;
2057         struct bt_uuid *uuid;
2058         int err;
2059
2060         BT_DBG("request for %s", hdev->name);
2061
2062         hci_dev_lock(hdev);
2063
2064         if (pending_eir_or_class(hdev)) {
2065                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2066                                       MGMT_STATUS_BUSY);
2067                 goto failed;
2068         }
2069
2070         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2071         if (!uuid) {
2072                 err = -ENOMEM;
2073                 goto failed;
2074         }
2075
2076         memcpy(uuid->uuid, cp->uuid, 16);
2077         uuid->svc_hint = cp->svc_hint;
2078         uuid->size = get_uuid_size(cp->uuid);
2079
2080         list_add_tail(&uuid->list, &hdev->uuids);
2081
2082         hci_req_init(&req, hdev);
2083
2084         __hci_req_update_class(&req);
2085         __hci_req_update_eir(&req);
2086
2087         err = hci_req_run(&req, add_uuid_complete);
2088         if (err < 0) {
2089                 if (err != -ENODATA)
2090                         goto failed;
2091
2092                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2093                                         hdev->dev_class, 3);
2094                 goto failed;
2095         }
2096
2097         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2098         if (!cmd) {
2099                 err = -ENOMEM;
2100                 goto failed;
2101         }
2102
2103         err = 0;
2104
2105 failed:
2106         hci_dev_unlock(hdev);
2107         return err;
2108 }
2109
2110 static bool enable_service_cache(struct hci_dev *hdev)
2111 {
2112         if (!hdev_is_powered(hdev))
2113                 return false;
2114
2115         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2116                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2117                                    CACHE_TIMEOUT);
2118                 return true;
2119         }
2120
2121         return false;
2122 }
2123
2124 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2125 {
2126         BT_DBG("status 0x%02x", status);
2127
2128         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2129 }
2130
2131 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2132                        u16 len)
2133 {
2134         struct mgmt_cp_remove_uuid *cp = data;
2135         struct mgmt_pending_cmd *cmd;
2136         struct bt_uuid *match, *tmp;
2137         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2138         struct hci_request req;
2139         int err, found;
2140
2141         BT_DBG("request for %s", hdev->name);
2142
2143         hci_dev_lock(hdev);
2144
2145         if (pending_eir_or_class(hdev)) {
2146                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2147                                       MGMT_STATUS_BUSY);
2148                 goto unlock;
2149         }
2150
2151         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2152                 hci_uuids_clear(hdev);
2153
2154                 if (enable_service_cache(hdev)) {
2155                         err = mgmt_cmd_complete(sk, hdev->id,
2156                                                 MGMT_OP_REMOVE_UUID,
2157                                                 0, hdev->dev_class, 3);
2158                         goto unlock;
2159                 }
2160
2161                 goto update_class;
2162         }
2163
2164         found = 0;
2165
2166         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2167                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2168                         continue;
2169
2170                 list_del(&match->list);
2171                 kfree(match);
2172                 found++;
2173         }
2174
2175         if (found == 0) {
2176                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2177                                       MGMT_STATUS_INVALID_PARAMS);
2178                 goto unlock;
2179         }
2180
2181 update_class:
2182         hci_req_init(&req, hdev);
2183
2184         __hci_req_update_class(&req);
2185         __hci_req_update_eir(&req);
2186
2187         err = hci_req_run(&req, remove_uuid_complete);
2188         if (err < 0) {
2189                 if (err != -ENODATA)
2190                         goto unlock;
2191
2192                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2193                                         hdev->dev_class, 3);
2194                 goto unlock;
2195         }
2196
2197         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2198         if (!cmd) {
2199                 err = -ENOMEM;
2200                 goto unlock;
2201         }
2202
2203         err = 0;
2204
2205 unlock:
2206         hci_dev_unlock(hdev);
2207         return err;
2208 }
2209
2210 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2211 {
2212         BT_DBG("status 0x%02x", status);
2213
2214         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2215 }
2216
2217 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2218                          u16 len)
2219 {
2220         struct mgmt_cp_set_dev_class *cp = data;
2221         struct mgmt_pending_cmd *cmd;
2222         struct hci_request req;
2223         int err;
2224
2225         BT_DBG("request for %s", hdev->name);
2226
2227         if (!lmp_bredr_capable(hdev))
2228                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2229                                        MGMT_STATUS_NOT_SUPPORTED);
2230
2231         hci_dev_lock(hdev);
2232
2233         if (pending_eir_or_class(hdev)) {
2234                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2235                                       MGMT_STATUS_BUSY);
2236                 goto unlock;
2237         }
2238
2239         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2240                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2241                                       MGMT_STATUS_INVALID_PARAMS);
2242                 goto unlock;
2243         }
2244
2245         hdev->major_class = cp->major;
2246         hdev->minor_class = cp->minor;
2247
2248         if (!hdev_is_powered(hdev)) {
2249                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2250                                         hdev->dev_class, 3);
2251                 goto unlock;
2252         }
2253
2254         hci_req_init(&req, hdev);
2255
2256         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2257                 hci_dev_unlock(hdev);
2258                 cancel_delayed_work_sync(&hdev->service_cache);
2259                 hci_dev_lock(hdev);
2260                 __hci_req_update_eir(&req);
2261         }
2262
2263         __hci_req_update_class(&req);
2264
2265         err = hci_req_run(&req, set_class_complete);
2266         if (err < 0) {
2267                 if (err != -ENODATA)
2268                         goto unlock;
2269
2270                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2271                                         hdev->dev_class, 3);
2272                 goto unlock;
2273         }
2274
2275         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2276         if (!cmd) {
2277                 err = -ENOMEM;
2278                 goto unlock;
2279         }
2280
2281         err = 0;
2282
2283 unlock:
2284         hci_dev_unlock(hdev);
2285         return err;
2286 }
2287
2288 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2289                           u16 len)
2290 {
2291         struct mgmt_cp_load_link_keys *cp = data;
2292         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2293                                    sizeof(struct mgmt_link_key_info));
2294         u16 key_count, expected_len;
2295         bool changed;
2296         int i;
2297
2298         BT_DBG("request for %s", hdev->name);
2299
2300         if (!lmp_bredr_capable(hdev))
2301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2302                                        MGMT_STATUS_NOT_SUPPORTED);
2303
2304         key_count = __le16_to_cpu(cp->key_count);
2305         if (key_count > max_key_count) {
2306                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2307                            key_count);
2308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309                                        MGMT_STATUS_INVALID_PARAMS);
2310         }
2311
2312         expected_len = sizeof(*cp) + key_count *
2313                                         sizeof(struct mgmt_link_key_info);
2314         if (expected_len != len) {
2315                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2316                            expected_len, len);
2317                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2318                                        MGMT_STATUS_INVALID_PARAMS);
2319         }
2320
2321         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2322                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2323                                        MGMT_STATUS_INVALID_PARAMS);
2324
2325         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2326                key_count);
2327
2328         for (i = 0; i < key_count; i++) {
2329                 struct mgmt_link_key_info *key = &cp->keys[i];
2330
2331                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2332                         return mgmt_cmd_status(sk, hdev->id,
2333                                                MGMT_OP_LOAD_LINK_KEYS,
2334                                                MGMT_STATUS_INVALID_PARAMS);
2335         }
2336
2337         hci_dev_lock(hdev);
2338
2339         hci_link_keys_clear(hdev);
2340
2341         if (cp->debug_keys)
2342                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2343         else
2344                 changed = hci_dev_test_and_clear_flag(hdev,
2345                                                       HCI_KEEP_DEBUG_KEYS);
2346
2347         if (changed)
2348                 new_settings(hdev, NULL);
2349
2350         for (i = 0; i < key_count; i++) {
2351                 struct mgmt_link_key_info *key = &cp->keys[i];
2352
2353                 /* Always ignore debug keys and require a new pairing if
2354                  * the user wants to use them.
2355                  */
2356                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2357                         continue;
2358
2359                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2360                                  key->type, key->pin_len, NULL);
2361         }
2362
2363         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2364
2365         hci_dev_unlock(hdev);
2366
2367         return 0;
2368 }
2369
2370 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2371                            u8 addr_type, struct sock *skip_sk)
2372 {
2373         struct mgmt_ev_device_unpaired ev;
2374
2375         bacpy(&ev.addr.bdaddr, bdaddr);
2376         ev.addr.type = addr_type;
2377
2378         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2379                           skip_sk);
2380 }
2381
2382 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2383                          u16 len)
2384 {
2385         struct mgmt_cp_unpair_device *cp = data;
2386         struct mgmt_rp_unpair_device rp;
2387         struct hci_conn_params *params;
2388         struct mgmt_pending_cmd *cmd;
2389         struct hci_conn *conn;
2390         u8 addr_type;
2391         int err;
2392
2393         memset(&rp, 0, sizeof(rp));
2394         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2395         rp.addr.type = cp->addr.type;
2396
2397         if (!bdaddr_type_is_valid(cp->addr.type))
2398                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2399                                          MGMT_STATUS_INVALID_PARAMS,
2400                                          &rp, sizeof(rp));
2401
2402         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2403                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2404                                          MGMT_STATUS_INVALID_PARAMS,
2405                                          &rp, sizeof(rp));
2406
2407         hci_dev_lock(hdev);
2408
2409         if (!hdev_is_powered(hdev)) {
2410                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2411                                         MGMT_STATUS_NOT_POWERED, &rp,
2412                                         sizeof(rp));
2413                 goto unlock;
2414         }
2415
2416         if (cp->addr.type == BDADDR_BREDR) {
2417                 /* If disconnection is requested, then look up the
2418                  * connection. If the remote device is connected, it
2419                  * will be later used to terminate the link.
2420                  *
2421                  * Setting it to NULL explicitly will cause no
2422                  * termination of the link.
2423                  */
2424                 if (cp->disconnect)
2425                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2426                                                        &cp->addr.bdaddr);
2427                 else
2428                         conn = NULL;
2429
2430                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2431                 if (err < 0) {
2432                         err = mgmt_cmd_complete(sk, hdev->id,
2433                                                 MGMT_OP_UNPAIR_DEVICE,
2434                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2435                                                 sizeof(rp));
2436                         goto unlock;
2437                 }
2438
2439                 goto done;
2440         }
2441
2442         /* LE address type */
2443         addr_type = le_addr_type(cp->addr.type);
2444
2445         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2446         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2447         if (err < 0) {
2448                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2449                                         MGMT_STATUS_NOT_PAIRED, &rp,
2450                                         sizeof(rp));
2451                 goto unlock;
2452         }
2453
2454         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2455         if (!conn) {
2456                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2457                 goto done;
2458         }
2459
2460
2461         /* Defer clearing up the connection parameters until closing to
2462          * give a chance of keeping them if a repairing happens.
2463          */
2464         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2465
2466         /* Disable auto-connection parameters if present */
2467         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2468         if (params) {
2469                 if (params->explicit_connect)
2470                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2471                 else
2472                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2473         }
2474
2475         /* If disconnection is not requested, then clear the connection
2476          * variable so that the link is not terminated.
2477          */
2478         if (!cp->disconnect)
2479                 conn = NULL;
2480
2481 done:
2482         /* If the connection variable is set, then termination of the
2483          * link is requested.
2484          */
2485         if (!conn) {
2486                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2487                                         &rp, sizeof(rp));
2488                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2489                 goto unlock;
2490         }
2491
2492         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2493                                sizeof(*cp));
2494         if (!cmd) {
2495                 err = -ENOMEM;
2496                 goto unlock;
2497         }
2498
2499         cmd->cmd_complete = addr_cmd_complete;
2500
2501         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2502         if (err < 0)
2503                 mgmt_pending_remove(cmd);
2504
2505 unlock:
2506         hci_dev_unlock(hdev);
2507         return err;
2508 }
2509
2510 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2511                       u16 len)
2512 {
2513         struct mgmt_cp_disconnect *cp = data;
2514         struct mgmt_rp_disconnect rp;
2515         struct mgmt_pending_cmd *cmd;
2516         struct hci_conn *conn;
2517         int err;
2518
2519         BT_DBG("");
2520
2521         memset(&rp, 0, sizeof(rp));
2522         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2523         rp.addr.type = cp->addr.type;
2524
2525         if (!bdaddr_type_is_valid(cp->addr.type))
2526                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2527                                          MGMT_STATUS_INVALID_PARAMS,
2528                                          &rp, sizeof(rp));
2529
2530         hci_dev_lock(hdev);
2531
2532         if (!test_bit(HCI_UP, &hdev->flags)) {
2533                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2534                                         MGMT_STATUS_NOT_POWERED, &rp,
2535                                         sizeof(rp));
2536                 goto failed;
2537         }
2538
2539         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2540                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2541                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2542                 goto failed;
2543         }
2544
2545         if (cp->addr.type == BDADDR_BREDR)
2546                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2547                                                &cp->addr.bdaddr);
2548         else
2549                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2550                                                le_addr_type(cp->addr.type));
2551
2552         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2553                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2554                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2555                                         sizeof(rp));
2556                 goto failed;
2557         }
2558
2559         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2560         if (!cmd) {
2561                 err = -ENOMEM;
2562                 goto failed;
2563         }
2564
2565         cmd->cmd_complete = generic_cmd_complete;
2566
2567         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2568         if (err < 0)
2569                 mgmt_pending_remove(cmd);
2570
2571 failed:
2572         hci_dev_unlock(hdev);
2573         return err;
2574 }
2575
2576 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2577 {
2578         switch (link_type) {
2579         case LE_LINK:
2580                 switch (addr_type) {
2581                 case ADDR_LE_DEV_PUBLIC:
2582                         return BDADDR_LE_PUBLIC;
2583
2584                 default:
2585                         /* Fallback to LE Random address type */
2586                         return BDADDR_LE_RANDOM;
2587                 }
2588
2589         default:
2590                 /* Fallback to BR/EDR type */
2591                 return BDADDR_BREDR;
2592         }
2593 }
2594
2595 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2596                            u16 data_len)
2597 {
2598         struct mgmt_rp_get_connections *rp;
2599         struct hci_conn *c;
2600         size_t rp_len;
2601         int err;
2602         u16 i;
2603
2604         BT_DBG("");
2605
2606         hci_dev_lock(hdev);
2607
2608         if (!hdev_is_powered(hdev)) {
2609                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2610                                       MGMT_STATUS_NOT_POWERED);
2611                 goto unlock;
2612         }
2613
2614         i = 0;
2615         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2616                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2617                         i++;
2618         }
2619
2620         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2621         rp = kmalloc(rp_len, GFP_KERNEL);
2622         if (!rp) {
2623                 err = -ENOMEM;
2624                 goto unlock;
2625         }
2626
2627         i = 0;
2628         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2629                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2630                         continue;
2631                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2632                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2633                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2634                         continue;
2635                 i++;
2636         }
2637
2638         rp->conn_count = cpu_to_le16(i);
2639
2640         /* Recalculate length in case of filtered SCO connections, etc */
2641         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2642
2643         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2644                                 rp_len);
2645
2646         kfree(rp);
2647
2648 unlock:
2649         hci_dev_unlock(hdev);
2650         return err;
2651 }
2652
2653 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2654                                    struct mgmt_cp_pin_code_neg_reply *cp)
2655 {
2656         struct mgmt_pending_cmd *cmd;
2657         int err;
2658
2659         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2660                                sizeof(*cp));
2661         if (!cmd)
2662                 return -ENOMEM;
2663
2664         cmd->cmd_complete = addr_cmd_complete;
2665
2666         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2667                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2668         if (err < 0)
2669                 mgmt_pending_remove(cmd);
2670
2671         return err;
2672 }
2673
2674 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2675                           u16 len)
2676 {
2677         struct hci_conn *conn;
2678         struct mgmt_cp_pin_code_reply *cp = data;
2679         struct hci_cp_pin_code_reply reply;
2680         struct mgmt_pending_cmd *cmd;
2681         int err;
2682
2683         BT_DBG("");
2684
2685         hci_dev_lock(hdev);
2686
2687         if (!hdev_is_powered(hdev)) {
2688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2689                                       MGMT_STATUS_NOT_POWERED);
2690                 goto failed;
2691         }
2692
2693         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2694         if (!conn) {
2695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2696                                       MGMT_STATUS_NOT_CONNECTED);
2697                 goto failed;
2698         }
2699
2700         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2701                 struct mgmt_cp_pin_code_neg_reply ncp;
2702
2703                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2704
2705                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2706
2707                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2708                 if (err >= 0)
2709                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2710                                               MGMT_STATUS_INVALID_PARAMS);
2711
2712                 goto failed;
2713         }
2714
2715         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2716         if (!cmd) {
2717                 err = -ENOMEM;
2718                 goto failed;
2719         }
2720
2721         cmd->cmd_complete = addr_cmd_complete;
2722
2723         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2724         reply.pin_len = cp->pin_len;
2725         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2726
2727         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2728         if (err < 0)
2729                 mgmt_pending_remove(cmd);
2730
2731 failed:
2732         hci_dev_unlock(hdev);
2733         return err;
2734 }
2735
2736 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2737                              u16 len)
2738 {
2739         struct mgmt_cp_set_io_capability *cp = data;
2740
2741         BT_DBG("");
2742
2743         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2745                                        MGMT_STATUS_INVALID_PARAMS);
2746
2747         hci_dev_lock(hdev);
2748
2749         hdev->io_capability = cp->io_capability;
2750
2751         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2752                hdev->io_capability);
2753
2754         hci_dev_unlock(hdev);
2755
2756         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2757                                  NULL, 0);
2758 }
2759
2760 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2761 {
2762         struct hci_dev *hdev = conn->hdev;
2763         struct mgmt_pending_cmd *cmd;
2764
2765         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2766                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2767                         continue;
2768
2769                 if (cmd->user_data != conn)
2770                         continue;
2771
2772                 return cmd;
2773         }
2774
2775         return NULL;
2776 }
2777
2778 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2779 {
2780         struct mgmt_rp_pair_device rp;
2781         struct hci_conn *conn = cmd->user_data;
2782         int err;
2783
2784         bacpy(&rp.addr.bdaddr, &conn->dst);
2785         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2786
2787         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2788                                 status, &rp, sizeof(rp));
2789
2790         /* So we don't get further callbacks for this connection */
2791         conn->connect_cfm_cb = NULL;
2792         conn->security_cfm_cb = NULL;
2793         conn->disconn_cfm_cb = NULL;
2794
2795         hci_conn_drop(conn);
2796
2797         /* The device is paired so there is no need to remove
2798          * its connection parameters anymore.
