net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_FAILED,             /* Reserved for future use */
 223         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 224         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 225         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 226         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 227         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 228         MGMT_STATUS_FAILED,             /* Reserved for future use */
 229         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 230         MGMT_STATUS_FAILED,             /* Reserved for future use */
 231         MGMT_STATUS_FAILED,             /* Slot Violation */
 232         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 233         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 234         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 235         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 236         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 237         MGMT_STATUS_BUSY,               /* Controller Busy */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 239         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 240         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 241         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 242         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 243 };
 244
 245 static u8 mgmt_status(u8 hci_status)
 246 {
 247         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 248                 return mgmt_status_table[hci_status];
 249
 250         return MGMT_STATUS_FAILED;
 251 }
 252
 253 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 254                             u16 len, int flag)
 255 {
 256         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 257                                flag, NULL);
 258 }
 259
 260 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 261                               u16 len, int flag, struct sock *skip_sk)
 262 {
 263         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 264                                flag, skip_sk);
 265 }
 266
 267 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 268                       struct sock *skip_sk)
 269 {
 270         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 271                                HCI_SOCK_TRUSTED, skip_sk);
 272 }
 273
 274 static u8 le_addr_type(u8 mgmt_addr_type)
 275 {
 276         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 277                 return ADDR_LE_DEV_PUBLIC;
 278         else
 279                 return ADDR_LE_DEV_RANDOM;
 280 }
 281
 282 void mgmt_fill_version_info(void *ver)
 283 {
 284         struct mgmt_rp_read_version *rp = ver;
 285
 286         rp->version = MGMT_VERSION;
 287         rp->revision = cpu_to_le16(MGMT_REVISION);
 288 }
 289
 290 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 291                         u16 data_len)
 292 {
 293         struct mgmt_rp_read_version rp;
 294
 295         BT_DBG("sock %p", sk);
 296
 297         mgmt_fill_version_info(&rp);
 298
 299         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 300                                  &rp, sizeof(rp));
 301 }
 302
 303 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 304                          u16 data_len)
 305 {
 306         struct mgmt_rp_read_commands *rp;
 307         u16 num_commands, num_events;
 308         size_t rp_size;
 309         int i, err;
 310
 311         BT_DBG("sock %p", sk);
 312
 313         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 314                 num_commands = ARRAY_SIZE(mgmt_commands);
 315                 num_events = ARRAY_SIZE(mgmt_events);
 316         } else {
 317                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 318                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 319         }
 320
 321         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 322
 323         rp = kmalloc(rp_size, GFP_KERNEL);
 324         if (!rp)
 325                 return -ENOMEM;
 326
 327         rp->num_commands = cpu_to_le16(num_commands);
 328         rp->num_events = cpu_to_le16(num_events);
 329
 330         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 331                 __le16 *opcode = rp->opcodes;
 332
 333                 for (i = 0; i < num_commands; i++, opcode++)
 334                         put_unaligned_le16(mgmt_commands[i], opcode);
 335
 336                 for (i = 0; i < num_events; i++, opcode++)
 337                         put_unaligned_le16(mgmt_events[i], opcode);
 338         } else {
 339                 __le16 *opcode = rp->opcodes;
 340
 341                 for (i = 0; i < num_commands; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 343
 344                 for (i = 0; i < num_events; i++, opcode++)
 345                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 346         }
 347
 348         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 349                                 rp, rp_size);
 350         kfree(rp);
 351
 352         return err;
 353 }
 354
 355 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 356                            u16 data_len)
 357 {
 358         struct mgmt_rp_read_index_list *rp;
 359         struct hci_dev *d;
 360         size_t rp_len;
 361         u16 count;
 362         int err;
 363
 364         BT_DBG("sock %p", sk);
 365
 366         read_lock(&hci_dev_list_lock);
 367
 368         count = 0;
 369         list_for_each_entry(d, &hci_dev_list, list) {
 370                 if (d->dev_type == HCI_PRIMARY &&
 371                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 372                         count++;
 373         }
 374
 375         rp_len = sizeof(*rp) + (2 * count);
 376         rp = kmalloc(rp_len, GFP_ATOMIC);
 377         if (!rp) {
 378                 read_unlock(&hci_dev_list_lock);
 379                 return -ENOMEM;
 380         }
 381
 382         count = 0;
 383         list_for_each_entry(d, &hci_dev_list, list) {
 384                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 385                     hci_dev_test_flag(d, HCI_CONFIG) ||
 386                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 387                         continue;
 388
 389                 /* Devices marked as raw-only are neither configured
 390                  * nor unconfigured controllers.
