net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 223         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 225         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 226         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 227         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 228         MGMT_STATUS_FAILED,             /* Slot Violation */
 229         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 230         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 231         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 232         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 233         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 234         MGMT_STATUS_BUSY,               /* Controller Busy */
 235         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 236         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 237         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 238         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 239         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 240 };
 241
 242 static u8 mgmt_status(u8 hci_status)
 243 {
 244         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245                 return mgmt_status_table[hci_status];
 246
 247         return MGMT_STATUS_FAILED;
 248 }
 249
 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251                             u16 len, int flag)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, NULL);
 255 }
 256
 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, int flag, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                flag, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 void mgmt_fill_version_info(void *ver)
 280 {
 281         struct mgmt_rp_read_version *rp = ver;
 282
 283         rp->version = MGMT_VERSION;
 284         rp->revision = cpu_to_le16(MGMT_REVISION);
 285 }
 286
 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288                         u16 data_len)
 289 {
 290         struct mgmt_rp_read_version rp;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         mgmt_fill_version_info(&rp);
 295
 296         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297                                  &rp, sizeof(rp));
 298 }
 299
 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301                          u16 data_len)
 302 {
 303         struct mgmt_rp_read_commands *rp;
 304         u16 num_commands, num_events;
 305         size_t rp_size;
 306         int i, err;
 307
 308         BT_DBG("sock %p", sk);
 309
 310         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311                 num_commands = ARRAY_SIZE(mgmt_commands);
 312                 num_events = ARRAY_SIZE(mgmt_events);
 313         } else {
 314                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316         }
 317
 318         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320         rp = kmalloc(rp_size, GFP_KERNEL);
 321         if (!rp)
 322                 return -ENOMEM;
 323
 324         rp->num_commands = cpu_to_le16(num_commands);
 325         rp->num_events = cpu_to_le16(num_events);
 326
 327         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328                 __le16 *opcode = rp->opcodes;
 329
 330                 for (i = 0; i < num_commands; i++, opcode++)
 331                         put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333                 for (i = 0; i < num_events; i++, opcode++)
 334                         put_unaligned_le16(mgmt_events[i], opcode);
 335         } else {
 336                 __le16 *opcode = rp->opcodes;
 337
 338                 for (i = 0; i < num_commands; i++, opcode++)
 339                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341                 for (i = 0; i < num_events; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343         }
 344
 345         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346                                 rp, rp_size);
 347         kfree(rp);
 348
 349         return err;
 350 }
 351
 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353                            u16 data_len)
 354 {
 355         struct mgmt_rp_read_index_list *rp;
 356         struct hci_dev *d;
 357         size_t rp_len;
 358         u16 count;
 359         int err;
 360
 361         BT_DBG("sock %p", sk);
 362
 363         read_lock(&hci_dev_list_lock);
 364
 365         count = 0;
 366         list_for_each_entry(d, &hci_dev_list, list) {
 367                 if (d->dev_type == HCI_PRIMARY &&
 368                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369                         count++;
 370         }
 371
 372         rp_len = sizeof(*rp) + (2 * count);
 373         rp = kmalloc(rp_len, GFP_ATOMIC);
 374         if (!rp) {
 375                 read_unlock(&hci_dev_list_lock);
 376                 return -ENOMEM;
 377         }
 378
 379         count = 0;
 380         list_for_each_entry(d, &hci_dev_list, list) {
 381                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 382                     hci_dev_test_flag(d, HCI_CONFIG) ||
 383                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384                         continue;
 385
 386                 /* Devices marked as raw-only are neither configured
 387                  * nor unconfigured controllers.
 388                  */
 389                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390                         continue;
 391
 392                 if (d->dev_type == HCI_PRIMARY &&
 393                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394                         rp->index[count++] = cpu_to_le16(d->id);
 395                         BT_DBG("Added hci%u", d->id);
 396                 }
 397         }
 398
 399         rp->num_controllers = cpu_to_le16(count);
 400         rp_len = sizeof(*rp) + (2 * count);
 401
 402         read_unlock(&hci_dev_list_lock);
 403
 404         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405                                 0, rp, rp_len);
 406
 407         kfree(rp);
 408
 409         return err;
 410 }
 411
 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413                                   void *data, u16 data_len)
 414 {
 415         struct mgmt_rp_read_unconf_index_list *rp;
 416         struct hci_dev *d;
 417         size_t rp_len;
 418         u16 count;
 419         int err;
 420
 421         BT_DBG("sock %p", sk);
 422
 423         read_lock(&hci_dev_list_lock);
 424
 425         count = 0;
 426         list_for_each_entry(d, &hci_dev_list, list) {
 427                 if (d->dev_type == HCI_PRIMARY &&
 428                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429                         count++;
 430         }
 431
 432         rp_len = sizeof(*rp) + (2 * count);
 433         rp = kmalloc(rp_len, GFP_ATOMIC);
 434         if (!rp) {
 435                 read_unlock(&hci_dev_list_lock);
 436                 return -ENOMEM;
 437         }
 438
 439         count = 0;
 440         list_for_each_entry(d, &hci_dev_list, list) {
 441                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 442                     hci_dev_test_flag(d, HCI_CONFIG) ||
 443                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444                         continue;
 445
 446                 /* Devices marked as raw-only are neither configured
 447                  * nor unconfigured controllers.
 448                  */
 449                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450                         continue;
 451
 452                 if (d->dev_type == HCI_PRIMARY &&
 453                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454                         rp->index[count++] = cpu_to_le16(d->id);
 455                         BT_DBG("Added hci%u", d->id);
 456                 }
 457         }
 458
 459         rp->num_controllers = cpu_to_le16(count);
 460         rp_len = sizeof(*rp) + (2 * count);
 461
 462         read_unlock(&hci_dev_list_lock);
 463
 464         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467         kfree(rp);
 468
 469         return err;
 470 }
 471
 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473                                void *data, u16 data_len)
 474 {
 475         struct mgmt_rp_read_ext_index_list *rp;
 476         struct hci_dev *d;
 477         size_t rp_len;
 478         u16 count;
 479         int err;
 480
 481         BT_DBG("sock %p", sk);
 482
 483         read_lock(&hci_dev_list_lock);
 484
 485         count = 0;
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 488                         count++;
 489         }
 490
 491         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 492         rp = kmalloc(rp_len, GFP_ATOMIC);
 493         if (!rp) {
 494                 read_unlock(&hci_dev_list_lock);
 495                 return -ENOMEM;
 496         }
 497
 498         count = 0;
 499         list_for_each_entry(d, &hci_dev_list, list) {
 500                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 501                     hci_dev_test_flag(d, HCI_CONFIG) ||
 502                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 503                         continue;
 504
 505                 /* Devices marked as raw-only are neither configured
 506                  * nor unconfigured controllers.
 507                  */
 508                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 509                         continue;
 510
 511                 if (d->dev_type == HCI_PRIMARY) {
 512                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 513                                 rp->entry[count].type = 0x01;
 514                         else
 515                                 rp->entry[count].type = 0x00;
 516                 } else if (d->dev_type == HCI_AMP) {
 517                         rp->entry[count].type = 0x02;
 518                 } else {
 519                         continue;
 520                 }
 521
 522                 rp->entry[count].bus = d->bus;
 523                 rp->entry[count++].index = cpu_to_le16(d->id);
 524                 BT_DBG("Added hci%u", d->id);
 525         }
 526
 527         rp->num_controllers = cpu_to_le16(count);
 528         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 542
 543         kfree(rp);
 544
 545         return err;
 546 }
 547
 548 static bool is_configured(struct hci_dev *hdev)
 549 {
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 return false;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 return false;
 557
 558         return true;
 559 }
 560
 561 static __le32 get_missing_options(struct hci_dev *hdev)
 562 {
 563         u32 options = 0;
 564
 565         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 566             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 567                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 568
 569         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 570             !bacmp(&hdev->public_addr, BDADDR_ANY))
 571                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573         return cpu_to_le32(options);
 574 }
 575
 576 static int new_options(struct hci_dev *hdev, struct sock *skip)
 577 {
 578         __le32 options = get_missing_options(hdev);
 579
 580         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582 }
 583
 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585 {
 586         __le32 options = get_missing_options(hdev);
 587
 588         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589                                  sizeof(options));
 590 }
 591
 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593                             void *data, u16 data_len)
 594 {
 595         struct mgmt_rp_read_config_info rp;
 596         u32 options = 0;
 597
 598         BT_DBG("sock %p %s", sk, hdev->name);
 599
 600         hci_dev_lock(hdev);
 601
 602         memset(&rp, 0, sizeof(rp));
 603         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if (hdev->set_bdaddr)
 609                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611         rp.supported_options = cpu_to_le32(options);
 612         rp.missing_options = get_missing_options(hdev);
 613
 614         hci_dev_unlock(hdev);
 615
 616         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617                                  &rp, sizeof(rp));
 618 }
 619
 620 static u32 get_supported_phys(struct hci_dev *hdev)
 621 {
 622         u32 supported_phys = 0;
 623
 624         if (lmp_bredr_capable(hdev)) {
 625                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 626
 627                 if (hdev->features[0][0] & LMP_3SLOT)
 628                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_5SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 632
 633                 if (lmp_edr_2m_capable(hdev)) {
 634                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 635
 636                         if (lmp_edr_3slot_capable(hdev))
 637                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 638
 639                         if (lmp_edr_5slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 641
 642                         if (lmp_edr_3m_capable(hdev)) {
 643                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 644
 645                                 if (lmp_edr_3slot_capable(hdev))
 646                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 647
 648                                 if (lmp_edr_5slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 650                         }
 651                 }
 652         }
 653
 654         if (lmp_le_capable(hdev)) {
 655                 supported_phys |= MGMT_PHY_LE_1M_TX;
 656                 supported_phys |= MGMT_PHY_LE_1M_RX;
 657
 658                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 659                         supported_phys |= MGMT_PHY_LE_2M_TX;
 660                         supported_phys |= MGMT_PHY_LE_2M_RX;
 661                 }
 662
 663                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 664                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 665                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 666                 }
 667         }
 668
 669         return supported_phys;
 670 }
 671
 672 static u32 get_selected_phys(struct hci_dev *hdev)
 673 {
 674         u32 selected_phys = 0;
 675
 676         if (lmp_bredr_capable(hdev)) {
 677                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 678
 679                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 680                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 683                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 684
 685                 if (lmp_edr_2m_capable(hdev)) {
 686                         if (!(hdev->pkt_type & HCI_2DH1))
 687                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 688
 689                         if (lmp_edr_3slot_capable(hdev) &&
 690                             !(hdev->pkt_type & HCI_2DH3))
 691                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 692
 693                         if (lmp_edr_5slot_capable(hdev) &&
 694                             !(hdev->pkt_type & HCI_2DH5))
 695                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 696
 697                         if (lmp_edr_3m_capable(hdev)) {
 698                                 if (!(hdev->pkt_type & HCI_3DH1))
 699                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 700
 701                                 if (lmp_edr_3slot_capable(hdev) &&
 702                                     !(hdev->pkt_type & HCI_3DH3))
 703                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 704
 705                                 if (lmp_edr_5slot_capable(hdev) &&
 706                                     !(hdev->pkt_type & HCI_3DH5))
 707                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 708                         }
 709                 }
 710         }
 711
 712         if (lmp_le_capable(hdev)) {
 713                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 714                         selected_phys |= MGMT_PHY_LE_1M_TX;
 715
 716                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_RX;
 718
 719                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 720                         selected_phys |= MGMT_PHY_LE_2M_TX;
 721
 722                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_RX;
 724
 725                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 726                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 727
 728                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 730         }
 731
 732         return selected_phys;
 733 }
 734
 735 static u32 get_configurable_phys(struct hci_dev *hdev)
 736 {
 737         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 738                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 739 }
 740
 741 static u32 get_supported_settings(struct hci_dev *hdev)
 742 {
 743         u32 settings = 0;
 744
 745         settings |= MGMT_SETTING_POWERED;
 746         settings |= MGMT_SETTING_BONDABLE;
 747         settings |= MGMT_SETTING_DEBUG_KEYS;
 748         settings |= MGMT_SETTING_CONNECTABLE;
 749         settings |= MGMT_SETTING_DISCOVERABLE;
 750
 751         if (lmp_bredr_capable(hdev)) {
 752                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 753                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 754                 settings |= MGMT_SETTING_BREDR;
 755                 settings |= MGMT_SETTING_LINK_SECURITY;
 756
 757                 if (lmp_ssp_capable(hdev)) {
 758                         settings |= MGMT_SETTING_SSP;
 759                         settings |= MGMT_SETTING_HS;
 760                 }
 761
 762                 if (lmp_sc_capable(hdev))
 763                         settings |= MGMT_SETTING_SECURE_CONN;
 764         }
 765
 766         if (lmp_le_capable(hdev)) {
 767                 settings |= MGMT_SETTING_LE;
 768                 settings |= MGMT_SETTING_ADVERTISING;
 769                 settings |= MGMT_SETTING_SECURE_CONN;
 770                 settings |= MGMT_SETTING_PRIVACY;
 771                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 772         }
 773
 774         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 775             hdev->set_bdaddr)
 776                 settings |= MGMT_SETTING_CONFIGURATION;
 777
 778         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 779
 780         return settings;
 781 }
 782
 783 static u32 get_current_settings(struct hci_dev *hdev)
 784 {
 785         u32 settings = 0;
 786
 787         if (hdev_is_powered(hdev))
 788                 settings |= MGMT_SETTING_POWERED;
 789
 790         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 791                 settings |= MGMT_SETTING_CONNECTABLE;
 792
 793         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 794                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 795
 796         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 797                 settings |= MGMT_SETTING_DISCOVERABLE;
 798
 799         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 800                 settings |= MGMT_SETTING_BONDABLE;
 801
 802         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 803                 settings |= MGMT_SETTING_BREDR;
 804
 805         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 806                 settings |= MGMT_SETTING_LE;
 807
 808         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 809                 settings |= MGMT_SETTING_LINK_SECURITY;
 810
 811         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 812                 settings |= MGMT_SETTING_SSP;
 813
 814         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 815                 settings |= MGMT_SETTING_HS;
 816
 817         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 818                 settings |= MGMT_SETTING_ADVERTISING;
 819
 820         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 821                 settings |= MGMT_SETTING_SECURE_CONN;
 822
 823         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 824                 settings |= MGMT_SETTING_DEBUG_KEYS;
 825
 826         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 827                 settings |= MGMT_SETTING_PRIVACY;
 828
 829         /* The current setting for static address has two purposes. The
 830          * first is to indicate if the static address will be used and
 831          * the second is to indicate if it is actually set.
 832          *
 833          * This means if the static address is not configured, this flag
 834          * will never be set. If the address is configured, then if the
 835          * address is actually used decides if the flag is set or not.
 836          *
 837          * For single mode LE only controllers and dual-mode controllers
 838          * with BR/EDR disabled, the existence of the static address will
 839          * be evaluated.
 840          */
 841         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 842             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 843             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 844                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 845                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 846         }
 847
 848         return settings;
 849 }
 850
 851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 852 {
 853         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 854 }
 855
 856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 857                                                   struct hci_dev *hdev,
 858                                                   const void *data)
 859 {
 860         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 861 }
 862
 863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 864 {
 865         struct mgmt_pending_cmd *cmd;
 866
 867         /* If there's a pending mgmt command the flags will not yet have
 868          * their final values, so check for this first.
 869          */
 870         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 871         if (cmd) {
 872                 struct mgmt_mode *cp = cmd->param;
 873                 if (cp->val == 0x01)
 874                         return LE_AD_GENERAL;
 875                 else if (cp->val == 0x02)
 876                         return LE_AD_LIMITED;
 877         } else {
 878                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 879                         return LE_AD_LIMITED;
 880                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 881                         return LE_AD_GENERAL;
 882         }
 883
 884         return 0;
 885 }
 886
 887 bool mgmt_get_connectable(struct hci_dev *hdev)
 888 {
 889         struct mgmt_pending_cmd *cmd;
 890
 891         /* If there's a pending mgmt command the flag will not yet have
 892          * it's final value, so check for this first.
 893          */
 894         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 895         if (cmd) {
 896                 struct mgmt_mode *cp = cmd->param;
 897
 898                 return cp->val;
 899         }
 900
 901         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 902 }
 903
 904 static void service_cache_off(struct work_struct *work)
 905 {
 906         struct hci_dev *hdev = container_of(work, struct hci_dev,
 907                                             service_cache.work);
 908         struct hci_request req;
 909
 910         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 911                 return;
 912
 913         hci_req_init(&req, hdev);
 914
 915         hci_dev_lock(hdev);
 916
 917         __hci_req_update_eir(&req);
 918         __hci_req_update_class(&req);
 919
 920         hci_dev_unlock(hdev);
 921
 922         hci_req_run(&req, NULL);
 923 }
 924
 925 static void rpa_expired(struct work_struct *work)
 926 {
 927         struct hci_dev *hdev = container_of(work, struct hci_dev,
 928                                             rpa_expired.work);
 929         struct hci_request req;
 930
 931         BT_DBG("");
 932
 933         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 934
 935         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 936                 return;
 937
 938         /* The generation of a new RPA and programming it into the
 939          * controller happens in the hci_req_enable_advertising()
 940          * function.
 941          */
 942         hci_req_init(&req, hdev);
 943         if (ext_adv_capable(hdev))
 944                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 945         else
 946                 __hci_req_enable_advertising(&req);
 947         hci_req_run(&req, NULL);
 948 }
 949
 950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 951 {
 952         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 953                 return;
 954
 955         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 956         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 957
 958         /* Non-mgmt controlled devices get this bit set
 959          * implicitly so that pairing works for them, however
 960          * for mgmt we require user-space to explicitly enable
 961          * it
 962          */
 963         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 964 }
 965
 966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 967                                 void *data, u16 data_len)
 968 {
 969         struct mgmt_rp_read_info rp;
 970
 971         BT_DBG("sock %p %s", sk, hdev->name);
 972
 973         hci_dev_lock(hdev);
 974
 975         memset(&rp, 0, sizeof(rp));
 976
 977         bacpy(&rp.bdaddr, &hdev->bdaddr);
 978
 979         rp.version = hdev->hci_ver;
 980         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 981
 982         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 983         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 984
 985         memcpy(rp.dev_class, hdev->dev_class, 3);
 986
 987         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 988         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 989
 990         hci_dev_unlock(hdev);
 991
 992         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 993                                  sizeof(rp));
 994 }
 995
 996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 997 {
 998         u16 eir_len = 0;
 999         size_t name_len;
1000
1001         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003                                           hdev->dev_class, 3);
1004
1005         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007                                           hdev->appearance);
1008
1009         name_len = strlen(hdev->dev_name);
1010         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011                                   hdev->dev_name, name_len);
1012
1013         name_len = strlen(hdev->short_name);
1014         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015                                   hdev->short_name, name_len);
1016
1017         return eir_len;
1018 }
1019
1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021                                     void *data, u16 data_len)
1022 {
1023         char buf[512];
1024         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025         u16 eir_len;
1026
1027         BT_DBG("sock %p %s", sk, hdev->name);
1028
1029         memset(&buf, 0, sizeof(buf));
1030
1031         hci_dev_lock(hdev);
1032
1033         bacpy(&rp->bdaddr, &hdev->bdaddr);
1034
1035         rp->version = hdev->hci_ver;
1036         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037
1038         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040
1041
1042         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043         rp->eir_len = cpu_to_le16(eir_len);
1044
1045         hci_dev_unlock(hdev);
1046
1047         /* If this command is called at least once, then the events
1048          * for class of device and local name changes are disabled
1049          * and only the new extended controller information event
1050          * is used.
1051          */
1052         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055
1056         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057                                  sizeof(*rp) + eir_len);
1058 }
1059
1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061 {
1062         char buf[512];
1063         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064         u16 eir_len;
1065
1066         memset(buf, 0, sizeof(buf));
1067
1068         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069         ev->eir_len = cpu_to_le16(eir_len);
1070
1071         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072                                   sizeof(*ev) + eir_len,
1073                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1074 }
1075
1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077 {
1078         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1079
1080         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081                                  sizeof(settings));
1082 }
1083
1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085 {
1086         BT_DBG("%s status 0x%02x", hdev->name, status);
1087
1088         if (hci_conn_count(hdev) == 0) {
1089                 cancel_delayed_work(&hdev->power_off);
1090                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091         }
1092 }
1093
1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095 {
1096         struct mgmt_ev_advertising_added ev;
1097
1098         ev.instance = instance;
1099
1100         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101 }
1102
1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104                               u8 instance)
1105 {
1106         struct mgmt_ev_advertising_removed ev;
1107
1108         ev.instance = instance;
1109
1110         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111 }
1112
1113 static void cancel_adv_timeout(struct hci_dev *hdev)
1114 {
1115         if (hdev->adv_instance_timeout) {
1116                 hdev->adv_instance_timeout = 0;
1117                 cancel_delayed_work(&hdev->adv_instance_expire);
1118         }
1119 }
1120
1121 static int clean_up_hci_state(struct hci_dev *hdev)
1122 {
1123         struct hci_request req;
1124         struct hci_conn *conn;
1125         bool discov_stopped;
1126         int err;
1127
1128         hci_req_init(&req, hdev);
1129
1130         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131             test_bit(HCI_PSCAN, &hdev->flags)) {
1132                 u8 scan = 0x00;
1133                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134         }
1135
1136         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137
1138         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139                 __hci_req_disable_advertising(&req);
1140
1141         discov_stopped = hci_req_stop_discovery(&req);
1142
1143         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144                 /* 0x15 == Terminated due to Power Off */
1145                 __hci_abort_conn(&req, conn, 0x15);
1146         }
1147
1148         err = hci_req_run(&req, clean_up_hci_complete);
1149         if (!err && discov_stopped)
1150                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151
1152         return err;
1153 }
1154
1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156                        u16 len)
1157 {
1158         struct mgmt_mode *cp = data;
1159         struct mgmt_pending_cmd *cmd;
1160         int err;
1161
1162         BT_DBG("request for %s", hdev->name);
1163
1164         if (cp->val != 0x00 && cp->val != 0x01)
1165                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166                                        MGMT_STATUS_INVALID_PARAMS);
1167
1168         hci_dev_lock(hdev);
1169
1170         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172                                       MGMT_STATUS_BUSY);
1173                 goto failed;
1174         }
1175
1176         if (!!cp->val == hdev_is_powered(hdev)) {
1177                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178                 goto failed;
1179         }
1180
1181         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182         if (!cmd) {
1183                 err = -ENOMEM;
1184                 goto failed;
1185         }
1186
1187         if (cp->val) {
1188                 queue_work(hdev->req_workqueue, &hdev->power_on);
1189                 err = 0;
1190         } else {
1191                 /* Disconnect connections, stop scans, etc */
1192                 err = clean_up_hci_state(hdev);
1193                 if (!err)
1194                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195                                            HCI_POWER_OFF_TIMEOUT);
1196
1197                 /* ENODATA means there were no HCI commands queued */
1198                 if (err == -ENODATA) {
1199                         cancel_delayed_work(&hdev->power_off);
1200                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201                         err = 0;
1202                 }
1203         }
1204
1205 failed:
1206         hci_dev_unlock(hdev);
1207         return err;
1208 }
1209
1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1213
1214         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217
1218 int mgmt_new_settings(struct hci_dev *hdev)
1219 {
1220         return new_settings(hdev, NULL);
1221 }
1222
1223 struct cmd_lookup {
1224         struct sock *sk;
1225         struct hci_dev *hdev;
1226         u8 mgmt_status;
1227 };
1228
1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230 {
1231         struct cmd_lookup *match = data;
1232
1233         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234
1235         list_del(&cmd->list);
1236
1237         if (match->sk == NULL) {
1238                 match->sk = cmd->sk;
1239                 sock_hold(match->sk);
1240         }
1241
1242         mgmt_pending_free(cmd);
1243 }
1244
1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246 {
1247         u8 *status = data;
1248
1249         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250         mgmt_pending_remove(cmd);
1251 }
1252
1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254 {
1255         if (cmd->cmd_complete) {
1256                 u8 *status = data;
1257
1258                 cmd->cmd_complete(cmd, *status);
1259                 mgmt_pending_remove(cmd);
1260
1261                 return;
1262         }
1263
1264         cmd_status_rsp(cmd, data);
1265 }
1266
1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268 {
1269         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270                                  cmd->param, cmd->param_len);
1271 }
1272
1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274 {
1275         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276                                  cmd->param, sizeof(struct mgmt_addr_info));
1277 }
1278
1279 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280 {
1281         if (!lmp_bredr_capable(hdev))
1282                 return MGMT_STATUS_NOT_SUPPORTED;
1283         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284                 return MGMT_STATUS_REJECTED;
1285         else
1286                 return MGMT_STATUS_SUCCESS;
1287 }
1288
1289 static u8 mgmt_le_support(struct hci_dev *hdev)
1290 {
1291         if (!lmp_le_capable(hdev))
1292                 return MGMT_STATUS_NOT_SUPPORTED;
1293         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294                 return MGMT_STATUS_REJECTED;
1295         else
1296                 return MGMT_STATUS_SUCCESS;
1297 }
1298
1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300 {
1301         struct mgmt_pending_cmd *cmd;
1302
1303         BT_DBG("status 0x%02x", status);
1304
1305         hci_dev_lock(hdev);
1306
1307         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308         if (!cmd)
1309                 goto unlock;
1310
1311         if (status) {
1312                 u8 mgmt_err = mgmt_status(status);
1313                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315                 goto remove_cmd;
1316         }
1317
1318         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319             hdev->discov_timeout > 0) {
1320                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322         }
1323
1324         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325         new_settings(hdev, cmd->sk);
1326
1327 remove_cmd:
1328         mgmt_pending_remove(cmd);
1329
1330 unlock:
1331         hci_dev_unlock(hdev);
1332 }
1333
1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335                             u16 len)
1336 {
1337         struct mgmt_cp_set_discoverable *cp = data;
1338         struct mgmt_pending_cmd *cmd;
1339         u16 timeout;
1340         int err;
1341
1342         BT_DBG("request for %s", hdev->name);
1343
1344         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347                                        MGMT_STATUS_REJECTED);
1348
1349         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351                                        MGMT_STATUS_INVALID_PARAMS);
1352
1353         timeout = __le16_to_cpu(cp->timeout);
1354
1355         /* Disabling discoverable requires that no timeout is set,
1356          * and enabling limited discoverable requires a timeout.