2799          */
2800         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2801
2802         hci_conn_put(conn);
2803
2804         return err;
2805 }
2806
2807 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2808 {
2809         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2810         struct mgmt_pending_cmd *cmd;
2811
2812         cmd = find_pairing(conn);
2813         if (cmd) {
2814                 cmd->cmd_complete(cmd, status);
2815                 mgmt_pending_remove(cmd);
2816         }
2817 }
2818
2819 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2820 {
2821         struct mgmt_pending_cmd *cmd;
2822
2823         BT_DBG("status %u", status);
2824
2825         cmd = find_pairing(conn);
2826         if (!cmd) {
2827                 BT_DBG("Unable to find a pending command");
2828                 return;
2829         }
2830
2831         cmd->cmd_complete(cmd, mgmt_status(status));
2832         mgmt_pending_remove(cmd);
2833 }
2834
2835 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2836 {
2837         struct mgmt_pending_cmd *cmd;
2838
2839         BT_DBG("status %u", status);
2840
2841         if (!status)
2842                 return;
2843
2844         cmd = find_pairing(conn);
2845         if (!cmd) {
2846                 BT_DBG("Unable to find a pending command");
2847                 return;
2848         }
2849
2850         cmd->cmd_complete(cmd, mgmt_status(status));
2851         mgmt_pending_remove(cmd);
2852 }
2853
2854 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2855                        u16 len)
2856 {
2857         struct mgmt_cp_pair_device *cp = data;
2858         struct mgmt_rp_pair_device rp;
2859         struct mgmt_pending_cmd *cmd;
2860         u8 sec_level, auth_type;
2861         struct hci_conn *conn;
2862         int err;
2863
2864         BT_DBG("");
2865
2866         memset(&rp, 0, sizeof(rp));
2867         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2868         rp.addr.type = cp->addr.type;
2869
2870         if (!bdaddr_type_is_valid(cp->addr.type))
2871                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2872                                          MGMT_STATUS_INVALID_PARAMS,
2873                                          &rp, sizeof(rp));
2874
2875         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2876                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2877                                          MGMT_STATUS_INVALID_PARAMS,
2878                                          &rp, sizeof(rp));
2879
2880         hci_dev_lock(hdev);
2881
2882         if (!hdev_is_powered(hdev)) {
2883                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2884                                         MGMT_STATUS_NOT_POWERED, &rp,
2885                                         sizeof(rp));
2886                 goto unlock;
2887         }
2888
2889         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2890                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2891                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2892                                         sizeof(rp));
2893                 goto unlock;
2894         }
2895
2896         sec_level = BT_SECURITY_MEDIUM;
2897         auth_type = HCI_AT_DEDICATED_BONDING;
2898
2899         if (cp->addr.type == BDADDR_BREDR) {
2900                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2901                                        auth_type);
2902         } else {
2903                 u8 addr_type = le_addr_type(cp->addr.type);
2904                 struct hci_conn_params *p;
2905
2906                 /* When pairing a new device, it is expected to remember
2907                  * this device for future connections. Adding the connection
2908                  * parameter information ahead of time allows tracking
2909                  * of the slave preferred values and will speed up any
2910                  * further connection establishment.
2911                  *
2912                  * If connection parameters already exist, then they
2913                  * will be kept and this function does nothing.
2914                  */
2915                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2916
2917                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2918                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2919
2920                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2921                                            addr_type, sec_level,
2922                                            HCI_LE_CONN_TIMEOUT);
2923         }
2924
2925         if (IS_ERR(conn)) {
2926                 int status;
2927
2928                 if (PTR_ERR(conn) == -EBUSY)
2929                         status = MGMT_STATUS_BUSY;
2930                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2931                         status = MGMT_STATUS_NOT_SUPPORTED;
2932                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2933                         status = MGMT_STATUS_REJECTED;
2934                 else
2935                         status = MGMT_STATUS_CONNECT_FAILED;
2936
2937                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2938                                         status, &rp, sizeof(rp));
2939                 goto unlock;
2940         }
2941
2942         if (conn->connect_cfm_cb) {
2943                 hci_conn_drop(conn);
2944                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2945                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2946                 goto unlock;
2947         }
2948
2949         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2950         if (!cmd) {
2951                 err = -ENOMEM;
2952                 hci_conn_drop(conn);
2953                 goto unlock;
2954         }
2955
2956         cmd->cmd_complete = pairing_complete;
2957
2958         /* For LE, just connecting isn't a proof that the pairing finished */
2959         if (cp->addr.type == BDADDR_BREDR) {
2960                 conn->connect_cfm_cb = pairing_complete_cb;
2961                 conn->security_cfm_cb = pairing_complete_cb;
2962                 conn->disconn_cfm_cb = pairing_complete_cb;
2963         } else {
2964                 conn->connect_cfm_cb = le_pairing_complete_cb;
2965                 conn->security_cfm_cb = le_pairing_complete_cb;
2966                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2967         }
2968
2969         conn->io_capability = cp->io_cap;
2970         cmd->user_data = hci_conn_get(conn);
2971
2972         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2973             hci_conn_security(conn, sec_level, auth_type, true)) {
2974                 cmd->cmd_complete(cmd, 0);
2975                 mgmt_pending_remove(cmd);
2976         }
2977
2978         err = 0;
2979
2980 unlock:
2981         hci_dev_unlock(hdev);
2982         return err;
2983 }
2984
2985 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2986                               u16 len)
2987 {
2988         struct mgmt_addr_info *addr = data;
2989         struct mgmt_pending_cmd *cmd;
2990         struct hci_conn *conn;
2991         int err;
2992
2993         BT_DBG("");
2994
2995         hci_dev_lock(hdev);
2996
2997         if (!hdev_is_powered(hdev)) {
2998                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2999                                       MGMT_STATUS_NOT_POWERED);
3000                 goto unlock;
3001         }
3002
3003         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3004         if (!cmd) {
3005                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3006                                       MGMT_STATUS_INVALID_PARAMS);
3007                 goto unlock;
3008         }
3009
3010         conn = cmd->user_data;
3011
3012         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3014                                       MGMT_STATUS_INVALID_PARAMS);
3015                 goto unlock;
3016         }
3017
3018         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3019         mgmt_pending_remove(cmd);
3020
3021         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3022                                 addr, sizeof(*addr));
3023 unlock:
3024         hci_dev_unlock(hdev);
3025         return err;
3026 }
3027
3028 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3029                              struct mgmt_addr_info *addr, u16 mgmt_op,
3030                              u16 hci_op, __le32 passkey)
3031 {
3032         struct mgmt_pending_cmd *cmd;
3033         struct hci_conn *conn;
3034         int err;
3035
3036         hci_dev_lock(hdev);
3037
3038         if (!hdev_is_powered(hdev)) {
3039                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3040                                         MGMT_STATUS_NOT_POWERED, addr,
3041                                         sizeof(*addr));
3042                 goto done;
3043         }
3044
3045         if (addr->type == BDADDR_BREDR)
3046                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3047         else
3048                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3049                                                le_addr_type(addr->type));
3050
3051         if (!conn) {
3052                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3053                                         MGMT_STATUS_NOT_CONNECTED, addr,
3054                                         sizeof(*addr));
3055                 goto done;
3056         }
3057
3058         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3059                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3060                 if (!err)
3061                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3062                                                 MGMT_STATUS_SUCCESS, addr,
3063                                                 sizeof(*addr));
3064                 else
3065                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3066                                                 MGMT_STATUS_FAILED, addr,
3067                                                 sizeof(*addr));
3068
3069                 goto done;
3070         }
3071
3072         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3073         if (!cmd) {
3074                 err = -ENOMEM;
3075                 goto done;
3076         }
3077
3078         cmd->cmd_complete = addr_cmd_complete;
3079
3080         /* Continue with pairing via HCI */
3081         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3082                 struct hci_cp_user_passkey_reply cp;
3083
3084                 bacpy(&cp.bdaddr, &addr->bdaddr);
3085                 cp.passkey = passkey;
3086                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3087         } else
3088                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3089                                    &addr->bdaddr);
3090
3091         if (err < 0)
3092                 mgmt_pending_remove(cmd);
3093
3094 done:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3100                               void *data, u16 len)
3101 {
3102         struct mgmt_cp_pin_code_neg_reply *cp = data;
3103
3104         BT_DBG("");
3105
3106         return user_pairing_resp(sk, hdev, &cp->addr,
3107                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3108                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3109 }
3110
3111 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3112                               u16 len)
3113 {
3114         struct mgmt_cp_user_confirm_reply *cp = data;
3115
3116         BT_DBG("");
3117
3118         if (len != sizeof(*cp))
3119                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3120                                        MGMT_STATUS_INVALID_PARAMS);
3121
3122         return user_pairing_resp(sk, hdev, &cp->addr,
3123                                  MGMT_OP_USER_CONFIRM_REPLY,
3124                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3125 }
3126
3127 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3128                                   void *data, u16 len)
3129 {
3130         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3131
3132         BT_DBG("");
3133
3134         return user_pairing_resp(sk, hdev, &cp->addr,
3135                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3136                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3137 }
3138
3139 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3140                               u16 len)
3141 {
3142         struct mgmt_cp_user_passkey_reply *cp = data;
3143
3144         BT_DBG("");
3145
3146         return user_pairing_resp(sk, hdev, &cp->addr,
3147                                  MGMT_OP_USER_PASSKEY_REPLY,
3148                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3149 }
3150
3151 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3152                                   void *data, u16 len)
3153 {
3154         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3155
3156         BT_DBG("");
3157
3158         return user_pairing_resp(sk, hdev, &cp->addr,
3159                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3160                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3161 }
3162
3163 static void adv_expire(struct hci_dev *hdev, u32 flags)
3164 {
3165         struct adv_info *adv_instance;
3166         struct hci_request req;
3167         int err;
3168
3169         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3170         if (!adv_instance)
3171                 return;
3172
3173         /* stop if current instance doesn't need to be changed */
3174         if (!(adv_instance->flags & flags))
3175                 return;
3176
3177         cancel_adv_timeout(hdev);
3178
3179         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3180         if (!adv_instance)
3181                 return;
3182
3183         hci_req_init(&req, hdev);
3184         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3185                                               true);
3186         if (err)
3187                 return;
3188
3189         hci_req_run(&req, NULL);
3190 }
3191
3192 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3193 {
3194         struct mgmt_cp_set_local_name *cp;
3195         struct mgmt_pending_cmd *cmd;
3196
3197         BT_DBG("status 0x%02x", status);
3198
3199         hci_dev_lock(hdev);
3200
3201         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3202         if (!cmd)
3203                 goto unlock;
3204
3205         cp = cmd->param;
3206
3207         if (status) {
3208                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3209                                 mgmt_status(status));
3210         } else {
3211                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3212                                   cp, sizeof(*cp));
3213
3214                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3215                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3216         }
3217
3218         mgmt_pending_remove(cmd);
3219
3220 unlock:
3221         hci_dev_unlock(hdev);
3222 }
3223
3224 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3225                           u16 len)
3226 {
3227         struct mgmt_cp_set_local_name *cp = data;
3228         struct mgmt_pending_cmd *cmd;
3229         struct hci_request req;
3230         int err;
3231
3232         BT_DBG("");
3233
3234         hci_dev_lock(hdev);
3235
3236         /* If the old values are the same as the new ones just return a
3237          * direct command complete event.
3238          */
3239         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3240             !memcmp(hdev->short_name, cp->short_name,
3241                     sizeof(hdev->short_name))) {
3242                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3243                                         data, len);
3244                 goto failed;
3245         }
3246
3247         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3248
3249         if (!hdev_is_powered(hdev)) {
3250                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3251
3252                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3253                                         data, len);
3254                 if (err < 0)
3255                         goto failed;
3256
3257                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3258                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3259                 ext_info_changed(hdev, sk);
3260
3261                 goto failed;
3262         }
3263
3264         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3265         if (!cmd) {
3266                 err = -ENOMEM;
3267                 goto failed;
3268         }
3269
3270         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3271
3272         hci_req_init(&req, hdev);
3273
3274         if (lmp_bredr_capable(hdev)) {
3275                 __hci_req_update_name(&req);
3276                 __hci_req_update_eir(&req);
3277         }
3278
3279         /* The name is stored in the scan response data and so
3280          * no need to udpate the advertising data here.
3281          */
3282         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3283                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3284
3285         err = hci_req_run(&req, set_name_complete);
3286         if (err < 0)
3287                 mgmt_pending_remove(cmd);
3288
3289 failed:
3290         hci_dev_unlock(hdev);
3291         return err;
3292 }
3293
3294 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3295                           u16 len)
3296 {
3297         struct mgmt_cp_set_appearance *cp = data;
3298         u16 apperance;
3299         int err;
3300
3301         BT_DBG("");
3302
3303         if (!lmp_le_capable(hdev))
3304                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3305                                        MGMT_STATUS_NOT_SUPPORTED);
3306
3307         apperance = le16_to_cpu(cp->appearance);
3308
3309         hci_dev_lock(hdev);
3310
3311         if (hdev->appearance != apperance) {
3312                 hdev->appearance = apperance;
3313
3314                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3315                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3316
3317                 ext_info_changed(hdev, sk);
3318         }
3319
3320         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3321                                 0);
3322
3323         hci_dev_unlock(hdev);
3324
3325         return err;
3326 }
3327
3328 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3329                                  void *data, u16 len)
3330 {
3331         struct mgmt_rp_get_phy_confguration rp;
3332
3333         BT_DBG("sock %p %s", sk, hdev->name);
3334
3335         hci_dev_lock(hdev);
3336
3337         memset(&rp, 0, sizeof(rp));
3338
3339         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3340         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3341         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3342
3343         hci_dev_unlock(hdev);
3344
3345         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3346                                  &rp, sizeof(rp));
3347 }
3348
3349 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3350 {
3351         struct mgmt_ev_phy_configuration_changed ev;
3352
3353         memset(&ev, 0, sizeof(ev));
3354
3355         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3356
3357         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3358                           sizeof(ev), skip);
3359 }
3360
3361 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3362                                      u16 opcode, struct sk_buff *skb)
3363 {
3364         struct mgmt_pending_cmd *cmd;
3365
3366         BT_DBG("status 0x%02x", status);
3367
3368         hci_dev_lock(hdev);
3369
3370         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3371         if (!cmd)
3372                 goto unlock;
3373
3374         if (status) {
3375                 mgmt_cmd_status(cmd->sk, hdev->id,
3376                                 MGMT_OP_SET_PHY_CONFIGURATION,
3377                                 mgmt_status(status));
3378         } else {
3379                 mgmt_cmd_complete(cmd->sk, hdev->id,
3380                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3381                                   NULL, 0);
3382
3383                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3384         }
3385
3386         mgmt_pending_remove(cmd);
3387
3388 unlock:
3389         hci_dev_unlock(hdev);
3390 }
3391
3392 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3393                                  void *data, u16 len)
3394 {
3395         struct mgmt_cp_set_phy_confguration *cp = data;
3396         struct hci_cp_le_set_default_phy cp_phy;
3397         struct mgmt_pending_cmd *cmd;
3398         struct hci_request req;
3399         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3400         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3401         bool changed = false;
3402         int err;
3403
3404         BT_DBG("sock %p %s", sk, hdev->name);
3405
3406         configurable_phys = get_configurable_phys(hdev);
3407         supported_phys = get_supported_phys(hdev);
3408         selected_phys = __le32_to_cpu(cp->selected_phys);
3409
3410         if (selected_phys & ~supported_phys)
3411                 return mgmt_cmd_status(sk, hdev->id,
3412                                        MGMT_OP_SET_PHY_CONFIGURATION,
3413                                        MGMT_STATUS_INVALID_PARAMS);
3414
3415         unconfigure_phys = supported_phys & ~configurable_phys;
3416
3417         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3418                 return mgmt_cmd_status(sk, hdev->id,
3419                                        MGMT_OP_SET_PHY_CONFIGURATION,
3420                                        MGMT_STATUS_INVALID_PARAMS);
3421
3422         if (selected_phys == get_selected_phys(hdev))
3423                 return mgmt_cmd_complete(sk, hdev->id,
3424                                          MGMT_OP_SET_PHY_CONFIGURATION,
3425                                          0, NULL, 0);
3426
3427         hci_dev_lock(hdev);
3428
3429         if (!hdev_is_powered(hdev)) {
3430                 err = mgmt_cmd_status(sk, hdev->id,
3431                                       MGMT_OP_SET_PHY_CONFIGURATION,
3432                                       MGMT_STATUS_REJECTED);
3433                 goto unlock;
3434         }
3435
3436         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3437                 err = mgmt_cmd_status(sk, hdev->id,
3438                                       MGMT_OP_SET_PHY_CONFIGURATION,
3439                                       MGMT_STATUS_BUSY);
3440                 goto unlock;
3441         }
3442
3443         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3444                 pkt_type |= (HCI_DH3 | HCI_DM3);
3445         else
3446                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3447
3448         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3449                 pkt_type |= (HCI_DH5 | HCI_DM5);
3450         else
3451                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3452
3453         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3454                 pkt_type &= ~HCI_2DH1;
3455         else
3456                 pkt_type |= HCI_2DH1;
3457
3458         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3459                 pkt_type &= ~HCI_2DH3;
3460         else
3461                 pkt_type |= HCI_2DH3;
3462
3463         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3464                 pkt_type &= ~HCI_2DH5;
3465         else
3466                 pkt_type |= HCI_2DH5;
3467
3468         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3469                 pkt_type &= ~HCI_3DH1;
3470         else
3471                 pkt_type |= HCI_3DH1;
3472
3473         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3474                 pkt_type &= ~HCI_3DH3;
3475         else
3476                 pkt_type |= HCI_3DH3;
3477
3478         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3479                 pkt_type &= ~HCI_3DH5;
3480         else
3481                 pkt_type |= HCI_3DH5;
3482
3483         if (pkt_type != hdev->pkt_type) {
3484                 hdev->pkt_type = pkt_type;
3485                 changed = true;
3486         }
3487
3488         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3489             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3490                 if (changed)
3491                         mgmt_phy_configuration_changed(hdev, sk);
3492
3493                 err = mgmt_cmd_complete(sk, hdev->id,
3494                                         MGMT_OP_SET_PHY_CONFIGURATION,
3495                                         0, NULL, 0);
3496
3497                 goto unlock;
3498         }
3499
3500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3501                                len);
3502         if (!cmd) {
3503                 err = -ENOMEM;
3504                 goto unlock;
3505         }
3506
3507         hci_req_init(&req, hdev);
3508
3509         memset(&cp_phy, 0, sizeof(cp_phy));
3510
3511         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3512                 cp_phy.all_phys |= 0x01;
3513
3514         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3515                 cp_phy.all_phys |= 0x02;
3516
3517         if (selected_phys & MGMT_PHY_LE_1M_TX)
3518                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3519
3520         if (selected_phys & MGMT_PHY_LE_2M_TX)
3521                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3522
3523         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3524                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3525
3526         if (selected_phys & MGMT_PHY_LE_1M_RX)
3527                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3528
3529         if (selected_phys & MGMT_PHY_LE_2M_RX)
3530                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3531
3532         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3533                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3534
3535         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3536
3537         err = hci_req_run_skb(&req, set_default_phy_complete);
3538         if (err < 0)
3539                 mgmt_pending_remove(cmd);
3540
3541 unlock:
3542         hci_dev_unlock(hdev);
3543
3544         return err;
3545 }
3546
3547 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3548                                          u16 opcode, struct sk_buff *skb)
3549 {
3550         struct mgmt_rp_read_local_oob_data mgmt_rp;
3551         size_t rp_size = sizeof(mgmt_rp);
3552         struct mgmt_pending_cmd *cmd;
3553
3554         BT_DBG("%s status %u", hdev->name, status);
3555
3556         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3557         if (!cmd)
3558                 return;
3559
3560         if (status || !skb) {
3561                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3562                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3563                 goto remove;
3564         }
3565
3566         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3567
3568         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3569                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3570
3571                 if (skb->len < sizeof(*rp)) {
3572                         mgmt_cmd_status(cmd->sk, hdev->id,
3573                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3574                                         MGMT_STATUS_FAILED);
3575                         goto remove;
3576                 }
3577
3578                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3579                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3580
3581                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3582         } else {
3583                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3584
3585                 if (skb->len < sizeof(*rp)) {
3586                         mgmt_cmd_status(cmd->sk, hdev->id,
3587                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3588                                         MGMT_STATUS_FAILED);
3589                         goto remove;
3590                 }
3591
3592                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3593                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3594
3595                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3596                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3597         }
3598
3599         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3600                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3601
3602 remove:
3603         mgmt_pending_remove(cmd);
3604 }
3605
3606 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3607                                void *data, u16 data_len)
3608 {
3609         struct mgmt_pending_cmd *cmd;
3610         struct hci_request req;
3611         int err;
3612
3613         BT_DBG("%s", hdev->name);
3614
3615         hci_dev_lock(hdev);
3616
3617         if (!hdev_is_powered(hdev)) {
3618                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3619                                       MGMT_STATUS_NOT_POWERED);
3620                 goto unlock;
3621         }
3622
3623         if (!lmp_ssp_capable(hdev)) {
3624                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3625                                       MGMT_STATUS_NOT_SUPPORTED);
3626                 goto unlock;
3627         }
3628
3629         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3630                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3631                                       MGMT_STATUS_BUSY);
3632                 goto unlock;
3633         }
3634
3635         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3636         if (!cmd) {
3637                 err = -ENOMEM;
3638                 goto unlock;
3639         }
3640
3641         hci_req_init(&req, hdev);
3642
3643         if (bredr_sc_enabled(hdev))
3644                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3645         else
3646                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3647
3648         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3649         if (err < 0)
3650                 mgmt_pending_remove(cmd);
3651
3652 unlock:
3653         hci_dev_unlock(hdev);
3654         return err;
3655 }
3656
3657 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3658                                void *data, u16 len)
3659 {
3660         struct mgmt_addr_info *addr = data;
3661         int err;
3662
3663         BT_DBG("%s ", hdev->name);
3664
3665         if (!bdaddr_type_is_valid(addr->type))
3666                 return mgmt_cmd_complete(sk, hdev->id,
3667                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3668                                          MGMT_STATUS_INVALID_PARAMS,
3669                                          addr, sizeof(*addr));
3670
3671         hci_dev_lock(hdev);
3672
3673         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3674                 struct mgmt_cp_add_remote_oob_data *cp = data;
3675                 u8 status;
3676
3677                 if (cp->addr.type != BDADDR_BREDR) {
3678                         err = mgmt_cmd_complete(sk, hdev->id,
3679                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3680                                                 MGMT_STATUS_INVALID_PARAMS,
3681                                                 &cp->addr, sizeof(cp->addr));
3682                         goto unlock;
3683                 }
3684
3685                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3686                                               cp->addr.type, cp->hash,
3687                                               cp->rand, NULL, NULL);
3688                 if (err < 0)
3689                         status = MGMT_STATUS_FAILED;
3690                 else
3691                         status = MGMT_STATUS_SUCCESS;
3692
3693                 err = mgmt_cmd_complete(sk, hdev->id,
3694                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3695                                         &cp->addr, sizeof(cp->addr));
3696         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3697                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3698                 u8 *rand192, *hash192, *rand256, *hash256;
3699                 u8 status;
3700
3701                 if (bdaddr_type_is_le(cp->addr.type)) {
3702                         /* Enforce zero-valued 192-bit parameters as
3703                          * long as legacy SMP OOB isn't implemented.