 391                  */
 392                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 393                         continue;
 394
 395                 if (d->dev_type == HCI_PRIMARY &&
 396                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 397                         rp->index[count++] = cpu_to_le16(d->id);
 398                         BT_DBG("Added hci%u", d->id);
 399                 }
 400         }
 401
 402         rp->num_controllers = cpu_to_le16(count);
 403         rp_len = sizeof(*rp) + (2 * count);
 404
 405         read_unlock(&hci_dev_list_lock);
 406
 407         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 408                                 0, rp, rp_len);
 409
 410         kfree(rp);
 411
 412         return err;
 413 }
 414
 415 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 416                                   void *data, u16 data_len)
 417 {
 418         struct mgmt_rp_read_unconf_index_list *rp;
 419         struct hci_dev *d;
 420         size_t rp_len;
 421         u16 count;
 422         int err;
 423
 424         BT_DBG("sock %p", sk);
 425
 426         read_lock(&hci_dev_list_lock);
 427
 428         count = 0;
 429         list_for_each_entry(d, &hci_dev_list, list) {
 430                 if (d->dev_type == HCI_PRIMARY &&
 431                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 432                         count++;
 433         }
 434
 435         rp_len = sizeof(*rp) + (2 * count);
 436         rp = kmalloc(rp_len, GFP_ATOMIC);
 437         if (!rp) {
 438                 read_unlock(&hci_dev_list_lock);
 439                 return -ENOMEM;
 440         }
 441
 442         count = 0;
 443         list_for_each_entry(d, &hci_dev_list, list) {
 444                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 445                     hci_dev_test_flag(d, HCI_CONFIG) ||
 446                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 447                         continue;
 448
 449                 /* Devices marked as raw-only are neither configured
 450                  * nor unconfigured controllers.
 451                  */
 452                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 453                         continue;
 454
 455                 if (d->dev_type == HCI_PRIMARY &&
 456                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 457                         rp->index[count++] = cpu_to_le16(d->id);
 458                         BT_DBG("Added hci%u", d->id);
 459                 }
 460         }
 461
 462         rp->num_controllers = cpu_to_le16(count);
 463         rp_len = sizeof(*rp) + (2 * count);
 464
 465         read_unlock(&hci_dev_list_lock);
 466
 467         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 468                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 469
 470         kfree(rp);
 471
 472         return err;
 473 }
 474
 475 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 476                                void *data, u16 data_len)
 477 {
 478         struct mgmt_rp_read_ext_index_list *rp;
 479         struct hci_dev *d;
 480         u16 count;
 481         int err;
 482
 483         BT_DBG("sock %p", sk);
 484
 485         read_lock(&hci_dev_list_lock);
 486
 487         count = 0;
 488         list_for_each_entry(d, &hci_dev_list, list) {
 489                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 490                         count++;
 491         }
 492
 493         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 494         if (!rp) {
 495                 read_unlock(&hci_dev_list_lock);
 496                 return -ENOMEM;
 497         }
 498
 499         count = 0;
 500         list_for_each_entry(d, &hci_dev_list, list) {
 501                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 502                     hci_dev_test_flag(d, HCI_CONFIG) ||
 503                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 504                         continue;
 505
 506                 /* Devices marked as raw-only are neither configured
 507                  * nor unconfigured controllers.
 508                  */
 509                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 510                         continue;
 511
 512                 if (d->dev_type == HCI_PRIMARY) {
 513                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 514                                 rp->entry[count].type = 0x01;
 515                         else
 516                                 rp->entry[count].type = 0x00;
 517                 } else if (d->dev_type == HCI_AMP) {
 518                         rp->entry[count].type = 0x02;
 519                 } else {
 520                         continue;
 521                 }
 522
 523                 rp->entry[count].bus = d->bus;
 524                 rp->entry[count++].index = cpu_to_le16(d->id);
 525                 BT_DBG("Added hci%u", d->id);
 526         }
 527
 528         rp->num_controllers = cpu_to_le16(count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 542                                 struct_size(rp, entry, count));
 543
 544         kfree(rp);
 545
 546         return err;
 547 }
 548
 549 static bool is_configured(struct hci_dev *hdev)
 550 {
 551         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 552             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 553                 return false;
 554
 555         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 556              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 557             !bacmp(&hdev->public_addr, BDADDR_ANY))
 558                 return false;
 559
 560         return true;
 561 }
 562
 563 static __le32 get_missing_options(struct hci_dev *hdev)
 564 {
 565         u32 options = 0;
 566
 567         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 568             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 569                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 570
 571         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 572              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 573             !bacmp(&hdev->public_addr, BDADDR_ANY))
 574                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 575
 576         return cpu_to_le32(options);
 577 }
 578
 579 static int new_options(struct hci_dev *hdev, struct sock *skip)
 580 {
 581         __le32 options = get_missing_options(hdev);
 582
 583         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 584                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 585 }
 586
 587 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 588 {
 589         __le32 options = get_missing_options(hdev);