1357          */
1358         if ((cp->val == 0x00 && timeout > 0) ||
1359             (cp->val == 0x02 && timeout == 0))
1360                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361                                        MGMT_STATUS_INVALID_PARAMS);
1362
1363         hci_dev_lock(hdev);
1364
1365         if (!hdev_is_powered(hdev) && timeout > 0) {
1366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367                                       MGMT_STATUS_NOT_POWERED);
1368                 goto failed;
1369         }
1370
1371         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374                                       MGMT_STATUS_BUSY);
1375                 goto failed;
1376         }
1377
1378         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380                                       MGMT_STATUS_REJECTED);
1381                 goto failed;
1382         }
1383
1384         if (!hdev_is_powered(hdev)) {
1385                 bool changed = false;
1386
1387                 /* Setting limited discoverable when powered off is
1388                  * not a valid operation since it requires a timeout
1389                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1390                  */
1391                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393                         changed = true;
1394                 }
1395
1396                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397                 if (err < 0)
1398                         goto failed;
1399
1400                 if (changed)
1401                         err = new_settings(hdev, sk);
1402
1403                 goto failed;
1404         }
1405
1406         /* If the current mode is the same, then just update the timeout
1407          * value with the new value. And if only the timeout gets updated,
1408          * then no need for any HCI transactions.
1409          */
1410         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412                                                    HCI_LIMITED_DISCOVERABLE)) {
1413                 cancel_delayed_work(&hdev->discov_off);
1414                 hdev->discov_timeout = timeout;
1415
1416                 if (cp->val && hdev->discov_timeout > 0) {
1417                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418                         queue_delayed_work(hdev->req_workqueue,
1419                                            &hdev->discov_off, to);
1420                 }
1421
1422                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423                 goto failed;
1424         }
1425
1426         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427         if (!cmd) {
1428                 err = -ENOMEM;
1429                 goto failed;
1430         }
1431
1432         /* Cancel any potential discoverable timeout that might be
1433          * still active and store new timeout value. The arming of
1434          * the timeout happens in the complete handler.
1435          */
1436         cancel_delayed_work(&hdev->discov_off);
1437         hdev->discov_timeout = timeout;
1438
1439         if (cp->val)
1440                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441         else
1442                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443
1444         /* Limited discoverable mode */
1445         if (cp->val == 0x02)
1446                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447         else
1448                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449
1450         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451         err = 0;
1452
1453 failed:
1454         hci_dev_unlock(hdev);
1455         return err;
1456 }
1457
1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459 {
1460         struct mgmt_pending_cmd *cmd;
1461
1462         BT_DBG("status 0x%02x", status);
1463
1464         hci_dev_lock(hdev);
1465
1466         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467         if (!cmd)
1468                 goto unlock;
1469
1470         if (status) {
1471                 u8 mgmt_err = mgmt_status(status);
1472                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473                 goto remove_cmd;
1474         }
1475
1476         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477         new_settings(hdev, cmd->sk);
1478
1479 remove_cmd:
1480         mgmt_pending_remove(cmd);
1481
1482 unlock:
1483         hci_dev_unlock(hdev);
1484 }
1485
1486 static int set_connectable_update_settings(struct hci_dev *hdev,
1487                                            struct sock *sk, u8 val)
1488 {
1489         bool changed = false;
1490         int err;
1491
1492         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493                 changed = true;
1494
1495         if (val) {
1496                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497         } else {
1498                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500         }
1501
1502         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503         if (err < 0)
1504                 return err;
1505
1506         if (changed) {
1507                 hci_req_update_scan(hdev);
1508                 hci_update_background_scan(hdev);
1509                 return new_settings(hdev, sk);
1510         }
1511
1512         return 0;
1513 }
1514
1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516                            u16 len)
1517 {
1518         struct mgmt_mode *cp = data;
1519         struct mgmt_pending_cmd *cmd;
1520         int err;
1521
1522         BT_DBG("request for %s", hdev->name);
1523
1524         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527                                        MGMT_STATUS_REJECTED);
1528
1529         if (cp->val != 0x00 && cp->val != 0x01)
1530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531                                        MGMT_STATUS_INVALID_PARAMS);
1532
1533         hci_dev_lock(hdev);
1534
1535         if (!hdev_is_powered(hdev)) {
1536                 err = set_connectable_update_settings(hdev, sk, cp->val);
1537                 goto failed;
1538         }
1539
1540         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543                                       MGMT_STATUS_BUSY);
1544                 goto failed;
1545         }
1546
1547         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548         if (!cmd) {
1549                 err = -ENOMEM;
1550                 goto failed;
1551         }
1552
1553         if (cp->val) {
1554                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555         } else {
1556                 if (hdev->discov_timeout > 0)
1557                         cancel_delayed_work(&hdev->discov_off);
1558
1559                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562         }
1563
1564         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565         err = 0;
1566
1567 failed:
1568         hci_dev_unlock(hdev);
1569         return err;
1570 }
1571
1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573                         u16 len)
1574 {
1575         struct mgmt_mode *cp = data;
1576         bool changed;
1577         int err;
1578
1579         BT_DBG("request for %s", hdev->name);
1580
1581         if (cp->val != 0x00 && cp->val != 0x01)
1582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583                                        MGMT_STATUS_INVALID_PARAMS);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (cp->val)
1588                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589         else
1590                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591
1592         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593         if (err < 0)
1594                 goto unlock;
1595
1596         if (changed) {
1597                 /* In limited privacy mode the change of bondable mode
1598                  * may affect the local advertising address.
1599                  */
1600                 if (hdev_is_powered(hdev) &&
1601                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604                         queue_work(hdev->req_workqueue,
1605                                    &hdev->discoverable_update);
1606
1607                 err = new_settings(hdev, sk);
1608         }
1609
1610 unlock:
1611         hci_dev_unlock(hdev);
1612         return err;
1613 }
1614
1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616                              u16 len)
1617 {
1618         struct mgmt_mode *cp = data;
1619         struct mgmt_pending_cmd *cmd;
1620         u8 val, status;
1621         int err;
1622
1623         BT_DBG("request for %s", hdev->name);
1624
1625         status = mgmt_bredr_support(hdev);
1626         if (status)
1627                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628                                        status);
1629
1630         if (cp->val != 0x00 && cp->val != 0x01)
1631                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632                                        MGMT_STATUS_INVALID_PARAMS);
1633
1634         hci_dev_lock(hdev);
1635
1636         if (!hdev_is_powered(hdev)) {
1637                 bool changed = false;
1638
1639                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641                         changed = true;
1642                 }
1643
1644                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645                 if (err < 0)
1646                         goto failed;
1647
1648                 if (changed)
1649                         err = new_settings(hdev, sk);
1650
1651                 goto failed;
1652         }
1653
1654         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656                                       MGMT_STATUS_BUSY);
1657                 goto failed;
1658         }
1659
1660         val = !!cp->val;
1661
1662         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664                 goto failed;
1665         }
1666
1667         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668         if (!cmd) {
1669                 err = -ENOMEM;
1670                 goto failed;
1671         }
1672
1673         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674         if (err < 0) {
1675                 mgmt_pending_remove(cmd);
1676                 goto failed;
1677         }
1678
1679 failed:
1680         hci_dev_unlock(hdev);
1681         return err;
1682 }
1683
1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685 {
1686         struct mgmt_mode *cp = data;
1687         struct mgmt_pending_cmd *cmd;
1688         u8 status;
1689         int err;
1690
1691         BT_DBG("request for %s", hdev->name);
1692
1693         status = mgmt_bredr_support(hdev);
1694         if (status)
1695                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696
1697         if (!lmp_ssp_capable(hdev))
1698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699                                        MGMT_STATUS_NOT_SUPPORTED);
1700
1701         if (cp->val != 0x00 && cp->val != 0x01)
1702                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703                                        MGMT_STATUS_INVALID_PARAMS);
1704
1705         hci_dev_lock(hdev);
1706
1707         if (!hdev_is_powered(hdev)) {
1708                 bool changed;
1709
1710                 if (cp->val) {
1711                         changed = !hci_dev_test_and_set_flag(hdev,
1712                                                              HCI_SSP_ENABLED);
1713                 } else {
1714                         changed = hci_dev_test_and_clear_flag(hdev,
1715                                                               HCI_SSP_ENABLED);
1716                         if (!changed)
1717                                 changed = hci_dev_test_and_clear_flag(hdev,
1718                                                                       HCI_HS_ENABLED);
1719                         else
1720                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721                 }
1722
1723                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724                 if (err < 0)
1725                         goto failed;
1726
1727                 if (changed)
1728                         err = new_settings(hdev, sk);
1729
1730                 goto failed;
1731         }
1732
1733         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735                                       MGMT_STATUS_BUSY);
1736                 goto failed;
1737         }
1738
1739         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741                 goto failed;
1742         }
1743
1744         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745         if (!cmd) {
1746                 err = -ENOMEM;
1747                 goto failed;
1748         }
1749
1750         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752                              sizeof(cp->val), &cp->val);
1753
1754         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755         if (err < 0) {
1756                 mgmt_pending_remove(cmd);
1757                 goto failed;
1758         }
1759
1760 failed:
1761         hci_dev_unlock(hdev);
1762         return err;
1763 }
1764
1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767         struct mgmt_mode *cp = data;
1768         bool changed;
1769         u8 status;
1770         int err;
1771
1772         BT_DBG("request for %s", hdev->name);
1773
1774         status = mgmt_bredr_support(hdev);
1775         if (status)
1776                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777
1778         if (!lmp_ssp_capable(hdev))
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780                                        MGMT_STATUS_NOT_SUPPORTED);
1781
1782         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784                                        MGMT_STATUS_REJECTED);
1785
1786         if (cp->val != 0x00 && cp->val != 0x01)
1787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788                                        MGMT_STATUS_INVALID_PARAMS);
1789
1790         hci_dev_lock(hdev);
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794                                       MGMT_STATUS_BUSY);
1795                 goto unlock;
1796         }
1797
1798         if (cp->val) {
1799                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800         } else {
1801                 if (hdev_is_powered(hdev)) {
1802                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803                                               MGMT_STATUS_REJECTED);
1804                         goto unlock;
1805                 }
1806
1807                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808         }
1809
1810         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811         if (err < 0)
1812                 goto unlock;
1813
1814         if (changed)
1815                 err = new_settings(hdev, sk);
1816
1817 unlock:
1818         hci_dev_unlock(hdev);
1819         return err;
1820 }
1821
1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823 {
1824         struct cmd_lookup match = { NULL, hdev };
1825
1826         hci_dev_lock(hdev);
1827
1828         if (status) {
1829                 u8 mgmt_err = mgmt_status(status);
1830
1831                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832                                      &mgmt_err);
1833                 goto unlock;
1834         }
1835
1836         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837
1838         new_settings(hdev, match.sk);
1839
1840         if (match.sk)
1841                 sock_put(match.sk);
1842
1843         /* Make sure the controller has a good default for
1844          * advertising data. Restrict the update to when LE
1845          * has actually been enabled. During power on, the
1846          * update in powered_update_hci will take care of it.
1847          */
1848         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849                 struct hci_request req;
1850                 hci_req_init(&req, hdev);
1851                 if (ext_adv_capable(hdev)) {
1852                         int err;
1853
1854                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855                         if (!err)
1856                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1857                 } else {
1858                         __hci_req_update_adv_data(&req, 0x00);
1859                         __hci_req_update_scan_rsp_data(&req, 0x00);
1860                 }
1861                 hci_req_run(&req, NULL);
1862                 hci_update_background_scan(hdev);
1863         }
1864
1865 unlock:
1866         hci_dev_unlock(hdev);
1867 }
1868
1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870 {
1871         struct mgmt_mode *cp = data;
1872         struct hci_cp_write_le_host_supported hci_cp;
1873         struct mgmt_pending_cmd *cmd;
1874         struct hci_request req;
1875         int err;
1876         u8 val, enabled;
1877
1878         BT_DBG("request for %s", hdev->name);
1879
1880         if (!lmp_le_capable(hdev))
1881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882                                        MGMT_STATUS_NOT_SUPPORTED);
1883
1884         if (cp->val != 0x00 && cp->val != 0x01)
1885                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886                                        MGMT_STATUS_INVALID_PARAMS);
1887
1888         /* Bluetooth single mode LE only controllers or dual-mode
1889          * controllers configured as LE only devices, do not allow
1890          * switching LE off. These have either LE enabled explicitly
1891          * or BR/EDR has been previously switched off.
1892          *
1893          * When trying to enable an already enabled LE, then gracefully
1894          * send a positive response. Trying to disable it however will
1895          * result into rejection.
1896          */
1897         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898                 if (cp->val == 0x01)
1899                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900
1901                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902                                        MGMT_STATUS_REJECTED);
1903         }
1904
1905         hci_dev_lock(hdev);
1906
1907         val = !!cp->val;
1908         enabled = lmp_host_le_capable(hdev);
1909
1910         if (!val)
1911                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912
1913         if (!hdev_is_powered(hdev) || val == enabled) {
1914                 bool changed = false;
1915
1916                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918                         changed = true;
1919                 }
1920
1921                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923                         changed = true;
1924                 }
1925
1926                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927                 if (err < 0)
1928                         goto unlock;
1929
1930                 if (changed)
1931                         err = new_settings(hdev, sk);
1932
1933                 goto unlock;
1934         }
1935
1936         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939                                       MGMT_STATUS_BUSY);
1940                 goto unlock;
1941         }
1942
1943         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944         if (!cmd) {
1945                 err = -ENOMEM;
1946                 goto unlock;
1947         }
1948
1949         hci_req_init(&req, hdev);
1950
1951         memset(&hci_cp, 0, sizeof(hci_cp));
1952
1953         if (val) {
1954                 hci_cp.le = val;
1955                 hci_cp.simul = 0x00;
1956         } else {
1957                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958                         __hci_req_disable_advertising(&req);
1959
1960                 if (ext_adv_capable(hdev))
1961                         __hci_req_clear_ext_adv_sets(&req);
1962         }
1963
1964         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965                     &hci_cp);
1966
1967         err = hci_req_run(&req, le_enable_complete);
1968         if (err < 0)
1969                 mgmt_pending_remove(cmd);
1970
1971 unlock:
1972         hci_dev_unlock(hdev);
1973         return err;
1974 }
1975
1976 /* This is a helper function to test for pending mgmt commands that can
1977  * cause CoD or EIR HCI commands. We can only allow one such pending
1978  * mgmt command at a time since otherwise we cannot easily track what
1979  * the current values are, will be, and based on that calculate if a new
1980  * HCI command needs to be sent and if yes with what value.
1981  */
1982 static bool pending_eir_or_class(struct hci_dev *hdev)
1983 {
1984         struct mgmt_pending_cmd *cmd;
1985
1986         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987                 switch (cmd->opcode) {
1988                 case MGMT_OP_ADD_UUID:
1989                 case MGMT_OP_REMOVE_UUID:
1990                 case MGMT_OP_SET_DEV_CLASS:
1991                 case MGMT_OP_SET_POWERED:
1992                         return true;
1993                 }
1994         }
1995
1996         return false;
1997 }
1998
1999 static const u8 bluetooth_base_uuid[] = {
2000                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002 };
2003
2004 static u8 get_uuid_size(const u8 *uuid)
2005 {
2006         u32 val;
2007
2008         if (memcmp(uuid, bluetooth_base_uuid, 12))
2009                 return 128;
2010
2011         val = get_unaligned_le32(&uuid[12]);
2012         if (val > 0xffff)
2013                 return 32;
2014
2015         return 16;
2016 }
2017
2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019 {
2020         struct mgmt_pending_cmd *cmd;
2021
2022         hci_dev_lock(hdev);
2023
2024         cmd = pending_find(mgmt_op, hdev);
2025         if (!cmd)
2026                 goto unlock;
2027
2028         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029                           mgmt_status(status), hdev->dev_class, 3);
2030
2031         mgmt_pending_remove(cmd);
2032
2033 unlock:
2034         hci_dev_unlock(hdev);
2035 }
2036
2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038 {
2039         BT_DBG("status 0x%02x", status);
2040
2041         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042 }
2043
2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045 {
2046         struct mgmt_cp_add_uuid *cp = data;
2047         struct mgmt_pending_cmd *cmd;
2048         struct hci_request req;
2049         struct bt_uuid *uuid;
2050         int err;
2051
2052         BT_DBG("request for %s", hdev->name);
2053
2054         hci_dev_lock(hdev);
2055
2056         if (pending_eir_or_class(hdev)) {
2057                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058                                       MGMT_STATUS_BUSY);
2059                 goto failed;
2060         }
2061
2062         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063         if (!uuid) {
2064                 err = -ENOMEM;
2065                 goto failed;
2066         }
2067
2068         memcpy(uuid->uuid, cp->uuid, 16);
2069         uuid->svc_hint = cp->svc_hint;
2070         uuid->size = get_uuid_size(cp->uuid);
2071
2072         list_add_tail(&uuid->list, &hdev->uuids);
2073
2074         hci_req_init(&req, hdev);
2075
2076         __hci_req_update_class(&req);
2077         __hci_req_update_eir(&req);
2078
2079         err = hci_req_run(&req, add_uuid_complete);
2080         if (err < 0) {
2081                 if (err != -ENODATA)
2082                         goto failed;
2083
2084                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085                                         hdev->dev_class, 3);
2086                 goto failed;
2087         }
2088
2089         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090         if (!cmd) {
2091                 err = -ENOMEM;
2092                 goto failed;
2093         }
2094
2095         err = 0;
2096
2097 failed:
2098         hci_dev_unlock(hdev);
2099         return err;
2100 }
2101
2102 static bool enable_service_cache(struct hci_dev *hdev)
2103 {
2104         if (!hdev_is_powered(hdev))
2105                 return false;
2106
2107         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109                                    CACHE_TIMEOUT);
2110                 return true;
2111         }
2112
2113         return false;
2114 }
2115
2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117 {
2118         BT_DBG("status 0x%02x", status);
2119
2120         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121 }
2122
2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124                        u16 len)
2125 {
2126         struct mgmt_cp_remove_uuid *cp = data;
2127         struct mgmt_pending_cmd *cmd;
2128         struct bt_uuid *match, *tmp;
2129         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130         struct hci_request req;
2131         int err, found;
2132
2133         BT_DBG("request for %s", hdev->name);
2134
2135         hci_dev_lock(hdev);
2136
2137         if (pending_eir_or_class(hdev)) {
2138                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139                                       MGMT_STATUS_BUSY);
2140                 goto unlock;
2141         }
2142
2143         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144                 hci_uuids_clear(hdev);
2145
2146                 if (enable_service_cache(hdev)) {
2147                         err = mgmt_cmd_complete(sk, hdev->id,
2148                                                 MGMT_OP_REMOVE_UUID,
2149                                                 0, hdev->dev_class, 3);
2150                         goto unlock;
2151                 }
2152
2153                 goto update_class;
2154         }
2155
2156         found = 0;
2157
2158         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160                         continue;
2161
2162                 list_del(&match->list);
2163                 kfree(match);
2164                 found++;
2165         }
2166
2167         if (found == 0) {
2168                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169                                       MGMT_STATUS_INVALID_PARAMS);
2170                 goto unlock;
2171         }
2172
2173 update_class:
2174         hci_req_init(&req, hdev);
2175
2176         __hci_req_update_class(&req);
2177         __hci_req_update_eir(&req);
2178
2179         err = hci_req_run(&req, remove_uuid_complete);
2180         if (err < 0) {
2181                 if (err != -ENODATA)
2182                         goto unlock;
2183
2184                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185                                         hdev->dev_class, 3);
2186                 goto unlock;
2187         }
2188
2189         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190         if (!cmd) {
2191                 err = -ENOMEM;
2192                 goto unlock;
2193         }
2194
2195         err = 0;
2196
2197 unlock:
2198         hci_dev_unlock(hdev);
2199         return err;
2200 }
2201
2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203 {
2204         BT_DBG("status 0x%02x", status);
2205
2206         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207 }
2208
2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210                          u16 len)
2211 {
2212         struct mgmt_cp_set_dev_class *cp = data;
2213         struct mgmt_pending_cmd *cmd;
2214         struct hci_request req;
2215         int err;
2216
2217         BT_DBG("request for %s", hdev->name);
2218
2219         if (!lmp_bredr_capable(hdev))
2220                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221                                        MGMT_STATUS_NOT_SUPPORTED);
2222
2223         hci_dev_lock(hdev);
2224
2225         if (pending_eir_or_class(hdev)) {
2226                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227                                       MGMT_STATUS_BUSY);
2228                 goto unlock;
2229         }
2230
2231         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233                                       MGMT_STATUS_INVALID_PARAMS);
2234                 goto unlock;
2235         }
2236
2237         hdev->major_class = cp->major;
2238         hdev->minor_class = cp->minor;
2239
2240         if (!hdev_is_powered(hdev)) {
2241                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242                                         hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         hci_req_init(&req, hdev);
2247
2248         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249                 hci_dev_unlock(hdev);
2250                 cancel_delayed_work_sync(&hdev->service_cache);
2251                 hci_dev_lock(hdev);
2252                 __hci_req_update_eir(&req);
2253         }
2254
2255         __hci_req_update_class(&req);
2256
2257         err = hci_req_run(&req, set_class_complete);
2258         if (err < 0) {
2259                 if (err != -ENODATA)
2260                         goto unlock;
2261
2262                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263                                         hdev->dev_class, 3);
2264                 goto unlock;
2265         }
2266
2267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268         if (!cmd) {
2269                 err = -ENOMEM;
2270                 goto unlock;
2271         }
2272
2273         err = 0;
2274
2275 unlock:
2276         hci_dev_unlock(hdev);
2277         return err;
2278 }
2279
2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281                           u16 len)
2282 {
2283         struct mgmt_cp_load_link_keys *cp = data;
2284         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285                                    sizeof(struct mgmt_link_key_info));
2286         u16 key_count, expected_len;
2287         bool changed;
2288         int i;
2289
2290         BT_DBG("request for %s", hdev->name);
2291
2292         if (!lmp_bredr_capable(hdev))
2293                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294                                        MGMT_STATUS_NOT_SUPPORTED);
2295
2296         key_count = __le16_to_cpu(cp->key_count);
2297         if (key_count > max_key_count) {
2298                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299                            key_count);
2300                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301                                        MGMT_STATUS_INVALID_PARAMS);
2302         }
2303
2304         expected_len = sizeof(*cp) + key_count *
2305                                         sizeof(struct mgmt_link_key_info);
2306         if (expected_len != len) {
2307                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2308                            expected_len, len);
2309                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2310                                        MGMT_STATUS_INVALID_PARAMS);
2311         }
2312
2313         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2314                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2315                                        MGMT_STATUS_INVALID_PARAMS);
2316
2317         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2318                key_count);
2319
2320         for (i = 0; i < key_count; i++) {
2321                 struct mgmt_link_key_info *key = &cp->keys[i];
2322
2323                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2324                         return mgmt_cmd_status(sk, hdev->id,
2325                                                MGMT_OP_LOAD_LINK_KEYS,
2326                                                MGMT_STATUS_INVALID_PARAMS);
2327         }
2328
2329         hci_dev_lock(hdev);
2330
2331         hci_link_keys_clear(hdev);
2332
2333         if (cp->debug_keys)
2334                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2335         else
2336                 changed = hci_dev_test_and_clear_flag(hdev,
2337                                                       HCI_KEEP_DEBUG_KEYS);
2338
2339         if (changed)
2340                 new_settings(hdev, NULL);
2341
2342         for (i = 0; i < key_count; i++) {
2343                 struct mgmt_link_key_info *key = &cp->keys[i];
2344
2345                 /* Always ignore debug keys and require a new pairing if
2346                  * the user wants to use them.