3704                          */
3705                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3706                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3707                                 err = mgmt_cmd_complete(sk, hdev->id,
3708                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3709                                                         MGMT_STATUS_INVALID_PARAMS,
3710                                                         addr, sizeof(*addr));
3711                                 goto unlock;
3712                         }
3713
3714                         rand192 = NULL;
3715                         hash192 = NULL;
3716                 } else {
3717                         /* In case one of the P-192 values is set to zero,
3718                          * then just disable OOB data for P-192.
3719                          */
3720                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3721                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3722                                 rand192 = NULL;
3723                                 hash192 = NULL;
3724                         } else {
3725                                 rand192 = cp->rand192;
3726                                 hash192 = cp->hash192;
3727                         }
3728                 }
3729
3730                 /* In case one of the P-256 values is set to zero, then just
3731                  * disable OOB data for P-256.
3732                  */
3733                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3734                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3735                         rand256 = NULL;
3736                         hash256 = NULL;
3737                 } else {
3738                         rand256 = cp->rand256;
3739                         hash256 = cp->hash256;
3740                 }
3741
3742                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3743                                               cp->addr.type, hash192, rand192,
3744                                               hash256, rand256);
3745                 if (err < 0)
3746                         status = MGMT_STATUS_FAILED;
3747                 else
3748                         status = MGMT_STATUS_SUCCESS;
3749
3750                 err = mgmt_cmd_complete(sk, hdev->id,
3751                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3752                                         status, &cp->addr, sizeof(cp->addr));
3753         } else {
3754                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3755                            len);
3756                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3757                                       MGMT_STATUS_INVALID_PARAMS);
3758         }
3759
3760 unlock:
3761         hci_dev_unlock(hdev);
3762         return err;
3763 }
3764
3765 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3766                                   void *data, u16 len)
3767 {
3768         struct mgmt_cp_remove_remote_oob_data *cp = data;
3769         u8 status;
3770         int err;
3771
3772         BT_DBG("%s", hdev->name);
3773
3774         if (cp->addr.type != BDADDR_BREDR)
3775                 return mgmt_cmd_complete(sk, hdev->id,
3776                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3777                                          MGMT_STATUS_INVALID_PARAMS,
3778                                          &cp->addr, sizeof(cp->addr));
3779
3780         hci_dev_lock(hdev);
3781
3782         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3783                 hci_remote_oob_data_clear(hdev);
3784                 status = MGMT_STATUS_SUCCESS;
3785                 goto done;
3786         }
3787
3788         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3789         if (err < 0)
3790                 status = MGMT_STATUS_INVALID_PARAMS;
3791         else
3792                 status = MGMT_STATUS_SUCCESS;
3793
3794 done:
3795         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3796                                 status, &cp->addr, sizeof(cp->addr));
3797
3798         hci_dev_unlock(hdev);
3799         return err;
3800 }
3801
3802 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3803 {
3804         struct mgmt_pending_cmd *cmd;
3805
3806         BT_DBG("status %d", status);
3807
3808         hci_dev_lock(hdev);
3809
3810         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3811         if (!cmd)
3812                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3813
3814         if (!cmd)
3815                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3816
3817         if (cmd) {
3818                 cmd->cmd_complete(cmd, mgmt_status(status));
3819                 mgmt_pending_remove(cmd);
3820         }
3821
3822         hci_dev_unlock(hdev);
3823 }
3824
3825 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3826                                     uint8_t *mgmt_status)
3827 {
3828         switch (type) {
3829         case DISCOV_TYPE_LE:
3830                 *mgmt_status = mgmt_le_support(hdev);
3831                 if (*mgmt_status)
3832                         return false;
3833                 break;
3834         case DISCOV_TYPE_INTERLEAVED:
3835                 *mgmt_status = mgmt_le_support(hdev);
3836                 if (*mgmt_status)
3837                         return false;
3838                 /* Intentional fall-through */
3839         case DISCOV_TYPE_BREDR:
3840                 *mgmt_status = mgmt_bredr_support(hdev);
3841                 if (*mgmt_status)
3842                         return false;
3843                 break;
3844         default:
3845                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3846                 return false;
3847         }
3848
3849         return true;
3850 }
3851
3852 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3853                                     u16 op, void *data, u16 len)
3854 {
3855         struct mgmt_cp_start_discovery *cp = data;
3856         struct mgmt_pending_cmd *cmd;
3857         u8 status;
3858         int err;
3859
3860         BT_DBG("%s", hdev->name);
3861
3862         hci_dev_lock(hdev);
3863
3864         if (!hdev_is_powered(hdev)) {
3865                 err = mgmt_cmd_complete(sk, hdev->id, op,
3866                                         MGMT_STATUS_NOT_POWERED,
3867                                         &cp->type, sizeof(cp->type));
3868                 goto failed;
3869         }
3870
3871         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3872             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3873                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3874                                         &cp->type, sizeof(cp->type));
3875                 goto failed;
3876         }
3877
3878         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3879                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3880                                         &cp->type, sizeof(cp->type));
3881                 goto failed;
3882         }
3883
3884         /* Clear the discovery filter first to free any previously
3885          * allocated memory for the UUID list.
3886          */
3887         hci_discovery_filter_clear(hdev);
3888
3889         hdev->discovery.type = cp->type;
3890         hdev->discovery.report_invalid_rssi = false;
3891         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3892                 hdev->discovery.limited = true;
3893         else
3894                 hdev->discovery.limited = false;
3895
3896         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3897         if (!cmd) {
3898                 err = -ENOMEM;
3899                 goto failed;
3900         }
3901
3902         cmd->cmd_complete = generic_cmd_complete;
3903
3904         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3905         queue_work(hdev->req_workqueue, &hdev->discov_update);
3906         err = 0;
3907
3908 failed:
3909         hci_dev_unlock(hdev);
3910         return err;
3911 }
3912
3913 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3914                            void *data, u16 len)
3915 {
3916         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3917                                         data, len);
3918 }
3919
3920 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3921                                    void *data, u16 len)
3922 {
3923         return start_discovery_internal(sk, hdev,
3924                                         MGMT_OP_START_LIMITED_DISCOVERY,
3925                                         data, len);
3926 }
3927
3928 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3929                                           u8 status)
3930 {
3931         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3932                                  cmd->param, 1);
3933 }
3934
3935 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3936                                    void *data, u16 len)
3937 {
3938         struct mgmt_cp_start_service_discovery *cp = data;
3939         struct mgmt_pending_cmd *cmd;
3940         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3941         u16 uuid_count, expected_len;
3942         u8 status;
3943         int err;
3944
3945         BT_DBG("%s", hdev->name);
3946
3947         hci_dev_lock(hdev);
3948
3949         if (!hdev_is_powered(hdev)) {
3950                 err = mgmt_cmd_complete(sk, hdev->id,
3951                                         MGMT_OP_START_SERVICE_DISCOVERY,
3952                                         MGMT_STATUS_NOT_POWERED,
3953                                         &cp->type, sizeof(cp->type));
3954                 goto failed;
3955         }
3956
3957         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3958             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3959                 err = mgmt_cmd_complete(sk, hdev->id,
3960                                         MGMT_OP_START_SERVICE_DISCOVERY,
3961                                         MGMT_STATUS_BUSY, &cp->type,
3962                                         sizeof(cp->type));
3963                 goto failed;
3964         }
3965
3966         uuid_count = __le16_to_cpu(cp->uuid_count);
3967         if (uuid_count > max_uuid_count) {
3968                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3969                            uuid_count);
3970                 err = mgmt_cmd_complete(sk, hdev->id,
3971                                         MGMT_OP_START_SERVICE_DISCOVERY,
3972                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3973                                         sizeof(cp->type));
3974                 goto failed;
3975         }
3976
3977         expected_len = sizeof(*cp) + uuid_count * 16;
3978         if (expected_len != len) {
3979                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3980                            expected_len, len);
3981                 err = mgmt_cmd_complete(sk, hdev->id,
3982                                         MGMT_OP_START_SERVICE_DISCOVERY,
3983                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3984                                         sizeof(cp->type));
3985                 goto failed;
3986         }
3987
3988         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3989                 err = mgmt_cmd_complete(sk, hdev->id,
3990                                         MGMT_OP_START_SERVICE_DISCOVERY,
3991                                         status, &cp->type, sizeof(cp->type));
3992                 goto failed;
3993         }
3994
3995         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3996                                hdev, data, len);
3997         if (!cmd) {
3998                 err = -ENOMEM;
3999                 goto failed;
4000         }
4001
4002         cmd->cmd_complete = service_discovery_cmd_complete;
4003
4004         /* Clear the discovery filter first to free any previously
4005          * allocated memory for the UUID list.
4006          */
4007         hci_discovery_filter_clear(hdev);
4008
4009         hdev->discovery.result_filtering = true;
4010         hdev->discovery.type = cp->type;
4011         hdev->discovery.rssi = cp->rssi;
4012         hdev->discovery.uuid_count = uuid_count;
4013
4014         if (uuid_count > 0) {
4015                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4016                                                 GFP_KERNEL);
4017                 if (!hdev->discovery.uuids) {
4018                         err = mgmt_cmd_complete(sk, hdev->id,
4019                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4020                                                 MGMT_STATUS_FAILED,
4021                                                 &cp->type, sizeof(cp->type));
4022                         mgmt_pending_remove(cmd);
4023                         goto failed;
4024                 }
4025         }
4026
4027         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4028         queue_work(hdev->req_workqueue, &hdev->discov_update);
4029         err = 0;
4030
4031 failed:
4032         hci_dev_unlock(hdev);
4033         return err;
4034 }
4035
4036 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4037 {
4038         struct mgmt_pending_cmd *cmd;
4039
4040         BT_DBG("status %d", status);
4041
4042         hci_dev_lock(hdev);
4043
4044         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4045         if (cmd) {
4046                 cmd->cmd_complete(cmd, mgmt_status(status));
4047                 mgmt_pending_remove(cmd);
4048         }
4049
4050         hci_dev_unlock(hdev);
4051 }
4052
4053 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4054                           u16 len)
4055 {
4056         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4057         struct mgmt_pending_cmd *cmd;
4058         int err;
4059
4060         BT_DBG("%s", hdev->name);
4061
4062         hci_dev_lock(hdev);
4063
4064         if (!hci_discovery_active(hdev)) {
4065                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4066                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4067                                         sizeof(mgmt_cp->type));
4068                 goto unlock;
4069         }
4070
4071         if (hdev->discovery.type != mgmt_cp->type) {
4072                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4073                                         MGMT_STATUS_INVALID_PARAMS,
4074                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4075                 goto unlock;
4076         }
4077
4078         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4079         if (!cmd) {
4080                 err = -ENOMEM;
4081                 goto unlock;
4082         }
4083
4084         cmd->cmd_complete = generic_cmd_complete;
4085
4086         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4087         queue_work(hdev->req_workqueue, &hdev->discov_update);
4088         err = 0;
4089
4090 unlock:
4091         hci_dev_unlock(hdev);
4092         return err;
4093 }
4094
4095 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4096                         u16 len)
4097 {
4098         struct mgmt_cp_confirm_name *cp = data;
4099         struct inquiry_entry *e;
4100         int err;
4101
4102         BT_DBG("%s", hdev->name);
4103
4104         hci_dev_lock(hdev);
4105
4106         if (!hci_discovery_active(hdev)) {
4107                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4108                                         MGMT_STATUS_FAILED, &cp->addr,
4109                                         sizeof(cp->addr));
4110                 goto failed;
4111         }
4112
4113         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4114         if (!e) {
4115                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4116                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4117                                         sizeof(cp->addr));
4118                 goto failed;
4119         }
4120
4121         if (cp->name_known) {
4122                 e->name_state = NAME_KNOWN;
4123                 list_del(&e->list);
4124         } else {
4125                 e->name_state = NAME_NEEDED;
4126                 hci_inquiry_cache_update_resolve(hdev, e);
4127         }
4128
4129         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4130                                 &cp->addr, sizeof(cp->addr));
4131
4132 failed:
4133         hci_dev_unlock(hdev);
4134         return err;
4135 }
4136
4137 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4138                         u16 len)
4139 {
4140         struct mgmt_cp_block_device *cp = data;
4141         u8 status;
4142         int err;
4143
4144         BT_DBG("%s", hdev->name);
4145
4146         if (!bdaddr_type_is_valid(cp->addr.type))
4147                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4148                                          MGMT_STATUS_INVALID_PARAMS,
4149                                          &cp->addr, sizeof(cp->addr));
4150
4151         hci_dev_lock(hdev);
4152
4153         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4154                                   cp->addr.type);
4155         if (err < 0) {
4156                 status = MGMT_STATUS_FAILED;
4157                 goto done;
4158         }
4159
4160         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4161                    sk);
4162         status = MGMT_STATUS_SUCCESS;
4163
4164 done:
4165         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4166                                 &cp->addr, sizeof(cp->addr));
4167
4168         hci_dev_unlock(hdev);
4169
4170         return err;
4171 }
4172
4173 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4174                           u16 len)
4175 {
4176         struct mgmt_cp_unblock_device *cp = data;
4177         u8 status;
4178         int err;
4179
4180         BT_DBG("%s", hdev->name);
4181
4182         if (!bdaddr_type_is_valid(cp->addr.type))
4183                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4184                                          MGMT_STATUS_INVALID_PARAMS,
4185                                          &cp->addr, sizeof(cp->addr));
4186
4187         hci_dev_lock(hdev);
4188
4189         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4190                                   cp->addr.type);
4191         if (err < 0) {
4192                 status = MGMT_STATUS_INVALID_PARAMS;
4193                 goto done;
4194         }
4195
4196         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4197                    sk);
4198         status = MGMT_STATUS_SUCCESS;
4199
4200 done:
4201         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4202                                 &cp->addr, sizeof(cp->addr));
4203
4204         hci_dev_unlock(hdev);
4205
4206         return err;
4207 }
4208
4209 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4210                          u16 len)
4211 {
4212         struct mgmt_cp_set_device_id *cp = data;
4213         struct hci_request req;
4214         int err;
4215         __u16 source;
4216
4217         BT_DBG("%s", hdev->name);
4218
4219         source = __le16_to_cpu(cp->source);
4220
4221         if (source > 0x0002)
4222                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4223                                        MGMT_STATUS_INVALID_PARAMS);
4224
4225         hci_dev_lock(hdev);
4226
4227         hdev->devid_source = source;
4228         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4229         hdev->devid_product = __le16_to_cpu(cp->product);
4230         hdev->devid_version = __le16_to_cpu(cp->version);
4231
4232         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4233                                 NULL, 0);
4234
4235         hci_req_init(&req, hdev);
4236         __hci_req_update_eir(&req);
4237         hci_req_run(&req, NULL);
4238
4239         hci_dev_unlock(hdev);
4240
4241         return err;
4242 }
4243
4244 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4245                                         u16 opcode)
4246 {
4247         BT_DBG("status %d", status);
4248 }
4249
4250 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4251                                      u16 opcode)
4252 {
4253         struct cmd_lookup match = { NULL, hdev };
4254         struct hci_request req;
4255         u8 instance;
4256         struct adv_info *adv_instance;
4257         int err;
4258
4259         hci_dev_lock(hdev);
4260
4261         if (status) {
4262                 u8 mgmt_err = mgmt_status(status);
4263
4264                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4265                                      cmd_status_rsp, &mgmt_err);
4266                 goto unlock;
4267         }
4268
4269         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4270                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4271         else
4272                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4273
4274         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4275                              &match);
4276
4277         new_settings(hdev, match.sk);
4278
4279         if (match.sk)
4280                 sock_put(match.sk);
4281
4282         /* If "Set Advertising" was just disabled and instance advertising was
4283          * set up earlier, then re-enable multi-instance advertising.
4284          */
4285         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4286             list_empty(&hdev->adv_instances))
4287                 goto unlock;
4288
4289         instance = hdev->cur_adv_instance;
4290         if (!instance) {
4291                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4292                                                         struct adv_info, list);
4293                 if (!adv_instance)
4294                         goto unlock;
4295
4296                 instance = adv_instance->instance;
4297         }
4298
4299         hci_req_init(&req, hdev);
4300
4301         err = __hci_req_schedule_adv_instance(&req, instance, true);
4302
4303         if (!err)
4304                 err = hci_req_run(&req, enable_advertising_instance);
4305
4306         if (err)
4307                 bt_dev_err(hdev, "failed to re-configure advertising");
4308
4309 unlock:
4310         hci_dev_unlock(hdev);
4311 }
4312
4313 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4314                            u16 len)
4315 {
4316         struct mgmt_mode *cp = data;
4317         struct mgmt_pending_cmd *cmd;
4318         struct hci_request req;
4319         u8 val, status;
4320         int err;
4321
4322         BT_DBG("request for %s", hdev->name);
4323
4324         status = mgmt_le_support(hdev);
4325         if (status)
4326                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4327                                        status);
4328
4329         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4331                                        MGMT_STATUS_INVALID_PARAMS);
4332
4333         hci_dev_lock(hdev);
4334
4335         val = !!cp->val;
4336
4337         /* The following conditions are ones which mean that we should
4338          * not do any HCI communication but directly send a mgmt
4339          * response to user space (after toggling the flag if
4340          * necessary).