 590
 591         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 592                                  sizeof(options));
 593 }
 594
 595 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 596                             void *data, u16 data_len)
 597 {
 598         struct mgmt_rp_read_config_info rp;
 599         u32 options = 0;
 600
 601         BT_DBG("sock %p %s", sk, hdev->name);
 602
 603         hci_dev_lock(hdev);
 604
 605         memset(&rp, 0, sizeof(rp));
 606         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 607
 608         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 609                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 610
 611         if (hdev->set_bdaddr)
 612                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 613
 614         rp.supported_options = cpu_to_le32(options);
 615         rp.missing_options = get_missing_options(hdev);
 616
 617         hci_dev_unlock(hdev);
 618
 619         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 620                                  &rp, sizeof(rp));
 621 }
 622
 623 static u32 get_supported_phys(struct hci_dev *hdev)
 624 {
 625         u32 supported_phys = 0;
 626
 627         if (lmp_bredr_capable(hdev)) {
 628                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_3SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 632
 633                 if (hdev->features[0][0] & LMP_5SLOT)
 634                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 635
 636                 if (lmp_edr_2m_capable(hdev)) {
 637                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 638
 639                         if (lmp_edr_3slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 641
 642                         if (lmp_edr_5slot_capable(hdev))
 643                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 644
 645                         if (lmp_edr_3m_capable(hdev)) {
 646                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 647
 648                                 if (lmp_edr_3slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 650
 651                                 if (lmp_edr_5slot_capable(hdev))
 652                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 653                         }
 654                 }
 655         }
 656
 657         if (lmp_le_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_LE_1M_TX;
 659                 supported_phys |= MGMT_PHY_LE_1M_RX;
 660
 661                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 662                         supported_phys |= MGMT_PHY_LE_2M_TX;
 663                         supported_phys |= MGMT_PHY_LE_2M_RX;
 664                 }
 665
 666                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 667                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 668                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 669                 }
 670         }
 671
 672         return supported_phys;
 673 }
 674
 675 static u32 get_selected_phys(struct hci_dev *hdev)
 676 {
 677         u32 selected_phys = 0;
 678
 679         if (lmp_bredr_capable(hdev)) {
 680                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 683                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 684
 685                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 686                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 687
 688                 if (lmp_edr_2m_capable(hdev)) {
 689                         if (!(hdev->pkt_type & HCI_2DH1))
 690                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 691
 692                         if (lmp_edr_3slot_capable(hdev) &&
 693                             !(hdev->pkt_type & HCI_2DH3))
 694                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 695
 696                         if (lmp_edr_5slot_capable(hdev) &&
 697                             !(hdev->pkt_type & HCI_2DH5))
 698                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 699
 700                         if (lmp_edr_3m_capable(hdev)) {
 701                                 if (!(hdev->pkt_type & HCI_3DH1))
 702                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 703
 704                                 if (lmp_edr_3slot_capable(hdev) &&
 705                                     !(hdev->pkt_type & HCI_3DH3))
 706                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 707
 708                                 if (lmp_edr_5slot_capable(hdev) &&
 709                                     !(hdev->pkt_type & HCI_3DH5))
 710                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 711                         }
 712                 }
 713         }
 714
 715         if (lmp_le_capable(hdev)) {
 716                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_TX;
 718
 719                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 720                         selected_phys |= MGMT_PHY_LE_1M_RX;
 721
 722                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_TX;
 724
 725                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 726                         selected_phys |= MGMT_PHY_LE_2M_RX;
 727
 728                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 730
 731                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 732                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 733         }
 734
 735         return selected_phys;
 736 }
 737
 738 static u32 get_configurable_phys(struct hci_dev *hdev)
 739 {
 740         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 741                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 742 }
 743
 744 static u32 get_supported_settings(struct hci_dev *hdev)
 745 {
 746         u32 settings = 0;
 747
 748         settings |= MGMT_SETTING_POWERED;
 749         settings |= MGMT_SETTING_BONDABLE;
 750         settings |= MGMT_SETTING_DEBUG_KEYS;
 751         settings |= MGMT_SETTING_CONNECTABLE;
 752         settings |= MGMT_SETTING_DISCOVERABLE;
 753
 754         if (lmp_bredr_capable(hdev)) {
 755                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 756                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 757                 settings |= MGMT_SETTING_BREDR;
 758                 settings |= MGMT_SETTING_LINK_SECURITY;
 759
 760                 if (lmp_ssp_capable(hdev)) {
 761                         settings |= MGMT_SETTING_SSP;
 762                         if (IS_ENABLED(CONFIG_BT_HS))
 763                                 settings |= MGMT_SETTING_HS;
 764                 }
 765
 766                 if (lmp_sc_capable(hdev))