2347                  */
2348                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2349                         continue;
2350
2351                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2352                                  key->type, key->pin_len, NULL);
2353         }
2354
2355         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2356
2357         hci_dev_unlock(hdev);
2358
2359         return 0;
2360 }
2361
2362 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2363                            u8 addr_type, struct sock *skip_sk)
2364 {
2365         struct mgmt_ev_device_unpaired ev;
2366
2367         bacpy(&ev.addr.bdaddr, bdaddr);
2368         ev.addr.type = addr_type;
2369
2370         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2371                           skip_sk);
2372 }
2373
2374 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2375                          u16 len)
2376 {
2377         struct mgmt_cp_unpair_device *cp = data;
2378         struct mgmt_rp_unpair_device rp;
2379         struct hci_conn_params *params;
2380         struct mgmt_pending_cmd *cmd;
2381         struct hci_conn *conn;
2382         u8 addr_type;
2383         int err;
2384
2385         memset(&rp, 0, sizeof(rp));
2386         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2387         rp.addr.type = cp->addr.type;
2388
2389         if (!bdaddr_type_is_valid(cp->addr.type))
2390                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2391                                          MGMT_STATUS_INVALID_PARAMS,
2392                                          &rp, sizeof(rp));
2393
2394         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2395                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2396                                          MGMT_STATUS_INVALID_PARAMS,
2397                                          &rp, sizeof(rp));
2398
2399         hci_dev_lock(hdev);
2400
2401         if (!hdev_is_powered(hdev)) {
2402                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2403                                         MGMT_STATUS_NOT_POWERED, &rp,
2404                                         sizeof(rp));
2405                 goto unlock;
2406         }
2407
2408         if (cp->addr.type == BDADDR_BREDR) {
2409                 /* If disconnection is requested, then look up the
2410                  * connection. If the remote device is connected, it
2411                  * will be later used to terminate the link.
2412                  *
2413                  * Setting it to NULL explicitly will cause no
2414                  * termination of the link.
2415                  */
2416                 if (cp->disconnect)
2417                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2418                                                        &cp->addr.bdaddr);
2419                 else
2420                         conn = NULL;
2421
2422                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2423                 if (err < 0) {
2424                         err = mgmt_cmd_complete(sk, hdev->id,
2425                                                 MGMT_OP_UNPAIR_DEVICE,
2426                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2427                                                 sizeof(rp));
2428                         goto unlock;
2429                 }
2430
2431                 goto done;
2432         }
2433
2434         /* LE address type */
2435         addr_type = le_addr_type(cp->addr.type);
2436
2437         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2438
2439         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2440         if (err < 0) {
2441                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2442                                         MGMT_STATUS_NOT_PAIRED, &rp,
2443                                         sizeof(rp));
2444                 goto unlock;
2445         }
2446
2447         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2448         if (!conn) {
2449                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2450                 goto done;
2451         }
2452
2453         /* Abort any ongoing SMP pairing */
2454         smp_cancel_pairing(conn);
2455
2456         /* Defer clearing up the connection parameters until closing to
2457          * give a chance of keeping them if a repairing happens.
2458          */
2459         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2460
2461         /* Disable auto-connection parameters if present */
2462         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2463         if (params) {
2464                 if (params->explicit_connect)
2465                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2466                 else
2467                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2468         }
2469
2470         /* If disconnection is not requested, then clear the connection
2471          * variable so that the link is not terminated.
2472          */
2473         if (!cp->disconnect)
2474                 conn = NULL;
2475
2476 done:
2477         /* If the connection variable is set, then termination of the
2478          * link is requested.
2479          */
2480         if (!conn) {
2481                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2482                                         &rp, sizeof(rp));
2483                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2484                 goto unlock;
2485         }
2486
2487         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2488                                sizeof(*cp));
2489         if (!cmd) {
2490                 err = -ENOMEM;
2491                 goto unlock;
2492         }
2493
2494         cmd->cmd_complete = addr_cmd_complete;
2495
2496         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2497         if (err < 0)
2498                 mgmt_pending_remove(cmd);
2499
2500 unlock:
2501         hci_dev_unlock(hdev);
2502         return err;
2503 }
2504
2505 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2506                       u16 len)
2507 {
2508         struct mgmt_cp_disconnect *cp = data;
2509         struct mgmt_rp_disconnect rp;
2510         struct mgmt_pending_cmd *cmd;
2511         struct hci_conn *conn;
2512         int err;
2513
2514         BT_DBG("");
2515
2516         memset(&rp, 0, sizeof(rp));
2517         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2518         rp.addr.type = cp->addr.type;
2519
2520         if (!bdaddr_type_is_valid(cp->addr.type))
2521                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2522                                          MGMT_STATUS_INVALID_PARAMS,
2523                                          &rp, sizeof(rp));
2524
2525         hci_dev_lock(hdev);
2526
2527         if (!test_bit(HCI_UP, &hdev->flags)) {
2528                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2529                                         MGMT_STATUS_NOT_POWERED, &rp,
2530                                         sizeof(rp));
2531                 goto failed;
2532         }
2533
2534         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2535                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2536                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2537                 goto failed;
2538         }
2539
2540         if (cp->addr.type == BDADDR_BREDR)
2541                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2542                                                &cp->addr.bdaddr);
2543         else
2544                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2545                                                le_addr_type(cp->addr.type));
2546
2547         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2549                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2550                                         sizeof(rp));
2551                 goto failed;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2555         if (!cmd) {
2556                 err = -ENOMEM;
2557                 goto failed;
2558         }
2559
2560         cmd->cmd_complete = generic_cmd_complete;
2561
2562         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 failed:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2572 {
2573         switch (link_type) {
2574         case LE_LINK:
2575                 switch (addr_type) {
2576                 case ADDR_LE_DEV_PUBLIC:
2577                         return BDADDR_LE_PUBLIC;
2578
2579                 default:
2580                         /* Fallback to LE Random address type */
2581                         return BDADDR_LE_RANDOM;
2582                 }
2583
2584         default:
2585                 /* Fallback to BR/EDR type */
2586                 return BDADDR_BREDR;
2587         }
2588 }
2589
2590 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2591                            u16 data_len)
2592 {
2593         struct mgmt_rp_get_connections *rp;
2594         struct hci_conn *c;
2595         size_t rp_len;
2596         int err;
2597         u16 i;
2598
2599         BT_DBG("");
2600
2601         hci_dev_lock(hdev);
2602
2603         if (!hdev_is_powered(hdev)) {
2604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2605                                       MGMT_STATUS_NOT_POWERED);
2606                 goto unlock;
2607         }
2608
2609         i = 0;
2610         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2611                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2612                         i++;
2613         }
2614
2615         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2616         rp = kmalloc(rp_len, GFP_KERNEL);
2617         if (!rp) {
2618                 err = -ENOMEM;
2619                 goto unlock;
2620         }
2621
2622         i = 0;
2623         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2624                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2625                         continue;
2626                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2627                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2628                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2629                         continue;
2630                 i++;
2631         }
2632
2633         rp->conn_count = cpu_to_le16(i);
2634
2635         /* Recalculate length in case of filtered SCO connections, etc */
2636         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2637
2638         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639                                 rp_len);
2640
2641         kfree(rp);
2642
2643 unlock:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649                                    struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651         struct mgmt_pending_cmd *cmd;
2652         int err;
2653
2654         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655                                sizeof(*cp));
2656         if (!cmd)
2657                 return -ENOMEM;
2658
2659         cmd->cmd_complete = addr_cmd_complete;
2660
2661         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2662                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2663         if (err < 0)
2664                 mgmt_pending_remove(cmd);
2665
2666         return err;
2667 }
2668
2669 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2670                           u16 len)
2671 {
2672         struct hci_conn *conn;
2673         struct mgmt_cp_pin_code_reply *cp = data;
2674         struct hci_cp_pin_code_reply reply;
2675         struct mgmt_pending_cmd *cmd;
2676         int err;
2677
2678         BT_DBG("");
2679
2680         hci_dev_lock(hdev);
2681
2682         if (!hdev_is_powered(hdev)) {
2683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2684                                       MGMT_STATUS_NOT_POWERED);
2685                 goto failed;
2686         }
2687
2688         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2689         if (!conn) {
2690                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2691                                       MGMT_STATUS_NOT_CONNECTED);
2692                 goto failed;
2693         }
2694
2695         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2696                 struct mgmt_cp_pin_code_neg_reply ncp;
2697
2698                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2699
2700                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2701
2702                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2703                 if (err >= 0)
2704                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2705                                               MGMT_STATUS_INVALID_PARAMS);
2706
2707                 goto failed;
2708         }
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2711         if (!cmd) {
2712                 err = -ENOMEM;
2713                 goto failed;
2714         }
2715
2716         cmd->cmd_complete = addr_cmd_complete;
2717
2718         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2719         reply.pin_len = cp->pin_len;
2720         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2721
2722         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2723         if (err < 0)
2724                 mgmt_pending_remove(cmd);
2725
2726 failed:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2732                              u16 len)
2733 {
2734         struct mgmt_cp_set_io_capability *cp = data;
2735
2736         BT_DBG("");
2737
2738         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2740                                        MGMT_STATUS_INVALID_PARAMS);
2741
2742         hci_dev_lock(hdev);
2743
2744         hdev->io_capability = cp->io_capability;
2745
2746         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2747                hdev->io_capability);
2748
2749         hci_dev_unlock(hdev);
2750
2751         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2752                                  NULL, 0);
2753 }
2754
2755 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2756 {
2757         struct hci_dev *hdev = conn->hdev;
2758         struct mgmt_pending_cmd *cmd;
2759
2760         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2761                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2762                         continue;
2763
2764                 if (cmd->user_data != conn)
2765                         continue;
2766
2767                 return cmd;
2768         }
2769
2770         return NULL;
2771 }
2772
2773 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2774 {
2775         struct mgmt_rp_pair_device rp;
2776         struct hci_conn *conn = cmd->user_data;
2777         int err;
2778
2779         bacpy(&rp.addr.bdaddr, &conn->dst);
2780         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2781
2782         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2783                                 status, &rp, sizeof(rp));
2784
2785         /* So we don't get further callbacks for this connection */
2786         conn->connect_cfm_cb = NULL;
2787         conn->security_cfm_cb = NULL;
2788         conn->disconn_cfm_cb = NULL;
2789
2790         hci_conn_drop(conn);
2791
2792         /* The device is paired so there is no need to remove
2793          * its connection parameters anymore.
2794          */
2795         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2796
2797         hci_conn_put(conn);
2798
2799         return err;
2800 }
2801
2802 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2803 {
2804         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2805         struct mgmt_pending_cmd *cmd;
2806
2807         cmd = find_pairing(conn);
2808         if (cmd) {
2809                 cmd->cmd_complete(cmd, status);
2810                 mgmt_pending_remove(cmd);
2811         }
2812 }
2813
2814 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2815 {
2816         struct mgmt_pending_cmd *cmd;
2817
2818         BT_DBG("status %u", status);
2819
2820         cmd = find_pairing(conn);
2821         if (!cmd) {
2822                 BT_DBG("Unable to find a pending command");
2823                 return;
2824         }
2825
2826         cmd->cmd_complete(cmd, mgmt_status(status));
2827         mgmt_pending_remove(cmd);
2828 }
2829
2830 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2831 {
2832         struct mgmt_pending_cmd *cmd;
2833
2834         BT_DBG("status %u", status);
2835
2836         if (!status)
2837                 return;
2838
2839         cmd = find_pairing(conn);
2840         if (!cmd) {
2841                 BT_DBG("Unable to find a pending command");
2842                 return;
2843         }
2844
2845         cmd->cmd_complete(cmd, mgmt_status(status));
2846         mgmt_pending_remove(cmd);
2847 }
2848
2849 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2850                        u16 len)
2851 {
2852         struct mgmt_cp_pair_device *cp = data;
2853         struct mgmt_rp_pair_device rp;
2854         struct mgmt_pending_cmd *cmd;
2855         u8 sec_level, auth_type;
2856         struct hci_conn *conn;
2857         int err;
2858
2859         BT_DBG("");
2860
2861         memset(&rp, 0, sizeof(rp));
2862         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2863         rp.addr.type = cp->addr.type;
2864
2865         if (!bdaddr_type_is_valid(cp->addr.type))
2866                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867                                          MGMT_STATUS_INVALID_PARAMS,
2868                                          &rp, sizeof(rp));
2869
2870         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2871                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2872                                          MGMT_STATUS_INVALID_PARAMS,
2873                                          &rp, sizeof(rp));
2874
2875         hci_dev_lock(hdev);
2876
2877         if (!hdev_is_powered(hdev)) {
2878                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2879                                         MGMT_STATUS_NOT_POWERED, &rp,
2880                                         sizeof(rp));
2881                 goto unlock;
2882         }
2883
2884         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2885                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2886                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2887                                         sizeof(rp));
2888                 goto unlock;
2889         }
2890
2891         sec_level = BT_SECURITY_MEDIUM;
2892         auth_type = HCI_AT_DEDICATED_BONDING;
2893
2894         if (cp->addr.type == BDADDR_BREDR) {
2895                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2896                                        auth_type);
2897         } else {
2898                 u8 addr_type = le_addr_type(cp->addr.type);
2899                 struct hci_conn_params *p;
2900
2901                 /* When pairing a new device, it is expected to remember
2902                  * this device for future connections. Adding the connection
2903                  * parameter information ahead of time allows tracking
2904                  * of the slave preferred values and will speed up any
2905                  * further connection establishment.
2906                  *
2907                  * If connection parameters already exist, then they
2908                  * will be kept and this function does nothing.
2909                  */
2910                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2911
2912                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2913                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2914
2915                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2916                                            addr_type, sec_level,
2917                                            HCI_LE_CONN_TIMEOUT);
2918         }
2919
2920         if (IS_ERR(conn)) {
2921                 int status;
2922
2923                 if (PTR_ERR(conn) == -EBUSY)
2924                         status = MGMT_STATUS_BUSY;
2925                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2926                         status = MGMT_STATUS_NOT_SUPPORTED;
2927                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2928                         status = MGMT_STATUS_REJECTED;
2929                 else
2930                         status = MGMT_STATUS_CONNECT_FAILED;
2931
2932                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933                                         status, &rp, sizeof(rp));
2934                 goto unlock;
2935         }
2936
2937         if (conn->connect_cfm_cb) {
2938                 hci_conn_drop(conn);
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2941                 goto unlock;
2942         }
2943
2944         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2945         if (!cmd) {
2946                 err = -ENOMEM;
2947                 hci_conn_drop(conn);
2948                 goto unlock;
2949         }
2950
2951         cmd->cmd_complete = pairing_complete;
2952
2953         /* For LE, just connecting isn't a proof that the pairing finished */
2954         if (cp->addr.type == BDADDR_BREDR) {
2955                 conn->connect_cfm_cb = pairing_complete_cb;
2956                 conn->security_cfm_cb = pairing_complete_cb;
2957                 conn->disconn_cfm_cb = pairing_complete_cb;
2958         } else {
2959                 conn->connect_cfm_cb = le_pairing_complete_cb;
2960                 conn->security_cfm_cb = le_pairing_complete_cb;
2961                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2962         }
2963
2964         conn->io_capability = cp->io_cap;
2965         cmd->user_data = hci_conn_get(conn);
2966
2967         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2968             hci_conn_security(conn, sec_level, auth_type, true)) {
2969                 cmd->cmd_complete(cmd, 0);
2970                 mgmt_pending_remove(cmd);
2971         }
2972
2973         err = 0;
2974
2975 unlock:
2976         hci_dev_unlock(hdev);
2977         return err;
2978 }
2979
2980 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981                               u16 len)
2982 {
2983         struct mgmt_addr_info *addr = data;
2984         struct mgmt_pending_cmd *cmd;
2985         struct hci_conn *conn;
2986         int err;
2987
2988         BT_DBG("");
2989
2990         hci_dev_lock(hdev);
2991
2992         if (!hdev_is_powered(hdev)) {
2993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2994                                       MGMT_STATUS_NOT_POWERED);
2995                 goto unlock;
2996         }
2997
2998         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2999         if (!cmd) {
3000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001                                       MGMT_STATUS_INVALID_PARAMS);
3002                 goto unlock;
3003         }
3004
3005         conn = cmd->user_data;
3006
3007         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3009                                       MGMT_STATUS_INVALID_PARAMS);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3014         mgmt_pending_remove(cmd);
3015
3016         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3017                                 addr, sizeof(*addr));
3018 unlock:
3019         hci_dev_unlock(hdev);
3020         return err;
3021 }
3022
3023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3024                              struct mgmt_addr_info *addr, u16 mgmt_op,
3025                              u16 hci_op, __le32 passkey)
3026 {
3027         struct mgmt_pending_cmd *cmd;
3028         struct hci_conn *conn;
3029         int err;
3030
3031         hci_dev_lock(hdev);
3032
3033         if (!hdev_is_powered(hdev)) {
3034                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3035                                         MGMT_STATUS_NOT_POWERED, addr,
3036                                         sizeof(*addr));
3037                 goto done;
3038         }
3039
3040         if (addr->type == BDADDR_BREDR)
3041                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3042         else
3043                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3044                                                le_addr_type(addr->type));
3045
3046         if (!conn) {
3047                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3048                                         MGMT_STATUS_NOT_CONNECTED, addr,
3049                                         sizeof(*addr));
3050                 goto done;
3051         }
3052
3053         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3054                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3055                 if (!err)
3056                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3057                                                 MGMT_STATUS_SUCCESS, addr,
3058                                                 sizeof(*addr));
3059                 else
3060                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3061                                                 MGMT_STATUS_FAILED, addr,
3062                                                 sizeof(*addr));
3063
3064                 goto done;
3065         }
3066
3067         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3068         if (!cmd) {
3069                 err = -ENOMEM;
3070                 goto done;
3071         }
3072
3073         cmd->cmd_complete = addr_cmd_complete;
3074
3075         /* Continue with pairing via HCI */
3076         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3077                 struct hci_cp_user_passkey_reply cp;
3078
3079                 bacpy(&cp.bdaddr, &addr->bdaddr);
3080                 cp.passkey = passkey;
3081                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3082         } else
3083                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3084                                    &addr->bdaddr);
3085
3086         if (err < 0)
3087                 mgmt_pending_remove(cmd);
3088
3089 done:
3090         hci_dev_unlock(hdev);
3091         return err;
3092 }
3093
3094 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3095                               void *data, u16 len)
3096 {
3097         struct mgmt_cp_pin_code_neg_reply *cp = data;
3098
3099         BT_DBG("");
3100
3101         return user_pairing_resp(sk, hdev, &cp->addr,
3102                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3103                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3104 }
3105
3106 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3107                               u16 len)
3108 {
3109         struct mgmt_cp_user_confirm_reply *cp = data;
3110
3111         BT_DBG("");
3112
3113         if (len != sizeof(*cp))
3114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3115                                        MGMT_STATUS_INVALID_PARAMS);
3116
3117         return user_pairing_resp(sk, hdev, &cp->addr,
3118                                  MGMT_OP_USER_CONFIRM_REPLY,
3119                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3120 }
3121
3122 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3123                                   void *data, u16 len)
3124 {
3125         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3126
3127         BT_DBG("");
3128
3129         return user_pairing_resp(sk, hdev, &cp->addr,
3130                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3131                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3132 }
3133
3134 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3135                               u16 len)
3136 {
3137         struct mgmt_cp_user_passkey_reply *cp = data;
3138
3139         BT_DBG("");
3140
3141         return user_pairing_resp(sk, hdev, &cp->addr,
3142                                  MGMT_OP_USER_PASSKEY_REPLY,
3143                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3144 }
3145
3146 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3147                                   void *data, u16 len)
3148 {
3149         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3150
3151         BT_DBG("");
3152
3153         return user_pairing_resp(sk, hdev, &cp->addr,
3154                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3155                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3156 }
3157
3158 static void adv_expire(struct hci_dev *hdev, u32 flags)
3159 {
3160         struct adv_info *adv_instance;
3161         struct hci_request req;
3162         int err;
3163
3164         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3165         if (!adv_instance)
3166                 return;
3167
3168         /* stop if current instance doesn't need to be changed */
3169         if (!(adv_instance->flags & flags))
3170                 return;
3171
3172         cancel_adv_timeout(hdev);
3173
3174         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3175         if (!adv_instance)
3176                 return;
3177
3178         hci_req_init(&req, hdev);
3179         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3180                                               true);
3181         if (err)
3182                 return;
3183
3184         hci_req_run(&req, NULL);
3185 }
3186
3187 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3188 {
3189         struct mgmt_cp_set_local_name *cp;
3190         struct mgmt_pending_cmd *cmd;
3191
3192         BT_DBG("status 0x%02x", status);
3193
3194         hci_dev_lock(hdev);
3195
3196         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3197         if (!cmd)
3198                 goto unlock;
3199
3200         cp = cmd->param;
3201
3202         if (status) {
3203                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3204                                 mgmt_status(status));
3205         } else {
3206                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3207                                   cp, sizeof(*cp));
3208
3209                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3210                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3211         }
3212
3213         mgmt_pending_remove(cmd);
3214
3215 unlock:
3216         hci_dev_unlock(hdev);
3217 }
3218
3219 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3220                           u16 len)
3221 {
3222         struct mgmt_cp_set_local_name *cp = data;
3223         struct mgmt_pending_cmd *cmd;
3224         struct hci_request req;
3225         int err;
3226
3227         BT_DBG("");
3228
3229         hci_dev_lock(hdev);
3230
3231         /* If the old values are the same as the new ones just return a
3232          * direct command complete event.
3233          */
3234         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3235             !memcmp(hdev->short_name, cp->short_name,
3236                     sizeof(hdev->short_name))) {
3237                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3238                                         data, len);
3239                 goto failed;
3240         }
3241
3242         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3243
3244         if (!hdev_is_powered(hdev)) {
3245                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3246
3247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3248                                         data, len);
3249                 if (err < 0)
3250                         goto failed;
3251
3252                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3253                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3254                 ext_info_changed(hdev, sk);
3255
3256                 goto failed;
3257         }
3258
3259         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3260         if (!cmd) {
3261                 err = -ENOMEM;
3262                 goto failed;
3263         }
3264
3265         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3266
3267         hci_req_init(&req, hdev);
3268
3269         if (lmp_bredr_capable(hdev)) {
3270                 __hci_req_update_name(&req);
3271                 __hci_req_update_eir(&req);
3272         }
3273
3274         /* The name is stored in the scan response data and so
3275          * no need to udpate the advertising data here.