4341          */
4342         if (!hdev_is_powered(hdev) ||
4343             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4344              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4345             hci_conn_num(hdev, LE_LINK) > 0 ||
4346             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4347              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4348                 bool changed;
4349
4350                 if (cp->val) {
4351                         hdev->cur_adv_instance = 0x00;
4352                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4353                         if (cp->val == 0x02)
4354                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4355                         else
4356                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4357                 } else {
4358                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4359                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4360                 }
4361
4362                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4363                 if (err < 0)
4364                         goto unlock;
4365
4366                 if (changed)
4367                         err = new_settings(hdev, sk);
4368
4369                 goto unlock;
4370         }
4371
4372         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4373             pending_find(MGMT_OP_SET_LE, hdev)) {
4374                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4375                                       MGMT_STATUS_BUSY);
4376                 goto unlock;
4377         }
4378
4379         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4380         if (!cmd) {
4381                 err = -ENOMEM;
4382                 goto unlock;
4383         }
4384
4385         hci_req_init(&req, hdev);
4386
4387         if (cp->val == 0x02)
4388                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4389         else
4390                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4391
4392         cancel_adv_timeout(hdev);
4393
4394         if (val) {
4395                 /* Switch to instance "0" for the Set Advertising setting.
4396                  * We cannot use update_[adv|scan_rsp]_data() here as the
4397                  * HCI_ADVERTISING flag is not yet set.
4398                  */
4399                 hdev->cur_adv_instance = 0x00;
4400
4401                 if (ext_adv_capable(hdev)) {
4402                         __hci_req_start_ext_adv(&req, 0x00);
4403                 } else {
4404                         __hci_req_update_adv_data(&req, 0x00);
4405                         __hci_req_update_scan_rsp_data(&req, 0x00);
4406                         __hci_req_enable_advertising(&req);
4407                 }
4408         } else {
4409                 __hci_req_disable_advertising(&req);
4410         }
4411
4412         err = hci_req_run(&req, set_advertising_complete);
4413         if (err < 0)
4414                 mgmt_pending_remove(cmd);
4415
4416 unlock:
4417         hci_dev_unlock(hdev);
4418         return err;
4419 }
4420
4421 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4422                               void *data, u16 len)
4423 {
4424         struct mgmt_cp_set_static_address *cp = data;
4425         int err;
4426
4427         BT_DBG("%s", hdev->name);
4428
4429         if (!lmp_le_capable(hdev))
4430                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4431                                        MGMT_STATUS_NOT_SUPPORTED);
4432
4433         if (hdev_is_powered(hdev))
4434                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4435                                        MGMT_STATUS_REJECTED);
4436
4437         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4438                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4439                         return mgmt_cmd_status(sk, hdev->id,
4440                                                MGMT_OP_SET_STATIC_ADDRESS,
4441                                                MGMT_STATUS_INVALID_PARAMS);
4442
4443                 /* Two most significant bits shall be set */
4444                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4445                         return mgmt_cmd_status(sk, hdev->id,
4446                                                MGMT_OP_SET_STATIC_ADDRESS,
4447                                                MGMT_STATUS_INVALID_PARAMS);
4448         }
4449
4450         hci_dev_lock(hdev);
4451
4452         bacpy(&hdev->static_addr, &cp->bdaddr);
4453
4454         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4455         if (err < 0)
4456                 goto unlock;
4457
4458         err = new_settings(hdev, sk);
4459
4460 unlock:
4461         hci_dev_unlock(hdev);
4462         return err;
4463 }
4464
4465 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4466                            void *data, u16 len)
4467 {
4468         struct mgmt_cp_set_scan_params *cp = data;
4469         __u16 interval, window;
4470         int err;
4471
4472         BT_DBG("%s", hdev->name);
4473
4474         if (!lmp_le_capable(hdev))
4475                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4476                                        MGMT_STATUS_NOT_SUPPORTED);
4477
4478         interval = __le16_to_cpu(cp->interval);
4479
4480         if (interval < 0x0004 || interval > 0x4000)
4481                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4482                                        MGMT_STATUS_INVALID_PARAMS);
4483
4484         window = __le16_to_cpu(cp->window);
4485
4486         if (window < 0x0004 || window > 0x4000)
4487                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4488                                        MGMT_STATUS_INVALID_PARAMS);
4489
4490         if (window > interval)
4491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4492                                        MGMT_STATUS_INVALID_PARAMS);
4493
4494         hci_dev_lock(hdev);
4495
4496         hdev->le_scan_interval = interval;
4497         hdev->le_scan_window = window;
4498
4499         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4500                                 NULL, 0);
4501
4502         /* If background scan is running, restart it so new parameters are
4503          * loaded.
4504          */
4505         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4506             hdev->discovery.state == DISCOVERY_STOPPED) {
4507                 struct hci_request req;
4508
4509                 hci_req_init(&req, hdev);
4510
4511                 hci_req_add_le_scan_disable(&req);
4512                 hci_req_add_le_passive_scan(&req);
4513
4514                 hci_req_run(&req, NULL);
4515         }
4516
4517         hci_dev_unlock(hdev);
4518
4519         return err;
4520 }
4521
4522 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4523                                       u16 opcode)
4524 {
4525         struct mgmt_pending_cmd *cmd;
4526
4527         BT_DBG("status 0x%02x", status);
4528
4529         hci_dev_lock(hdev);
4530
4531         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4532         if (!cmd)
4533                 goto unlock;
4534
4535         if (status) {
4536                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4537                                 mgmt_status(status));
4538         } else {
4539                 struct mgmt_mode *cp = cmd->param;
4540
4541                 if (cp->val)
4542                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4543                 else
4544                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4545
4546                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4547                 new_settings(hdev, cmd->sk);
4548         }
4549
4550         mgmt_pending_remove(cmd);
4551
4552 unlock:
4553         hci_dev_unlock(hdev);
4554 }
4555
4556 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4557                                 void *data, u16 len)
4558 {
4559         struct mgmt_mode *cp = data;
4560         struct mgmt_pending_cmd *cmd;
4561         struct hci_request req;
4562         int err;
4563
4564         BT_DBG("%s", hdev->name);
4565
4566         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4567             hdev->hci_ver < BLUETOOTH_VER_1_2)
4568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4569                                        MGMT_STATUS_NOT_SUPPORTED);
4570
4571         if (cp->val != 0x00 && cp->val != 0x01)
4572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4573                                        MGMT_STATUS_INVALID_PARAMS);
4574
4575         hci_dev_lock(hdev);
4576
4577         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4579                                       MGMT_STATUS_BUSY);
4580                 goto unlock;
4581         }
4582
4583         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4584                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4585                                         hdev);
4586                 goto unlock;
4587         }
4588
4589         if (!hdev_is_powered(hdev)) {
4590                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4591                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4592                                         hdev);
4593                 new_settings(hdev, sk);
4594                 goto unlock;
4595         }
4596
4597         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4598                                data, len);
4599         if (!cmd) {
4600                 err = -ENOMEM;
4601                 goto unlock;
4602         }
4603
4604         hci_req_init(&req, hdev);
4605
4606         __hci_req_write_fast_connectable(&req, cp->val);
4607
4608         err = hci_req_run(&req, fast_connectable_complete);
4609         if (err < 0) {
4610                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4611                                       MGMT_STATUS_FAILED);
4612                 mgmt_pending_remove(cmd);
4613         }
4614
4615 unlock:
4616         hci_dev_unlock(hdev);
4617
4618         return err;
4619 }
4620
4621 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4622 {
4623         struct mgmt_pending_cmd *cmd;
4624
4625         BT_DBG("status 0x%02x", status);
4626
4627         hci_dev_lock(hdev);
4628
4629         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4630         if (!cmd)
4631                 goto unlock;
4632
4633         if (status) {
4634                 u8 mgmt_err = mgmt_status(status);
4635
4636                 /* We need to restore the flag if related HCI commands
4637                  * failed.
4638                  */
4639                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4640
4641                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4642         } else {
4643                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4644                 new_settings(hdev, cmd->sk);
4645         }
4646
4647         mgmt_pending_remove(cmd);
4648
4649 unlock:
4650         hci_dev_unlock(hdev);
4651 }
4652
4653 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4654 {
4655         struct mgmt_mode *cp = data;
4656         struct mgmt_pending_cmd *cmd;
4657         struct hci_request req;
4658         int err;
4659
4660         BT_DBG("request for %s", hdev->name);
4661
4662         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4663                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4664                                        MGMT_STATUS_NOT_SUPPORTED);
4665
4666         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4667                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4668                                        MGMT_STATUS_REJECTED);
4669
4670         if (cp->val != 0x00 && cp->val != 0x01)
4671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4672                                        MGMT_STATUS_INVALID_PARAMS);
4673
4674         hci_dev_lock(hdev);
4675
4676         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4677                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4678                 goto unlock;
4679         }
4680
4681         if (!hdev_is_powered(hdev)) {
4682                 if (!cp->val) {
4683                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4684                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4685                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4686                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4687                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4688                 }
4689
4690                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4691
4692                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4693                 if (err < 0)
4694                         goto unlock;
4695
4696                 err = new_settings(hdev, sk);
4697                 goto unlock;
4698         }
4699
4700         /* Reject disabling when powered on */
4701         if (!cp->val) {
4702                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4703                                       MGMT_STATUS_REJECTED);
4704                 goto unlock;
4705         } else {
4706                 /* When configuring a dual-mode controller to operate
4707                  * with LE only and using a static address, then switching
4708                  * BR/EDR back on is not allowed.
4709                  *
4710                  * Dual-mode controllers shall operate with the public
4711                  * address as its identity address for BR/EDR and LE. So
4712                  * reject the attempt to create an invalid configuration.
4713                  *
4714                  * The same restrictions applies when secure connections
4715                  * has been enabled. For BR/EDR this is a controller feature
4716                  * while for LE it is a host stack feature. This means that
4717                  * switching BR/EDR back on when secure connections has been
4718                  * enabled is not a supported transaction.
4719                  */
4720                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4721                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4722                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4723                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4724                                               MGMT_STATUS_REJECTED);
4725                         goto unlock;
4726                 }
4727         }
4728
4729         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4730                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4731                                       MGMT_STATUS_BUSY);
4732                 goto unlock;
4733         }
4734
4735         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4736         if (!cmd) {
4737                 err = -ENOMEM;
4738                 goto unlock;
4739         }
4740
4741         /* We need to flip the bit already here so that
4742          * hci_req_update_adv_data generates the correct flags.
4743          */
4744         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4745
4746         hci_req_init(&req, hdev);
4747
4748         __hci_req_write_fast_connectable(&req, false);
4749         __hci_req_update_scan(&req);
4750
4751         /* Since only the advertising data flags will change, there
4752          * is no need to update the scan response data.
4753          */
4754         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4755
4756         err = hci_req_run(&req, set_bredr_complete);
4757         if (err < 0)
4758                 mgmt_pending_remove(cmd);
4759
4760 unlock:
4761         hci_dev_unlock(hdev);
4762         return err;
4763 }
4764
4765 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4766 {
4767         struct mgmt_pending_cmd *cmd;
4768         struct mgmt_mode *cp;
4769
4770         BT_DBG("%s status %u", hdev->name, status);
4771
4772         hci_dev_lock(hdev);
4773
4774         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4775         if (!cmd)
4776                 goto unlock;
4777
4778         if (status) {
4779                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4780                                 mgmt_status(status));
4781                 goto remove;
4782         }
4783
4784         cp = cmd->param;
4785
4786         switch (cp->val) {
4787         case 0x00:
4788                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4789                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4790                 break;
4791         case 0x01:
4792                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4793                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4794                 break;
4795         case 0x02:
4796                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4797                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4798                 break;
4799         }
4800
4801         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4802         new_settings(hdev, cmd->sk);
4803
4804 remove:
4805         mgmt_pending_remove(cmd);
4806 unlock:
4807         hci_dev_unlock(hdev);
4808 }
4809
4810 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4811                            void *data, u16 len)
4812 {
4813         struct mgmt_mode *cp = data;
4814         struct mgmt_pending_cmd *cmd;
4815         struct hci_request req;
4816         u8 val;
4817         int err;
4818
4819         BT_DBG("request for %s", hdev->name);
4820
4821         if (!lmp_sc_capable(hdev) &&
4822             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4823                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4824                                        MGMT_STATUS_NOT_SUPPORTED);
4825
4826         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4827             lmp_sc_capable(hdev) &&
4828             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4829                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4830                                        MGMT_STATUS_REJECTED);
4831
4832         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4834                                   MGMT_STATUS_INVALID_PARAMS);
4835
4836         hci_dev_lock(hdev);
4837
4838         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4839             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4840                 bool changed;
4841
4842                 if (cp->val) {
4843                         changed = !hci_dev_test_and_set_flag(hdev,
4844                                                              HCI_SC_ENABLED);
4845                         if (cp->val == 0x02)
4846                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4847                         else
4848                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4849                 } else {
4850                         changed = hci_dev_test_and_clear_flag(hdev,
4851                                                               HCI_SC_ENABLED);
4852                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4853                 }
4854
4855                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4856                 if (err < 0)
4857                         goto failed;
4858
4859                 if (changed)
4860                         err = new_settings(hdev, sk);
4861
4862                 goto failed;
4863         }
4864
4865         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4866                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4867                                       MGMT_STATUS_BUSY);
4868                 goto failed;
4869         }
4870
4871         val = !!cp->val;
4872
4873         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4874             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4875                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4876                 goto failed;
4877         }
4878
4879         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4880         if (!cmd) {
4881                 err = -ENOMEM;
4882                 goto failed;
4883         }
4884
4885         hci_req_init(&req, hdev);
4886         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4887         err = hci_req_run(&req, sc_enable_complete);
4888         if (err < 0) {
4889                 mgmt_pending_remove(cmd);
4890                 goto failed;
4891         }
4892
4893 failed:
4894         hci_dev_unlock(hdev);
4895         return err;
4896 }
4897
4898 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4899                           void *data, u16 len)
4900 {
4901         struct mgmt_mode *cp = data;
4902         bool changed, use_changed;
4903         int err;
4904
4905         BT_DBG("request for %s", hdev->name);
4906
4907         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4909                                        MGMT_STATUS_INVALID_PARAMS);
4910
4911         hci_dev_lock(hdev);
4912
4913         if (cp->val)
4914                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4915         else
4916                 changed = hci_dev_test_and_clear_flag(hdev,
4917                                                       HCI_KEEP_DEBUG_KEYS);
4918
4919         if (cp->val == 0x02)
4920                 use_changed = !hci_dev_test_and_set_flag(hdev,
4921                                                          HCI_USE_DEBUG_KEYS);
4922         else
4923                 use_changed = hci_dev_test_and_clear_flag(hdev,
4924                                                           HCI_USE_DEBUG_KEYS);
4925
4926         if (hdev_is_powered(hdev) && use_changed &&
4927             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4928                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4929                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4930                              sizeof(mode), &mode);
4931         }
4932
4933         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4934         if (err < 0)
4935                 goto unlock;
4936
4937         if (changed)
4938                 err = new_settings(hdev, sk);
4939
4940 unlock:
4941         hci_dev_unlock(hdev);
4942         return err;
4943 }
4944
4945 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4946                        u16 len)
4947 {
4948         struct mgmt_cp_set_privacy *cp = cp_data;
4949         bool changed;
4950         int err;
4951
4952         BT_DBG("request for %s", hdev->name);
4953
4954         if (!lmp_le_capable(hdev))
4955                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4956                                        MGMT_STATUS_NOT_SUPPORTED);
4957
4958         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4959                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4960                                        MGMT_STATUS_INVALID_PARAMS);
4961
4962         if (hdev_is_powered(hdev))
4963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4964                                        MGMT_STATUS_REJECTED);
4965
4966         hci_dev_lock(hdev);
4967
4968         /* If user space supports this command it is also expected to
4969          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4970          */
4971         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4972
4973         if (cp->privacy) {
4974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4975                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4976                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4977                 hci_adv_instances_set_rpa_expired(hdev, true);
4978                 if (cp->privacy == 0x02)
4979                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4980                 else
4981                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4982         } else {
4983                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4984                 memset(hdev->irk, 0, sizeof(hdev->irk));
4985                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4986                 hci_adv_instances_set_rpa_expired(hdev, false);
4987                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4988         }
4989
4990         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4991         if (err < 0)
4992                 goto unlock;
4993
4994         if (changed)
4995                 err = new_settings(hdev, sk);
4996
4997 unlock:
4998         hci_dev_unlock(hdev);
4999         return err;
5000 }
5001
5002 static bool irk_is_valid(struct mgmt_irk_info *irk)
5003 {
5004         switch (irk->addr.type) {
5005         case BDADDR_LE_PUBLIC:
5006                 return true;
5007
5008         case BDADDR_LE_RANDOM:
5009                 /* Two most significant bits shall be set */
5010                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5011                         return false;
5012                 return true;
5013         }
5014
5015         return false;
5016 }
5017
5018 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5019                      u16 len)
5020 {
5021         struct mgmt_cp_load_irks *cp = cp_data;
5022         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5023                                    sizeof(struct mgmt_irk_info));
5024         u16 irk_count, expected_len;
5025         int i, err;
5026
5027         BT_DBG("request for %s", hdev->name);
5028
5029         if (!lmp_le_capable(hdev))
5030                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5031                                        MGMT_STATUS_NOT_SUPPORTED);
5032
5033         irk_count = __le16_to_cpu(cp->irk_count);
5034         if (irk_count > max_irk_count) {
5035                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5036                            irk_count);
5037                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5038                                        MGMT_STATUS_INVALID_PARAMS);
5039         }
5040
5041         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5042         if (expected_len != len) {
5043                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5044                            expected_len, len);
5045                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5046                                        MGMT_STATUS_INVALID_PARAMS);
5047         }
5048
5049         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5050
5051         for (i = 0; i < irk_count; i++) {
5052                 struct mgmt_irk_info *key = &cp->irks[i];
5053
5054                 if (!irk_is_valid(key))
5055                         return mgmt_cmd_status(sk, hdev->id,
5056                                                MGMT_OP_LOAD_IRKS,
5057                                                MGMT_STATUS_INVALID_PARAMS);
5058         }
5059
5060         hci_dev_lock(hdev);
5061
5062         hci_smp_irks_clear(hdev);
5063
5064         for (i = 0; i < irk_count; i++) {
5065                 struct mgmt_irk_info *irk = &cp->irks[i];
5066
5067                 hci_add_irk(hdev, &irk->addr.bdaddr,
5068                             le_addr_type(irk->addr.type), irk->val,
5069                             BDADDR_ANY);
5070         }
5071
5072         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5073
5074         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5075
5076         hci_dev_unlock(hdev);
5077
5078         return err;
5079 }
5080
5081 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5082 {
5083         if (key->master != 0x00 && key->master != 0x01)
5084                 return false;
5085
5086         switch (key->addr.type) {
5087         case BDADDR_LE_PUBLIC:
5088                 return true;
5089
5090         case BDADDR_LE_RANDOM:
5091                 /* Two most significant bits shall be set */
5092                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5093                         return false;
5094                 return true;
5095         }
5096
5097         return false;
5098 }
5099
5100 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5101                                void *cp_data, u16 len)
5102 {
5103         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5104         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5105                                    sizeof(struct mgmt_ltk_info));
5106         u16 key_count, expected_len;
5107         int i, err;
5108
5109         BT_DBG("request for %s", hdev->name);
5110
5111         if (!lmp_le_capable(hdev))
5112                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5113                                        MGMT_STATUS_NOT_SUPPORTED);
5114
5115         key_count = __le16_to_cpu(cp->key_count);
5116         if (key_count > max_key_count) {
5117                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5118                            key_count);
5119                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5120                                        MGMT_STATUS_INVALID_PARAMS);
5121         }
5122
5123         expected_len = sizeof(*cp) + key_count *
5124                                         sizeof(struct mgmt_ltk_info);
5125         if (expected_len != len) {
5126                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5127                            expected_len, len);
5128                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5129                                        MGMT_STATUS_INVALID_PARAMS);
5130         }
5131
5132         BT_DBG("%s key_count %u", hdev->name, key_count);
5133
5134         for (i = 0; i < key_count; i++) {
5135                 struct mgmt_ltk_info *key = &cp->keys[i];
5136
5137                 if (!ltk_is_valid(key))
5138                         return mgmt_cmd_status(sk, hdev->id,
5139                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5140                                                MGMT_STATUS_INVALID_PARAMS);
5141         }
5142
5143         hci_dev_lock(hdev);
5144
5145         hci_smp_ltks_clear(hdev);
5146
5147         for (i = 0; i < key_count; i++) {
5148                 struct mgmt_ltk_info *key = &cp->keys[i];
5149                 u8 type, authenticated;
5150
5151                 switch (key->type) {
5152                 case MGMT_LTK_UNAUTHENTICATED:
5153                         authenticated = 0x00;
5154                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5155                         break;
5156                 case MGMT_LTK_AUTHENTICATED:
5157                         authenticated = 0x01;
5158                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5159                         break;
5160                 case MGMT_LTK_P256_UNAUTH:
5161                         authenticated = 0x00;
5162                         type = SMP_LTK_P256;
5163                         break;
5164                 case MGMT_LTK_P256_AUTH:
5165                         authenticated = 0x01;
5166                         type = SMP_LTK_P256;
5167                         break;
5168                 case MGMT_LTK_P256_DEBUG:
5169                         authenticated = 0x00;
5170                         type = SMP_LTK_P256_DEBUG;
5171                         /* fall through */
5172                 default:
5173                         continue;
5174                 }
5175
5176                 hci_add_ltk(hdev, &key->addr.bdaddr,
5177                             le_addr_type(key->addr.type), type, authenticated,
5178                             key->val, key->enc_size, key->ediv, key->rand);
5179         }
5180
5181         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5182                            NULL, 0);
5183
5184         hci_dev_unlock(hdev);
5185
5186         return err;
5187 }
5188
5189 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5190 {
5191         struct hci_conn *conn = cmd->user_data;
5192         struct mgmt_rp_get_conn_info rp;
5193         int err;
5194
5195         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5196
5197         if (status == MGMT_STATUS_SUCCESS) {
5198                 rp.rssi = conn->rssi;
5199                 rp.tx_power = conn->tx_power;
5200                 rp.max_tx_power = conn->max_tx_power;
5201         } else {
5202                 rp.rssi = HCI_RSSI_INVALID;
5203                 rp.tx_power = HCI_TX_POWER_INVALID;
5204                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5205         }
5206
5207         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5208                                 status, &rp, sizeof(rp));
5209
5210         hci_conn_drop(conn);
5211         hci_conn_put(conn);
5212
5213         return err;
5214 }
5215
5216 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5217                                        u16 opcode)
5218 {
5219         struct hci_cp_read_rssi *cp;
5220         struct mgmt_pending_cmd *cmd;
5221         struct hci_conn *conn;
5222         u16 handle;
5223         u8 status;
5224
5225         BT_DBG("status 0x%02x", hci_status);
5226
5227         hci_dev_lock(hdev);
5228
5229         /* Commands sent in request are either Read RSSI or Read Transmit Power
5230          * Level so we check which one was last sent to retrieve connection
5231          * handle.  Both commands have handle as first parameter so it's safe to
5232          * cast data on the same command struct.