 767                         settings |= MGMT_SETTING_SECURE_CONN;
 768         }
 769
 770         if (lmp_le_capable(hdev)) {
 771                 settings |= MGMT_SETTING_LE;
 772                 settings |= MGMT_SETTING_ADVERTISING;
 773                 settings |= MGMT_SETTING_SECURE_CONN;
 774                 settings |= MGMT_SETTING_PRIVACY;
 775                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 776         }
 777
 778         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 779             hdev->set_bdaddr)
 780                 settings |= MGMT_SETTING_CONFIGURATION;
 781
 782         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 783
 784         return settings;
 785 }
 786
 787 static u32 get_current_settings(struct hci_dev *hdev)
 788 {
 789         u32 settings = 0;
 790
 791         if (hdev_is_powered(hdev))
 792                 settings |= MGMT_SETTING_POWERED;
 793
 794         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 795                 settings |= MGMT_SETTING_CONNECTABLE;
 796
 797         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 798                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 799
 800         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 801                 settings |= MGMT_SETTING_DISCOVERABLE;
 802
 803         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 804                 settings |= MGMT_SETTING_BONDABLE;
 805
 806         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 807                 settings |= MGMT_SETTING_BREDR;
 808
 809         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 810                 settings |= MGMT_SETTING_LE;
 811
 812         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 813                 settings |= MGMT_SETTING_LINK_SECURITY;
 814
 815         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 816                 settings |= MGMT_SETTING_SSP;
 817
 818         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 819                 settings |= MGMT_SETTING_HS;
 820
 821         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 822                 settings |= MGMT_SETTING_ADVERTISING;
 823
 824         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 825                 settings |= MGMT_SETTING_SECURE_CONN;
 826
 827         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 828                 settings |= MGMT_SETTING_DEBUG_KEYS;
 829
 830         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 831                 settings |= MGMT_SETTING_PRIVACY;
 832
 833         /* The current setting for static address has two purposes. The
 834          * first is to indicate if the static address will be used and
 835          * the second is to indicate if it is actually set.
 836          *
 837          * This means if the static address is not configured, this flag
 838          * will never be set. If the address is configured, then if the
 839          * address is actually used decides if the flag is set or not.
 840          *
 841          * For single mode LE only controllers and dual-mode controllers
 842          * with BR/EDR disabled, the existence of the static address will
 843          * be evaluated.
 844          */
 845         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 846             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 847             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 848                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 849                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 850         }
 851
 852         return settings;
 853 }
 854
 855 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 856 {
 857         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 858 }
 859
 860 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 861                                                   struct hci_dev *hdev,
 862                                                   const void *data)
 863 {
 864         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 865 }
 866
 867 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 868 {
 869         struct mgmt_pending_cmd *cmd;
 870
 871         /* If there's a pending mgmt command the flags will not yet have
 872          * their final values, so check for this first.
 873          */
 874         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 875         if (cmd) {
 876                 struct mgmt_mode *cp = cmd->param;
 877                 if (cp->val == 0x01)
 878                         return LE_AD_GENERAL;
 879                 else if (cp->val == 0x02)
 880                         return LE_AD_LIMITED;
 881         } else {
 882                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 883                         return LE_AD_LIMITED;
 884                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 885                         return LE_AD_GENERAL;
 886         }
 887
 888         return 0;
 889 }
 890
 891 bool mgmt_get_connectable(struct hci_dev *hdev)
 892 {
 893         struct mgmt_pending_cmd *cmd;
 894
 895         /* If there's a pending mgmt command the flag will not yet have
 896          * it's final value, so check for this first.
 897          */
 898         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 899         if (cmd) {
 900                 struct mgmt_mode *cp = cmd->param;
 901
 902                 return cp->val;
 903         }
 904
 905         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 906 }
 907
 908 static void service_cache_off(struct work_struct *work)
 909 {
 910         struct hci_dev *hdev = container_of(work, struct hci_dev,
 911                                             service_cache.work);
 912         struct hci_request req;
 913
 914         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 915                 return;
 916
 917         hci_req_init(&req, hdev);
 918
 919         hci_dev_lock(hdev);
 920
 921         __hci_req_update_eir(&req);
 922         __hci_req_update_class(&req);
 923
 924         hci_dev_unlock(hdev);
 925
 926         hci_req_run(&req, NULL);
 927 }
 928
 929 static void rpa_expired(struct work_struct *work)
 930 {
 931         struct hci_dev *hdev = container_of(work, struct hci_dev,
 932                                             rpa_expired.work);
 933         struct hci_request req;
 934
 935         BT_DBG("");
 936
 937         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 938
 939         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 940                 return;
 941
 942         /* The generation of a new RPA and programming it into the
 943          * controller happens in the hci_req_enable_advertising()
 944          * function.