3276          */
3277         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3278                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3279
3280         err = hci_req_run(&req, set_name_complete);
3281         if (err < 0)
3282                 mgmt_pending_remove(cmd);
3283
3284 failed:
3285         hci_dev_unlock(hdev);
3286         return err;
3287 }
3288
3289 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3290                           u16 len)
3291 {
3292         struct mgmt_cp_set_appearance *cp = data;
3293         u16 apperance;
3294         int err;
3295
3296         BT_DBG("");
3297
3298         if (!lmp_le_capable(hdev))
3299                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3300                                        MGMT_STATUS_NOT_SUPPORTED);
3301
3302         apperance = le16_to_cpu(cp->appearance);
3303
3304         hci_dev_lock(hdev);
3305
3306         if (hdev->appearance != apperance) {
3307                 hdev->appearance = apperance;
3308
3309                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3310                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3311
3312                 ext_info_changed(hdev, sk);
3313         }
3314
3315         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3316                                 0);
3317
3318         hci_dev_unlock(hdev);
3319
3320         return err;
3321 }
3322
3323 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3324                                  void *data, u16 len)
3325 {
3326         struct mgmt_rp_get_phy_confguration rp;
3327
3328         BT_DBG("sock %p %s", sk, hdev->name);
3329
3330         hci_dev_lock(hdev);
3331
3332         memset(&rp, 0, sizeof(rp));
3333
3334         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3335         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3336         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3337
3338         hci_dev_unlock(hdev);
3339
3340         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3341                                  &rp, sizeof(rp));
3342 }
3343
3344 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3345 {
3346         struct mgmt_ev_phy_configuration_changed ev;
3347
3348         memset(&ev, 0, sizeof(ev));
3349
3350         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3351
3352         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3353                           sizeof(ev), skip);
3354 }
3355
3356 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3357                                      u16 opcode, struct sk_buff *skb)
3358 {
3359         struct mgmt_pending_cmd *cmd;
3360
3361         BT_DBG("status 0x%02x", status);
3362
3363         hci_dev_lock(hdev);
3364
3365         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3366         if (!cmd)
3367                 goto unlock;
3368
3369         if (status) {
3370                 mgmt_cmd_status(cmd->sk, hdev->id,
3371                                 MGMT_OP_SET_PHY_CONFIGURATION,
3372                                 mgmt_status(status));
3373         } else {
3374                 mgmt_cmd_complete(cmd->sk, hdev->id,
3375                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3376                                   NULL, 0);
3377
3378                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3379         }
3380
3381         mgmt_pending_remove(cmd);
3382
3383 unlock:
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3388                                  void *data, u16 len)
3389 {
3390         struct mgmt_cp_set_phy_confguration *cp = data;
3391         struct hci_cp_le_set_default_phy cp_phy;
3392         struct mgmt_pending_cmd *cmd;
3393         struct hci_request req;
3394         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3395         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3396         bool changed = false;
3397         int err;
3398
3399         BT_DBG("sock %p %s", sk, hdev->name);
3400
3401         configurable_phys = get_configurable_phys(hdev);
3402         supported_phys = get_supported_phys(hdev);
3403         selected_phys = __le32_to_cpu(cp->selected_phys);
3404
3405         if (selected_phys & ~supported_phys)
3406                 return mgmt_cmd_status(sk, hdev->id,
3407                                        MGMT_OP_SET_PHY_CONFIGURATION,
3408                                        MGMT_STATUS_INVALID_PARAMS);
3409
3410         unconfigure_phys = supported_phys & ~configurable_phys;
3411
3412         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3413                 return mgmt_cmd_status(sk, hdev->id,
3414                                        MGMT_OP_SET_PHY_CONFIGURATION,
3415                                        MGMT_STATUS_INVALID_PARAMS);
3416
3417         if (selected_phys == get_selected_phys(hdev))
3418                 return mgmt_cmd_complete(sk, hdev->id,
3419                                          MGMT_OP_SET_PHY_CONFIGURATION,
3420                                          0, NULL, 0);
3421
3422         hci_dev_lock(hdev);
3423
3424         if (!hdev_is_powered(hdev)) {
3425                 err = mgmt_cmd_status(sk, hdev->id,
3426                                       MGMT_OP_SET_PHY_CONFIGURATION,
3427                                       MGMT_STATUS_REJECTED);
3428                 goto unlock;
3429         }
3430
3431         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3432                 err = mgmt_cmd_status(sk, hdev->id,
3433                                       MGMT_OP_SET_PHY_CONFIGURATION,
3434                                       MGMT_STATUS_BUSY);
3435                 goto unlock;
3436         }
3437
3438         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3439                 pkt_type |= (HCI_DH3 | HCI_DM3);
3440         else
3441                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3442
3443         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3444                 pkt_type |= (HCI_DH5 | HCI_DM5);
3445         else
3446                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3447
3448         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3449                 pkt_type &= ~HCI_2DH1;
3450         else
3451                 pkt_type |= HCI_2DH1;
3452
3453         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3454                 pkt_type &= ~HCI_2DH3;
3455         else
3456                 pkt_type |= HCI_2DH3;
3457
3458         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3459                 pkt_type &= ~HCI_2DH5;
3460         else
3461                 pkt_type |= HCI_2DH5;
3462
3463         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3464                 pkt_type &= ~HCI_3DH1;
3465         else
3466                 pkt_type |= HCI_3DH1;
3467
3468         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3469                 pkt_type &= ~HCI_3DH3;
3470         else
3471                 pkt_type |= HCI_3DH3;
3472
3473         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3474                 pkt_type &= ~HCI_3DH5;
3475         else
3476                 pkt_type |= HCI_3DH5;
3477
3478         if (pkt_type != hdev->pkt_type) {
3479                 hdev->pkt_type = pkt_type;
3480                 changed = true;
3481         }
3482
3483         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3484             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3485                 if (changed)
3486                         mgmt_phy_configuration_changed(hdev, sk);
3487
3488                 err = mgmt_cmd_complete(sk, hdev->id,
3489                                         MGMT_OP_SET_PHY_CONFIGURATION,
3490                                         0, NULL, 0);
3491
3492                 goto unlock;
3493         }
3494
3495         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3496                                len);
3497         if (!cmd) {
3498                 err = -ENOMEM;
3499                 goto unlock;
3500         }
3501
3502         hci_req_init(&req, hdev);
3503
3504         memset(&cp_phy, 0, sizeof(cp_phy));
3505
3506         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3507                 cp_phy.all_phys |= 0x01;
3508
3509         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3510                 cp_phy.all_phys |= 0x02;
3511
3512         if (selected_phys & MGMT_PHY_LE_1M_TX)
3513                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3514
3515         if (selected_phys & MGMT_PHY_LE_2M_TX)
3516                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3517
3518         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3519                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3520
3521         if (selected_phys & MGMT_PHY_LE_1M_RX)
3522                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3523
3524         if (selected_phys & MGMT_PHY_LE_2M_RX)
3525                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3526
3527         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3528                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3529
3530         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3531
3532         err = hci_req_run_skb(&req, set_default_phy_complete);
3533         if (err < 0)
3534                 mgmt_pending_remove(cmd);
3535
3536 unlock:
3537         hci_dev_unlock(hdev);
3538
3539         return err;
3540 }
3541
3542 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3543                                          u16 opcode, struct sk_buff *skb)
3544 {
3545         struct mgmt_rp_read_local_oob_data mgmt_rp;
3546         size_t rp_size = sizeof(mgmt_rp);
3547         struct mgmt_pending_cmd *cmd;
3548
3549         BT_DBG("%s status %u", hdev->name, status);
3550
3551         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3552         if (!cmd)
3553                 return;
3554
3555         if (status || !skb) {
3556                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3557                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3558                 goto remove;
3559         }
3560
3561         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3562
3563         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3564                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3565
3566                 if (skb->len < sizeof(*rp)) {
3567                         mgmt_cmd_status(cmd->sk, hdev->id,
3568                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3569                                         MGMT_STATUS_FAILED);
3570                         goto remove;
3571                 }
3572
3573                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3574                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3575
3576                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3577         } else {
3578                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3579
3580                 if (skb->len < sizeof(*rp)) {
3581                         mgmt_cmd_status(cmd->sk, hdev->id,
3582                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3583                                         MGMT_STATUS_FAILED);
3584                         goto remove;
3585                 }
3586
3587                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3588                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3589
3590                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3591                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3592         }
3593
3594         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3595                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3596
3597 remove:
3598         mgmt_pending_remove(cmd);
3599 }
3600
3601 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3602                                void *data, u16 data_len)
3603 {
3604         struct mgmt_pending_cmd *cmd;
3605         struct hci_request req;
3606         int err;
3607
3608         BT_DBG("%s", hdev->name);
3609
3610         hci_dev_lock(hdev);
3611
3612         if (!hdev_is_powered(hdev)) {
3613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3614                                       MGMT_STATUS_NOT_POWERED);
3615                 goto unlock;
3616         }
3617
3618         if (!lmp_ssp_capable(hdev)) {
3619                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3620                                       MGMT_STATUS_NOT_SUPPORTED);
3621                 goto unlock;
3622         }
3623
3624         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3625                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3626                                       MGMT_STATUS_BUSY);
3627                 goto unlock;
3628         }
3629
3630         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3631         if (!cmd) {
3632                 err = -ENOMEM;
3633                 goto unlock;
3634         }
3635
3636         hci_req_init(&req, hdev);
3637
3638         if (bredr_sc_enabled(hdev))
3639                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3640         else
3641                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3642
3643         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3644         if (err < 0)
3645                 mgmt_pending_remove(cmd);
3646
3647 unlock:
3648         hci_dev_unlock(hdev);
3649         return err;
3650 }
3651
3652 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3653                                void *data, u16 len)
3654 {
3655         struct mgmt_addr_info *addr = data;
3656         int err;
3657
3658         BT_DBG("%s ", hdev->name);
3659
3660         if (!bdaddr_type_is_valid(addr->type))
3661                 return mgmt_cmd_complete(sk, hdev->id,
3662                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3663                                          MGMT_STATUS_INVALID_PARAMS,
3664                                          addr, sizeof(*addr));
3665
3666         hci_dev_lock(hdev);
3667
3668         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3669                 struct mgmt_cp_add_remote_oob_data *cp = data;
3670                 u8 status;
3671
3672                 if (cp->addr.type != BDADDR_BREDR) {
3673                         err = mgmt_cmd_complete(sk, hdev->id,
3674                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3675                                                 MGMT_STATUS_INVALID_PARAMS,
3676                                                 &cp->addr, sizeof(cp->addr));
3677                         goto unlock;
3678                 }
3679
3680                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3681                                               cp->addr.type, cp->hash,
3682                                               cp->rand, NULL, NULL);
3683                 if (err < 0)
3684                         status = MGMT_STATUS_FAILED;
3685                 else
3686                         status = MGMT_STATUS_SUCCESS;
3687
3688                 err = mgmt_cmd_complete(sk, hdev->id,
3689                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3690                                         &cp->addr, sizeof(cp->addr));
3691         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3692                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3693                 u8 *rand192, *hash192, *rand256, *hash256;
3694                 u8 status;
3695
3696                 if (bdaddr_type_is_le(cp->addr.type)) {
3697                         /* Enforce zero-valued 192-bit parameters as
3698                          * long as legacy SMP OOB isn't implemented.
3699                          */
3700                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3701                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3702                                 err = mgmt_cmd_complete(sk, hdev->id,
3703                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3704                                                         MGMT_STATUS_INVALID_PARAMS,
3705                                                         addr, sizeof(*addr));
3706                                 goto unlock;
3707                         }
3708
3709                         rand192 = NULL;
3710                         hash192 = NULL;
3711                 } else {
3712                         /* In case one of the P-192 values is set to zero,
3713                          * then just disable OOB data for P-192.
3714                          */
3715                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3716                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3717                                 rand192 = NULL;
3718                                 hash192 = NULL;
3719                         } else {
3720                                 rand192 = cp->rand192;
3721                                 hash192 = cp->hash192;
3722                         }
3723                 }
3724
3725                 /* In case one of the P-256 values is set to zero, then just
3726                  * disable OOB data for P-256.
3727                  */
3728                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3729                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3730                         rand256 = NULL;
3731                         hash256 = NULL;
3732                 } else {
3733                         rand256 = cp->rand256;
3734                         hash256 = cp->hash256;
3735                 }
3736
3737                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3738                                               cp->addr.type, hash192, rand192,
3739                                               hash256, rand256);
3740                 if (err < 0)
3741                         status = MGMT_STATUS_FAILED;
3742                 else
3743                         status = MGMT_STATUS_SUCCESS;
3744
3745                 err = mgmt_cmd_complete(sk, hdev->id,
3746                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3747                                         status, &cp->addr, sizeof(cp->addr));
3748         } else {
3749                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3750                            len);
3751                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3752                                       MGMT_STATUS_INVALID_PARAMS);
3753         }
3754
3755 unlock:
3756         hci_dev_unlock(hdev);
3757         return err;
3758 }
3759
3760 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3761                                   void *data, u16 len)
3762 {
3763         struct mgmt_cp_remove_remote_oob_data *cp = data;
3764         u8 status;
3765         int err;
3766
3767         BT_DBG("%s", hdev->name);
3768
3769         if (cp->addr.type != BDADDR_BREDR)
3770                 return mgmt_cmd_complete(sk, hdev->id,
3771                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3772                                          MGMT_STATUS_INVALID_PARAMS,
3773                                          &cp->addr, sizeof(cp->addr));
3774
3775         hci_dev_lock(hdev);
3776
3777         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3778                 hci_remote_oob_data_clear(hdev);
3779                 status = MGMT_STATUS_SUCCESS;
3780                 goto done;
3781         }
3782
3783         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3784         if (err < 0)
3785                 status = MGMT_STATUS_INVALID_PARAMS;
3786         else
3787                 status = MGMT_STATUS_SUCCESS;
3788
3789 done:
3790         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3791                                 status, &cp->addr, sizeof(cp->addr));
3792
3793         hci_dev_unlock(hdev);
3794         return err;
3795 }
3796
3797 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3798 {
3799         struct mgmt_pending_cmd *cmd;
3800
3801         BT_DBG("status %d", status);
3802
3803         hci_dev_lock(hdev);
3804
3805         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3806         if (!cmd)
3807                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3808
3809         if (!cmd)
3810                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3811
3812         if (cmd) {
3813                 cmd->cmd_complete(cmd, mgmt_status(status));
3814                 mgmt_pending_remove(cmd);
3815         }
3816
3817         hci_dev_unlock(hdev);
3818 }
3819
3820 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3821                                     uint8_t *mgmt_status)
3822 {
3823         switch (type) {
3824         case DISCOV_TYPE_LE:
3825                 *mgmt_status = mgmt_le_support(hdev);
3826                 if (*mgmt_status)
3827                         return false;
3828                 break;
3829         case DISCOV_TYPE_INTERLEAVED:
3830                 *mgmt_status = mgmt_le_support(hdev);
3831                 if (*mgmt_status)
3832                         return false;
3833                 /* Intentional fall-through */
3834         case DISCOV_TYPE_BREDR:
3835                 *mgmt_status = mgmt_bredr_support(hdev);
3836                 if (*mgmt_status)
3837                         return false;
3838                 break;
3839         default:
3840                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3841                 return false;
3842         }
3843
3844         return true;
3845 }
3846
3847 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3848                                     u16 op, void *data, u16 len)
3849 {
3850         struct mgmt_cp_start_discovery *cp = data;
3851         struct mgmt_pending_cmd *cmd;
3852         u8 status;
3853         int err;
3854
3855         BT_DBG("%s", hdev->name);
3856
3857         hci_dev_lock(hdev);
3858
3859         if (!hdev_is_powered(hdev)) {
3860                 err = mgmt_cmd_complete(sk, hdev->id, op,
3861                                         MGMT_STATUS_NOT_POWERED,
3862                                         &cp->type, sizeof(cp->type));
3863                 goto failed;
3864         }
3865
3866         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3867             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3868                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3869                                         &cp->type, sizeof(cp->type));
3870                 goto failed;
3871         }
3872
3873         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3874                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3875                                         &cp->type, sizeof(cp->type));
3876                 goto failed;
3877         }
3878
3879         /* Clear the discovery filter first to free any previously
3880          * allocated memory for the UUID list.
3881          */
3882         hci_discovery_filter_clear(hdev);
3883
3884         hdev->discovery.type = cp->type;
3885         hdev->discovery.report_invalid_rssi = false;
3886         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3887                 hdev->discovery.limited = true;
3888         else
3889                 hdev->discovery.limited = false;
3890
3891         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3892         if (!cmd) {
3893                 err = -ENOMEM;
3894                 goto failed;
3895         }
3896
3897         cmd->cmd_complete = generic_cmd_complete;
3898
3899         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3900         queue_work(hdev->req_workqueue, &hdev->discov_update);
3901         err = 0;
3902
3903 failed:
3904         hci_dev_unlock(hdev);
3905         return err;
3906 }
3907
3908 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3909                            void *data, u16 len)
3910 {
3911         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3912                                         data, len);
3913 }
3914
3915 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3916                                    void *data, u16 len)
3917 {
3918         return start_discovery_internal(sk, hdev,
3919                                         MGMT_OP_START_LIMITED_DISCOVERY,
3920                                         data, len);
3921 }
3922
3923 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3924                                           u8 status)
3925 {
3926         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3927                                  cmd->param, 1);
3928 }
3929
3930 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3931                                    void *data, u16 len)
3932 {
3933         struct mgmt_cp_start_service_discovery *cp = data;
3934         struct mgmt_pending_cmd *cmd;
3935         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3936         u16 uuid_count, expected_len;
3937         u8 status;
3938         int err;
3939
3940         BT_DBG("%s", hdev->name);
3941
3942         hci_dev_lock(hdev);
3943
3944         if (!hdev_is_powered(hdev)) {
3945                 err = mgmt_cmd_complete(sk, hdev->id,
3946                                         MGMT_OP_START_SERVICE_DISCOVERY,
3947                                         MGMT_STATUS_NOT_POWERED,
3948                                         &cp->type, sizeof(cp->type));
3949                 goto failed;
3950         }
3951
3952         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3953             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3954                 err = mgmt_cmd_complete(sk, hdev->id,
3955                                         MGMT_OP_START_SERVICE_DISCOVERY,
3956                                         MGMT_STATUS_BUSY, &cp->type,
3957                                         sizeof(cp->type));
3958                 goto failed;
3959         }
3960
3961         uuid_count = __le16_to_cpu(cp->uuid_count);
3962         if (uuid_count > max_uuid_count) {
3963                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3964                            uuid_count);
3965                 err = mgmt_cmd_complete(sk, hdev->id,
3966                                         MGMT_OP_START_SERVICE_DISCOVERY,
3967                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3968                                         sizeof(cp->type));
3969                 goto failed;
3970         }
3971
3972         expected_len = sizeof(*cp) + uuid_count * 16;
3973         if (expected_len != len) {
3974                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3975                            expected_len, len);
3976                 err = mgmt_cmd_complete(sk, hdev->id,
3977                                         MGMT_OP_START_SERVICE_DISCOVERY,
3978                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3979                                         sizeof(cp->type));
3980                 goto failed;
3981         }
3982
3983         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3984                 err = mgmt_cmd_complete(sk, hdev->id,
3985                                         MGMT_OP_START_SERVICE_DISCOVERY,
3986                                         status, &cp->type, sizeof(cp->type));
3987                 goto failed;
3988         }
3989
3990         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3991                                hdev, data, len);
3992         if (!cmd) {
3993                 err = -ENOMEM;
3994                 goto failed;
3995         }
3996
3997         cmd->cmd_complete = service_discovery_cmd_complete;
3998
3999         /* Clear the discovery filter first to free any previously
4000          * allocated memory for the UUID list.
4001          */
4002         hci_discovery_filter_clear(hdev);
4003
4004         hdev->discovery.result_filtering = true;
4005         hdev->discovery.type = cp->type;
4006         hdev->discovery.rssi = cp->rssi;
4007         hdev->discovery.uuid_count = uuid_count;
4008
4009         if (uuid_count > 0) {
4010                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4011                                                 GFP_KERNEL);
4012                 if (!hdev->discovery.uuids) {
4013                         err = mgmt_cmd_complete(sk, hdev->id,
4014                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4015                                                 MGMT_STATUS_FAILED,
4016                                                 &cp->type, sizeof(cp->type));
4017                         mgmt_pending_remove(cmd);
4018                         goto failed;
4019                 }
4020         }
4021
4022         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4023         queue_work(hdev->req_workqueue, &hdev->discov_update);
4024         err = 0;
4025
4026 failed:
4027         hci_dev_unlock(hdev);
4028         return err;
4029 }
4030
4031 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4032 {
4033         struct mgmt_pending_cmd *cmd;
4034
4035         BT_DBG("status %d", status);
4036
4037         hci_dev_lock(hdev);
4038
4039         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4040         if (cmd) {
4041                 cmd->cmd_complete(cmd, mgmt_status(status));
4042                 mgmt_pending_remove(cmd);
4043         }
4044
4045         hci_dev_unlock(hdev);
4046 }
4047
4048 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4049                           u16 len)
4050 {
4051         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4052         struct mgmt_pending_cmd *cmd;
4053         int err;
4054
4055         BT_DBG("%s", hdev->name);
4056
4057         hci_dev_lock(hdev);
4058
4059         if (!hci_discovery_active(hdev)) {
4060                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4061                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4062                                         sizeof(mgmt_cp->type));
4063                 goto unlock;
4064         }
4065
4066         if (hdev->discovery.type != mgmt_cp->type) {
4067                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4068                                         MGMT_STATUS_INVALID_PARAMS,
4069                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4070                 goto unlock;
4071         }
4072
4073         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4074         if (!cmd) {
4075                 err = -ENOMEM;
4076                 goto unlock;
4077         }
4078
4079         cmd->cmd_complete = generic_cmd_complete;
4080
4081         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4082         queue_work(hdev->req_workqueue, &hdev->discov_update);
4083         err = 0;
4084
4085 unlock:
4086         hci_dev_unlock(hdev);
4087         return err;
4088 }
4089
4090 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4091                         u16 len)
4092 {
4093         struct mgmt_cp_confirm_name *cp = data;
4094         struct inquiry_entry *e;
4095         int err;
4096
4097         BT_DBG("%s", hdev->name);
4098
4099         hci_dev_lock(hdev);
4100
4101         if (!hci_discovery_active(hdev)) {
4102                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103                                         MGMT_STATUS_FAILED, &cp->addr,
4104                                         sizeof(cp->addr));
4105                 goto failed;
4106         }
4107
4108         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4109         if (!e) {
4110                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4111                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4112                                         sizeof(cp->addr));
4113                 goto failed;
4114         }
4115
4116         if (cp->name_known) {
4117                 e->name_state = NAME_KNOWN;
4118                 list_del(&e->list);
4119         } else {
4120                 e->name_state = NAME_NEEDED;
4121                 hci_inquiry_cache_update_resolve(hdev, e);
4122         }
4123
4124         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4125                                 &cp->addr, sizeof(cp->addr));
4126
4127 failed:
4128         hci_dev_unlock(hdev);
4129         return err;
4130 }
4131
4132 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4133                         u16 len)
4134 {
4135         struct mgmt_cp_block_device *cp = data;
4136         u8 status;
4137         int err;
4138
4139         BT_DBG("%s", hdev->name);
4140
4141         if (!bdaddr_type_is_valid(cp->addr.type))
4142                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4143                                          MGMT_STATUS_INVALID_PARAMS,
4144                                          &cp->addr, sizeof(cp->addr));
4145
4146         hci_dev_lock(hdev);
4147
4148         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4149                                   cp->addr.type);
4150         if (err < 0) {
4151                 status = MGMT_STATUS_FAILED;
4152                 goto done;
4153         }
4154
4155         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4156                    sk);
4157         status = MGMT_STATUS_SUCCESS;
4158
4159 done:
4160         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4161                                 &cp->addr, sizeof(cp->addr));
4162
4163         hci_dev_unlock(hdev);
4164
4165         return err;
4166 }
4167
4168 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4169                           u16 len)
4170 {
4171         struct mgmt_cp_unblock_device *cp = data;
4172         u8 status;
4173         int err;
4174
4175         BT_DBG("%s", hdev->name);
4176
4177         if (!bdaddr_type_is_valid(cp->addr.type))
4178                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4179                                          MGMT_STATUS_INVALID_PARAMS,
4180                                          &cp->addr, sizeof(cp->addr));
4181
4182         hci_dev_lock(hdev);
4183
4184         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4185                                   cp->addr.type);
4186         if (err < 0) {
4187                 status = MGMT_STATUS_INVALID_PARAMS;
4188                 goto done;
4189         }
4190
4191         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4192                    sk);
4193         status = MGMT_STATUS_SUCCESS;
4194
4195 done:
4196         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4197                                 &cp->addr, sizeof(cp->addr));
4198
4199         hci_dev_unlock(hdev);
4200
4201         return err;
4202 }
4203
4204 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4205                          u16 len)
4206 {
4207         struct mgmt_cp_set_device_id *cp = data;
4208         struct hci_request req;
4209         int err;
4210         __u16 source;
4211
4212         BT_DBG("%s", hdev->name);
4213
4214         source = __le16_to_cpu(cp->source);
4215
4216         if (source > 0x0002)
4217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4218                                        MGMT_STATUS_INVALID_PARAMS);
4219
4220         hci_dev_lock(hdev);
4221
4222         hdev->devid_source = source;
4223         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4224         hdev->devid_product = __le16_to_cpu(cp->product);
4225         hdev->devid_version = __le16_to_cpu(cp->version);
4226
4227         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4228                                 NULL, 0);
4229
4230         hci_req_init(&req, hdev);
4231         __hci_req_update_eir(&req);
4232         hci_req_run(&req, NULL);
4233
4234         hci_dev_unlock(hdev);
4235
4236         return err;
4237 }
4238
4239 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4240                                         u16 opcode)
4241 {
4242         BT_DBG("status %d", status);
4243 }
4244
4245 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4246                                      u16 opcode)
4247 {
4248         struct cmd_lookup match = { NULL, hdev };
4249         struct hci_request req;
4250         u8 instance;
4251         struct adv_info *adv_instance;
4252         int err;
4253
4254         hci_dev_lock(hdev);
4255
4256         if (status) {
4257                 u8 mgmt_err = mgmt_status(status);
4258
4259                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4260                                      cmd_status_rsp, &mgmt_err);
4261                 goto unlock;
4262         }
4263
4264         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4265                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4266         else
4267                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4268
4269         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4270                              &match);
4271
4272         new_settings(hdev, match.sk);
4273
4274         if (match.sk)
4275                 sock_put(match.sk);
4276
4277         /* If "Set Advertising" was just disabled and instance advertising was
4278          * set up earlier, then re-enable multi-instance advertising.