5233          *
5234          * First command sent is always Read RSSI and we fail only if it fails.
5235          * In other case we simply override error to indicate success as we
5236          * already remembered if TX power value is actually valid.
5237          */
5238         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5239         if (!cp) {
5240                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5241                 status = MGMT_STATUS_SUCCESS;
5242         } else {
5243                 status = mgmt_status(hci_status);
5244         }
5245
5246         if (!cp) {
5247                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5248                 goto unlock;
5249         }
5250
5251         handle = __le16_to_cpu(cp->handle);
5252         conn = hci_conn_hash_lookup_handle(hdev, handle);
5253         if (!conn) {
5254                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5255                            handle);
5256                 goto unlock;
5257         }
5258
5259         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5260         if (!cmd)
5261                 goto unlock;
5262
5263         cmd->cmd_complete(cmd, status);
5264         mgmt_pending_remove(cmd);
5265
5266 unlock:
5267         hci_dev_unlock(hdev);
5268 }
5269
5270 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5271                          u16 len)
5272 {
5273         struct mgmt_cp_get_conn_info *cp = data;
5274         struct mgmt_rp_get_conn_info rp;
5275         struct hci_conn *conn;
5276         unsigned long conn_info_age;
5277         int err = 0;
5278
5279         BT_DBG("%s", hdev->name);
5280
5281         memset(&rp, 0, sizeof(rp));
5282         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5283         rp.addr.type = cp->addr.type;
5284
5285         if (!bdaddr_type_is_valid(cp->addr.type))
5286                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5287                                          MGMT_STATUS_INVALID_PARAMS,
5288                                          &rp, sizeof(rp));
5289
5290         hci_dev_lock(hdev);
5291
5292         if (!hdev_is_powered(hdev)) {
5293                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5294                                         MGMT_STATUS_NOT_POWERED, &rp,
5295                                         sizeof(rp));
5296                 goto unlock;
5297         }
5298
5299         if (cp->addr.type == BDADDR_BREDR)
5300                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5301                                                &cp->addr.bdaddr);
5302         else
5303                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5304
5305         if (!conn || conn->state != BT_CONNECTED) {
5306                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5307                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5308                                         sizeof(rp));
5309                 goto unlock;
5310         }
5311
5312         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5314                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5315                 goto unlock;
5316         }
5317
5318         /* To avoid client trying to guess when to poll again for information we
5319          * calculate conn info age as random value between min/max set in hdev.
5320          */
5321         conn_info_age = hdev->conn_info_min_age +
5322                         prandom_u32_max(hdev->conn_info_max_age -
5323                                         hdev->conn_info_min_age);
5324
5325         /* Query controller to refresh cached values if they are too old or were
5326          * never read.
5327          */
5328         if (time_after(jiffies, conn->conn_info_timestamp +
5329                        msecs_to_jiffies(conn_info_age)) ||
5330             !conn->conn_info_timestamp) {
5331                 struct hci_request req;
5332                 struct hci_cp_read_tx_power req_txp_cp;
5333                 struct hci_cp_read_rssi req_rssi_cp;
5334                 struct mgmt_pending_cmd *cmd;
5335
5336                 hci_req_init(&req, hdev);
5337                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5338                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5339                             &req_rssi_cp);
5340
5341                 /* For LE links TX power does not change thus we don't need to
5342                  * query for it once value is known.
5343                  */
5344                 if (!bdaddr_type_is_le(cp->addr.type) ||
5345                     conn->tx_power == HCI_TX_POWER_INVALID) {
5346                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5347                         req_txp_cp.type = 0x00;
5348                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5349                                     sizeof(req_txp_cp), &req_txp_cp);
5350                 }
5351
5352                 /* Max TX power needs to be read only once per connection */
5353                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5354                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5355                         req_txp_cp.type = 0x01;
5356                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5357                                     sizeof(req_txp_cp), &req_txp_cp);
5358                 }
5359
5360                 err = hci_req_run(&req, conn_info_refresh_complete);
5361                 if (err < 0)
5362                         goto unlock;
5363
5364                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5365                                        data, len);
5366                 if (!cmd) {
5367                         err = -ENOMEM;
5368                         goto unlock;
5369                 }
5370
5371                 hci_conn_hold(conn);
5372                 cmd->user_data = hci_conn_get(conn);
5373                 cmd->cmd_complete = conn_info_cmd_complete;
5374
5375                 conn->conn_info_timestamp = jiffies;
5376         } else {
5377                 /* Cache is valid, just reply with values cached in hci_conn */
5378                 rp.rssi = conn->rssi;
5379                 rp.tx_power = conn->tx_power;
5380                 rp.max_tx_power = conn->max_tx_power;
5381
5382                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5383                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5384         }
5385
5386 unlock:
5387         hci_dev_unlock(hdev);
5388         return err;
5389 }
5390
5391 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5392 {
5393         struct hci_conn *conn = cmd->user_data;
5394         struct mgmt_rp_get_clock_info rp;
5395         struct hci_dev *hdev;
5396         int err;
5397
5398         memset(&rp, 0, sizeof(rp));
5399         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5400
5401         if (status)
5402                 goto complete;
5403
5404         hdev = hci_dev_get(cmd->index);
5405         if (hdev) {
5406                 rp.local_clock = cpu_to_le32(hdev->clock);
5407                 hci_dev_put(hdev);
5408         }
5409
5410         if (conn) {
5411                 rp.piconet_clock = cpu_to_le32(conn->clock);
5412                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5413         }
5414
5415 complete:
5416         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5417                                 sizeof(rp));
5418
5419         if (conn) {
5420                 hci_conn_drop(conn);
5421                 hci_conn_put(conn);
5422         }
5423
5424         return err;
5425 }
5426
5427 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5428 {
5429         struct hci_cp_read_clock *hci_cp;
5430         struct mgmt_pending_cmd *cmd;
5431         struct hci_conn *conn;
5432
5433         BT_DBG("%s status %u", hdev->name, status);
5434
5435         hci_dev_lock(hdev);
5436
5437         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5438         if (!hci_cp)
5439                 goto unlock;
5440
5441         if (hci_cp->which) {
5442                 u16 handle = __le16_to_cpu(hci_cp->handle);
5443                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5444         } else {
5445                 conn = NULL;
5446         }
5447
5448         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5449         if (!cmd)
5450                 goto unlock;
5451
5452         cmd->cmd_complete(cmd, mgmt_status(status));
5453         mgmt_pending_remove(cmd);
5454
5455 unlock:
5456         hci_dev_unlock(hdev);
5457 }
5458
5459 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5460                          u16 len)
5461 {
5462         struct mgmt_cp_get_clock_info *cp = data;
5463         struct mgmt_rp_get_clock_info rp;
5464         struct hci_cp_read_clock hci_cp;
5465         struct mgmt_pending_cmd *cmd;
5466         struct hci_request req;
5467         struct hci_conn *conn;
5468         int err;
5469
5470         BT_DBG("%s", hdev->name);
5471
5472         memset(&rp, 0, sizeof(rp));
5473         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5474         rp.addr.type = cp->addr.type;
5475
5476         if (cp->addr.type != BDADDR_BREDR)
5477                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5478                                          MGMT_STATUS_INVALID_PARAMS,
5479                                          &rp, sizeof(rp));
5480
5481         hci_dev_lock(hdev);
5482
5483         if (!hdev_is_powered(hdev)) {
5484                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5485                                         MGMT_STATUS_NOT_POWERED, &rp,
5486                                         sizeof(rp));
5487                 goto unlock;
5488         }
5489
5490         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5491                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5492                                                &cp->addr.bdaddr);
5493                 if (!conn || conn->state != BT_CONNECTED) {
5494                         err = mgmt_cmd_complete(sk, hdev->id,
5495                                                 MGMT_OP_GET_CLOCK_INFO,
5496                                                 MGMT_STATUS_NOT_CONNECTED,
5497                                                 &rp, sizeof(rp));
5498                         goto unlock;
5499                 }
5500         } else {
5501                 conn = NULL;
5502         }
5503
5504         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5505         if (!cmd) {
5506                 err = -ENOMEM;
5507                 goto unlock;
5508         }
5509
5510         cmd->cmd_complete = clock_info_cmd_complete;
5511
5512         hci_req_init(&req, hdev);
5513
5514         memset(&hci_cp, 0, sizeof(hci_cp));
5515         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5516
5517         if (conn) {
5518                 hci_conn_hold(conn);
5519                 cmd->user_data = hci_conn_get(conn);
5520
5521                 hci_cp.handle = cpu_to_le16(conn->handle);
5522                 hci_cp.which = 0x01; /* Piconet clock */
5523                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5524         }
5525
5526         err = hci_req_run(&req, get_clock_info_complete);
5527         if (err < 0)
5528                 mgmt_pending_remove(cmd);
5529
5530 unlock:
5531         hci_dev_unlock(hdev);
5532         return err;
5533 }
5534
5535 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5536 {
5537         struct hci_conn *conn;
5538
5539         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5540         if (!conn)
5541                 return false;
5542
5543         if (conn->dst_type != type)
5544                 return false;
5545
5546         if (conn->state != BT_CONNECTED)
5547                 return false;
5548
5549         return true;
5550 }
5551
5552 /* This function requires the caller holds hdev->lock */
5553 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5554                                u8 addr_type, u8 auto_connect)
5555 {
5556         struct hci_conn_params *params;
5557
5558         params = hci_conn_params_add(hdev, addr, addr_type);
5559         if (!params)
5560                 return -EIO;
5561
5562         if (params->auto_connect == auto_connect)
5563                 return 0;
5564
5565         list_del_init(&params->action);
5566
5567         switch (auto_connect) {
5568         case HCI_AUTO_CONN_DISABLED:
5569         case HCI_AUTO_CONN_LINK_LOSS:
5570                 /* If auto connect is being disabled when we're trying to
5571                  * connect to device, keep connecting.
5572                  */
5573                 if (params->explicit_connect)
5574                         list_add(&params->action, &hdev->pend_le_conns);
5575                 break;
5576         case HCI_AUTO_CONN_REPORT:
5577                 if (params->explicit_connect)
5578                         list_add(&params->action, &hdev->pend_le_conns);
5579                 else
5580                         list_add(&params->action, &hdev->pend_le_reports);
5581                 break;
5582         case HCI_AUTO_CONN_DIRECT:
5583         case HCI_AUTO_CONN_ALWAYS:
5584                 if (!is_connected(hdev, addr, addr_type))
5585                         list_add(&params->action, &hdev->pend_le_conns);
5586                 break;
5587         }
5588
5589         params->auto_connect = auto_connect;
5590
5591         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5592                auto_connect);
5593
5594         return 0;
5595 }
5596
5597 static void device_added(struct sock *sk, struct hci_dev *hdev,
5598                          bdaddr_t *bdaddr, u8 type, u8 action)
5599 {
5600         struct mgmt_ev_device_added ev;
5601
5602         bacpy(&ev.addr.bdaddr, bdaddr);
5603         ev.addr.type = type;
5604         ev.action = action;
5605
5606         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5607 }
5608
5609 static int add_device(struct sock *sk, struct hci_dev *hdev,
5610                       void *data, u16 len)
5611 {
5612         struct mgmt_cp_add_device *cp = data;
5613         u8 auto_conn, addr_type;
5614         int err;
5615
5616         BT_DBG("%s", hdev->name);
5617
5618         if (!bdaddr_type_is_valid(cp->addr.type) ||
5619             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5620                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5621                                          MGMT_STATUS_INVALID_PARAMS,
5622                                          &cp->addr, sizeof(cp->addr));
5623
5624         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5625                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5626                                          MGMT_STATUS_INVALID_PARAMS,
5627                                          &cp->addr, sizeof(cp->addr));
5628
5629         hci_dev_lock(hdev);
5630
5631         if (cp->addr.type == BDADDR_BREDR) {
5632                 /* Only incoming connections action is supported for now */
5633                 if (cp->action != 0x01) {
5634                         err = mgmt_cmd_complete(sk, hdev->id,
5635                                                 MGMT_OP_ADD_DEVICE,
5636                                                 MGMT_STATUS_INVALID_PARAMS,
5637                                                 &cp->addr, sizeof(cp->addr));
5638                         goto unlock;
5639                 }
5640
5641                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5642                                           cp->addr.type);
5643                 if (err)
5644                         goto unlock;
5645
5646                 hci_req_update_scan(hdev);
5647
5648                 goto added;
5649         }
5650
5651         addr_type = le_addr_type(cp->addr.type);
5652
5653         if (cp->action == 0x02)
5654                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5655         else if (cp->action == 0x01)
5656                 auto_conn = HCI_AUTO_CONN_DIRECT;
5657         else
5658                 auto_conn = HCI_AUTO_CONN_REPORT;
5659
5660         /* Kernel internally uses conn_params with resolvable private
5661          * address, but Add Device allows only identity addresses.
5662          * Make sure it is enforced before calling
5663          * hci_conn_params_lookup.
5664          */
5665         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5666                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5667                                         MGMT_STATUS_INVALID_PARAMS,
5668                                         &cp->addr, sizeof(cp->addr));
5669                 goto unlock;
5670         }
5671
5672         /* If the connection parameters don't exist for this device,
5673          * they will be created and configured with defaults.
5674          */
5675         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5676                                 auto_conn) < 0) {
5677                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5678                                         MGMT_STATUS_FAILED, &cp->addr,
5679                                         sizeof(cp->addr));
5680                 goto unlock;
5681         }
5682
5683         hci_update_background_scan(hdev);
5684
5685 added:
5686         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5687
5688         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5689                                 MGMT_STATUS_SUCCESS, &cp->addr,
5690                                 sizeof(cp->addr));
5691
5692 unlock:
5693         hci_dev_unlock(hdev);
5694         return err;
5695 }
5696
5697 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5698                            bdaddr_t *bdaddr, u8 type)
5699 {
5700         struct mgmt_ev_device_removed ev;
5701
5702         bacpy(&ev.addr.bdaddr, bdaddr);
5703         ev.addr.type = type;
5704
5705         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5706 }
5707
5708 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5709                          void *data, u16 len)
5710 {
5711         struct mgmt_cp_remove_device *cp = data;
5712         int err;
5713
5714         BT_DBG("%s", hdev->name);
5715
5716         hci_dev_lock(hdev);
5717
5718         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5719                 struct hci_conn_params *params;
5720                 u8 addr_type;
5721
5722                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5723                         err = mgmt_cmd_complete(sk, hdev->id,
5724                                                 MGMT_OP_REMOVE_DEVICE,
5725                                                 MGMT_STATUS_INVALID_PARAMS,
5726                                                 &cp->addr, sizeof(cp->addr));
5727                         goto unlock;
5728                 }
5729
5730                 if (cp->addr.type == BDADDR_BREDR) {
5731                         err = hci_bdaddr_list_del(&hdev->whitelist,
5732                                                   &cp->addr.bdaddr,
5733                                                   cp->addr.type);
5734                         if (err) {
5735                                 err = mgmt_cmd_complete(sk, hdev->id,
5736                                                         MGMT_OP_REMOVE_DEVICE,
5737                                                         MGMT_STATUS_INVALID_PARAMS,
5738                                                         &cp->addr,
5739                                                         sizeof(cp->addr));
5740                                 goto unlock;
5741                         }
5742
5743                         hci_req_update_scan(hdev);
5744
5745                         device_removed(sk, hdev, &cp->addr.bdaddr,
5746                                        cp->addr.type);
5747                         goto complete;
5748                 }
5749
5750                 addr_type = le_addr_type(cp->addr.type);
5751
5752                 /* Kernel internally uses conn_params with resolvable private
5753                  * address, but Remove Device allows only identity addresses.
5754                  * Make sure it is enforced before calling
5755                  * hci_conn_params_lookup.