 945          */
 946         hci_req_init(&req, hdev);
 947         if (ext_adv_capable(hdev))
 948                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 949         else
 950                 __hci_req_enable_advertising(&req);
 951         hci_req_run(&req, NULL);
 952 }
 953
 954 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 955 {
 956         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 957                 return;
 958
 959         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 960         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 961
 962         /* Non-mgmt controlled devices get this bit set
 963          * implicitly so that pairing works for them, however
 964          * for mgmt we require user-space to explicitly enable
 965          * it
 966          */
 967         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 968 }
 969
 970 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 971                                 void *data, u16 data_len)
 972 {
 973         struct mgmt_rp_read_info rp;
 974
 975         BT_DBG("sock %p %s", sk, hdev->name);
 976
 977         hci_dev_lock(hdev);
 978
 979         memset(&rp, 0, sizeof(rp));
 980
 981         bacpy(&rp.bdaddr, &hdev->bdaddr);
 982
 983         rp.version = hdev->hci_ver;
 984         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 985
 986         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 987         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 988
 989         memcpy(rp.dev_class, hdev->dev_class, 3);
 990
 991         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 992         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 993
 994         hci_dev_unlock(hdev);
 995
 996         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 997                                  sizeof(rp));
 998 }
 999
1000 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1001 {
1002         u16 eir_len = 0;
1003         size_t name_len;
1004
1005         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1006                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1007                                           hdev->dev_class, 3);
1008
1009         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1010                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1011                                           hdev->appearance);
1012
1013         name_len = strlen(hdev->dev_name);
1014         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1015                                   hdev->dev_name, name_len);
1016
1017         name_len = strlen(hdev->short_name);
1018         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1019                                   hdev->short_name, name_len);
1020
1021         return eir_len;
1022 }
1023
1024 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1025                                     void *data, u16 data_len)
1026 {
1027         char buf[512];
1028         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1029         u16 eir_len;
1030
1031         BT_DBG("sock %p %s", sk, hdev->name);
1032
1033         memset(&buf, 0, sizeof(buf));
1034
1035         hci_dev_lock(hdev);
1036
1037         bacpy(&rp->bdaddr, &hdev->bdaddr);
1038
1039         rp->version = hdev->hci_ver;
1040         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1041
1042         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1043         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1044
1045
1046         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1047         rp->eir_len = cpu_to_le16(eir_len);
1048
1049         hci_dev_unlock(hdev);
1050
1051         /* If this command is called at least once, then the events
1052          * for class of device and local name changes are disabled
1053          * and only the new extended controller information event
1054          * is used.
1055          */
1056         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1057         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1058         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1059
1060         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1061                                  sizeof(*rp) + eir_len);
1062 }
1063
1064 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1065 {
1066         char buf[512];
1067         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1068         u16 eir_len;
1069
1070         memset(buf, 0, sizeof(buf));
1071
1072         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1073         ev->eir_len = cpu_to_le16(eir_len);
1074
1075         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1076                                   sizeof(*ev) + eir_len,
1077                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1078 }
1079
1080 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1081 {
1082         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1083
1084         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1085                                  sizeof(settings));
1086 }
1087
1088 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1089 {
1090         BT_DBG("%s status 0x%02x", hdev->name, status);
1091
1092         if (hci_conn_count(hdev) == 0) {
1093                 cancel_delayed_work(&hdev->power_off);
1094                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1095         }
1096 }
1097
1098 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1099 {
1100         struct mgmt_ev_advertising_added ev;
1101
1102         ev.instance = instance;
1103
1104         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1105 }
1106
1107 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1108                               u8 instance)
1109 {
1110         struct mgmt_ev_advertising_removed ev;
1111
1112         ev.instance = instance;
1113
1114         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1115 }
1116
1117 static void cancel_adv_timeout(struct hci_dev *hdev)
1118 {
1119         if (hdev->adv_instance_timeout) {
1120                 hdev->adv_instance_timeout = 0;
1121                 cancel_delayed_work(&hdev->adv_instance_expire);
1122         }
1123 }
1124
1125 static int clean_up_hci_state(struct hci_dev *hdev)
1126 {
1127         struct hci_request req;
1128         struct hci_conn *conn;
1129         bool discov_stopped;
1130         int err;
1131
1132         hci_req_init(&req, hdev);
1133
1134         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1135             test_bit(HCI_PSCAN, &hdev->flags)) {
1136                 u8 scan = 0x00;
1137                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1138         }
1139
1140         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1141
1142         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1143                 __hci_req_disable_advertising(&req);
1144
1145         discov_stopped = hci_req_stop_discovery(&req);