4279          */
4280         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4281             list_empty(&hdev->adv_instances))
4282                 goto unlock;
4283
4284         instance = hdev->cur_adv_instance;
4285         if (!instance) {
4286                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4287                                                         struct adv_info, list);
4288                 if (!adv_instance)
4289                         goto unlock;
4290
4291                 instance = adv_instance->instance;
4292         }
4293
4294         hci_req_init(&req, hdev);
4295
4296         err = __hci_req_schedule_adv_instance(&req, instance, true);
4297
4298         if (!err)
4299                 err = hci_req_run(&req, enable_advertising_instance);
4300
4301         if (err)
4302                 bt_dev_err(hdev, "failed to re-configure advertising");
4303
4304 unlock:
4305         hci_dev_unlock(hdev);
4306 }
4307
4308 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4309                            u16 len)
4310 {
4311         struct mgmt_mode *cp = data;
4312         struct mgmt_pending_cmd *cmd;
4313         struct hci_request req;
4314         u8 val, status;
4315         int err;
4316
4317         BT_DBG("request for %s", hdev->name);
4318
4319         status = mgmt_le_support(hdev);
4320         if (status)
4321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4322                                        status);
4323
4324         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4325                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4326                                        MGMT_STATUS_INVALID_PARAMS);
4327
4328         hci_dev_lock(hdev);
4329
4330         val = !!cp->val;
4331
4332         /* The following conditions are ones which mean that we should
4333          * not do any HCI communication but directly send a mgmt
4334          * response to user space (after toggling the flag if
4335          * necessary).
4336          */
4337         if (!hdev_is_powered(hdev) ||
4338             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4339              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4340             hci_conn_num(hdev, LE_LINK) > 0 ||
4341             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4342              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4343                 bool changed;
4344
4345                 if (cp->val) {
4346                         hdev->cur_adv_instance = 0x00;
4347                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4348                         if (cp->val == 0x02)
4349                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350                         else
4351                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4352                 } else {
4353                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4354                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4355                 }
4356
4357                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4358                 if (err < 0)
4359                         goto unlock;
4360
4361                 if (changed)
4362                         err = new_settings(hdev, sk);
4363
4364                 goto unlock;
4365         }
4366
4367         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4368             pending_find(MGMT_OP_SET_LE, hdev)) {
4369                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4370                                       MGMT_STATUS_BUSY);
4371                 goto unlock;
4372         }
4373
4374         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4375         if (!cmd) {
4376                 err = -ENOMEM;
4377                 goto unlock;
4378         }
4379
4380         hci_req_init(&req, hdev);
4381
4382         if (cp->val == 0x02)
4383                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4384         else
4385                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4386
4387         cancel_adv_timeout(hdev);
4388
4389         if (val) {
4390                 /* Switch to instance "0" for the Set Advertising setting.
4391                  * We cannot use update_[adv|scan_rsp]_data() here as the
4392                  * HCI_ADVERTISING flag is not yet set.
4393                  */
4394                 hdev->cur_adv_instance = 0x00;
4395
4396                 if (ext_adv_capable(hdev)) {
4397                         __hci_req_start_ext_adv(&req, 0x00);
4398                 } else {
4399                         __hci_req_update_adv_data(&req, 0x00);
4400                         __hci_req_update_scan_rsp_data(&req, 0x00);
4401                         __hci_req_enable_advertising(&req);
4402                 }
4403         } else {
4404                 __hci_req_disable_advertising(&req);
4405         }
4406
4407         err = hci_req_run(&req, set_advertising_complete);
4408         if (err < 0)
4409                 mgmt_pending_remove(cmd);
4410
4411 unlock:
4412         hci_dev_unlock(hdev);
4413         return err;
4414 }
4415
4416 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4417                               void *data, u16 len)
4418 {
4419         struct mgmt_cp_set_static_address *cp = data;
4420         int err;
4421
4422         BT_DBG("%s", hdev->name);
4423
4424         if (!lmp_le_capable(hdev))
4425                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4426                                        MGMT_STATUS_NOT_SUPPORTED);
4427
4428         if (hdev_is_powered(hdev))
4429                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4430                                        MGMT_STATUS_REJECTED);
4431
4432         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4433                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4434                         return mgmt_cmd_status(sk, hdev->id,
4435                                                MGMT_OP_SET_STATIC_ADDRESS,
4436                                                MGMT_STATUS_INVALID_PARAMS);
4437
4438                 /* Two most significant bits shall be set */
4439                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4440                         return mgmt_cmd_status(sk, hdev->id,
4441                                                MGMT_OP_SET_STATIC_ADDRESS,
4442                                                MGMT_STATUS_INVALID_PARAMS);
4443         }
4444
4445         hci_dev_lock(hdev);
4446
4447         bacpy(&hdev->static_addr, &cp->bdaddr);
4448
4449         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4450         if (err < 0)
4451                 goto unlock;
4452
4453         err = new_settings(hdev, sk);
4454
4455 unlock:
4456         hci_dev_unlock(hdev);
4457         return err;
4458 }
4459
4460 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4461                            void *data, u16 len)
4462 {
4463         struct mgmt_cp_set_scan_params *cp = data;
4464         __u16 interval, window;
4465         int err;
4466
4467         BT_DBG("%s", hdev->name);
4468
4469         if (!lmp_le_capable(hdev))
4470                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4471                                        MGMT_STATUS_NOT_SUPPORTED);
4472
4473         interval = __le16_to_cpu(cp->interval);
4474
4475         if (interval < 0x0004 || interval > 0x4000)
4476                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4477                                        MGMT_STATUS_INVALID_PARAMS);
4478
4479         window = __le16_to_cpu(cp->window);
4480
4481         if (window < 0x0004 || window > 0x4000)
4482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4483                                        MGMT_STATUS_INVALID_PARAMS);
4484
4485         if (window > interval)
4486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4487                                        MGMT_STATUS_INVALID_PARAMS);
4488
4489         hci_dev_lock(hdev);
4490
4491         hdev->le_scan_interval = interval;
4492         hdev->le_scan_window = window;
4493
4494         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4495                                 NULL, 0);
4496
4497         /* If background scan is running, restart it so new parameters are
4498          * loaded.
4499          */
4500         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4501             hdev->discovery.state == DISCOVERY_STOPPED) {
4502                 struct hci_request req;
4503
4504                 hci_req_init(&req, hdev);
4505
4506                 hci_req_add_le_scan_disable(&req);
4507                 hci_req_add_le_passive_scan(&req);
4508
4509                 hci_req_run(&req, NULL);
4510         }
4511
4512         hci_dev_unlock(hdev);
4513
4514         return err;
4515 }
4516
4517 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4518                                       u16 opcode)
4519 {
4520         struct mgmt_pending_cmd *cmd;
4521
4522         BT_DBG("status 0x%02x", status);
4523
4524         hci_dev_lock(hdev);
4525
4526         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4527         if (!cmd)
4528                 goto unlock;
4529
4530         if (status) {
4531                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4532                                 mgmt_status(status));
4533         } else {
4534                 struct mgmt_mode *cp = cmd->param;
4535
4536                 if (cp->val)
4537                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4538                 else
4539                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4540
4541                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4542                 new_settings(hdev, cmd->sk);
4543         }
4544
4545         mgmt_pending_remove(cmd);
4546
4547 unlock:
4548         hci_dev_unlock(hdev);
4549 }
4550
4551 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4552                                 void *data, u16 len)
4553 {
4554         struct mgmt_mode *cp = data;
4555         struct mgmt_pending_cmd *cmd;
4556         struct hci_request req;
4557         int err;
4558
4559         BT_DBG("%s", hdev->name);
4560
4561         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4562             hdev->hci_ver < BLUETOOTH_VER_1_2)
4563                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4564                                        MGMT_STATUS_NOT_SUPPORTED);
4565
4566         if (cp->val != 0x00 && cp->val != 0x01)
4567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4568                                        MGMT_STATUS_INVALID_PARAMS);
4569
4570         hci_dev_lock(hdev);
4571
4572         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4573                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4574                                       MGMT_STATUS_BUSY);
4575                 goto unlock;
4576         }
4577
4578         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4579                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4580                                         hdev);
4581                 goto unlock;
4582         }
4583
4584         if (!hdev_is_powered(hdev)) {
4585                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4586                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4587                                         hdev);
4588                 new_settings(hdev, sk);
4589                 goto unlock;
4590         }
4591
4592         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4593                                data, len);
4594         if (!cmd) {
4595                 err = -ENOMEM;
4596                 goto unlock;
4597         }
4598
4599         hci_req_init(&req, hdev);
4600
4601         __hci_req_write_fast_connectable(&req, cp->val);
4602
4603         err = hci_req_run(&req, fast_connectable_complete);
4604         if (err < 0) {
4605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4606                                       MGMT_STATUS_FAILED);
4607                 mgmt_pending_remove(cmd);
4608         }
4609
4610 unlock:
4611         hci_dev_unlock(hdev);
4612
4613         return err;
4614 }
4615
4616 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4617 {
4618         struct mgmt_pending_cmd *cmd;
4619
4620         BT_DBG("status 0x%02x", status);
4621
4622         hci_dev_lock(hdev);
4623
4624         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4625         if (!cmd)
4626                 goto unlock;
4627
4628         if (status) {
4629                 u8 mgmt_err = mgmt_status(status);
4630
4631                 /* We need to restore the flag if related HCI commands
4632                  * failed.
4633                  */
4634                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4635
4636                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4637         } else {
4638                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4639                 new_settings(hdev, cmd->sk);
4640         }
4641
4642         mgmt_pending_remove(cmd);
4643
4644 unlock:
4645         hci_dev_unlock(hdev);
4646 }
4647
4648 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4649 {
4650         struct mgmt_mode *cp = data;
4651         struct mgmt_pending_cmd *cmd;
4652         struct hci_request req;
4653         int err;
4654
4655         BT_DBG("request for %s", hdev->name);
4656
4657         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4658                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659                                        MGMT_STATUS_NOT_SUPPORTED);
4660
4661         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4662                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4663                                        MGMT_STATUS_REJECTED);
4664
4665         if (cp->val != 0x00 && cp->val != 0x01)
4666                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4667                                        MGMT_STATUS_INVALID_PARAMS);
4668
4669         hci_dev_lock(hdev);
4670
4671         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4672                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4673                 goto unlock;
4674         }
4675
4676         if (!hdev_is_powered(hdev)) {
4677                 if (!cp->val) {
4678                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4679                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4680                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4681                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4682                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4683                 }
4684
4685                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4686
4687                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4688                 if (err < 0)
4689                         goto unlock;
4690
4691                 err = new_settings(hdev, sk);
4692                 goto unlock;
4693         }
4694
4695         /* Reject disabling when powered on */
4696         if (!cp->val) {
4697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4698                                       MGMT_STATUS_REJECTED);
4699                 goto unlock;
4700         } else {
4701                 /* When configuring a dual-mode controller to operate
4702                  * with LE only and using a static address, then switching
4703                  * BR/EDR back on is not allowed.
4704                  *
4705                  * Dual-mode controllers shall operate with the public
4706                  * address as its identity address for BR/EDR and LE. So
4707                  * reject the attempt to create an invalid configuration.
4708                  *
4709                  * The same restrictions applies when secure connections
4710                  * has been enabled. For BR/EDR this is a controller feature
4711                  * while for LE it is a host stack feature. This means that
4712                  * switching BR/EDR back on when secure connections has been
4713                  * enabled is not a supported transaction.
4714                  */
4715                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4716                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4717                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4718                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4719                                               MGMT_STATUS_REJECTED);
4720                         goto unlock;
4721                 }
4722         }
4723
4724         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4725                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4726                                       MGMT_STATUS_BUSY);
4727                 goto unlock;
4728         }
4729
4730         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4731         if (!cmd) {
4732                 err = -ENOMEM;
4733                 goto unlock;
4734         }
4735
4736         /* We need to flip the bit already here so that
4737          * hci_req_update_adv_data generates the correct flags.
4738          */
4739         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4740
4741         hci_req_init(&req, hdev);
4742
4743         __hci_req_write_fast_connectable(&req, false);
4744         __hci_req_update_scan(&req);
4745
4746         /* Since only the advertising data flags will change, there
4747          * is no need to update the scan response data.
4748          */
4749         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4750
4751         err = hci_req_run(&req, set_bredr_complete);
4752         if (err < 0)
4753                 mgmt_pending_remove(cmd);
4754
4755 unlock:
4756         hci_dev_unlock(hdev);
4757         return err;
4758 }
4759
4760 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4761 {
4762         struct mgmt_pending_cmd *cmd;
4763         struct mgmt_mode *cp;
4764
4765         BT_DBG("%s status %u", hdev->name, status);
4766
4767         hci_dev_lock(hdev);
4768
4769         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4770         if (!cmd)
4771                 goto unlock;
4772
4773         if (status) {
4774                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4775                                 mgmt_status(status));
4776                 goto remove;
4777         }
4778
4779         cp = cmd->param;
4780
4781         switch (cp->val) {
4782         case 0x00:
4783                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4784                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4785                 break;
4786         case 0x01:
4787                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4788                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4789                 break;
4790         case 0x02:
4791                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4792                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4793                 break;
4794         }
4795
4796         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4797         new_settings(hdev, cmd->sk);
4798
4799 remove:
4800         mgmt_pending_remove(cmd);
4801 unlock:
4802         hci_dev_unlock(hdev);
4803 }
4804
4805 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4806                            void *data, u16 len)
4807 {
4808         struct mgmt_mode *cp = data;
4809         struct mgmt_pending_cmd *cmd;
4810         struct hci_request req;
4811         u8 val;
4812         int err;
4813
4814         BT_DBG("request for %s", hdev->name);
4815
4816         if (!lmp_sc_capable(hdev) &&
4817             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4819                                        MGMT_STATUS_NOT_SUPPORTED);
4820
4821         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4822             lmp_sc_capable(hdev) &&
4823             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4824                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4825                                        MGMT_STATUS_REJECTED);
4826
4827         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4828                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4829                                   MGMT_STATUS_INVALID_PARAMS);
4830
4831         hci_dev_lock(hdev);
4832
4833         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4834             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4835                 bool changed;
4836
4837                 if (cp->val) {
4838                         changed = !hci_dev_test_and_set_flag(hdev,
4839                                                              HCI_SC_ENABLED);
4840                         if (cp->val == 0x02)
4841                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4842                         else
4843                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4844                 } else {
4845                         changed = hci_dev_test_and_clear_flag(hdev,
4846                                                               HCI_SC_ENABLED);
4847                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4848                 }
4849
4850                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4851                 if (err < 0)
4852                         goto failed;
4853
4854                 if (changed)
4855                         err = new_settings(hdev, sk);
4856
4857                 goto failed;
4858         }
4859
4860         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4861                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4862                                       MGMT_STATUS_BUSY);
4863                 goto failed;
4864         }
4865
4866         val = !!cp->val;
4867
4868         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4869             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4870                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4871                 goto failed;
4872         }
4873
4874         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4875         if (!cmd) {
4876                 err = -ENOMEM;
4877                 goto failed;
4878         }
4879
4880         hci_req_init(&req, hdev);
4881         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4882         err = hci_req_run(&req, sc_enable_complete);
4883         if (err < 0) {
4884                 mgmt_pending_remove(cmd);
4885                 goto failed;
4886         }
4887
4888 failed:
4889         hci_dev_unlock(hdev);
4890         return err;
4891 }
4892
4893 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4894                           void *data, u16 len)
4895 {
4896         struct mgmt_mode *cp = data;
4897         bool changed, use_changed;
4898         int err;
4899
4900         BT_DBG("request for %s", hdev->name);
4901
4902         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4903                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4904                                        MGMT_STATUS_INVALID_PARAMS);
4905
4906         hci_dev_lock(hdev);
4907
4908         if (cp->val)
4909                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4910         else
4911                 changed = hci_dev_test_and_clear_flag(hdev,
4912                                                       HCI_KEEP_DEBUG_KEYS);
4913
4914         if (cp->val == 0x02)
4915                 use_changed = !hci_dev_test_and_set_flag(hdev,
4916                                                          HCI_USE_DEBUG_KEYS);
4917         else
4918                 use_changed = hci_dev_test_and_clear_flag(hdev,
4919                                                           HCI_USE_DEBUG_KEYS);
4920
4921         if (hdev_is_powered(hdev) && use_changed &&
4922             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4923                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4924                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4925                              sizeof(mode), &mode);
4926         }
4927
4928         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4929         if (err < 0)
4930                 goto unlock;
4931
4932         if (changed)
4933                 err = new_settings(hdev, sk);
4934
4935 unlock:
4936         hci_dev_unlock(hdev);
4937         return err;
4938 }
4939
4940 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4941                        u16 len)
4942 {
4943         struct mgmt_cp_set_privacy *cp = cp_data;
4944         bool changed;
4945         int err;
4946
4947         BT_DBG("request for %s", hdev->name);
4948
4949         if (!lmp_le_capable(hdev))
4950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951                                        MGMT_STATUS_NOT_SUPPORTED);
4952
4953         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4955                                        MGMT_STATUS_INVALID_PARAMS);
4956
4957         if (hdev_is_powered(hdev))
4958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4959                                        MGMT_STATUS_REJECTED);
4960
4961         hci_dev_lock(hdev);
4962
4963         /* If user space supports this command it is also expected to
4964          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4965          */
4966         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4967
4968         if (cp->privacy) {
4969                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4970                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4971                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4972                 hci_adv_instances_set_rpa_expired(hdev, true);
4973                 if (cp->privacy == 0x02)
4974                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4975                 else
4976                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4977         } else {
4978                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4979                 memset(hdev->irk, 0, sizeof(hdev->irk));
4980                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4981                 hci_adv_instances_set_rpa_expired(hdev, false);
4982                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4983         }
4984
4985         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4986         if (err < 0)
4987                 goto unlock;
4988
4989         if (changed)
4990                 err = new_settings(hdev, sk);
4991
4992 unlock:
4993         hci_dev_unlock(hdev);
4994         return err;
4995 }
4996
4997 static bool irk_is_valid(struct mgmt_irk_info *irk)
4998 {
4999         switch (irk->addr.type) {
5000         case BDADDR_LE_PUBLIC:
5001                 return true;
5002
5003         case BDADDR_LE_RANDOM:
5004                 /* Two most significant bits shall be set */
5005                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5006                         return false;
5007                 return true;
5008         }
5009
5010         return false;
5011 }
5012
5013 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014                      u16 len)
5015 {
5016         struct mgmt_cp_load_irks *cp = cp_data;
5017         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5018                                    sizeof(struct mgmt_irk_info));
5019         u16 irk_count, expected_len;
5020         int i, err;
5021
5022         BT_DBG("request for %s", hdev->name);
5023
5024         if (!lmp_le_capable(hdev))
5025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5026                                        MGMT_STATUS_NOT_SUPPORTED);
5027
5028         irk_count = __le16_to_cpu(cp->irk_count);
5029         if (irk_count > max_irk_count) {
5030                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5031                            irk_count);
5032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033                                        MGMT_STATUS_INVALID_PARAMS);
5034         }
5035
5036         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5037         if (expected_len != len) {
5038                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5039                            expected_len, len);
5040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5041                                        MGMT_STATUS_INVALID_PARAMS);
5042         }
5043
5044         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5045
5046         for (i = 0; i < irk_count; i++) {
5047                 struct mgmt_irk_info *key = &cp->irks[i];
5048
5049                 if (!irk_is_valid(key))
5050                         return mgmt_cmd_status(sk, hdev->id,
5051                                                MGMT_OP_LOAD_IRKS,
5052                                                MGMT_STATUS_INVALID_PARAMS);
5053         }
5054
5055         hci_dev_lock(hdev);
5056
5057         hci_smp_irks_clear(hdev);
5058
5059         for (i = 0; i < irk_count; i++) {
5060                 struct mgmt_irk_info *irk = &cp->irks[i];
5061
5062                 hci_add_irk(hdev, &irk->addr.bdaddr,
5063                             le_addr_type(irk->addr.type), irk->val,
5064                             BDADDR_ANY);
5065         }
5066
5067         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5068
5069         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5070
5071         hci_dev_unlock(hdev);
5072
5073         return err;
5074 }
5075
5076 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5077 {
5078         if (key->master != 0x00 && key->master != 0x01)
5079                 return false;
5080
5081         switch (key->addr.type) {
5082         case BDADDR_LE_PUBLIC:
5083                 return true;
5084
5085         case BDADDR_LE_RANDOM:
5086                 /* Two most significant bits shall be set */
5087                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5088                         return false;
5089                 return true;
5090         }
5091
5092         return false;
5093 }
5094
5095 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5096                                void *cp_data, u16 len)
5097 {
5098         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5099         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5100                                    sizeof(struct mgmt_ltk_info));
5101         u16 key_count, expected_len;
5102         int i, err;
5103
5104         BT_DBG("request for %s", hdev->name);
5105
5106         if (!lmp_le_capable(hdev))
5107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5108                                        MGMT_STATUS_NOT_SUPPORTED);
5109
5110         key_count = __le16_to_cpu(cp->key_count);
5111         if (key_count > max_key_count) {
5112                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5113                            key_count);
5114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115                                        MGMT_STATUS_INVALID_PARAMS);
5116         }
5117
5118         expected_len = sizeof(*cp) + key_count *
5119                                         sizeof(struct mgmt_ltk_info);
5120         if (expected_len != len) {
5121                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5122                            expected_len, len);
5123                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5124                                        MGMT_STATUS_INVALID_PARAMS);
5125         }
5126
5127         BT_DBG("%s key_count %u", hdev->name, key_count);
5128
5129         for (i = 0; i < key_count; i++) {
5130                 struct mgmt_ltk_info *key = &cp->keys[i];
5131
5132                 if (!ltk_is_valid(key))
5133                         return mgmt_cmd_status(sk, hdev->id,
5134                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5135                                                MGMT_STATUS_INVALID_PARAMS);
5136         }
5137
5138         hci_dev_lock(hdev);
5139
5140         hci_smp_ltks_clear(hdev);
5141
5142         for (i = 0; i < key_count; i++) {
5143                 struct mgmt_ltk_info *key = &cp->keys[i];
5144                 u8 type, authenticated;
5145
5146                 switch (key->type) {
5147                 case MGMT_LTK_UNAUTHENTICATED:
5148                         authenticated = 0x00;
5149                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5150                         break;
5151                 case MGMT_LTK_AUTHENTICATED:
5152                         authenticated = 0x01;
5153                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5154                         break;
5155                 case MGMT_LTK_P256_UNAUTH:
5156                         authenticated = 0x00;
5157                         type = SMP_LTK_P256;
5158                         break;
5159                 case MGMT_LTK_P256_AUTH:
5160                         authenticated = 0x01;
5161                         type = SMP_LTK_P256;
5162                         break;
5163                 case MGMT_LTK_P256_DEBUG:
5164                         authenticated = 0x00;
5165                         type = SMP_LTK_P256_DEBUG;
5166                         /* fall through */
5167                 default:
5168                         continue;
5169                 }
5170
5171                 hci_add_ltk(hdev, &key->addr.bdaddr,
5172                             le_addr_type(key->addr.type), type, authenticated,
5173                             key->val, key->enc_size, key->ediv, key->rand);
5174         }
5175
5176         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5177                            NULL, 0);
5178
5179         hci_dev_unlock(hdev);
5180
5181         return err;
5182 }
5183
5184 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5185 {
5186         struct hci_conn *conn = cmd->user_data;
5187         struct mgmt_rp_get_conn_info rp;
5188         int err;
5189
5190         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5191
5192         if (status == MGMT_STATUS_SUCCESS) {
5193                 rp.rssi = conn->rssi;
5194                 rp.tx_power = conn->tx_power;
5195                 rp.max_tx_power = conn->max_tx_power;
5196         } else {
5197                 rp.rssi = HCI_RSSI_INVALID;
5198                 rp.tx_power = HCI_TX_POWER_INVALID;
5199                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5200         }
5201
5202         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5203                                 status, &rp, sizeof(rp));
5204
5205         hci_conn_drop(conn);
5206         hci_conn_put(conn);
5207
5208         return err;
5209 }
5210
5211 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5212                                        u16 opcode)
5213 {
5214         struct hci_cp_read_rssi *cp;
5215         struct mgmt_pending_cmd *cmd;
5216         struct hci_conn *conn;
5217         u16 handle;
5218         u8 status;
5219
5220         BT_DBG("status 0x%02x", hci_status);
5221
5222         hci_dev_lock(hdev);
5223
5224         /* Commands sent in request are either Read RSSI or Read Transmit Power
5225          * Level so we check which one was last sent to retrieve connection
5226          * handle.  Both commands have handle as first parameter so it's safe to
5227          * cast data on the same command struct.
5228          *
5229          * First command sent is always Read RSSI and we fail only if it fails.
5230          * In other case we simply override error to indicate success as we
5231          * already remembered if TX power value is actually valid.