5756                  */
5757                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5758                         err = mgmt_cmd_complete(sk, hdev->id,
5759                                                 MGMT_OP_REMOVE_DEVICE,
5760                                                 MGMT_STATUS_INVALID_PARAMS,
5761                                                 &cp->addr, sizeof(cp->addr));
5762                         goto unlock;
5763                 }
5764
5765                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5766                                                 addr_type);
5767                 if (!params) {
5768                         err = mgmt_cmd_complete(sk, hdev->id,
5769                                                 MGMT_OP_REMOVE_DEVICE,
5770                                                 MGMT_STATUS_INVALID_PARAMS,
5771                                                 &cp->addr, sizeof(cp->addr));
5772                         goto unlock;
5773                 }
5774
5775                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5776                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5777                         err = mgmt_cmd_complete(sk, hdev->id,
5778                                                 MGMT_OP_REMOVE_DEVICE,
5779                                                 MGMT_STATUS_INVALID_PARAMS,
5780                                                 &cp->addr, sizeof(cp->addr));
5781                         goto unlock;
5782                 }
5783
5784                 list_del(&params->action);
5785                 list_del(&params->list);
5786                 kfree(params);
5787                 hci_update_background_scan(hdev);
5788
5789                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5790         } else {
5791                 struct hci_conn_params *p, *tmp;
5792                 struct bdaddr_list *b, *btmp;
5793
5794                 if (cp->addr.type) {
5795                         err = mgmt_cmd_complete(sk, hdev->id,
5796                                                 MGMT_OP_REMOVE_DEVICE,
5797                                                 MGMT_STATUS_INVALID_PARAMS,
5798                                                 &cp->addr, sizeof(cp->addr));
5799                         goto unlock;
5800                 }
5801
5802                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5803                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5804                         list_del(&b->list);
5805                         kfree(b);
5806                 }
5807
5808                 hci_req_update_scan(hdev);
5809
5810                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5811                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5812                                 continue;
5813                         device_removed(sk, hdev, &p->addr, p->addr_type);
5814                         if (p->explicit_connect) {
5815                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5816                                 continue;
5817                         }
5818                         list_del(&p->action);
5819                         list_del(&p->list);
5820                         kfree(p);
5821                 }
5822
5823                 BT_DBG("All LE connection parameters were removed");
5824
5825                 hci_update_background_scan(hdev);
5826         }
5827
5828 complete:
5829         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5830                                 MGMT_STATUS_SUCCESS, &cp->addr,
5831                                 sizeof(cp->addr));
5832 unlock:
5833         hci_dev_unlock(hdev);
5834         return err;
5835 }
5836
5837 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5838                            u16 len)
5839 {
5840         struct mgmt_cp_load_conn_param *cp = data;
5841         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5842                                      sizeof(struct mgmt_conn_param));
5843         u16 param_count, expected_len;
5844         int i;
5845
5846         if (!lmp_le_capable(hdev))
5847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5848                                        MGMT_STATUS_NOT_SUPPORTED);
5849
5850         param_count = __le16_to_cpu(cp->param_count);
5851         if (param_count > max_param_count) {
5852                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5853                            param_count);
5854                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5855                                        MGMT_STATUS_INVALID_PARAMS);
5856         }
5857
5858         expected_len = sizeof(*cp) + param_count *
5859                                         sizeof(struct mgmt_conn_param);
5860         if (expected_len != len) {
5861                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5862                            expected_len, len);
5863                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5864                                        MGMT_STATUS_INVALID_PARAMS);
5865         }
5866
5867         BT_DBG("%s param_count %u", hdev->name, param_count);
5868
5869         hci_dev_lock(hdev);
5870
5871         hci_conn_params_clear_disabled(hdev);
5872
5873         for (i = 0; i < param_count; i++) {
5874                 struct mgmt_conn_param *param = &cp->params[i];
5875                 struct hci_conn_params *hci_param;
5876                 u16 min, max, latency, timeout;
5877                 u8 addr_type;
5878
5879                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5880                        param->addr.type);
5881
5882                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5883                         addr_type = ADDR_LE_DEV_PUBLIC;
5884                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5885                         addr_type = ADDR_LE_DEV_RANDOM;
5886                 } else {
5887                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5888                         continue;
5889                 }
5890
5891                 min = le16_to_cpu(param->min_interval);
5892                 max = le16_to_cpu(param->max_interval);
5893                 latency = le16_to_cpu(param->latency);
5894                 timeout = le16_to_cpu(param->timeout);
5895
5896                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5897                        min, max, latency, timeout);
5898
5899                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5900                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5901                         continue;
5902                 }
5903
5904                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5905                                                 addr_type);
5906                 if (!hci_param) {
5907                         bt_dev_err(hdev, "failed to add connection parameters");
5908                         continue;
5909                 }
5910
5911                 hci_param->conn_min_interval = min;
5912                 hci_param->conn_max_interval = max;
5913                 hci_param->conn_latency = latency;
5914                 hci_param->supervision_timeout = timeout;
5915         }
5916
5917         hci_dev_unlock(hdev);
5918
5919         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5920                                  NULL, 0);
5921 }
5922
5923 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5924                                void *data, u16 len)
5925 {
5926         struct mgmt_cp_set_external_config *cp = data;
5927         bool changed;
5928         int err;
5929
5930         BT_DBG("%s", hdev->name);
5931
5932         if (hdev_is_powered(hdev))
5933                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5934                                        MGMT_STATUS_REJECTED);
5935
5936         if (cp->config != 0x00 && cp->config != 0x01)
5937                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5938                                          MGMT_STATUS_INVALID_PARAMS);
5939
5940         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5941                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5942                                        MGMT_STATUS_NOT_SUPPORTED);
5943
5944         hci_dev_lock(hdev);
5945
5946         if (cp->config)
5947                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5948         else
5949                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5950
5951         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5952         if (err < 0)
5953                 goto unlock;
5954
5955         if (!changed)
5956                 goto unlock;
5957
5958         err = new_options(hdev, sk);
5959
5960         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5961                 mgmt_index_removed(hdev);
5962
5963                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5964                         hci_dev_set_flag(hdev, HCI_CONFIG);
5965                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5966
5967                         queue_work(hdev->req_workqueue, &hdev->power_on);
5968                 } else {
5969                         set_bit(HCI_RAW, &hdev->flags);
5970                         mgmt_index_added(hdev);
5971                 }
5972         }
5973
5974 unlock:
5975         hci_dev_unlock(hdev);
5976         return err;
5977 }
5978
5979 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5980                               void *data, u16 len)
5981 {
5982         struct mgmt_cp_set_public_address *cp = data;
5983         bool changed;
5984         int err;
5985
5986         BT_DBG("%s", hdev->name);
5987
5988         if (hdev_is_powered(hdev))
5989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5990                                        MGMT_STATUS_REJECTED);
5991
5992         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5993                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5994                                        MGMT_STATUS_INVALID_PARAMS);
5995
5996         if (!hdev->set_bdaddr)
5997                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5998                                        MGMT_STATUS_NOT_SUPPORTED);
5999
6000         hci_dev_lock(hdev);
6001
6002         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6003         bacpy(&hdev->public_addr, &cp->bdaddr);
6004
6005         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6006         if (err < 0)
6007                 goto unlock;
6008
6009         if (!changed)
6010                 goto unlock;
6011
6012         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6013                 err = new_options(hdev, sk);
6014
6015         if (is_configured(hdev)) {
6016                 mgmt_index_removed(hdev);
6017
6018                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6019
6020                 hci_dev_set_flag(hdev, HCI_CONFIG);
6021                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6022
6023                 queue_work(hdev->req_workqueue, &hdev->power_on);
6024         }
6025
6026 unlock:
6027         hci_dev_unlock(hdev);
6028         return err;
6029 }
6030
6031 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6032                                              u16 opcode, struct sk_buff *skb)
6033 {
6034         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6035         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6036         u8 *h192, *r192, *h256, *r256;
6037         struct mgmt_pending_cmd *cmd;
6038         u16 eir_len;
6039         int err;
6040
6041         BT_DBG("%s status %u", hdev->name, status);
6042
6043         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6044         if (!cmd)
6045                 return;
6046
6047         mgmt_cp = cmd->param;
6048
6049         if (status) {
6050                 status = mgmt_status(status);
6051                 eir_len = 0;
6052
6053                 h192 = NULL;
6054                 r192 = NULL;
6055                 h256 = NULL;
6056                 r256 = NULL;
6057         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6058                 struct hci_rp_read_local_oob_data *rp;
6059
6060                 if (skb->len != sizeof(*rp)) {
6061                         status = MGMT_STATUS_FAILED;
6062                         eir_len = 0;
6063                 } else {
6064                         status = MGMT_STATUS_SUCCESS;
6065                         rp = (void *)skb->data;
6066
6067                         eir_len = 5 + 18 + 18;
6068                         h192 = rp->hash;
6069                         r192 = rp->rand;
6070                         h256 = NULL;
6071                         r256 = NULL;
6072                 }
6073         } else {
6074                 struct hci_rp_read_local_oob_ext_data *rp;
6075
6076                 if (skb->len != sizeof(*rp)) {
6077                         status = MGMT_STATUS_FAILED;
6078                         eir_len = 0;
6079                 } else {
6080                         status = MGMT_STATUS_SUCCESS;
6081                         rp = (void *)skb->data;
6082
6083                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6084                                 eir_len = 5 + 18 + 18;
6085                                 h192 = NULL;
6086                                 r192 = NULL;
6087                         } else {
6088                                 eir_len = 5 + 18 + 18 + 18 + 18;
6089                                 h192 = rp->hash192;
6090                                 r192 = rp->rand192;
6091                         }
6092
6093                         h256 = rp->hash256;
6094                         r256 = rp->rand256;
6095                 }
6096         }
6097
6098         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6099         if (!mgmt_rp)
6100                 goto done;
6101
6102         if (status)
6103                 goto send_rsp;
6104
6105         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6106                                   hdev->dev_class, 3);
6107
6108         if (h192 && r192) {
6109                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6110                                           EIR_SSP_HASH_C192, h192, 16);
6111                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6112                                           EIR_SSP_RAND_R192, r192, 16);
6113         }
6114
6115         if (h256 && r256) {
6116                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6117                                           EIR_SSP_HASH_C256, h256, 16);
6118                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6119                                           EIR_SSP_RAND_R256, r256, 16);
6120         }
6121
6122 send_rsp:
6123         mgmt_rp->type = mgmt_cp->type;
6124         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6125
6126         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6127                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6128                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6129         if (err < 0 || status)
6130                 goto done;
6131
6132         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6133
6134         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6135                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6136                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6137 done:
6138         kfree(mgmt_rp);
6139         mgmt_pending_remove(cmd);
6140 }
6141
6142 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6143                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6144 {
6145         struct mgmt_pending_cmd *cmd;
6146         struct hci_request req;
6147         int err;
6148
6149         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6150                                cp, sizeof(*cp));
6151         if (!cmd)
6152                 return -ENOMEM;
6153
6154         hci_req_init(&req, hdev);
6155
6156         if (bredr_sc_enabled(hdev))
6157                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6158         else
6159                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6160
6161         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6162         if (err < 0) {
6163                 mgmt_pending_remove(cmd);
6164                 return err;
6165         }
6166
6167         return 0;
6168 }
6169
6170 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6171                                    void *data, u16 data_len)
6172 {
6173         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6174         struct mgmt_rp_read_local_oob_ext_data *rp;
6175         size_t rp_len;
6176         u16 eir_len;
6177         u8 status, flags, role, addr[7], hash[16], rand[16];
6178         int err;
6179
6180         BT_DBG("%s", hdev->name);
6181
6182         if (hdev_is_powered(hdev)) {
6183                 switch (cp->type) {
6184                 case BIT(BDADDR_BREDR):
6185                         status = mgmt_bredr_support(hdev);
6186                         if (status)
6187                                 eir_len = 0;
6188                         else
6189                                 eir_len = 5;
6190                         break;
6191                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6192                         status = mgmt_le_support(hdev);
6193                         if (status)
6194                                 eir_len = 0;
6195                         else
6196                                 eir_len = 9 + 3 + 18 + 18 + 3;
6197                         break;
6198                 default:
6199                         status = MGMT_STATUS_INVALID_PARAMS;
6200                         eir_len = 0;
6201                         break;
6202                 }
6203         } else {
6204                 status = MGMT_STATUS_NOT_POWERED;
6205                 eir_len = 0;
6206         }
6207
6208         rp_len = sizeof(*rp) + eir_len;
6209         rp = kmalloc(rp_len, GFP_ATOMIC);
6210         if (!rp)
6211                 return -ENOMEM;
6212
6213         if (status)
6214                 goto complete;
6215
6216         hci_dev_lock(hdev);
6217
6218         eir_len = 0;
6219         switch (cp->type) {
6220         case BIT(BDADDR_BREDR):
6221                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6222                         err = read_local_ssp_oob_req(hdev, sk, cp);
6223                         hci_dev_unlock(hdev);
6224                         if (!err)
6225                                 goto done;
6226
6227                         status = MGMT_STATUS_FAILED;
6228                         goto complete;
6229                 } else {
6230                         eir_len = eir_append_data(rp->eir, eir_len,
6231                                                   EIR_CLASS_OF_DEV,
6232                                                   hdev->dev_class, 3);
6233                 }
6234                 break;
6235         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6236                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6237                     smp_generate_oob(hdev, hash, rand) < 0) {
6238                         hci_dev_unlock(hdev);
6239                         status = MGMT_STATUS_FAILED;
6240                         goto complete;
6241                 }
6242
6243                 /* This should return the active RPA, but since the RPA
6244                  * is only programmed on demand, it is really hard to fill
6245                  * this in at the moment. For now disallow retrieving
6246                  * local out-of-band data when privacy is in use.
6247                  *
6248                  * Returning the identity address will not help here since
6249                  * pairing happens before the identity resolving key is
6250                  * known and thus the connection establishment happens
6251                  * based on the RPA and not the identity address.
6252                  */
6253                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6254                         hci_dev_unlock(hdev);
6255                         status = MGMT_STATUS_REJECTED;
6256                         goto complete;
6257                 }
6258
6259                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6260                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6261                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6262                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6263                         memcpy(addr, &hdev->static_addr, 6);
6264                         addr[6] = 0x01;
6265                 } else {
6266                         memcpy(addr, &hdev->bdaddr, 6);
6267                         addr[6] = 0x00;
6268                 }
6269
6270                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6271                                           addr, sizeof(addr));
6272
6273                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6274                         role = 0x02;
6275                 else
6276                         role = 0x01;
6277
6278                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6279                                           &role, sizeof(role));
6280
6281                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6282                         eir_len = eir_append_data(rp->eir, eir_len,
6283                                                   EIR_LE_SC_CONFIRM,
6284                                                   hash, sizeof(hash));
6285
6286                         eir_len = eir_append_data(rp->eir, eir_len,
6287                                                   EIR_LE_SC_RANDOM,
6288                                                   rand, sizeof(rand));
6289                 }
6290
6291                 flags = mgmt_get_adv_discov_flags(hdev);
6292
6293                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6294                         flags |= LE_AD_NO_BREDR;
6295
6296                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6297                                           &flags, sizeof(flags));
6298                 break;
6299         }
6300
6301         hci_dev_unlock(hdev);
6302
6303         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6304
6305         status = MGMT_STATUS_SUCCESS;
6306
6307 complete:
6308         rp->type = cp->type;
6309         rp->eir_len = cpu_to_le16(eir_len);
6310
6311         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6312                                 status, rp, sizeof(*rp) + eir_len);
6313         if (err < 0 || status)
6314                 goto done;
6315
6316         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6317                                  rp, sizeof(*rp) + eir_len,
6318                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6319
6320 done:
6321         kfree(rp);
6322
6323         return err;
6324 }
6325
6326 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6327 {
6328         u32 flags = 0;
6329
6330         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6331         flags |= MGMT_ADV_FLAG_DISCOV;
6332         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6333         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6334         flags |= MGMT_ADV_FLAG_APPEARANCE;
6335         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6336
6337         /* In extended adv TX_POWER returned from Set Adv Param
6338          * will be always valid.
6339          */
6340         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6341             ext_adv_capable(hdev))
6342                 flags |= MGMT_ADV_FLAG_TX_POWER;
6343
6344         if (ext_adv_capable(hdev)) {
6345                 flags |= MGMT_ADV_FLAG_SEC_1M;
6346
6347                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6348                         flags |= MGMT_ADV_FLAG_SEC_2M;
6349
6350                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6351                         flags |= MGMT_ADV_FLAG_SEC_CODED;
6352         }
6353
6354         return flags;
6355 }
6356
6357 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6358                              void *data, u16 data_len)
6359 {
6360         struct mgmt_rp_read_adv_features *rp;
6361         size_t rp_len;
6362         int err;
6363         struct adv_info *adv_instance;
6364         u32 supported_flags;
6365         u8 *instance;
6366
6367         BT_DBG("%s", hdev->name);
6368
6369         if (!lmp_le_capable(hdev))
6370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6371                                        MGMT_STATUS_REJECTED);
6372
6373         hci_dev_lock(hdev);
6374
6375         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6376         rp = kmalloc(rp_len, GFP_ATOMIC);
6377         if (!rp) {
6378                 hci_dev_unlock(hdev);
6379                 return -ENOMEM;
6380         }
6381
6382         supported_flags = get_supported_adv_flags(hdev);
6383
6384         rp->supported_flags = cpu_to_le32(supported_flags);
6385         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6386         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6387         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6388         rp->num_instances = hdev->adv_instance_cnt;
6389
6390         instance = rp->instance;
6391         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6392                 *instance = adv_instance->instance;
6393                 instance++;
6394         }
6395
6396         hci_dev_unlock(hdev);
6397
6398         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6399                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6400
6401         kfree(rp);
6402
6403         return err;
6404 }
6405
6406 static u8 calculate_name_len(struct hci_dev *hdev)
6407 {
6408         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6409
6410         return append_local_name(hdev, buf, 0);
6411 }
6412
6413 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6414                            bool is_adv_data)
6415 {
6416         u8 max_len = HCI_MAX_AD_LENGTH;
6417
6418         if (is_adv_data) {
6419                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6420                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6421                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6422                         max_len -= 3;
6423
6424                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6425                         max_len -= 3;
6426         } else {
6427                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6428                         max_len -= calculate_name_len(hdev);
6429
6430                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6431                         max_len -= 4;
6432         }
6433
6434         return max_len;
6435 }
6436
6437 static bool flags_managed(u32 adv_flags)
6438 {
6439         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6440                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6441                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6442 }
6443
6444 static bool tx_power_managed(u32 adv_flags)
6445 {
6446         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6447 }
6448
6449 static bool name_managed(u32 adv_flags)
6450 {
6451         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6452 }
6453
6454 static bool appearance_managed(u32 adv_flags)
6455 {
6456         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6457 }
6458
6459 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6460                               u8 len, bool is_adv_data)
6461 {
6462         int i, cur_len;
6463         u8 max_len;
6464
6465         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6466
6467         if (len > max_len)
6468                 return false;
6469
6470         /* Make sure that the data is correctly formatted. */
6471         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6472                 cur_len = data[i];
6473
6474                 if (!cur_len)
6475                         continue;
6476
6477                 if (data[i + 1] == EIR_FLAGS &&
6478                     (!is_adv_data || flags_managed(adv_flags)))
6479                         return false;
6480
6481                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6482                         return false;
6483
6484                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6485                         return false;
6486
6487                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6488                         return false;
6489
6490                 if (data[i + 1] == EIR_APPEARANCE &&
6491                     appearance_managed(adv_flags))
6492                         return false;
6493
6494                 /* If the current field length would exceed the total data
6495                  * length, then it's invalid.