1146
1147         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1148                 /* 0x15 == Terminated due to Power Off */
1149                 __hci_abort_conn(&req, conn, 0x15);
1150         }
1151
1152         err = hci_req_run(&req, clean_up_hci_complete);
1153         if (!err && discov_stopped)
1154                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1155
1156         return err;
1157 }
1158
1159 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1160                        u16 len)
1161 {
1162         struct mgmt_mode *cp = data;
1163         struct mgmt_pending_cmd *cmd;
1164         int err;
1165
1166         BT_DBG("request for %s", hdev->name);
1167
1168         if (cp->val != 0x00 && cp->val != 0x01)
1169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1170                                        MGMT_STATUS_INVALID_PARAMS);
1171
1172         hci_dev_lock(hdev);
1173
1174         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1176                                       MGMT_STATUS_BUSY);
1177                 goto failed;
1178         }
1179
1180         if (!!cp->val == hdev_is_powered(hdev)) {
1181                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1182                 goto failed;
1183         }
1184
1185         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1186         if (!cmd) {
1187                 err = -ENOMEM;
1188                 goto failed;
1189         }
1190
1191         if (cp->val) {
1192                 queue_work(hdev->req_workqueue, &hdev->power_on);
1193                 err = 0;
1194         } else {
1195                 /* Disconnect connections, stop scans, etc */
1196                 err = clean_up_hci_state(hdev);
1197                 if (!err)
1198                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1199                                            HCI_POWER_OFF_TIMEOUT);
1200
1201                 /* ENODATA means there were no HCI commands queued */
1202                 if (err == -ENODATA) {
1203                         cancel_delayed_work(&hdev->power_off);
1204                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1205                         err = 0;
1206                 }
1207         }
1208
1209 failed:
1210         hci_dev_unlock(hdev);
1211         return err;
1212 }
1213
1214 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1215 {
1216         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1217
1218         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1219                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1220 }
1221
1222 int mgmt_new_settings(struct hci_dev *hdev)
1223 {
1224         return new_settings(hdev, NULL);
1225 }
1226
1227 struct cmd_lookup {
1228         struct sock *sk;
1229         struct hci_dev *hdev;
1230         u8 mgmt_status;
1231 };
1232
1233 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1234 {
1235         struct cmd_lookup *match = data;
1236
1237         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1238
1239         list_del(&cmd->list);
1240
1241         if (match->sk == NULL) {
1242                 match->sk = cmd->sk;
1243                 sock_hold(match->sk);
1244         }
1245
1246         mgmt_pending_free(cmd);
1247 }
1248
1249 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1250 {
1251         u8 *status = data;
1252
1253         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1254         mgmt_pending_remove(cmd);
1255 }
1256
1257 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1258 {
1259         if (cmd->cmd_complete) {
1260                 u8 *status = data;
1261
1262                 cmd->cmd_complete(cmd, *status);
1263                 mgmt_pending_remove(cmd);
1264
1265                 return;
1266         }
1267
1268         cmd_status_rsp(cmd, data);
1269 }
1270
1271 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1272 {
1273         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1274                                  cmd->param, cmd->param_len);
1275 }
1276
1277 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1278 {
1279         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1280                                  cmd->param, sizeof(struct mgmt_addr_info));
1281 }
1282
1283 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1284 {
1285         if (!lmp_bredr_capable(hdev))
1286                 return MGMT_STATUS_NOT_SUPPORTED;
1287         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1288                 return MGMT_STATUS_REJECTED;
1289         else
1290                 return MGMT_STATUS_SUCCESS;
1291 }
1292
1293 static u8 mgmt_le_support(struct hci_dev *hdev)
1294 {
1295         if (!lmp_le_capable(hdev))
1296                 return MGMT_STATUS_NOT_SUPPORTED;
1297         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1298                 return MGMT_STATUS_REJECTED;
1299         else
1300                 return MGMT_STATUS_SUCCESS;
1301 }
1302
1303 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1304 {
1305         struct mgmt_pending_cmd *cmd;
1306
1307         BT_DBG("status 0x%02x", status);
1308
1309         hci_dev_lock(hdev);
1310
1311         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1312         if (!cmd)
1313                 goto unlock;
1314
1315         if (status) {
1316                 u8 mgmt_err = mgmt_status(status);
1317                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1318                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1319                 goto remove_cmd;
1320         }
1321
1322         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1323             hdev->discov_timeout > 0) {
1324                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1325                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1326         }
1327
1328         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1329         new_settings(hdev, cmd->sk);
1330
1331 remove_cmd:
1332         mgmt_pending_remove(cmd);
1333
1334 unlock:
1335         hci_dev_unlock(hdev);
1336 }
1337
1338 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1339                             u16 len)
1340 {
1341         struct mgmt_cp_set_discoverable *cp = data;
1342         struct mgmt_pending_cmd *cmd;
1343         u16 timeout;
1344         int err;
1345
1346         BT_DBG("request for %s", hdev->name);
1347
1348         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1349             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351                                        MGMT_STATUS_REJECTED);
1352
1353         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1355                                        MGMT_STATUS_INVALID_PARAMS);
1356
1357         timeout = __le16_to_cpu(cp->timeout);
1358
1359         /* Disabling discoverable requires that no timeout is set,
1360          * and enabling limited discoverable requires a timeout.