5232          */
5233         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5234         if (!cp) {
5235                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5236                 status = MGMT_STATUS_SUCCESS;
5237         } else {
5238                 status = mgmt_status(hci_status);
5239         }
5240
5241         if (!cp) {
5242                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5243                 goto unlock;
5244         }
5245
5246         handle = __le16_to_cpu(cp->handle);
5247         conn = hci_conn_hash_lookup_handle(hdev, handle);
5248         if (!conn) {
5249                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5250                            handle);
5251                 goto unlock;
5252         }
5253
5254         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5255         if (!cmd)
5256                 goto unlock;
5257
5258         cmd->cmd_complete(cmd, status);
5259         mgmt_pending_remove(cmd);
5260
5261 unlock:
5262         hci_dev_unlock(hdev);
5263 }
5264
5265 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5266                          u16 len)
5267 {
5268         struct mgmt_cp_get_conn_info *cp = data;
5269         struct mgmt_rp_get_conn_info rp;
5270         struct hci_conn *conn;
5271         unsigned long conn_info_age;
5272         int err = 0;
5273
5274         BT_DBG("%s", hdev->name);
5275
5276         memset(&rp, 0, sizeof(rp));
5277         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5278         rp.addr.type = cp->addr.type;
5279
5280         if (!bdaddr_type_is_valid(cp->addr.type))
5281                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5282                                          MGMT_STATUS_INVALID_PARAMS,
5283                                          &rp, sizeof(rp));
5284
5285         hci_dev_lock(hdev);
5286
5287         if (!hdev_is_powered(hdev)) {
5288                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5289                                         MGMT_STATUS_NOT_POWERED, &rp,
5290                                         sizeof(rp));
5291                 goto unlock;
5292         }
5293
5294         if (cp->addr.type == BDADDR_BREDR)
5295                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5296                                                &cp->addr.bdaddr);
5297         else
5298                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5299
5300         if (!conn || conn->state != BT_CONNECTED) {
5301                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5302                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5303                                         sizeof(rp));
5304                 goto unlock;
5305         }
5306
5307         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5308                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5309                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5310                 goto unlock;
5311         }
5312
5313         /* To avoid client trying to guess when to poll again for information we
5314          * calculate conn info age as random value between min/max set in hdev.
5315          */
5316         conn_info_age = hdev->conn_info_min_age +
5317                         prandom_u32_max(hdev->conn_info_max_age -
5318                                         hdev->conn_info_min_age);
5319
5320         /* Query controller to refresh cached values if they are too old or were
5321          * never read.
5322          */
5323         if (time_after(jiffies, conn->conn_info_timestamp +
5324                        msecs_to_jiffies(conn_info_age)) ||
5325             !conn->conn_info_timestamp) {
5326                 struct hci_request req;
5327                 struct hci_cp_read_tx_power req_txp_cp;
5328                 struct hci_cp_read_rssi req_rssi_cp;
5329                 struct mgmt_pending_cmd *cmd;
5330
5331                 hci_req_init(&req, hdev);
5332                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5333                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5334                             &req_rssi_cp);
5335
5336                 /* For LE links TX power does not change thus we don't need to
5337                  * query for it once value is known.
5338                  */
5339                 if (!bdaddr_type_is_le(cp->addr.type) ||
5340                     conn->tx_power == HCI_TX_POWER_INVALID) {
5341                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5342                         req_txp_cp.type = 0x00;
5343                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5344                                     sizeof(req_txp_cp), &req_txp_cp);
5345                 }
5346
5347                 /* Max TX power needs to be read only once per connection */
5348                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5349                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5350                         req_txp_cp.type = 0x01;
5351                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5352                                     sizeof(req_txp_cp), &req_txp_cp);
5353                 }
5354
5355                 err = hci_req_run(&req, conn_info_refresh_complete);
5356                 if (err < 0)
5357                         goto unlock;
5358
5359                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5360                                        data, len);
5361                 if (!cmd) {
5362                         err = -ENOMEM;
5363                         goto unlock;
5364                 }
5365
5366                 hci_conn_hold(conn);
5367                 cmd->user_data = hci_conn_get(conn);
5368                 cmd->cmd_complete = conn_info_cmd_complete;
5369
5370                 conn->conn_info_timestamp = jiffies;
5371         } else {
5372                 /* Cache is valid, just reply with values cached in hci_conn */
5373                 rp.rssi = conn->rssi;
5374                 rp.tx_power = conn->tx_power;
5375                 rp.max_tx_power = conn->max_tx_power;
5376
5377                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5378                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5379         }
5380
5381 unlock:
5382         hci_dev_unlock(hdev);
5383         return err;
5384 }
5385
5386 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5387 {
5388         struct hci_conn *conn = cmd->user_data;
5389         struct mgmt_rp_get_clock_info rp;
5390         struct hci_dev *hdev;
5391         int err;
5392
5393         memset(&rp, 0, sizeof(rp));
5394         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5395
5396         if (status)
5397                 goto complete;
5398
5399         hdev = hci_dev_get(cmd->index);
5400         if (hdev) {
5401                 rp.local_clock = cpu_to_le32(hdev->clock);
5402                 hci_dev_put(hdev);
5403         }
5404
5405         if (conn) {
5406                 rp.piconet_clock = cpu_to_le32(conn->clock);
5407                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5408         }
5409
5410 complete:
5411         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5412                                 sizeof(rp));
5413
5414         if (conn) {
5415                 hci_conn_drop(conn);
5416                 hci_conn_put(conn);
5417         }
5418
5419         return err;
5420 }
5421
5422 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5423 {
5424         struct hci_cp_read_clock *hci_cp;
5425         struct mgmt_pending_cmd *cmd;
5426         struct hci_conn *conn;
5427
5428         BT_DBG("%s status %u", hdev->name, status);
5429
5430         hci_dev_lock(hdev);
5431
5432         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5433         if (!hci_cp)
5434                 goto unlock;
5435
5436         if (hci_cp->which) {
5437                 u16 handle = __le16_to_cpu(hci_cp->handle);
5438                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5439         } else {
5440                 conn = NULL;
5441         }
5442
5443         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5444         if (!cmd)
5445                 goto unlock;
5446
5447         cmd->cmd_complete(cmd, mgmt_status(status));
5448         mgmt_pending_remove(cmd);
5449
5450 unlock:
5451         hci_dev_unlock(hdev);
5452 }
5453
5454 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5455                          u16 len)
5456 {
5457         struct mgmt_cp_get_clock_info *cp = data;
5458         struct mgmt_rp_get_clock_info rp;
5459         struct hci_cp_read_clock hci_cp;
5460         struct mgmt_pending_cmd *cmd;
5461         struct hci_request req;
5462         struct hci_conn *conn;
5463         int err;
5464
5465         BT_DBG("%s", hdev->name);
5466
5467         memset(&rp, 0, sizeof(rp));
5468         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5469         rp.addr.type = cp->addr.type;
5470
5471         if (cp->addr.type != BDADDR_BREDR)
5472                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5473                                          MGMT_STATUS_INVALID_PARAMS,
5474                                          &rp, sizeof(rp));
5475
5476         hci_dev_lock(hdev);
5477
5478         if (!hdev_is_powered(hdev)) {
5479                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5480                                         MGMT_STATUS_NOT_POWERED, &rp,
5481                                         sizeof(rp));
5482                 goto unlock;
5483         }
5484
5485         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5486                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5487                                                &cp->addr.bdaddr);
5488                 if (!conn || conn->state != BT_CONNECTED) {
5489                         err = mgmt_cmd_complete(sk, hdev->id,
5490                                                 MGMT_OP_GET_CLOCK_INFO,
5491                                                 MGMT_STATUS_NOT_CONNECTED,
5492                                                 &rp, sizeof(rp));
5493                         goto unlock;
5494                 }
5495         } else {
5496                 conn = NULL;
5497         }
5498
5499         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5500         if (!cmd) {
5501                 err = -ENOMEM;
5502                 goto unlock;
5503         }
5504
5505         cmd->cmd_complete = clock_info_cmd_complete;
5506
5507         hci_req_init(&req, hdev);
5508
5509         memset(&hci_cp, 0, sizeof(hci_cp));
5510         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5511
5512         if (conn) {
5513                 hci_conn_hold(conn);
5514                 cmd->user_data = hci_conn_get(conn);
5515
5516                 hci_cp.handle = cpu_to_le16(conn->handle);
5517                 hci_cp.which = 0x01; /* Piconet clock */
5518                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5519         }
5520
5521         err = hci_req_run(&req, get_clock_info_complete);
5522         if (err < 0)
5523                 mgmt_pending_remove(cmd);
5524
5525 unlock:
5526         hci_dev_unlock(hdev);
5527         return err;
5528 }
5529
5530 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5531 {
5532         struct hci_conn *conn;
5533
5534         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5535         if (!conn)
5536                 return false;
5537
5538         if (conn->dst_type != type)
5539                 return false;
5540
5541         if (conn->state != BT_CONNECTED)
5542                 return false;
5543
5544         return true;
5545 }
5546
5547 /* This function requires the caller holds hdev->lock */
5548 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5549                                u8 addr_type, u8 auto_connect)
5550 {
5551         struct hci_conn_params *params;
5552
5553         params = hci_conn_params_add(hdev, addr, addr_type);
5554         if (!params)
5555                 return -EIO;
5556
5557         if (params->auto_connect == auto_connect)
5558                 return 0;
5559
5560         list_del_init(&params->action);
5561
5562         switch (auto_connect) {
5563         case HCI_AUTO_CONN_DISABLED:
5564         case HCI_AUTO_CONN_LINK_LOSS:
5565                 /* If auto connect is being disabled when we're trying to
5566                  * connect to device, keep connecting.
5567                  */
5568                 if (params->explicit_connect)
5569                         list_add(&params->action, &hdev->pend_le_conns);
5570                 break;
5571         case HCI_AUTO_CONN_REPORT:
5572                 if (params->explicit_connect)
5573                         list_add(&params->action, &hdev->pend_le_conns);
5574                 else
5575                         list_add(&params->action, &hdev->pend_le_reports);
5576                 break;
5577         case HCI_AUTO_CONN_DIRECT:
5578         case HCI_AUTO_CONN_ALWAYS:
5579                 if (!is_connected(hdev, addr, addr_type))
5580                         list_add(&params->action, &hdev->pend_le_conns);
5581                 break;
5582         }
5583
5584         params->auto_connect = auto_connect;
5585
5586         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5587                auto_connect);
5588
5589         return 0;
5590 }
5591
5592 static void device_added(struct sock *sk, struct hci_dev *hdev,
5593                          bdaddr_t *bdaddr, u8 type, u8 action)
5594 {
5595         struct mgmt_ev_device_added ev;
5596
5597         bacpy(&ev.addr.bdaddr, bdaddr);
5598         ev.addr.type = type;
5599         ev.action = action;
5600
5601         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5602 }
5603
5604 static int add_device(struct sock *sk, struct hci_dev *hdev,
5605                       void *data, u16 len)
5606 {
5607         struct mgmt_cp_add_device *cp = data;
5608         u8 auto_conn, addr_type;
5609         int err;
5610
5611         BT_DBG("%s", hdev->name);
5612
5613         if (!bdaddr_type_is_valid(cp->addr.type) ||
5614             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5615                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5616                                          MGMT_STATUS_INVALID_PARAMS,
5617                                          &cp->addr, sizeof(cp->addr));
5618
5619         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5620                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5621                                          MGMT_STATUS_INVALID_PARAMS,
5622                                          &cp->addr, sizeof(cp->addr));
5623
5624         hci_dev_lock(hdev);
5625
5626         if (cp->addr.type == BDADDR_BREDR) {
5627                 /* Only incoming connections action is supported for now */
5628                 if (cp->action != 0x01) {
5629                         err = mgmt_cmd_complete(sk, hdev->id,
5630                                                 MGMT_OP_ADD_DEVICE,
5631                                                 MGMT_STATUS_INVALID_PARAMS,
5632                                                 &cp->addr, sizeof(cp->addr));
5633                         goto unlock;
5634                 }
5635
5636                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5637                                           cp->addr.type);
5638                 if (err)
5639                         goto unlock;
5640
5641                 hci_req_update_scan(hdev);
5642
5643                 goto added;
5644         }
5645
5646         addr_type = le_addr_type(cp->addr.type);
5647
5648         if (cp->action == 0x02)
5649                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5650         else if (cp->action == 0x01)
5651                 auto_conn = HCI_AUTO_CONN_DIRECT;
5652         else
5653                 auto_conn = HCI_AUTO_CONN_REPORT;
5654
5655         /* Kernel internally uses conn_params with resolvable private
5656          * address, but Add Device allows only identity addresses.
5657          * Make sure it is enforced before calling
5658          * hci_conn_params_lookup.
5659          */
5660         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5661                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5662                                         MGMT_STATUS_INVALID_PARAMS,
5663                                         &cp->addr, sizeof(cp->addr));
5664                 goto unlock;
5665         }
5666
5667         /* If the connection parameters don't exist for this device,
5668          * they will be created and configured with defaults.
5669          */
5670         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5671                                 auto_conn) < 0) {
5672                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5673                                         MGMT_STATUS_FAILED, &cp->addr,
5674                                         sizeof(cp->addr));
5675                 goto unlock;
5676         }
5677
5678         hci_update_background_scan(hdev);
5679
5680 added:
5681         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5682
5683         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5684                                 MGMT_STATUS_SUCCESS, &cp->addr,
5685                                 sizeof(cp->addr));
5686
5687 unlock:
5688         hci_dev_unlock(hdev);
5689         return err;
5690 }
5691
5692 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5693                            bdaddr_t *bdaddr, u8 type)
5694 {
5695         struct mgmt_ev_device_removed ev;
5696
5697         bacpy(&ev.addr.bdaddr, bdaddr);
5698         ev.addr.type = type;
5699
5700         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5701 }
5702
5703 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5704                          void *data, u16 len)
5705 {
5706         struct mgmt_cp_remove_device *cp = data;
5707         int err;
5708
5709         BT_DBG("%s", hdev->name);
5710
5711         hci_dev_lock(hdev);
5712
5713         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5714                 struct hci_conn_params *params;
5715                 u8 addr_type;
5716
5717                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5718                         err = mgmt_cmd_complete(sk, hdev->id,
5719                                                 MGMT_OP_REMOVE_DEVICE,
5720                                                 MGMT_STATUS_INVALID_PARAMS,
5721                                                 &cp->addr, sizeof(cp->addr));
5722                         goto unlock;
5723                 }
5724
5725                 if (cp->addr.type == BDADDR_BREDR) {
5726                         err = hci_bdaddr_list_del(&hdev->whitelist,
5727                                                   &cp->addr.bdaddr,
5728                                                   cp->addr.type);
5729                         if (err) {
5730                                 err = mgmt_cmd_complete(sk, hdev->id,
5731                                                         MGMT_OP_REMOVE_DEVICE,
5732                                                         MGMT_STATUS_INVALID_PARAMS,
5733                                                         &cp->addr,
5734                                                         sizeof(cp->addr));
5735                                 goto unlock;
5736                         }
5737
5738                         hci_req_update_scan(hdev);
5739
5740                         device_removed(sk, hdev, &cp->addr.bdaddr,
5741                                        cp->addr.type);
5742                         goto complete;
5743                 }
5744
5745                 addr_type = le_addr_type(cp->addr.type);
5746
5747                 /* Kernel internally uses conn_params with resolvable private
5748                  * address, but Remove Device allows only identity addresses.
5749                  * Make sure it is enforced before calling
5750                  * hci_conn_params_lookup.
5751                  */
5752                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5753                         err = mgmt_cmd_complete(sk, hdev->id,
5754                                                 MGMT_OP_REMOVE_DEVICE,
5755                                                 MGMT_STATUS_INVALID_PARAMS,
5756                                                 &cp->addr, sizeof(cp->addr));
5757                         goto unlock;
5758                 }
5759
5760                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5761                                                 addr_type);
5762                 if (!params) {
5763                         err = mgmt_cmd_complete(sk, hdev->id,
5764                                                 MGMT_OP_REMOVE_DEVICE,
5765                                                 MGMT_STATUS_INVALID_PARAMS,
5766                                                 &cp->addr, sizeof(cp->addr));
5767                         goto unlock;
5768                 }
5769
5770                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5771                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5772                         err = mgmt_cmd_complete(sk, hdev->id,
5773                                                 MGMT_OP_REMOVE_DEVICE,
5774                                                 MGMT_STATUS_INVALID_PARAMS,
5775                                                 &cp->addr, sizeof(cp->addr));
5776                         goto unlock;
5777                 }
5778
5779                 list_del(&params->action);
5780                 list_del(&params->list);
5781                 kfree(params);
5782                 hci_update_background_scan(hdev);
5783
5784                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5785         } else {
5786                 struct hci_conn_params *p, *tmp;
5787                 struct bdaddr_list *b, *btmp;
5788
5789                 if (cp->addr.type) {
5790                         err = mgmt_cmd_complete(sk, hdev->id,
5791                                                 MGMT_OP_REMOVE_DEVICE,
5792                                                 MGMT_STATUS_INVALID_PARAMS,
5793                                                 &cp->addr, sizeof(cp->addr));
5794                         goto unlock;
5795                 }
5796
5797                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5798                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5799                         list_del(&b->list);
5800                         kfree(b);
5801                 }
5802
5803                 hci_req_update_scan(hdev);
5804
5805                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5806                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5807                                 continue;
5808                         device_removed(sk, hdev, &p->addr, p->addr_type);
5809                         if (p->explicit_connect) {
5810                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5811                                 continue;
5812                         }
5813                         list_del(&p->action);
5814                         list_del(&p->list);
5815                         kfree(p);
5816                 }
5817
5818                 BT_DBG("All LE connection parameters were removed");
5819
5820                 hci_update_background_scan(hdev);
5821         }
5822
5823 complete:
5824         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5825                                 MGMT_STATUS_SUCCESS, &cp->addr,
5826                                 sizeof(cp->addr));
5827 unlock:
5828         hci_dev_unlock(hdev);
5829         return err;
5830 }
5831
5832 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5833                            u16 len)
5834 {
5835         struct mgmt_cp_load_conn_param *cp = data;
5836         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5837                                      sizeof(struct mgmt_conn_param));
5838         u16 param_count, expected_len;
5839         int i;
5840
5841         if (!lmp_le_capable(hdev))
5842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5843                                        MGMT_STATUS_NOT_SUPPORTED);
5844
5845         param_count = __le16_to_cpu(cp->param_count);
5846         if (param_count > max_param_count) {
5847                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5848                            param_count);
5849                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5850                                        MGMT_STATUS_INVALID_PARAMS);
5851         }
5852
5853         expected_len = sizeof(*cp) + param_count *
5854                                         sizeof(struct mgmt_conn_param);
5855         if (expected_len != len) {
5856                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5857                            expected_len, len);
5858                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5859                                        MGMT_STATUS_INVALID_PARAMS);
5860         }
5861
5862         BT_DBG("%s param_count %u", hdev->name, param_count);
5863
5864         hci_dev_lock(hdev);
5865
5866         hci_conn_params_clear_disabled(hdev);
5867
5868         for (i = 0; i < param_count; i++) {
5869                 struct mgmt_conn_param *param = &cp->params[i];
5870                 struct hci_conn_params *hci_param;
5871                 u16 min, max, latency, timeout;
5872                 u8 addr_type;
5873
5874                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5875                        param->addr.type);
5876
5877                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5878                         addr_type = ADDR_LE_DEV_PUBLIC;
5879                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5880                         addr_type = ADDR_LE_DEV_RANDOM;
5881                 } else {
5882                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5883                         continue;
5884                 }
5885
5886                 min = le16_to_cpu(param->min_interval);
5887                 max = le16_to_cpu(param->max_interval);
5888                 latency = le16_to_cpu(param->latency);
5889                 timeout = le16_to_cpu(param->timeout);
5890
5891                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5892                        min, max, latency, timeout);
5893
5894                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5895                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5896                         continue;
5897                 }
5898
5899                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5900                                                 addr_type);
5901                 if (!hci_param) {
5902                         bt_dev_err(hdev, "failed to add connection parameters");
5903                         continue;
5904                 }
5905
5906                 hci_param->conn_min_interval = min;
5907                 hci_param->conn_max_interval = max;
5908                 hci_param->conn_latency = latency;
5909                 hci_param->supervision_timeout = timeout;
5910         }
5911
5912         hci_dev_unlock(hdev);
5913
5914         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5915                                  NULL, 0);
5916 }
5917
5918 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5919                                void *data, u16 len)
5920 {
5921         struct mgmt_cp_set_external_config *cp = data;
5922         bool changed;
5923         int err;
5924
5925         BT_DBG("%s", hdev->name);
5926
5927         if (hdev_is_powered(hdev))
5928                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5929                                        MGMT_STATUS_REJECTED);
5930
5931         if (cp->config != 0x00 && cp->config != 0x01)
5932                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5933                                          MGMT_STATUS_INVALID_PARAMS);
5934
5935         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5936                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5937                                        MGMT_STATUS_NOT_SUPPORTED);
5938
5939         hci_dev_lock(hdev);
5940
5941         if (cp->config)
5942                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5943         else
5944                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5945
5946         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5947         if (err < 0)
5948                 goto unlock;
5949
5950         if (!changed)
5951                 goto unlock;
5952
5953         err = new_options(hdev, sk);
5954
5955         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5956                 mgmt_index_removed(hdev);
5957
5958                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5959                         hci_dev_set_flag(hdev, HCI_CONFIG);
5960                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5961
5962                         queue_work(hdev->req_workqueue, &hdev->power_on);
5963                 } else {
5964                         set_bit(HCI_RAW, &hdev->flags);
5965                         mgmt_index_added(hdev);
5966                 }
5967         }
5968
5969 unlock:
5970         hci_dev_unlock(hdev);
5971         return err;
5972 }
5973
5974 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5975                               void *data, u16 len)
5976 {
5977         struct mgmt_cp_set_public_address *cp = data;
5978         bool changed;
5979         int err;
5980
5981         BT_DBG("%s", hdev->name);
5982
5983         if (hdev_is_powered(hdev))
5984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5985                                        MGMT_STATUS_REJECTED);
5986
5987         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5989                                        MGMT_STATUS_INVALID_PARAMS);
5990
5991         if (!hdev->set_bdaddr)
5992                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5993                                        MGMT_STATUS_NOT_SUPPORTED);
5994
5995         hci_dev_lock(hdev);
5996
5997         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5998         bacpy(&hdev->public_addr, &cp->bdaddr);
5999
6000         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6001         if (err < 0)
6002                 goto unlock;
6003
6004         if (!changed)
6005                 goto unlock;
6006
6007         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6008                 err = new_options(hdev, sk);
6009
6010         if (is_configured(hdev)) {
6011                 mgmt_index_removed(hdev);
6012
6013                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6014
6015                 hci_dev_set_flag(hdev, HCI_CONFIG);
6016                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6017
6018                 queue_work(hdev->req_workqueue, &hdev->power_on);
6019         }
6020
6021 unlock:
6022         hci_dev_unlock(hdev);
6023         return err;
6024 }
6025
6026 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6027                                              u16 opcode, struct sk_buff *skb)
6028 {
6029         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6030         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6031         u8 *h192, *r192, *h256, *r256;
6032         struct mgmt_pending_cmd *cmd;
6033         u16 eir_len;
6034         int err;
6035
6036         BT_DBG("%s status %u", hdev->name, status);
6037
6038         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6039         if (!cmd)
6040                 return;
6041
6042         mgmt_cp = cmd->param;
6043
6044         if (status) {
6045                 status = mgmt_status(status);
6046                 eir_len = 0;
6047
6048                 h192 = NULL;
6049                 r192 = NULL;
6050                 h256 = NULL;
6051                 r256 = NULL;
6052         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6053                 struct hci_rp_read_local_oob_data *rp;
6054
6055                 if (skb->len != sizeof(*rp)) {
6056                         status = MGMT_STATUS_FAILED;
6057                         eir_len = 0;
6058                 } else {
6059                         status = MGMT_STATUS_SUCCESS;
6060                         rp = (void *)skb->data;
6061
6062                         eir_len = 5 + 18 + 18;
6063                         h192 = rp->hash;
6064                         r192 = rp->rand;
6065                         h256 = NULL;
6066                         r256 = NULL;
6067                 }
6068         } else {
6069                 struct hci_rp_read_local_oob_ext_data *rp;
6070
6071                 if (skb->len != sizeof(*rp)) {
6072                         status = MGMT_STATUS_FAILED;
6073                         eir_len = 0;
6074                 } else {
6075                         status = MGMT_STATUS_SUCCESS;
6076                         rp = (void *)skb->data;
6077
6078                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6079                                 eir_len = 5 + 18 + 18;
6080                                 h192 = NULL;
6081                                 r192 = NULL;
6082                         } else {
6083                                 eir_len = 5 + 18 + 18 + 18 + 18;
6084                                 h192 = rp->hash192;
6085                                 r192 = rp->rand192;
6086                         }
6087
6088                         h256 = rp->hash256;
6089                         r256 = rp->rand256;
6090                 }
6091         }
6092
6093         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6094         if (!mgmt_rp)
6095                 goto done;
6096
6097         if (status)
6098                 goto send_rsp;
6099
6100         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6101                                   hdev->dev_class, 3);
6102
6103         if (h192 && r192) {
6104                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6105                                           EIR_SSP_HASH_C192, h192, 16);
6106                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6107                                           EIR_SSP_RAND_R192, r192, 16);
6108         }
6109
6110         if (h256 && r256) {
6111                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6112                                           EIR_SSP_HASH_C256, h256, 16);
6113                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6114                                           EIR_SSP_RAND_R256, r256, 16);
6115         }
6116
6117 send_rsp:
6118         mgmt_rp->type = mgmt_cp->type;
6119         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6120
6121         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6122                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6123                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6124         if (err < 0 || status)
6125                 goto done;
6126
6127         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6128
6129         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6130                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6131                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6132 done:
6133         kfree(mgmt_rp);
6134         mgmt_pending_remove(cmd);
6135 }
6136
6137 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6138                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6139 {
6140         struct mgmt_pending_cmd *cmd;
6141         struct hci_request req;
6142         int err;
6143
6144         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6145                                cp, sizeof(*cp));
6146         if (!cmd)
6147                 return -ENOMEM;
6148
6149         hci_req_init(&req, hdev);
6150
6151         if (bredr_sc_enabled(hdev))
6152                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6153         else
6154                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6155
6156         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6157         if (err < 0) {
6158                 mgmt_pending_remove(cmd);
6159                 return err;
6160         }
6161
6162         return 0;
6163 }
6164
6165 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6166                                    void *data, u16 data_len)
6167 {
6168         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6169         struct mgmt_rp_read_local_oob_ext_data *rp;
6170         size_t rp_len;
6171         u16 eir_len;
6172         u8 status, flags, role, addr[7], hash[16], rand[16];
6173         int err;
6174
6175         BT_DBG("%s", hdev->name);
6176
6177         if (hdev_is_powered(hdev)) {
6178                 switch (cp->type) {
6179                 case BIT(BDADDR_BREDR):
6180                         status = mgmt_bredr_support(hdev);
6181                         if (status)
6182                                 eir_len = 0;
6183                         else
6184                                 eir_len = 5;
6185                         break;
6186                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6187                         status = mgmt_le_support(hdev);
6188                         if (status)
6189                                 eir_len = 0;
6190                         else
6191                                 eir_len = 9 + 3 + 18 + 18 + 3;
6192                         break;
6193                 default:
6194                         status = MGMT_STATUS_INVALID_PARAMS;
6195                         eir_len = 0;
6196                         break;
6197                 }
6198         } else {
6199                 status = MGMT_STATUS_NOT_POWERED;
6200                 eir_len = 0;
6201         }
6202
6203         rp_len = sizeof(*rp) + eir_len;
6204         rp = kmalloc(rp_len, GFP_ATOMIC);
6205         if (!rp)
6206                 return -ENOMEM;
6207
6208         if (status)
6209                 goto complete;
6210
6211         hci_dev_lock(hdev);
6212
6213         eir_len = 0;
6214         switch (cp->type) {
6215         case BIT(BDADDR_BREDR):
6216                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6217                         err = read_local_ssp_oob_req(hdev, sk, cp);
6218                         hci_dev_unlock(hdev);
6219                         if (!err)
6220                                 goto done;
6221
6222                         status = MGMT_STATUS_FAILED;
6223                         goto complete;
6224                 } else {
6225                         eir_len = eir_append_data(rp->eir, eir_len,
6226                                                   EIR_CLASS_OF_DEV,
6227                                                   hdev->dev_class, 3);
6228                 }
6229                 break;
6230         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6231                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6232                     smp_generate_oob(hdev, hash, rand) < 0) {
6233                         hci_dev_unlock(hdev);
6234                         status = MGMT_STATUS_FAILED;
6235                         goto complete;
6236                 }
6237
6238                 /* This should return the active RPA, but since the RPA
6239                  * is only programmed on demand, it is really hard to fill
6240                  * this in at the moment. For now disallow retrieving
6241                  * local out-of-band data when privacy is in use.