6496                  */
6497                 if (i + cur_len >= len)
6498                         return false;
6499         }
6500
6501         return true;
6502 }
6503
6504 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6505                                      u16 opcode)
6506 {
6507         struct mgmt_pending_cmd *cmd;
6508         struct mgmt_cp_add_advertising *cp;
6509         struct mgmt_rp_add_advertising rp;
6510         struct adv_info *adv_instance, *n;
6511         u8 instance;
6512
6513         BT_DBG("status %d", status);
6514
6515         hci_dev_lock(hdev);
6516
6517         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6518
6519         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6520                 if (!adv_instance->pending)
6521                         continue;
6522
6523                 if (!status) {
6524                         adv_instance->pending = false;
6525                         continue;
6526                 }
6527
6528                 instance = adv_instance->instance;
6529
6530                 if (hdev->cur_adv_instance == instance)
6531                         cancel_adv_timeout(hdev);
6532
6533                 hci_remove_adv_instance(hdev, instance);
6534                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6535         }
6536
6537         if (!cmd)
6538                 goto unlock;
6539
6540         cp = cmd->param;
6541         rp.instance = cp->instance;
6542
6543         if (status)
6544                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6545                                 mgmt_status(status));
6546         else
6547                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6548                                   mgmt_status(status), &rp, sizeof(rp));
6549
6550         mgmt_pending_remove(cmd);
6551
6552 unlock:
6553         hci_dev_unlock(hdev);
6554 }
6555
6556 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6557                            void *data, u16 data_len)
6558 {
6559         struct mgmt_cp_add_advertising *cp = data;
6560         struct mgmt_rp_add_advertising rp;
6561         u32 flags;
6562         u32 supported_flags, phy_flags;
6563         u8 status;
6564         u16 timeout, duration;
6565         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6566         u8 schedule_instance = 0;
6567         struct adv_info *next_instance;
6568         int err;
6569         struct mgmt_pending_cmd *cmd;
6570         struct hci_request req;
6571
6572         BT_DBG("%s", hdev->name);
6573
6574         status = mgmt_le_support(hdev);
6575         if (status)
6576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6577                                        status);
6578
6579         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6581                                        MGMT_STATUS_INVALID_PARAMS);
6582
6583         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6585                                        MGMT_STATUS_INVALID_PARAMS);
6586
6587         flags = __le32_to_cpu(cp->flags);
6588         timeout = __le16_to_cpu(cp->timeout);
6589         duration = __le16_to_cpu(cp->duration);
6590
6591         /* The current implementation only supports a subset of the specified
6592          * flags. Also need to check mutual exclusiveness of sec flags.
6593          */
6594         supported_flags = get_supported_adv_flags(hdev);
6595         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6596         if (flags & ~supported_flags ||
6597             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6598                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6599                                        MGMT_STATUS_INVALID_PARAMS);
6600
6601         hci_dev_lock(hdev);
6602
6603         if (timeout && !hdev_is_powered(hdev)) {
6604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6605                                       MGMT_STATUS_REJECTED);
6606                 goto unlock;
6607         }
6608
6609         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6610             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6611             pending_find(MGMT_OP_SET_LE, hdev)) {
6612                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6613                                       MGMT_STATUS_BUSY);
6614                 goto unlock;
6615         }
6616
6617         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6618             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6619                                cp->scan_rsp_len, false)) {
6620                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6621                                       MGMT_STATUS_INVALID_PARAMS);
6622                 goto unlock;
6623         }
6624
6625         err = hci_add_adv_instance(hdev, cp->instance, flags,
6626                                    cp->adv_data_len, cp->data,
6627                                    cp->scan_rsp_len,
6628                                    cp->data + cp->adv_data_len,
6629                                    timeout, duration);
6630         if (err < 0) {
6631                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6632                                       MGMT_STATUS_FAILED);
6633                 goto unlock;
6634         }
6635
6636         /* Only trigger an advertising added event if a new instance was
6637          * actually added.
6638          */
6639         if (hdev->adv_instance_cnt > prev_instance_cnt)
6640                 mgmt_advertising_added(sk, hdev, cp->instance);
6641
6642         if (hdev->cur_adv_instance == cp->instance) {
6643                 /* If the currently advertised instance is being changed then
6644                  * cancel the current advertising and schedule the next
6645                  * instance. If there is only one instance then the overridden
6646                  * advertising data will be visible right away.
6647                  */
6648                 cancel_adv_timeout(hdev);
6649
6650                 next_instance = hci_get_next_instance(hdev, cp->instance);
6651                 if (next_instance)
6652                         schedule_instance = next_instance->instance;
6653         } else if (!hdev->adv_instance_timeout) {
6654                 /* Immediately advertise the new instance if no other
6655                  * instance is currently being advertised.
6656                  */
6657                 schedule_instance = cp->instance;
6658         }
6659
6660         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6661          * there is no instance to be advertised then we have no HCI
6662          * communication to make. Simply return.
6663          */
6664         if (!hdev_is_powered(hdev) ||
6665             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6666             !schedule_instance) {
6667                 rp.instance = cp->instance;
6668                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6669                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6670                 goto unlock;
6671         }
6672
6673         /* We're good to go, update advertising data, parameters, and start
6674          * advertising.
6675          */
6676         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6677                                data_len);
6678         if (!cmd) {
6679                 err = -ENOMEM;
6680                 goto unlock;
6681         }
6682
6683         hci_req_init(&req, hdev);
6684
6685         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6686
6687         if (!err)
6688                 err = hci_req_run(&req, add_advertising_complete);
6689
6690         if (err < 0)
6691                 mgmt_pending_remove(cmd);
6692
6693 unlock:
6694         hci_dev_unlock(hdev);
6695
6696         return err;
6697 }
6698
6699 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6700                                         u16 opcode)
6701 {
6702         struct mgmt_pending_cmd *cmd;
6703         struct mgmt_cp_remove_advertising *cp;
6704         struct mgmt_rp_remove_advertising rp;
6705
6706         BT_DBG("status %d", status);
6707
6708         hci_dev_lock(hdev);
6709
6710         /* A failure status here only means that we failed to disable
6711          * advertising. Otherwise, the advertising instance has been removed,
6712          * so report success.
6713          */
6714         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6715         if (!cmd)
6716                 goto unlock;
6717
6718         cp = cmd->param;
6719         rp.instance = cp->instance;
6720
6721         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6722                           &rp, sizeof(rp));
6723         mgmt_pending_remove(cmd);
6724
6725 unlock:
6726         hci_dev_unlock(hdev);
6727 }
6728
6729 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6730                               void *data, u16 data_len)
6731 {
6732         struct mgmt_cp_remove_advertising *cp = data;
6733         struct mgmt_rp_remove_advertising rp;
6734         struct mgmt_pending_cmd *cmd;
6735         struct hci_request req;
6736         int err;
6737
6738         BT_DBG("%s", hdev->name);
6739
6740         hci_dev_lock(hdev);
6741
6742         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6743                 err = mgmt_cmd_status(sk, hdev->id,
6744                                       MGMT_OP_REMOVE_ADVERTISING,
6745                                       MGMT_STATUS_INVALID_PARAMS);
6746                 goto unlock;
6747         }
6748
6749         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6750             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6751             pending_find(MGMT_OP_SET_LE, hdev)) {
6752                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6753                                       MGMT_STATUS_BUSY);
6754                 goto unlock;
6755         }
6756
6757         if (list_empty(&hdev->adv_instances)) {
6758                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6759                                       MGMT_STATUS_INVALID_PARAMS);
6760                 goto unlock;
6761         }
6762
6763         hci_req_init(&req, hdev);
6764
6765         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6766
6767         if (list_empty(&hdev->adv_instances))
6768                 __hci_req_disable_advertising(&req);
6769
6770         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6771          * flag is set or the device isn't powered then we have no HCI
6772          * communication to make. Simply return.
6773          */
6774         if (skb_queue_empty(&req.cmd_q) ||
6775             !hdev_is_powered(hdev) ||
6776             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6777                 hci_req_purge(&req);
6778                 rp.instance = cp->instance;
6779                 err = mgmt_cmd_complete(sk, hdev->id,
6780                                         MGMT_OP_REMOVE_ADVERTISING,
6781                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6782                 goto unlock;
6783         }
6784
6785         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6786                                data_len);
6787         if (!cmd) {
6788                 err = -ENOMEM;
6789                 goto unlock;
6790         }
6791
6792         err = hci_req_run(&req, remove_advertising_complete);
6793         if (err < 0)
6794                 mgmt_pending_remove(cmd);
6795
6796 unlock:
6797         hci_dev_unlock(hdev);
6798
6799         return err;
6800 }
6801
6802 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6803                              void *data, u16 data_len)
6804 {
6805         struct mgmt_cp_get_adv_size_info *cp = data;
6806         struct mgmt_rp_get_adv_size_info rp;
6807         u32 flags, supported_flags;
6808         int err;
6809
6810         BT_DBG("%s", hdev->name);
6811
6812         if (!lmp_le_capable(hdev))
6813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6814                                        MGMT_STATUS_REJECTED);
6815
6816         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6817                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6818                                        MGMT_STATUS_INVALID_PARAMS);
6819
6820         flags = __le32_to_cpu(cp->flags);
6821
6822         /* The current implementation only supports a subset of the specified
6823          * flags.
6824          */
6825         supported_flags = get_supported_adv_flags(hdev);
6826         if (flags & ~supported_flags)
6827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6828                                        MGMT_STATUS_INVALID_PARAMS);
6829
6830         rp.instance = cp->instance;
6831         rp.flags = cp->flags;
6832         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6833         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6834
6835         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6836                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6837
6838         return err;
6839 }
6840
6841 static const struct hci_mgmt_handler mgmt_handlers[] = {
6842         { NULL }, /* 0x0000 (no command) */
6843         { read_version,            MGMT_READ_VERSION_SIZE,
6844                                                 HCI_MGMT_NO_HDEV |
6845                                                 HCI_MGMT_UNTRUSTED },
6846         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6847                                                 HCI_MGMT_NO_HDEV |
6848                                                 HCI_MGMT_UNTRUSTED },
6849         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6850                                                 HCI_MGMT_NO_HDEV |
6851                                                 HCI_MGMT_UNTRUSTED },
6852         { read_controller_info,    MGMT_READ_INFO_SIZE,
6853                                                 HCI_MGMT_UNTRUSTED },
6854         { set_powered,             MGMT_SETTING_SIZE },
6855         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6856         { set_connectable,         MGMT_SETTING_SIZE },
6857         { set_fast_connectable,    MGMT_SETTING_SIZE },
6858         { set_bondable,            MGMT_SETTING_SIZE },
6859         { set_link_security,       MGMT_SETTING_SIZE },
6860         { set_ssp,                 MGMT_SETTING_SIZE },
6861         { set_hs,                  MGMT_SETTING_SIZE },
6862         { set_le,                  MGMT_SETTING_SIZE },
6863         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6864         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6865         { add_uuid,                MGMT_ADD_UUID_SIZE },
6866         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6867         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6868                                                 HCI_MGMT_VAR_LEN },
6869         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6870                                                 HCI_MGMT_VAR_LEN },
6871         { disconnect,              MGMT_DISCONNECT_SIZE },
6872         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6873         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6874         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6875         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6876         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6877         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6878         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6879         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6880         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6881         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6882         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6883         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6884         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6885                                                 HCI_MGMT_VAR_LEN },
6886         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6887         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6888         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6889         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6890         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6891         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6892         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6893         { set_advertising,         MGMT_SETTING_SIZE },
6894         { set_bredr,               MGMT_SETTING_SIZE },
6895         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6896         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6897         { set_secure_conn,         MGMT_SETTING_SIZE },
6898         { set_debug_keys,          MGMT_SETTING_SIZE },
6899         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6900         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6901                                                 HCI_MGMT_VAR_LEN },
6902         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6903         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6904         { add_device,              MGMT_ADD_DEVICE_SIZE },
6905         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6906         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6907                                                 HCI_MGMT_VAR_LEN },
6908         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6909                                                 HCI_MGMT_NO_HDEV |
6910                                                 HCI_MGMT_UNTRUSTED },
6911         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6912                                                 HCI_MGMT_UNCONFIGURED |
6913                                                 HCI_MGMT_UNTRUSTED },
6914         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6915                                                 HCI_MGMT_UNCONFIGURED },
6916         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6917                                                 HCI_MGMT_UNCONFIGURED },
6918         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6919                                                 HCI_MGMT_VAR_LEN },
6920         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6921         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6922                                                 HCI_MGMT_NO_HDEV |
6923                                                 HCI_MGMT_UNTRUSTED },
6924         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6925         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6926                                                 HCI_MGMT_VAR_LEN },
6927         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6928         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6929         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6930         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6931                                                 HCI_MGMT_UNTRUSTED },
6932         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6933         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6934         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6935 };
6936
6937 void mgmt_index_added(struct hci_dev *hdev)
6938 {
6939         struct mgmt_ev_ext_index ev;
6940
6941         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6942                 return;
6943
6944         switch (hdev->dev_type) {
6945         case HCI_PRIMARY:
6946                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6947                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6948                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6949                         ev.type = 0x01;
6950                 } else {
6951                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6952                                          HCI_MGMT_INDEX_EVENTS);
6953                         ev.type = 0x00;
6954                 }
6955                 break;
6956         case HCI_AMP:
6957                 ev.type = 0x02;
6958                 break;
6959         default:
6960                 return;
6961         }
6962
6963         ev.bus = hdev->bus;
6964
6965         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6966                          HCI_MGMT_EXT_INDEX_EVENTS);
6967 }
6968
6969 void mgmt_index_removed(struct hci_dev *hdev)
6970 {
6971         struct mgmt_ev_ext_index ev;
6972         u8 status = MGMT_STATUS_INVALID_INDEX;
6973
6974         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6975                 return;
6976
6977         switch (hdev->dev_type) {
6978         case HCI_PRIMARY:
6979                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6980
6981                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6982                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6983                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6984                         ev.type = 0x01;
6985                 } else {
6986                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6987                                          HCI_MGMT_INDEX_EVENTS);
6988                         ev.type = 0x00;
6989                 }
6990                 break;
6991         case HCI_AMP:
6992                 ev.type = 0x02;
6993                 break;
6994         default:
6995                 return;
6996         }
6997
6998         ev.bus = hdev->bus;
6999
7000         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7001                          HCI_MGMT_EXT_INDEX_EVENTS);
7002 }
7003
7004 /* This function requires the caller holds hdev->lock */
7005 static void restart_le_actions(struct hci_dev *hdev)
7006 {
7007         struct hci_conn_params *p;
7008
7009         list_for_each_entry(p, &hdev->le_conn_params, list) {
7010                 /* Needed for AUTO_OFF case where might not "really"
7011                  * have been powered off.
7012                  */
7013                 list_del_init(&p->action);
7014
7015                 switch (p->auto_connect) {
7016                 case HCI_AUTO_CONN_DIRECT:
7017                 case HCI_AUTO_CONN_ALWAYS:
7018                         list_add(&p->action, &hdev->pend_le_conns);
7019                         break;
7020                 case HCI_AUTO_CONN_REPORT:
7021                         list_add(&p->action, &hdev->pend_le_reports);
7022                         break;
7023                 default:
7024                         break;
7025                 }
7026         }
7027 }
7028
7029 void mgmt_power_on(struct hci_dev *hdev, int err)
7030 {
7031         struct cmd_lookup match = { NULL, hdev };
7032
7033         BT_DBG("err %d", err);
7034
7035         hci_dev_lock(hdev);
7036
7037         if (!err) {
7038                 restart_le_actions(hdev);
7039                 hci_update_background_scan(hdev);
7040         }
7041
7042         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7043
7044         new_settings(hdev, match.sk);
7045
7046         if (match.sk)
7047                 sock_put(match.sk);
7048
7049         hci_dev_unlock(hdev);
7050 }
7051
7052 void __mgmt_power_off(struct hci_dev *hdev)
7053 {
7054         struct cmd_lookup match = { NULL, hdev };
7055         u8 status, zero_cod[] = { 0, 0, 0 };
7056
7057         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7058
7059         /* If the power off is because of hdev unregistration let
7060          * use the appropriate INVALID_INDEX status. Otherwise use
7061          * NOT_POWERED. We cover both scenarios here since later in
7062          * mgmt_index_removed() any hci_conn callbacks will have already
7063          * been triggered, potentially causing misleading DISCONNECTED
7064          * status responses.
7065          */
7066         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7067                 status = MGMT_STATUS_INVALID_INDEX;
7068         else
7069                 status = MGMT_STATUS_NOT_POWERED;
7070
7071         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7072
7073         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7074                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7075                                    zero_cod, sizeof(zero_cod),
7076                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7077                 ext_info_changed(hdev, NULL);
7078         }
7079
7080         new_settings(hdev, match.sk);
7081
7082         if (match.sk)
7083                 sock_put(match.sk);
7084 }
7085
7086 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7087 {
7088         struct mgmt_pending_cmd *cmd;
7089         u8 status;
7090
7091         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7092         if (!cmd)
7093                 return;
7094
7095         if (err == -ERFKILL)
7096                 status = MGMT_STATUS_RFKILLED;
7097         else
7098                 status = MGMT_STATUS_FAILED;
7099
7100         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7101
7102         mgmt_pending_remove(cmd);
7103 }
7104
7105 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7106                        bool persistent)
7107 {
7108         struct mgmt_ev_new_link_key ev;
7109
7110         memset(&ev, 0, sizeof(ev));
7111
7112         ev.store_hint = persistent;
7113         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7114         ev.key.addr.type = BDADDR_BREDR;
7115         ev.key.type = key->type;
7116         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7117         ev.key.pin_len = key->pin_len;
7118
7119         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7120 }
7121
7122 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7123 {
7124         switch (ltk->type) {
7125         case SMP_LTK:
7126         case SMP_LTK_SLAVE:
7127                 if (ltk->authenticated)
7128                         return MGMT_LTK_AUTHENTICATED;
7129                 return MGMT_LTK_UNAUTHENTICATED;
7130         case SMP_LTK_P256:
7131                 if (ltk->authenticated)
7132                         return MGMT_LTK_P256_AUTH;
7133                 return MGMT_LTK_P256_UNAUTH;
7134         case SMP_LTK_P256_DEBUG:
7135                 return MGMT_LTK_P256_DEBUG;
7136         }
7137
7138         return MGMT_LTK_UNAUTHENTICATED;
7139 }
7140
7141 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7142 {
7143         struct mgmt_ev_new_long_term_key ev;
7144
7145         memset(&ev, 0, sizeof(ev));
7146
7147         /* Devices using resolvable or non-resolvable random addresses
7148          * without providing an identity resolving key don't require
7149          * to store long term keys. Their addresses will change the
7150          * next time around.
7151          *
7152          * Only when a remote device provides an identity address
7153          * make sure the long term key is stored. If the remote
7154          * identity is known, the long term keys are internally
7155          * mapped to the identity address. So allow static random
7156          * and public addresses here.
7157          */
7158         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7159             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7160                 ev.store_hint = 0x00;
7161         else
7162                 ev.store_hint = persistent;
7163
7164         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7165         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7166         ev.key.type = mgmt_ltk_type(key);
7167         ev.key.enc_size = key->enc_size;
7168         ev.key.ediv = key->ediv;
7169         ev.key.rand = key->rand;
7170
7171         if (key->type == SMP_LTK)
7172                 ev.key.master = 1;
7173
7174         /* Make sure we copy only the significant bytes based on the
7175          * encryption key size, and set the rest of the value to zeroes.
7176          */
7177         memcpy(ev.key.val, key->val, key->enc_size);
7178         memset(ev.key.val + key->enc_size, 0,
7179                sizeof(ev.key.val) - key->enc_size);
7180
7181         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7182 }
7183
7184 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7185 {
7186         struct mgmt_ev_new_irk ev;
7187
7188         memset(&ev, 0, sizeof(ev));
7189
7190         ev.store_hint = persistent;
7191
7192         bacpy(&ev.rpa, &irk->rpa);
7193         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7194         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7195         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7196
7197         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7198 }
7199
7200 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7201                    bool persistent)
7202 {
7203         struct mgmt_ev_new_csrk ev;
7204
7205         memset(&ev, 0, sizeof(ev));
7206
7207         /* Devices using resolvable or non-resolvable random addresses
7208          * without providing an identity resolving key don't require
7209          * to store signature resolving keys. Their addresses will change
7210          * the next time around.