1361          */
1362         if ((cp->val == 0x00 && timeout > 0) ||
1363             (cp->val == 0x02 && timeout == 0))
1364                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1365                                        MGMT_STATUS_INVALID_PARAMS);
1366
1367         hci_dev_lock(hdev);
1368
1369         if (!hdev_is_powered(hdev) && timeout > 0) {
1370                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1371                                       MGMT_STATUS_NOT_POWERED);
1372                 goto failed;
1373         }
1374
1375         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1376             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1378                                       MGMT_STATUS_BUSY);
1379                 goto failed;
1380         }
1381
1382         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1383                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1384                                       MGMT_STATUS_REJECTED);
1385                 goto failed;
1386         }
1387
1388         if (!hdev_is_powered(hdev)) {
1389                 bool changed = false;
1390
1391                 /* Setting limited discoverable when powered off is
1392                  * not a valid operation since it requires a timeout
1393                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1394                  */
1395                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1396                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1397                         changed = true;
1398                 }
1399
1400                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1401                 if (err < 0)
1402                         goto failed;
1403
1404                 if (changed)
1405                         err = new_settings(hdev, sk);
1406
1407                 goto failed;
1408         }
1409
1410         /* If the current mode is the same, then just update the timeout
1411          * value with the new value. And if only the timeout gets updated,
1412          * then no need for any HCI transactions.
1413          */
1414         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1415             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1416                                                    HCI_LIMITED_DISCOVERABLE)) {
1417                 cancel_delayed_work(&hdev->discov_off);
1418                 hdev->discov_timeout = timeout;
1419
1420                 if (cp->val && hdev->discov_timeout > 0) {
1421                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1422                         queue_delayed_work(hdev->req_workqueue,
1423                                            &hdev->discov_off, to);
1424                 }
1425
1426                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1427                 goto failed;
1428         }
1429
1430         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1431         if (!cmd) {
1432                 err = -ENOMEM;
1433                 goto failed;
1434         }
1435
1436         /* Cancel any potential discoverable timeout that might be
1437          * still active and store new timeout value. The arming of
1438          * the timeout happens in the complete handler.
1439          */
1440         cancel_delayed_work(&hdev->discov_off);
1441         hdev->discov_timeout = timeout;
1442
1443         if (cp->val)
1444                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1445         else
1446                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1447
1448         /* Limited discoverable mode */
1449         if (cp->val == 0x02)
1450                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1451         else
1452                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1453
1454         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1455         err = 0;
1456
1457 failed:
1458         hci_dev_unlock(hdev);
1459         return err;
1460 }
1461
1462 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1463 {
1464         struct mgmt_pending_cmd *cmd;
1465
1466         BT_DBG("status 0x%02x", status);
1467
1468         hci_dev_lock(hdev);
1469
1470         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1471         if (!cmd)
1472                 goto unlock;
1473
1474         if (status) {
1475                 u8 mgmt_err = mgmt_status(status);
1476                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1477                 goto remove_cmd;
1478         }
1479
1480         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1481         new_settings(hdev, cmd->sk);
1482
1483 remove_cmd:
1484         mgmt_pending_remove(cmd);
1485
1486 unlock:
1487         hci_dev_unlock(hdev);
1488 }
1489
1490 static int set_connectable_update_settings(struct hci_dev *hdev,
1491                                            struct sock *sk, u8 val)
1492 {
1493         bool changed = false;
1494         int err;
1495
1496         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1497                 changed = true;
1498
1499         if (val) {
1500                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1501         } else {
1502                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1503                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1504         }
1505
1506         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1507         if (err < 0)
1508                 return err;
1509
1510         if (changed) {
1511                 hci_req_update_scan(hdev);
1512                 hci_update_background_scan(hdev);
1513                 return new_settings(hdev, sk);
1514         }
1515
1516         return 0;
1517 }
1518
1519 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1520                            u16 len)
1521 {
1522         struct mgmt_mode *cp = data;
1523         struct mgmt_pending_cmd *cmd;
1524         int err;
1525
1526         BT_DBG("request for %s", hdev->name);
1527
1528         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1529             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531                                        MGMT_STATUS_REJECTED);
1532
1533         if (cp->val != 0x00 && cp->val != 0x01)
1534                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1535                                        MGMT_STATUS_INVALID_PARAMS);
1536
1537         hci_dev_lock(hdev);
1538
1539         if (!hdev_is_powered(hdev)) {
1540                 err = set_connectable_update_settings(hdev, sk, cp->val);
1541                 goto failed;
1542         }
1543
1544         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1545             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1546                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1547                                       MGMT_STATUS_BUSY);
1548                 goto failed;
1549         }
1550
1551         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1552         if (!cmd) {
1553                 err = -ENOMEM;
1554                 goto failed;
1555         }
1556
1557         if (cp->val) {
1558                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1559         } else {
1560                 if (hdev->discov_timeout > 0)
1561                         cancel_delayed_work(&hdev->discov_off);
1562
1563                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1564                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1565                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1566         }
1567
1568         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1569         err = 0;
1570
1571 failed:
1572         hci_dev_unlock(hdev);
1573         return err;
1574 }
1575
1576 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1577                         u16 len)
1578 {
1579         struct mgmt_mode *cp = data;
1580         bool changed;
1581         int err;
1582
1583         BT_DBG("request for %s", hdev->name);
1584
1585         if (cp->val != 0x00 && cp->val != 0x01)
1586                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1587                                        MGMT_STATUS_INVALID_PARAMS);
1588
1589         hci_dev_lock(hdev);
1590
1591         if (cp->val)
1592                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1593         else
1594                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1595
1596         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1597         if (err < 0)
1598                 goto unlock;
1599
1600         if (changed) {
1601                 /* In limited privacy mode the change of bondable mode
1602                  * may affect the local advertising address.