6242                  *
6243                  * Returning the identity address will not help here since
6244                  * pairing happens before the identity resolving key is
6245                  * known and thus the connection establishment happens
6246                  * based on the RPA and not the identity address.
6247                  */
6248                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6249                         hci_dev_unlock(hdev);
6250                         status = MGMT_STATUS_REJECTED;
6251                         goto complete;
6252                 }
6253
6254                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6255                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6256                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6257                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6258                         memcpy(addr, &hdev->static_addr, 6);
6259                         addr[6] = 0x01;
6260                 } else {
6261                         memcpy(addr, &hdev->bdaddr, 6);
6262                         addr[6] = 0x00;
6263                 }
6264
6265                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6266                                           addr, sizeof(addr));
6267
6268                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6269                         role = 0x02;
6270                 else
6271                         role = 0x01;
6272
6273                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6274                                           &role, sizeof(role));
6275
6276                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6277                         eir_len = eir_append_data(rp->eir, eir_len,
6278                                                   EIR_LE_SC_CONFIRM,
6279                                                   hash, sizeof(hash));
6280
6281                         eir_len = eir_append_data(rp->eir, eir_len,
6282                                                   EIR_LE_SC_RANDOM,
6283                                                   rand, sizeof(rand));
6284                 }
6285
6286                 flags = mgmt_get_adv_discov_flags(hdev);
6287
6288                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6289                         flags |= LE_AD_NO_BREDR;
6290
6291                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6292                                           &flags, sizeof(flags));
6293                 break;
6294         }
6295
6296         hci_dev_unlock(hdev);
6297
6298         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6299
6300         status = MGMT_STATUS_SUCCESS;
6301
6302 complete:
6303         rp->type = cp->type;
6304         rp->eir_len = cpu_to_le16(eir_len);
6305
6306         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6307                                 status, rp, sizeof(*rp) + eir_len);
6308         if (err < 0 || status)
6309                 goto done;
6310
6311         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6312                                  rp, sizeof(*rp) + eir_len,
6313                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6314
6315 done:
6316         kfree(rp);
6317
6318         return err;
6319 }
6320
6321 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6322 {
6323         u32 flags = 0;
6324
6325         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6326         flags |= MGMT_ADV_FLAG_DISCOV;
6327         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6328         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6329         flags |= MGMT_ADV_FLAG_APPEARANCE;
6330         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6331
6332         /* In extended adv TX_POWER returned from Set Adv Param
6333          * will be always valid.
6334          */
6335         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6336             ext_adv_capable(hdev))
6337                 flags |= MGMT_ADV_FLAG_TX_POWER;
6338
6339         if (ext_adv_capable(hdev)) {
6340                 flags |= MGMT_ADV_FLAG_SEC_1M;
6341
6342                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6343                         flags |= MGMT_ADV_FLAG_SEC_2M;
6344
6345                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6346                         flags |= MGMT_ADV_FLAG_SEC_CODED;
6347         }
6348
6349         return flags;
6350 }
6351
6352 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6353                              void *data, u16 data_len)
6354 {
6355         struct mgmt_rp_read_adv_features *rp;
6356         size_t rp_len;
6357         int err;
6358         struct adv_info *adv_instance;
6359         u32 supported_flags;
6360         u8 *instance;
6361
6362         BT_DBG("%s", hdev->name);
6363
6364         if (!lmp_le_capable(hdev))
6365                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6366                                        MGMT_STATUS_REJECTED);
6367
6368         hci_dev_lock(hdev);
6369
6370         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6371         rp = kmalloc(rp_len, GFP_ATOMIC);
6372         if (!rp) {
6373                 hci_dev_unlock(hdev);
6374                 return -ENOMEM;
6375         }
6376
6377         supported_flags = get_supported_adv_flags(hdev);
6378
6379         rp->supported_flags = cpu_to_le32(supported_flags);
6380         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6381         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6382         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6383         rp->num_instances = hdev->adv_instance_cnt;
6384
6385         instance = rp->instance;
6386         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6387                 *instance = adv_instance->instance;
6388                 instance++;
6389         }
6390
6391         hci_dev_unlock(hdev);
6392
6393         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6394                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6395
6396         kfree(rp);
6397
6398         return err;
6399 }
6400
6401 static u8 calculate_name_len(struct hci_dev *hdev)
6402 {
6403         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6404
6405         return append_local_name(hdev, buf, 0);
6406 }
6407
6408 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6409                            bool is_adv_data)
6410 {
6411         u8 max_len = HCI_MAX_AD_LENGTH;
6412
6413         if (is_adv_data) {
6414                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6415                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6416                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6417                         max_len -= 3;
6418
6419                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6420                         max_len -= 3;
6421         } else {
6422                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6423                         max_len -= calculate_name_len(hdev);
6424
6425                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6426                         max_len -= 4;
6427         }
6428
6429         return max_len;
6430 }
6431
6432 static bool flags_managed(u32 adv_flags)
6433 {
6434         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6435                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6436                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6437 }
6438
6439 static bool tx_power_managed(u32 adv_flags)
6440 {
6441         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6442 }
6443
6444 static bool name_managed(u32 adv_flags)
6445 {
6446         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6447 }
6448
6449 static bool appearance_managed(u32 adv_flags)
6450 {
6451         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6452 }
6453
6454 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6455                               u8 len, bool is_adv_data)
6456 {
6457         int i, cur_len;
6458         u8 max_len;
6459
6460         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6461
6462         if (len > max_len)
6463                 return false;
6464
6465         /* Make sure that the data is correctly formatted. */
6466         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6467                 cur_len = data[i];
6468
6469                 if (data[i + 1] == EIR_FLAGS &&
6470                     (!is_adv_data || flags_managed(adv_flags)))
6471                         return false;
6472
6473                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6474                         return false;
6475
6476                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6477                         return false;
6478
6479                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6480                         return false;
6481
6482                 if (data[i + 1] == EIR_APPEARANCE &&
6483                     appearance_managed(adv_flags))
6484                         return false;
6485
6486                 /* If the current field length would exceed the total data
6487                  * length, then it's invalid.
6488                  */
6489                 if (i + cur_len >= len)
6490                         return false;
6491         }
6492
6493         return true;
6494 }
6495
6496 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6497                                      u16 opcode)
6498 {
6499         struct mgmt_pending_cmd *cmd;
6500         struct mgmt_cp_add_advertising *cp;
6501         struct mgmt_rp_add_advertising rp;
6502         struct adv_info *adv_instance, *n;
6503         u8 instance;
6504
6505         BT_DBG("status %d", status);
6506
6507         hci_dev_lock(hdev);
6508
6509         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6510
6511         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6512                 if (!adv_instance->pending)
6513                         continue;
6514
6515                 if (!status) {
6516                         adv_instance->pending = false;
6517                         continue;
6518                 }
6519
6520                 instance = adv_instance->instance;
6521
6522                 if (hdev->cur_adv_instance == instance)
6523                         cancel_adv_timeout(hdev);
6524
6525                 hci_remove_adv_instance(hdev, instance);
6526                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6527         }
6528
6529         if (!cmd)
6530                 goto unlock;
6531
6532         cp = cmd->param;
6533         rp.instance = cp->instance;
6534
6535         if (status)
6536                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6537                                 mgmt_status(status));
6538         else
6539                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6540                                   mgmt_status(status), &rp, sizeof(rp));
6541
6542         mgmt_pending_remove(cmd);
6543
6544 unlock:
6545         hci_dev_unlock(hdev);
6546 }
6547
6548 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6549                            void *data, u16 data_len)
6550 {
6551         struct mgmt_cp_add_advertising *cp = data;
6552         struct mgmt_rp_add_advertising rp;
6553         u32 flags;
6554         u32 supported_flags, phy_flags;
6555         u8 status;
6556         u16 timeout, duration;
6557         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6558         u8 schedule_instance = 0;
6559         struct adv_info *next_instance;
6560         int err;
6561         struct mgmt_pending_cmd *cmd;
6562         struct hci_request req;
6563
6564         BT_DBG("%s", hdev->name);
6565
6566         status = mgmt_le_support(hdev);
6567         if (status)
6568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6569                                        status);
6570
6571         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6573                                        MGMT_STATUS_INVALID_PARAMS);
6574
6575         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6577                                        MGMT_STATUS_INVALID_PARAMS);
6578
6579         flags = __le32_to_cpu(cp->flags);
6580         timeout = __le16_to_cpu(cp->timeout);
6581         duration = __le16_to_cpu(cp->duration);
6582
6583         /* The current implementation only supports a subset of the specified
6584          * flags. Also need to check mutual exclusiveness of sec flags.
6585          */
6586         supported_flags = get_supported_adv_flags(hdev);
6587         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6588         if (flags & ~supported_flags ||
6589             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6590                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6591                                        MGMT_STATUS_INVALID_PARAMS);
6592
6593         hci_dev_lock(hdev);
6594
6595         if (timeout && !hdev_is_powered(hdev)) {
6596                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6597                                       MGMT_STATUS_REJECTED);
6598                 goto unlock;
6599         }
6600
6601         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6602             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6603             pending_find(MGMT_OP_SET_LE, hdev)) {
6604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6605                                       MGMT_STATUS_BUSY);
6606                 goto unlock;
6607         }
6608
6609         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6610             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6611                                cp->scan_rsp_len, false)) {
6612                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6613                                       MGMT_STATUS_INVALID_PARAMS);
6614                 goto unlock;
6615         }
6616
6617         err = hci_add_adv_instance(hdev, cp->instance, flags,
6618                                    cp->adv_data_len, cp->data,
6619                                    cp->scan_rsp_len,
6620                                    cp->data + cp->adv_data_len,
6621                                    timeout, duration);
6622         if (err < 0) {
6623                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6624                                       MGMT_STATUS_FAILED);
6625                 goto unlock;
6626         }
6627
6628         /* Only trigger an advertising added event if a new instance was
6629          * actually added.
6630          */
6631         if (hdev->adv_instance_cnt > prev_instance_cnt)
6632                 mgmt_advertising_added(sk, hdev, cp->instance);
6633
6634         if (hdev->cur_adv_instance == cp->instance) {
6635                 /* If the currently advertised instance is being changed then
6636                  * cancel the current advertising and schedule the next
6637                  * instance. If there is only one instance then the overridden
6638                  * advertising data will be visible right away.
6639                  */
6640                 cancel_adv_timeout(hdev);
6641
6642                 next_instance = hci_get_next_instance(hdev, cp->instance);
6643                 if (next_instance)
6644                         schedule_instance = next_instance->instance;
6645         } else if (!hdev->adv_instance_timeout) {
6646                 /* Immediately advertise the new instance if no other
6647                  * instance is currently being advertised.
6648                  */
6649                 schedule_instance = cp->instance;
6650         }
6651
6652         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6653          * there is no instance to be advertised then we have no HCI
6654          * communication to make. Simply return.
6655          */
6656         if (!hdev_is_powered(hdev) ||
6657             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6658             !schedule_instance) {
6659                 rp.instance = cp->instance;
6660                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6661                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6662                 goto unlock;
6663         }
6664
6665         /* We're good to go, update advertising data, parameters, and start
6666          * advertising.
6667          */
6668         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6669                                data_len);
6670         if (!cmd) {
6671                 err = -ENOMEM;
6672                 goto unlock;
6673         }
6674
6675         hci_req_init(&req, hdev);
6676
6677         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6678
6679         if (!err)
6680                 err = hci_req_run(&req, add_advertising_complete);
6681
6682         if (err < 0)
6683                 mgmt_pending_remove(cmd);
6684
6685 unlock:
6686         hci_dev_unlock(hdev);
6687
6688         return err;
6689 }
6690
6691 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6692                                         u16 opcode)
6693 {
6694         struct mgmt_pending_cmd *cmd;
6695         struct mgmt_cp_remove_advertising *cp;
6696         struct mgmt_rp_remove_advertising rp;
6697
6698         BT_DBG("status %d", status);
6699
6700         hci_dev_lock(hdev);
6701
6702         /* A failure status here only means that we failed to disable
6703          * advertising. Otherwise, the advertising instance has been removed,
6704          * so report success.
6705          */
6706         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6707         if (!cmd)
6708                 goto unlock;
6709
6710         cp = cmd->param;
6711         rp.instance = cp->instance;
6712
6713         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6714                           &rp, sizeof(rp));
6715         mgmt_pending_remove(cmd);
6716
6717 unlock:
6718         hci_dev_unlock(hdev);
6719 }
6720
6721 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6722                               void *data, u16 data_len)
6723 {
6724         struct mgmt_cp_remove_advertising *cp = data;
6725         struct mgmt_rp_remove_advertising rp;
6726         struct mgmt_pending_cmd *cmd;
6727         struct hci_request req;
6728         int err;
6729
6730         BT_DBG("%s", hdev->name);
6731
6732         hci_dev_lock(hdev);
6733
6734         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6735                 err = mgmt_cmd_status(sk, hdev->id,
6736                                       MGMT_OP_REMOVE_ADVERTISING,
6737                                       MGMT_STATUS_INVALID_PARAMS);
6738                 goto unlock;
6739         }
6740
6741         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6742             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6743             pending_find(MGMT_OP_SET_LE, hdev)) {
6744                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6745                                       MGMT_STATUS_BUSY);
6746                 goto unlock;
6747         }
6748
6749         if (list_empty(&hdev->adv_instances)) {
6750                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6751                                       MGMT_STATUS_INVALID_PARAMS);
6752                 goto unlock;
6753         }
6754
6755         hci_req_init(&req, hdev);
6756
6757         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6758
6759         if (list_empty(&hdev->adv_instances))
6760                 __hci_req_disable_advertising(&req);
6761
6762         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6763          * flag is set or the device isn't powered then we have no HCI
6764          * communication to make. Simply return.
6765          */
6766         if (skb_queue_empty(&req.cmd_q) ||
6767             !hdev_is_powered(hdev) ||
6768             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6769                 hci_req_purge(&req);
6770                 rp.instance = cp->instance;
6771                 err = mgmt_cmd_complete(sk, hdev->id,
6772                                         MGMT_OP_REMOVE_ADVERTISING,
6773                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6774                 goto unlock;
6775         }
6776
6777         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6778                                data_len);
6779         if (!cmd) {
6780                 err = -ENOMEM;
6781                 goto unlock;
6782         }
6783
6784         err = hci_req_run(&req, remove_advertising_complete);
6785         if (err < 0)
6786                 mgmt_pending_remove(cmd);
6787
6788 unlock:
6789         hci_dev_unlock(hdev);
6790
6791         return err;
6792 }
6793
6794 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6795                              void *data, u16 data_len)
6796 {
6797         struct mgmt_cp_get_adv_size_info *cp = data;
6798         struct mgmt_rp_get_adv_size_info rp;
6799         u32 flags, supported_flags;
6800         int err;
6801
6802         BT_DBG("%s", hdev->name);
6803
6804         if (!lmp_le_capable(hdev))
6805                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6806                                        MGMT_STATUS_REJECTED);
6807
6808         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6810                                        MGMT_STATUS_INVALID_PARAMS);
6811
6812         flags = __le32_to_cpu(cp->flags);
6813
6814         /* The current implementation only supports a subset of the specified
6815          * flags.
6816          */
6817         supported_flags = get_supported_adv_flags(hdev);
6818         if (flags & ~supported_flags)
6819                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6820                                        MGMT_STATUS_INVALID_PARAMS);
6821
6822         rp.instance = cp->instance;
6823         rp.flags = cp->flags;
6824         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6825         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6826
6827         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6828                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6829
6830         return err;
6831 }
6832
6833 static const struct hci_mgmt_handler mgmt_handlers[] = {
6834         { NULL }, /* 0x0000 (no command) */
6835         { read_version,            MGMT_READ_VERSION_SIZE,
6836                                                 HCI_MGMT_NO_HDEV |
6837                                                 HCI_MGMT_UNTRUSTED },
6838         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6839                                                 HCI_MGMT_NO_HDEV |
6840                                                 HCI_MGMT_UNTRUSTED },
6841         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6842                                                 HCI_MGMT_NO_HDEV |
6843                                                 HCI_MGMT_UNTRUSTED },
6844         { read_controller_info,    MGMT_READ_INFO_SIZE,
6845                                                 HCI_MGMT_UNTRUSTED },
6846         { set_powered,             MGMT_SETTING_SIZE },
6847         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6848         { set_connectable,         MGMT_SETTING_SIZE },
6849         { set_fast_connectable,    MGMT_SETTING_SIZE },
6850         { set_bondable,            MGMT_SETTING_SIZE },
6851         { set_link_security,       MGMT_SETTING_SIZE },
6852         { set_ssp,                 MGMT_SETTING_SIZE },
6853         { set_hs,                  MGMT_SETTING_SIZE },
6854         { set_le,                  MGMT_SETTING_SIZE },
6855         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6856         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6857         { add_uuid,                MGMT_ADD_UUID_SIZE },
6858         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6859         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6860                                                 HCI_MGMT_VAR_LEN },
6861         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6862                                                 HCI_MGMT_VAR_LEN },
6863         { disconnect,              MGMT_DISCONNECT_SIZE },
6864         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6865         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6866         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6867         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6868         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6869         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6870         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6871         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6872         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6873         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6874         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6875         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6876         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6877                                                 HCI_MGMT_VAR_LEN },
6878         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6879         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6880         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6881         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6882         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6883         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6884         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6885         { set_advertising,         MGMT_SETTING_SIZE },
6886         { set_bredr,               MGMT_SETTING_SIZE },
6887         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6888         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6889         { set_secure_conn,         MGMT_SETTING_SIZE },
6890         { set_debug_keys,          MGMT_SETTING_SIZE },
6891         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6892         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6893                                                 HCI_MGMT_VAR_LEN },
6894         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6895         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6896         { add_device,              MGMT_ADD_DEVICE_SIZE },
6897         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6898         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6899                                                 HCI_MGMT_VAR_LEN },
6900         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6901                                                 HCI_MGMT_NO_HDEV |
6902                                                 HCI_MGMT_UNTRUSTED },
6903         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6904                                                 HCI_MGMT_UNCONFIGURED |
6905                                                 HCI_MGMT_UNTRUSTED },
6906         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6907                                                 HCI_MGMT_UNCONFIGURED },
6908         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6909                                                 HCI_MGMT_UNCONFIGURED },
6910         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6911                                                 HCI_MGMT_VAR_LEN },
6912         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6913         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6914                                                 HCI_MGMT_NO_HDEV |
6915                                                 HCI_MGMT_UNTRUSTED },
6916         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6917         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6918                                                 HCI_MGMT_VAR_LEN },
6919         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6920         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6921         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6922         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6923                                                 HCI_MGMT_UNTRUSTED },
6924         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6925         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6926         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6927 };
6928
6929 void mgmt_index_added(struct hci_dev *hdev)
6930 {
6931         struct mgmt_ev_ext_index ev;
6932
6933         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6934                 return;
6935
6936         switch (hdev->dev_type) {
6937         case HCI_PRIMARY:
6938                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6939                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6940                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6941                         ev.type = 0x01;
6942                 } else {
6943                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6944                                          HCI_MGMT_INDEX_EVENTS);
6945                         ev.type = 0x00;
6946                 }
6947                 break;
6948         case HCI_AMP:
6949                 ev.type = 0x02;
6950                 break;
6951         default:
6952                 return;
6953         }
6954
6955         ev.bus = hdev->bus;
6956
6957         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6958                          HCI_MGMT_EXT_INDEX_EVENTS);
6959 }
6960
6961 void mgmt_index_removed(struct hci_dev *hdev)
6962 {
6963         struct mgmt_ev_ext_index ev;
6964         u8 status = MGMT_STATUS_INVALID_INDEX;
6965
6966         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6967                 return;
6968
6969         switch (hdev->dev_type) {
6970         case HCI_PRIMARY:
6971                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6972
6973                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6974                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6975                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6976                         ev.type = 0x01;
6977                 } else {
6978                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6979                                          HCI_MGMT_INDEX_EVENTS);
6980                         ev.type = 0x00;
6981                 }
6982                 break;
6983         case HCI_AMP:
6984                 ev.type = 0x02;
6985                 break;
6986         default:
6987                 return;
6988         }
6989
6990         ev.bus = hdev->bus;
6991
6992         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6993                          HCI_MGMT_EXT_INDEX_EVENTS);
6994 }
6995
6996 /* This function requires the caller holds hdev->lock */
6997 static void restart_le_actions(struct hci_dev *hdev)
6998 {
6999         struct hci_conn_params *p;
7000
7001         list_for_each_entry(p, &hdev->le_conn_params, list) {
7002                 /* Needed for AUTO_OFF case where might not "really"
7003                  * have been powered off.