7211          *
7212          * Only when a remote device provides an identity address
7213          * make sure the signature resolving key is stored. So allow
7214          * static random and public addresses here.
7215          */
7216         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7217             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7218                 ev.store_hint = 0x00;
7219         else
7220                 ev.store_hint = persistent;
7221
7222         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7223         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7224         ev.key.type = csrk->type;
7225         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7226
7227         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7228 }
7229
7230 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7231                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7232                          u16 max_interval, u16 latency, u16 timeout)
7233 {
7234         struct mgmt_ev_new_conn_param ev;
7235
7236         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7237                 return;
7238
7239         memset(&ev, 0, sizeof(ev));
7240         bacpy(&ev.addr.bdaddr, bdaddr);
7241         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7242         ev.store_hint = store_hint;
7243         ev.min_interval = cpu_to_le16(min_interval);
7244         ev.max_interval = cpu_to_le16(max_interval);
7245         ev.latency = cpu_to_le16(latency);
7246         ev.timeout = cpu_to_le16(timeout);
7247
7248         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7249 }
7250
7251 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7252                            u32 flags, u8 *name, u8 name_len)
7253 {
7254         char buf[512];
7255         struct mgmt_ev_device_connected *ev = (void *) buf;
7256         u16 eir_len = 0;
7257
7258         bacpy(&ev->addr.bdaddr, &conn->dst);
7259         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7260
7261         ev->flags = __cpu_to_le32(flags);
7262
7263         /* We must ensure that the EIR Data fields are ordered and
7264          * unique. Keep it simple for now and avoid the problem by not
7265          * adding any BR/EDR data to the LE adv.
7266          */
7267         if (conn->le_adv_data_len > 0) {
7268                 memcpy(&ev->eir[eir_len],
7269                        conn->le_adv_data, conn->le_adv_data_len);
7270                 eir_len = conn->le_adv_data_len;
7271         } else {
7272                 if (name_len > 0)
7273                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7274                                                   name, name_len);
7275
7276                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7277                         eir_len = eir_append_data(ev->eir, eir_len,
7278                                                   EIR_CLASS_OF_DEV,
7279                                                   conn->dev_class, 3);
7280         }
7281
7282         ev->eir_len = cpu_to_le16(eir_len);
7283
7284         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7285                     sizeof(*ev) + eir_len, NULL);
7286 }
7287
7288 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7289 {
7290         struct sock **sk = data;
7291
7292         cmd->cmd_complete(cmd, 0);
7293
7294         *sk = cmd->sk;
7295         sock_hold(*sk);
7296
7297         mgmt_pending_remove(cmd);
7298 }
7299
7300 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7301 {
7302         struct hci_dev *hdev = data;
7303         struct mgmt_cp_unpair_device *cp = cmd->param;
7304
7305         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7306
7307         cmd->cmd_complete(cmd, 0);
7308         mgmt_pending_remove(cmd);
7309 }
7310
7311 bool mgmt_powering_down(struct hci_dev *hdev)
7312 {
7313         struct mgmt_pending_cmd *cmd;
7314         struct mgmt_mode *cp;
7315
7316         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7317         if (!cmd)
7318                 return false;
7319
7320         cp = cmd->param;
7321         if (!cp->val)
7322                 return true;
7323
7324         return false;
7325 }
7326
7327 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7328                               u8 link_type, u8 addr_type, u8 reason,
7329                               bool mgmt_connected)
7330 {
7331         struct mgmt_ev_device_disconnected ev;
7332         struct sock *sk = NULL;
7333
7334         /* The connection is still in hci_conn_hash so test for 1
7335          * instead of 0 to know if this is the last one.
7336          */
7337         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7338                 cancel_delayed_work(&hdev->power_off);
7339                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7340         }
7341
7342         if (!mgmt_connected)
7343                 return;
7344
7345         if (link_type != ACL_LINK && link_type != LE_LINK)
7346                 return;
7347
7348         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7349
7350         bacpy(&ev.addr.bdaddr, bdaddr);
7351         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7352         ev.reason = reason;
7353
7354         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7355
7356         if (sk)
7357                 sock_put(sk);
7358
7359         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7360                              hdev);
7361 }
7362
7363 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7364                             u8 link_type, u8 addr_type, u8 status)
7365 {
7366         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7367         struct mgmt_cp_disconnect *cp;
7368         struct mgmt_pending_cmd *cmd;
7369
7370         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7371                              hdev);
7372
7373         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7374         if (!cmd)
7375                 return;
7376
7377         cp = cmd->param;
7378
7379         if (bacmp(bdaddr, &cp->addr.bdaddr))
7380                 return;
7381
7382         if (cp->addr.type != bdaddr_type)
7383                 return;
7384
7385         cmd->cmd_complete(cmd, mgmt_status(status));
7386         mgmt_pending_remove(cmd);
7387 }
7388
7389 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7390                          u8 addr_type, u8 status)
7391 {
7392         struct mgmt_ev_connect_failed ev;
7393
7394         /* The connection is still in hci_conn_hash so test for 1
7395          * instead of 0 to know if this is the last one.
7396          */
7397         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7398                 cancel_delayed_work(&hdev->power_off);
7399                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7400         }
7401
7402         bacpy(&ev.addr.bdaddr, bdaddr);
7403         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7404         ev.status = mgmt_status(status);
7405
7406         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7407 }
7408
7409 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7410 {
7411         struct mgmt_ev_pin_code_request ev;
7412
7413         bacpy(&ev.addr.bdaddr, bdaddr);
7414         ev.addr.type = BDADDR_BREDR;
7415         ev.secure = secure;
7416
7417         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7418 }
7419
7420 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7421                                   u8 status)
7422 {
7423         struct mgmt_pending_cmd *cmd;
7424
7425         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7426         if (!cmd)
7427                 return;
7428
7429         cmd->cmd_complete(cmd, mgmt_status(status));
7430         mgmt_pending_remove(cmd);
7431 }
7432
7433 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7434                                       u8 status)
7435 {
7436         struct mgmt_pending_cmd *cmd;
7437
7438         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7439         if (!cmd)
7440                 return;
7441
7442         cmd->cmd_complete(cmd, mgmt_status(status));
7443         mgmt_pending_remove(cmd);
7444 }
7445
7446 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7447                               u8 link_type, u8 addr_type, u32 value,
7448                               u8 confirm_hint)
7449 {
7450         struct mgmt_ev_user_confirm_request ev;
7451
7452         BT_DBG("%s", hdev->name);
7453
7454         bacpy(&ev.addr.bdaddr, bdaddr);
7455         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7456         ev.confirm_hint = confirm_hint;
7457         ev.value = cpu_to_le32(value);
7458
7459         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7460                           NULL);
7461 }
7462
7463 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7464                               u8 link_type, u8 addr_type)
7465 {
7466         struct mgmt_ev_user_passkey_request ev;
7467
7468         BT_DBG("%s", hdev->name);
7469
7470         bacpy(&ev.addr.bdaddr, bdaddr);
7471         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7472
7473         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7474                           NULL);
7475 }
7476
7477 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7478                                       u8 link_type, u8 addr_type, u8 status,
7479                                       u8 opcode)
7480 {
7481         struct mgmt_pending_cmd *cmd;
7482
7483         cmd = pending_find(opcode, hdev);
7484         if (!cmd)
7485                 return -ENOENT;
7486
7487         cmd->cmd_complete(cmd, mgmt_status(status));
7488         mgmt_pending_remove(cmd);
7489
7490         return 0;
7491 }
7492
7493 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7494                                      u8 link_type, u8 addr_type, u8 status)
7495 {
7496         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7497                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7498 }
7499
7500 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7501                                          u8 link_type, u8 addr_type, u8 status)
7502 {
7503         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7504                                           status,
7505                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7506 }
7507
7508 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7509                                      u8 link_type, u8 addr_type, u8 status)
7510 {
7511         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7512                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7513 }
7514
7515 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7516                                          u8 link_type, u8 addr_type, u8 status)
7517 {
7518         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7519                                           status,
7520                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7521 }
7522
7523 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7524                              u8 link_type, u8 addr_type, u32 passkey,
7525                              u8 entered)
7526 {
7527         struct mgmt_ev_passkey_notify ev;
7528
7529         BT_DBG("%s", hdev->name);
7530
7531         bacpy(&ev.addr.bdaddr, bdaddr);
7532         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7533         ev.passkey = __cpu_to_le32(passkey);
7534         ev.entered = entered;
7535
7536         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7537 }
7538
7539 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7540 {
7541         struct mgmt_ev_auth_failed ev;
7542         struct mgmt_pending_cmd *cmd;
7543         u8 status = mgmt_status(hci_status);
7544
7545         bacpy(&ev.addr.bdaddr, &conn->dst);
7546         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7547         ev.status = status;
7548
7549         cmd = find_pairing(conn);
7550
7551         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7552                     cmd ? cmd->sk : NULL);
7553
7554         if (cmd) {
7555                 cmd->cmd_complete(cmd, status);
7556                 mgmt_pending_remove(cmd);
7557         }
7558 }
7559
7560 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7561 {
7562         struct cmd_lookup match = { NULL, hdev };
7563         bool changed;
7564
7565         if (status) {
7566                 u8 mgmt_err = mgmt_status(status);
7567                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7568                                      cmd_status_rsp, &mgmt_err);
7569                 return;
7570         }
7571
7572         if (test_bit(HCI_AUTH, &hdev->flags))
7573                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7574         else
7575                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7576
7577         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7578                              &match);
7579
7580         if (changed)
7581                 new_settings(hdev, match.sk);
7582
7583         if (match.sk)
7584                 sock_put(match.sk);
7585 }
7586
7587 static void clear_eir(struct hci_request *req)
7588 {
7589         struct hci_dev *hdev = req->hdev;
7590         struct hci_cp_write_eir cp;
7591
7592         if (!lmp_ext_inq_capable(hdev))
7593                 return;
7594
7595         memset(hdev->eir, 0, sizeof(hdev->eir));
7596
7597         memset(&cp, 0, sizeof(cp));
7598
7599         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7600 }
7601
7602 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7603 {
7604         struct cmd_lookup match = { NULL, hdev };
7605         struct hci_request req;
7606         bool changed = false;
7607
7608         if (status) {
7609                 u8 mgmt_err = mgmt_status(status);
7610
7611                 if (enable && hci_dev_test_and_clear_flag(hdev,
7612                                                           HCI_SSP_ENABLED)) {
7613                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7614                         new_settings(hdev, NULL);
7615                 }
7616
7617                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7618                                      &mgmt_err);
7619                 return;
7620         }
7621
7622         if (enable) {
7623                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7624         } else {
7625                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7626                 if (!changed)
7627                         changed = hci_dev_test_and_clear_flag(hdev,
7628                                                               HCI_HS_ENABLED);
7629                 else
7630                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7631         }
7632
7633         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7634
7635         if (changed)
7636                 new_settings(hdev, match.sk);
7637
7638         if (match.sk)
7639                 sock_put(match.sk);
7640
7641         hci_req_init(&req, hdev);
7642
7643         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7644                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7645                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7646                                     sizeof(enable), &enable);
7647                 __hci_req_update_eir(&req);
7648         } else {
7649                 clear_eir(&req);
7650         }
7651
7652         hci_req_run(&req, NULL);
7653 }
7654
7655 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7656 {
7657         struct cmd_lookup *match = data;
7658
7659         if (match->sk == NULL) {
7660                 match->sk = cmd->sk;
7661                 sock_hold(match->sk);
7662         }
7663 }
7664
7665 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7666                                     u8 status)
7667 {
7668         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7669
7670         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7671         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7672         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7673
7674         if (!status) {
7675                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7676                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7677                 ext_info_changed(hdev, NULL);
7678         }
7679
7680         if (match.sk)
7681                 sock_put(match.sk);
7682 }
7683
7684 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7685 {
7686         struct mgmt_cp_set_local_name ev;
7687         struct mgmt_pending_cmd *cmd;
7688
7689         if (status)
7690                 return;
7691
7692         memset(&ev, 0, sizeof(ev));
7693         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7694         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7695
7696         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7697         if (!cmd) {
7698                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7699
7700                 /* If this is a HCI command related to powering on the
7701                  * HCI dev don't send any mgmt signals.
7702                  */
7703                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7704                         return;
7705         }
7706
7707         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7708                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7709         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7710 }
7711
7712 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7713 {
7714         int i;
7715
7716         for (i = 0; i < uuid_count; i++) {
7717                 if (!memcmp(uuid, uuids[i], 16))
7718                         return true;
7719         }
7720
7721         return false;
7722 }
7723
7724 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7725 {
7726         u16 parsed = 0;
7727
7728         while (parsed < eir_len) {
7729                 u8 field_len = eir[0];
7730                 u8 uuid[16];
7731                 int i;
7732
7733                 if (field_len == 0)
7734                         break;
7735
7736                 if (eir_len - parsed < field_len + 1)
7737                         break;
7738
7739                 switch (eir[1]) {
7740                 case EIR_UUID16_ALL:
7741                 case EIR_UUID16_SOME:
7742                         for (i = 0; i + 3 <= field_len; i += 2) {
7743                                 memcpy(uuid, bluetooth_base_uuid, 16);
7744                                 uuid[13] = eir[i + 3];
7745                                 uuid[12] = eir[i + 2];
7746                                 if (has_uuid(uuid, uuid_count, uuids))
7747                                         return true;
7748                         }
7749                         break;
7750                 case EIR_UUID32_ALL:
7751                 case EIR_UUID32_SOME:
7752                         for (i = 0; i + 5 <= field_len; i += 4) {
7753                                 memcpy(uuid, bluetooth_base_uuid, 16);
7754                                 uuid[15] = eir[i + 5];
7755                                 uuid[14] = eir[i + 4];
7756                                 uuid[13] = eir[i + 3];
7757                                 uuid[12] = eir[i + 2];
7758                                 if (has_uuid(uuid, uuid_count, uuids))
7759                                         return true;
7760                         }
7761                         break;
7762                 case EIR_UUID128_ALL:
7763                 case EIR_UUID128_SOME:
7764                         for (i = 0; i + 17 <= field_len; i += 16) {
7765                                 memcpy(uuid, eir + i + 2, 16);
7766                                 if (has_uuid(uuid, uuid_count, uuids))
7767                                         return true;
7768                         }
7769                         break;
7770                 }
7771
7772                 parsed += field_len + 1;
7773                 eir += field_len + 1;
7774         }
7775
7776         return false;
7777 }
7778
7779 static void restart_le_scan(struct hci_dev *hdev)
7780 {
7781         /* If controller is not scanning we are done. */
7782         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7783                 return;
7784
7785         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7786                        hdev->discovery.scan_start +
7787                        hdev->discovery.scan_duration))
7788                 return;
7789
7790         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7791                            DISCOV_LE_RESTART_DELAY);
7792 }
7793
7794 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7795                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7796 {
7797         /* If a RSSI threshold has been specified, and
7798          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7799          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7800          * is set, let it through for further processing, as we might need to
7801          * restart the scan.
7802          *
7803          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7804          * the results are also dropped.
7805          */
7806         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7807             (rssi == HCI_RSSI_INVALID ||
7808             (rssi < hdev->discovery.rssi &&
7809              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7810                 return  false;
7811
7812         if (hdev->discovery.uuid_count != 0) {
7813                 /* If a list of UUIDs is provided in filter, results with no
7814                  * matching UUID should be dropped.
7815                  */
7816                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7817                                    hdev->discovery.uuids) &&
7818                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7819                                    hdev->discovery.uuid_count,
7820                                    hdev->discovery.uuids))
7821                         return false;
7822         }
7823
7824         /* If duplicate filtering does not report RSSI changes, then restart
7825          * scanning to ensure updated result with updated RSSI values.
7826          */
7827         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7828                 restart_le_scan(hdev);
7829
7830                 /* Validate RSSI value against the RSSI threshold once more. */
7831                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7832                     rssi < hdev->discovery.rssi)
7833                         return false;
7834         }
7835
7836         return true;
7837 }
7838
7839 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7840                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7841                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7842 {
7843         char buf[512];
7844         struct mgmt_ev_device_found *ev = (void *)buf;
7845         size_t ev_size;
7846
7847         /* Don't send events for a non-kernel initiated discovery. With
7848          * LE one exception is if we have pend_le_reports > 0 in which
7849          * case we're doing passive scanning and want these events.
7850          */
7851         if (!hci_discovery_active(hdev)) {
7852                 if (link_type == ACL_LINK)
7853                         return;
7854                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7855                         return;
7856         }
7857
7858         if (hdev->discovery.result_filtering) {
7859                 /* We are using service discovery */
7860                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7861                                      scan_rsp_len))
7862                         return;
7863         }
7864
7865         if (hdev->discovery.limited) {
7866                 /* Check for limited discoverable bit */
7867                 if (dev_class) {
7868                         if (!(dev_class[1] & 0x20))
7869                                 return;
7870                 } else {
7871                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7872                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7873                                 return;
7874                 }
7875         }
7876
7877         /* Make sure that the buffer is big enough. The 5 extra bytes
7878          * are for the potential CoD field.
7879          */
7880         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7881                 return;
7882
7883         memset(buf, 0, sizeof(buf));
7884
7885         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7886          * RSSI value was reported as 0 when not available. This behavior
7887          * is kept when using device discovery. This is required for full
7888          * backwards compatibility with the API.
7889          *
7890          * However when using service discovery, the value 127 will be
7891          * returned when the RSSI is not available.
7892          */
7893         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7894             link_type == ACL_LINK)
7895                 rssi = 0;
7896
7897         bacpy(&ev->addr.bdaddr, bdaddr);
7898         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7899         ev->rssi = rssi;
7900         ev->flags = cpu_to_le32(flags);
7901
7902         if (eir_len > 0)
7903                 /* Copy EIR or advertising data into event */
7904                 memcpy(ev->eir, eir, eir_len);
7905
7906         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7907                                        NULL))
7908                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7909                                           dev_class, 3);
7910
7911         if (scan_rsp_len > 0)
7912                 /* Append scan response data to event */
7913                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7914
7915         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7916         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7917
7918         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7919 }
7920
7921 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7922                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7923 {
7924         struct mgmt_ev_device_found *ev;
7925         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7926         u16 eir_len;
7927
7928         ev = (struct mgmt_ev_device_found *) buf;
7929
7930         memset(buf, 0, sizeof(buf));
7931
7932         bacpy(&ev->addr.bdaddr, bdaddr);
7933         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7934         ev->rssi = rssi;
7935
7936         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7937                                   name_len);
7938
7939         ev->eir_len = cpu_to_le16(eir_len);
7940
7941         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7942 }
7943
7944 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7945 {
7946         struct mgmt_ev_discovering ev;
7947
7948         BT_DBG("%s discovering %u", hdev->name, discovering);
7949
7950         memset(&ev, 0, sizeof(ev));
7951         ev.type = hdev->discovery.type;
7952         ev.discovering = discovering;
7953
7954         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7955 }
7956
7957 static struct hci_mgmt_chan chan = {
7958         .channel        = HCI_CHANNEL_CONTROL,
7959         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7960         .handlers       = mgmt_handlers,
7961         .hdev_init      = mgmt_init_hdev,
7962 };
7963
7964 int mgmt_init(void)
7965 {
7966         return hci_mgmt_chan_register(&chan);
7967 }
7968
7969 void mgmt_exit(void)
7970 {
7971         hci_mgmt_chan_unregister(&chan);
7972 }