7004                  */
7005                 list_del_init(&p->action);
7006
7007                 switch (p->auto_connect) {
7008                 case HCI_AUTO_CONN_DIRECT:
7009                 case HCI_AUTO_CONN_ALWAYS:
7010                         list_add(&p->action, &hdev->pend_le_conns);
7011                         break;
7012                 case HCI_AUTO_CONN_REPORT:
7013                         list_add(&p->action, &hdev->pend_le_reports);
7014                         break;
7015                 default:
7016                         break;
7017                 }
7018         }
7019 }
7020
7021 void mgmt_power_on(struct hci_dev *hdev, int err)
7022 {
7023         struct cmd_lookup match = { NULL, hdev };
7024
7025         BT_DBG("err %d", err);
7026
7027         hci_dev_lock(hdev);
7028
7029         if (!err) {
7030                 restart_le_actions(hdev);
7031                 hci_update_background_scan(hdev);
7032         }
7033
7034         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7035
7036         new_settings(hdev, match.sk);
7037
7038         if (match.sk)
7039                 sock_put(match.sk);
7040
7041         hci_dev_unlock(hdev);
7042 }
7043
7044 void __mgmt_power_off(struct hci_dev *hdev)
7045 {
7046         struct cmd_lookup match = { NULL, hdev };
7047         u8 status, zero_cod[] = { 0, 0, 0 };
7048
7049         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7050
7051         /* If the power off is because of hdev unregistration let
7052          * use the appropriate INVALID_INDEX status. Otherwise use
7053          * NOT_POWERED. We cover both scenarios here since later in
7054          * mgmt_index_removed() any hci_conn callbacks will have already
7055          * been triggered, potentially causing misleading DISCONNECTED
7056          * status responses.
7057          */
7058         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7059                 status = MGMT_STATUS_INVALID_INDEX;
7060         else
7061                 status = MGMT_STATUS_NOT_POWERED;
7062
7063         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7064
7065         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7066                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7067                                    zero_cod, sizeof(zero_cod),
7068                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7069                 ext_info_changed(hdev, NULL);
7070         }
7071
7072         new_settings(hdev, match.sk);
7073
7074         if (match.sk)
7075                 sock_put(match.sk);
7076 }
7077
7078 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7079 {
7080         struct mgmt_pending_cmd *cmd;
7081         u8 status;
7082
7083         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7084         if (!cmd)
7085                 return;
7086
7087         if (err == -ERFKILL)
7088                 status = MGMT_STATUS_RFKILLED;
7089         else
7090                 status = MGMT_STATUS_FAILED;
7091
7092         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7093
7094         mgmt_pending_remove(cmd);
7095 }
7096
7097 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7098                        bool persistent)
7099 {
7100         struct mgmt_ev_new_link_key ev;
7101
7102         memset(&ev, 0, sizeof(ev));
7103
7104         ev.store_hint = persistent;
7105         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7106         ev.key.addr.type = BDADDR_BREDR;
7107         ev.key.type = key->type;
7108         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7109         ev.key.pin_len = key->pin_len;
7110
7111         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7112 }
7113
7114 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7115 {
7116         switch (ltk->type) {
7117         case SMP_LTK:
7118         case SMP_LTK_SLAVE:
7119                 if (ltk->authenticated)
7120                         return MGMT_LTK_AUTHENTICATED;
7121                 return MGMT_LTK_UNAUTHENTICATED;
7122         case SMP_LTK_P256:
7123                 if (ltk->authenticated)
7124                         return MGMT_LTK_P256_AUTH;
7125                 return MGMT_LTK_P256_UNAUTH;
7126         case SMP_LTK_P256_DEBUG:
7127                 return MGMT_LTK_P256_DEBUG;
7128         }
7129
7130         return MGMT_LTK_UNAUTHENTICATED;
7131 }
7132
7133 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7134 {
7135         struct mgmt_ev_new_long_term_key ev;
7136
7137         memset(&ev, 0, sizeof(ev));
7138
7139         /* Devices using resolvable or non-resolvable random addresses
7140          * without providing an identity resolving key don't require
7141          * to store long term keys. Their addresses will change the
7142          * next time around.
7143          *
7144          * Only when a remote device provides an identity address
7145          * make sure the long term key is stored. If the remote
7146          * identity is known, the long term keys are internally
7147          * mapped to the identity address. So allow static random
7148          * and public addresses here.
7149          */
7150         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7151             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7152                 ev.store_hint = 0x00;
7153         else
7154                 ev.store_hint = persistent;
7155
7156         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7157         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7158         ev.key.type = mgmt_ltk_type(key);
7159         ev.key.enc_size = key->enc_size;
7160         ev.key.ediv = key->ediv;
7161         ev.key.rand = key->rand;
7162
7163         if (key->type == SMP_LTK)
7164                 ev.key.master = 1;
7165
7166         /* Make sure we copy only the significant bytes based on the
7167          * encryption key size, and set the rest of the value to zeroes.
7168          */
7169         memcpy(ev.key.val, key->val, key->enc_size);
7170         memset(ev.key.val + key->enc_size, 0,
7171                sizeof(ev.key.val) - key->enc_size);
7172
7173         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7174 }
7175
7176 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7177 {
7178         struct mgmt_ev_new_irk ev;
7179
7180         memset(&ev, 0, sizeof(ev));
7181
7182         ev.store_hint = persistent;
7183
7184         bacpy(&ev.rpa, &irk->rpa);
7185         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7186         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7187         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7188
7189         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7190 }
7191
7192 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7193                    bool persistent)
7194 {
7195         struct mgmt_ev_new_csrk ev;
7196
7197         memset(&ev, 0, sizeof(ev));
7198
7199         /* Devices using resolvable or non-resolvable random addresses
7200          * without providing an identity resolving key don't require
7201          * to store signature resolving keys. Their addresses will change
7202          * the next time around.
7203          *
7204          * Only when a remote device provides an identity address
7205          * make sure the signature resolving key is stored. So allow
7206          * static random and public addresses here.
7207          */
7208         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7209             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7210                 ev.store_hint = 0x00;
7211         else
7212                 ev.store_hint = persistent;
7213
7214         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7215         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7216         ev.key.type = csrk->type;
7217         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7218
7219         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7220 }
7221
7222 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7223                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7224                          u16 max_interval, u16 latency, u16 timeout)
7225 {
7226         struct mgmt_ev_new_conn_param ev;
7227
7228         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7229                 return;
7230
7231         memset(&ev, 0, sizeof(ev));
7232         bacpy(&ev.addr.bdaddr, bdaddr);
7233         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7234         ev.store_hint = store_hint;
7235         ev.min_interval = cpu_to_le16(min_interval);
7236         ev.max_interval = cpu_to_le16(max_interval);
7237         ev.latency = cpu_to_le16(latency);
7238         ev.timeout = cpu_to_le16(timeout);
7239
7240         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7241 }
7242
7243 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7244                            u32 flags, u8 *name, u8 name_len)
7245 {
7246         char buf[512];
7247         struct mgmt_ev_device_connected *ev = (void *) buf;
7248         u16 eir_len = 0;
7249
7250         bacpy(&ev->addr.bdaddr, &conn->dst);
7251         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7252
7253         ev->flags = __cpu_to_le32(flags);
7254
7255         /* We must ensure that the EIR Data fields are ordered and
7256          * unique. Keep it simple for now and avoid the problem by not
7257          * adding any BR/EDR data to the LE adv.
7258          */
7259         if (conn->le_adv_data_len > 0) {
7260                 memcpy(&ev->eir[eir_len],
7261                        conn->le_adv_data, conn->le_adv_data_len);
7262                 eir_len = conn->le_adv_data_len;
7263         } else {
7264                 if (name_len > 0)
7265                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7266                                                   name, name_len);
7267
7268                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7269                         eir_len = eir_append_data(ev->eir, eir_len,
7270                                                   EIR_CLASS_OF_DEV,
7271                                                   conn->dev_class, 3);
7272         }
7273
7274         ev->eir_len = cpu_to_le16(eir_len);
7275
7276         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7277                     sizeof(*ev) + eir_len, NULL);
7278 }
7279
7280 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7281 {
7282         struct sock **sk = data;
7283
7284         cmd->cmd_complete(cmd, 0);
7285
7286         *sk = cmd->sk;
7287         sock_hold(*sk);
7288
7289         mgmt_pending_remove(cmd);
7290 }
7291
7292 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7293 {
7294         struct hci_dev *hdev = data;
7295         struct mgmt_cp_unpair_device *cp = cmd->param;
7296
7297         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7298
7299         cmd->cmd_complete(cmd, 0);
7300         mgmt_pending_remove(cmd);
7301 }
7302
7303 bool mgmt_powering_down(struct hci_dev *hdev)
7304 {
7305         struct mgmt_pending_cmd *cmd;
7306         struct mgmt_mode *cp;
7307
7308         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7309         if (!cmd)
7310                 return false;
7311
7312         cp = cmd->param;
7313         if (!cp->val)
7314                 return true;
7315
7316         return false;
7317 }
7318
7319 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7320                               u8 link_type, u8 addr_type, u8 reason,
7321                               bool mgmt_connected)
7322 {
7323         struct mgmt_ev_device_disconnected ev;
7324         struct sock *sk = NULL;
7325
7326         /* The connection is still in hci_conn_hash so test for 1
7327          * instead of 0 to know if this is the last one.
7328          */
7329         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7330                 cancel_delayed_work(&hdev->power_off);
7331                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7332         }
7333
7334         if (!mgmt_connected)
7335                 return;
7336
7337         if (link_type != ACL_LINK && link_type != LE_LINK)
7338                 return;
7339
7340         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7341
7342         bacpy(&ev.addr.bdaddr, bdaddr);
7343         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7344         ev.reason = reason;
7345
7346         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7347
7348         if (sk)
7349                 sock_put(sk);
7350
7351         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7352                              hdev);
7353 }
7354
7355 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7356                             u8 link_type, u8 addr_type, u8 status)
7357 {
7358         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7359         struct mgmt_cp_disconnect *cp;
7360         struct mgmt_pending_cmd *cmd;
7361
7362         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7363                              hdev);
7364
7365         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7366         if (!cmd)
7367                 return;
7368
7369         cp = cmd->param;
7370
7371         if (bacmp(bdaddr, &cp->addr.bdaddr))
7372                 return;
7373
7374         if (cp->addr.type != bdaddr_type)
7375                 return;
7376
7377         cmd->cmd_complete(cmd, mgmt_status(status));
7378         mgmt_pending_remove(cmd);
7379 }
7380
7381 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7382                          u8 addr_type, u8 status)
7383 {
7384         struct mgmt_ev_connect_failed ev;
7385
7386         /* The connection is still in hci_conn_hash so test for 1
7387          * instead of 0 to know if this is the last one.
7388          */
7389         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7390                 cancel_delayed_work(&hdev->power_off);
7391                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7392         }
7393
7394         bacpy(&ev.addr.bdaddr, bdaddr);
7395         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7396         ev.status = mgmt_status(status);
7397
7398         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7399 }
7400
7401 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7402 {
7403         struct mgmt_ev_pin_code_request ev;
7404
7405         bacpy(&ev.addr.bdaddr, bdaddr);
7406         ev.addr.type = BDADDR_BREDR;
7407         ev.secure = secure;
7408
7409         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7410 }
7411
7412 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7413                                   u8 status)
7414 {
7415         struct mgmt_pending_cmd *cmd;
7416
7417         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7418         if (!cmd)
7419                 return;
7420
7421         cmd->cmd_complete(cmd, mgmt_status(status));
7422         mgmt_pending_remove(cmd);
7423 }
7424
7425 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7426                                       u8 status)
7427 {
7428         struct mgmt_pending_cmd *cmd;
7429
7430         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7431         if (!cmd)
7432                 return;
7433
7434         cmd->cmd_complete(cmd, mgmt_status(status));
7435         mgmt_pending_remove(cmd);
7436 }
7437
7438 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7439                               u8 link_type, u8 addr_type, u32 value,
7440                               u8 confirm_hint)
7441 {
7442         struct mgmt_ev_user_confirm_request ev;
7443
7444         BT_DBG("%s", hdev->name);
7445
7446         bacpy(&ev.addr.bdaddr, bdaddr);
7447         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7448         ev.confirm_hint = confirm_hint;
7449         ev.value = cpu_to_le32(value);
7450
7451         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7452                           NULL);
7453 }
7454
7455 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7456                               u8 link_type, u8 addr_type)
7457 {
7458         struct mgmt_ev_user_passkey_request ev;
7459
7460         BT_DBG("%s", hdev->name);
7461
7462         bacpy(&ev.addr.bdaddr, bdaddr);
7463         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7464
7465         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7466                           NULL);
7467 }
7468
7469 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7470                                       u8 link_type, u8 addr_type, u8 status,
7471                                       u8 opcode)
7472 {
7473         struct mgmt_pending_cmd *cmd;
7474
7475         cmd = pending_find(opcode, hdev);
7476         if (!cmd)
7477                 return -ENOENT;
7478
7479         cmd->cmd_complete(cmd, mgmt_status(status));
7480         mgmt_pending_remove(cmd);
7481
7482         return 0;
7483 }
7484
7485 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7486                                      u8 link_type, u8 addr_type, u8 status)
7487 {
7488         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7489                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7490 }
7491
7492 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7493                                          u8 link_type, u8 addr_type, u8 status)
7494 {
7495         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7496                                           status,
7497                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7498 }
7499
7500 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7501                                      u8 link_type, u8 addr_type, u8 status)
7502 {
7503         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7504                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7505 }
7506
7507 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7508                                          u8 link_type, u8 addr_type, u8 status)
7509 {
7510         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7511                                           status,
7512                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7513 }
7514
7515 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7516                              u8 link_type, u8 addr_type, u32 passkey,
7517                              u8 entered)
7518 {
7519         struct mgmt_ev_passkey_notify ev;
7520
7521         BT_DBG("%s", hdev->name);
7522
7523         bacpy(&ev.addr.bdaddr, bdaddr);
7524         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7525         ev.passkey = __cpu_to_le32(passkey);
7526         ev.entered = entered;
7527
7528         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7529 }
7530
7531 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7532 {
7533         struct mgmt_ev_auth_failed ev;
7534         struct mgmt_pending_cmd *cmd;
7535         u8 status = mgmt_status(hci_status);
7536
7537         bacpy(&ev.addr.bdaddr, &conn->dst);
7538         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7539         ev.status = status;
7540
7541         cmd = find_pairing(conn);
7542
7543         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7544                     cmd ? cmd->sk : NULL);
7545
7546         if (cmd) {
7547                 cmd->cmd_complete(cmd, status);
7548                 mgmt_pending_remove(cmd);
7549         }
7550 }
7551
7552 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7553 {
7554         struct cmd_lookup match = { NULL, hdev };
7555         bool changed;
7556
7557         if (status) {
7558                 u8 mgmt_err = mgmt_status(status);
7559                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7560                                      cmd_status_rsp, &mgmt_err);
7561                 return;
7562         }
7563
7564         if (test_bit(HCI_AUTH, &hdev->flags))
7565                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7566         else
7567                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7568
7569         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7570                              &match);
7571
7572         if (changed)
7573                 new_settings(hdev, match.sk);
7574
7575         if (match.sk)
7576                 sock_put(match.sk);
7577 }
7578
7579 static void clear_eir(struct hci_request *req)
7580 {
7581         struct hci_dev *hdev = req->hdev;
7582         struct hci_cp_write_eir cp;
7583
7584         if (!lmp_ext_inq_capable(hdev))
7585                 return;
7586
7587         memset(hdev->eir, 0, sizeof(hdev->eir));
7588
7589         memset(&cp, 0, sizeof(cp));
7590
7591         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7592 }
7593
7594 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7595 {
7596         struct cmd_lookup match = { NULL, hdev };
7597         struct hci_request req;
7598         bool changed = false;
7599
7600         if (status) {
7601                 u8 mgmt_err = mgmt_status(status);
7602
7603                 if (enable && hci_dev_test_and_clear_flag(hdev,
7604                                                           HCI_SSP_ENABLED)) {
7605                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7606                         new_settings(hdev, NULL);
7607                 }
7608
7609                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7610                                      &mgmt_err);
7611                 return;
7612         }
7613
7614         if (enable) {
7615                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7616         } else {
7617                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7618                 if (!changed)
7619                         changed = hci_dev_test_and_clear_flag(hdev,
7620                                                               HCI_HS_ENABLED);
7621                 else
7622                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7623         }
7624
7625         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7626
7627         if (changed)
7628                 new_settings(hdev, match.sk);
7629
7630         if (match.sk)
7631                 sock_put(match.sk);
7632
7633         hci_req_init(&req, hdev);
7634
7635         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7636                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7637                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7638                                     sizeof(enable), &enable);
7639                 __hci_req_update_eir(&req);
7640         } else {
7641                 clear_eir(&req);
7642         }
7643
7644         hci_req_run(&req, NULL);
7645 }
7646
7647 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7648 {
7649         struct cmd_lookup *match = data;
7650
7651         if (match->sk == NULL) {
7652                 match->sk = cmd->sk;
7653                 sock_hold(match->sk);
7654         }
7655 }
7656
7657 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7658                                     u8 status)
7659 {
7660         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7661
7662         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7663         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7664         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7665
7666         if (!status) {
7667                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7668                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7669                 ext_info_changed(hdev, NULL);
7670         }
7671
7672         if (match.sk)
7673                 sock_put(match.sk);
7674 }
7675
7676 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7677 {
7678         struct mgmt_cp_set_local_name ev;
7679         struct mgmt_pending_cmd *cmd;
7680
7681         if (status)
7682                 return;
7683
7684         memset(&ev, 0, sizeof(ev));
7685         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7686         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7687
7688         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7689         if (!cmd) {
7690                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7691
7692                 /* If this is a HCI command related to powering on the
7693                  * HCI dev don't send any mgmt signals.
7694                  */
7695                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7696                         return;
7697         }
7698
7699         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7700                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7701         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7702 }
7703
7704 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7705 {
7706         int i;
7707
7708         for (i = 0; i < uuid_count; i++) {
7709                 if (!memcmp(uuid, uuids[i], 16))
7710                         return true;
7711         }
7712
7713         return false;
7714 }
7715
7716 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7717 {
7718         u16 parsed = 0;
7719
7720         while (parsed < eir_len) {
7721                 u8 field_len = eir[0];
7722                 u8 uuid[16];
7723                 int i;
7724
7725                 if (field_len == 0)
7726                         break;
7727
7728                 if (eir_len - parsed < field_len + 1)
7729                         break;
7730
7731                 switch (eir[1]) {
7732                 case EIR_UUID16_ALL:
7733                 case EIR_UUID16_SOME:
7734                         for (i = 0; i + 3 <= field_len; i += 2) {
7735                                 memcpy(uuid, bluetooth_base_uuid, 16);
7736                                 uuid[13] = eir[i + 3];
7737                                 uuid[12] = eir[i + 2];
7738                                 if (has_uuid(uuid, uuid_count, uuids))
7739                                         return true;
7740                         }
7741                         break;
7742                 case EIR_UUID32_ALL:
7743                 case EIR_UUID32_SOME:
7744                         for (i = 0; i + 5 <= field_len; i += 4) {
7745                                 memcpy(uuid, bluetooth_base_uuid, 16);
7746                                 uuid[15] = eir[i + 5];
7747                                 uuid[14] = eir[i + 4];
7748                                 uuid[13] = eir[i + 3];
7749                                 uuid[12] = eir[i + 2];
7750                                 if (has_uuid(uuid, uuid_count, uuids))
7751                                         return true;
7752                         }
7753                         break;
7754                 case EIR_UUID128_ALL:
7755                 case EIR_UUID128_SOME:
7756                         for (i = 0; i + 17 <= field_len; i += 16) {
7757                                 memcpy(uuid, eir + i + 2, 16);
7758                                 if (has_uuid(uuid, uuid_count, uuids))
7759                                         return true;
7760                         }
7761                         break;
7762                 }
7763
7764                 parsed += field_len + 1;
7765                 eir += field_len + 1;
7766         }
7767
7768         return false;
7769 }
7770
7771 static void restart_le_scan(struct hci_dev *hdev)
7772 {
7773         /* If controller is not scanning we are done. */
7774         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7775                 return;
7776
7777         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7778                        hdev->discovery.scan_start +
7779                        hdev->discovery.scan_duration))
7780                 return;
7781
7782         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7783                            DISCOV_LE_RESTART_DELAY);
7784 }
7785
7786 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7787                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7788 {
7789         /* If a RSSI threshold has been specified, and
7790          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7791          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7792          * is set, let it through for further processing, as we might need to
7793          * restart the scan.
7794          *
7795          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7796          * the results are also dropped.
7797          */
7798         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7799             (rssi == HCI_RSSI_INVALID ||
7800             (rssi < hdev->discovery.rssi &&
7801              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7802                 return  false;
7803
7804         if (hdev->discovery.uuid_count != 0) {
7805                 /* If a list of UUIDs is provided in filter, results with no
7806                  * matching UUID should be dropped.
7807                  */
7808                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7809                                    hdev->discovery.uuids) &&
7810                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7811                                    hdev->discovery.uuid_count,
7812                                    hdev->discovery.uuids))
7813                         return false;
7814         }
7815
7816         /* If duplicate filtering does not report RSSI changes, then restart
7817          * scanning to ensure updated result with updated RSSI values.
7818          */
7819         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7820                 restart_le_scan(hdev);
7821
7822                 /* Validate RSSI value against the RSSI threshold once more. */
7823                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7824                     rssi < hdev->discovery.rssi)
7825                         return false;
7826         }
7827
7828         return true;
7829 }
7830
7831 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7832                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7833                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7834 {
7835         char buf[512];
7836         struct mgmt_ev_device_found *ev = (void *)buf;
7837         size_t ev_size;
7838
7839         /* Don't send events for a non-kernel initiated discovery. With
7840          * LE one exception is if we have pend_le_reports > 0 in which
7841          * case we're doing passive scanning and want these events.
7842          */
7843         if (!hci_discovery_active(hdev)) {
7844                 if (link_type == ACL_LINK)
7845                         return;
7846                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7847                         return;
7848         }
7849
7850         if (hdev->discovery.result_filtering) {
7851                 /* We are using service discovery */
7852                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7853                                      scan_rsp_len))
7854                         return;
7855         }
7856
7857         if (hdev->discovery.limited) {
7858                 /* Check for limited discoverable bit */
7859                 if (dev_class) {
7860                         if (!(dev_class[1] & 0x20))
7861                                 return;
7862                 } else {
7863                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7864                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7865                                 return;
7866                 }
7867         }
7868
7869         /* Make sure that the buffer is big enough. The 5 extra bytes
7870          * are for the potential CoD field.
7871          */
7872         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7873                 return;
7874
7875         memset(buf, 0, sizeof(buf));
7876
7877         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7878          * RSSI value was reported as 0 when not available. This behavior
7879          * is kept when using device discovery. This is required for full
7880          * backwards compatibility with the API.
7881          *
7882          * However when using service discovery, the value 127 will be
7883          * returned when the RSSI is not available.
7884          */
7885         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7886             link_type == ACL_LINK)
7887                 rssi = 0;
7888
7889         bacpy(&ev->addr.bdaddr, bdaddr);
7890         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7891         ev->rssi = rssi;
7892         ev->flags = cpu_to_le32(flags);
7893
7894         if (eir_len > 0)
7895                 /* Copy EIR or advertising data into event */
7896                 memcpy(ev->eir, eir, eir_len);
7897
7898         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7899                                        NULL))
7900                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7901                                           dev_class, 3);
7902
7903         if (scan_rsp_len > 0)
7904                 /* Append scan response data to event */
7905                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7906
7907         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7908         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7909
7910         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7911 }
7912
7913 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7914                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7915 {
7916         struct mgmt_ev_device_found *ev;
7917         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7918         u16 eir_len;
7919
7920         ev = (struct mgmt_ev_device_found *) buf;
7921
7922         memset(buf, 0, sizeof(buf));
7923
7924         bacpy(&ev->addr.bdaddr, bdaddr);
7925         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7926         ev->rssi = rssi;
7927
7928         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7929                                   name_len);
7930
7931         ev->eir_len = cpu_to_le16(eir_len);
7932
7933         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7934 }
7935
7936 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7937 {
7938         struct mgmt_ev_discovering ev;
7939
7940         BT_DBG("%s discovering %u", hdev->name, discovering);
7941
7942         memset(&ev, 0, sizeof(ev));
7943         ev.type = hdev->discovery.type;
7944         ev.discovering = discovering;
7945
7946         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7947 }
7948
7949 static struct hci_mgmt_chan chan = {
7950         .channel        = HCI_CHANNEL_CONTROL,
7951         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7952         .handlers       = mgmt_handlers,
7953         .hdev_init      = mgmt_init_hdev,
7954 };
7955
7956 int mgmt_init(void)
7957 {
7958         return hci_mgmt_chan_register(&chan);
7959 }
7960
7961 void mgmt_exit(void)
7962 {
7963         hci_mgmt_chan_unregister(&chan);
7964 }