1603                  */
1604                 if (hdev_is_powered(hdev) &&
1605                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1606                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1607                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1608                         queue_work(hdev->req_workqueue,
1609                                    &hdev->discoverable_update);
1610
1611                 err = new_settings(hdev, sk);
1612         }
1613
1614 unlock:
1615         hci_dev_unlock(hdev);
1616         return err;
1617 }
1618
1619 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1620                              u16 len)
1621 {
1622         struct mgmt_mode *cp = data;
1623         struct mgmt_pending_cmd *cmd;
1624         u8 val, status;
1625         int err;
1626
1627         BT_DBG("request for %s", hdev->name);
1628
1629         status = mgmt_bredr_support(hdev);
1630         if (status)
1631                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632                                        status);
1633
1634         if (cp->val != 0x00 && cp->val != 0x01)
1635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1636                                        MGMT_STATUS_INVALID_PARAMS);
1637
1638         hci_dev_lock(hdev);
1639
1640         if (!hdev_is_powered(hdev)) {
1641                 bool changed = false;
1642
1643                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1644                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1645                         changed = true;
1646                 }
1647
1648                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1649                 if (err < 0)
1650                         goto failed;
1651
1652                 if (changed)
1653                         err = new_settings(hdev, sk);
1654
1655                 goto failed;
1656         }
1657
1658         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1659                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1660                                       MGMT_STATUS_BUSY);
1661                 goto failed;
1662         }
1663
1664         val = !!cp->val;
1665
1666         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1667                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1668                 goto failed;
1669         }
1670
1671         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1672         if (!cmd) {
1673                 err = -ENOMEM;
1674                 goto failed;
1675         }
1676
1677         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1678         if (err < 0) {
1679                 mgmt_pending_remove(cmd);
1680                 goto failed;
1681         }
1682
1683 failed:
1684         hci_dev_unlock(hdev);
1685         return err;
1686 }
1687
1688 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1689 {
1690         struct mgmt_mode *cp = data;
1691         struct mgmt_pending_cmd *cmd;
1692         u8 status;
1693         int err;
1694
1695         BT_DBG("request for %s", hdev->name);
1696
1697         status = mgmt_bredr_support(hdev);
1698         if (status)
1699                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1700
1701         if (!lmp_ssp_capable(hdev))
1702                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703                                        MGMT_STATUS_NOT_SUPPORTED);
1704
1705         if (cp->val != 0x00 && cp->val != 0x01)
1706                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1707                                        MGMT_STATUS_INVALID_PARAMS);
1708
1709         hci_dev_lock(hdev);
1710
1711         if (!hdev_is_powered(hdev)) {
1712                 bool changed;
1713
1714                 if (cp->val) {
1715                         changed = !hci_dev_test_and_set_flag(hdev,
1716                                                              HCI_SSP_ENABLED);
1717                 } else {
1718                         changed = hci_dev_test_and_clear_flag(hdev,
1719                                                               HCI_SSP_ENABLED);
1720                         if (!changed)
1721                                 changed = hci_dev_test_and_clear_flag(hdev,
1722                                                                       HCI_HS_ENABLED);
1723                         else
1724                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1725                 }
1726
1727                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1728                 if (err < 0)
1729                         goto failed;
1730
1731                 if (changed)
1732                         err = new_settings(hdev, sk);
1733
1734                 goto failed;
1735         }
1736
1737         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1738                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1739                                       MGMT_STATUS_BUSY);
1740                 goto failed;
1741         }
1742
1743         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1744                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1745                 goto failed;
1746         }
1747
1748         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1749         if (!cmd) {
1750                 err = -ENOMEM;
1751                 goto failed;
1752         }
1753
1754         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1755                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1756                              sizeof(cp->val), &cp->val);
1757
1758         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1759         if (err < 0) {
1760                 mgmt_pending_remove(cmd);
1761                 goto failed;
1762         }
1763
1764 failed:
1765         hci_dev_unlock(hdev);
1766         return err;
1767 }
1768
1769 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1770 {
1771         struct mgmt_mode *cp = data;
1772         bool changed;
1773         u8 status;
1774         int err;
1775
1776         BT_DBG("request for %s", hdev->name);
1777
1778         if (!IS_ENABLED(CONFIG_BT_HS))
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780                                        MGMT_STATUS_NOT_SUPPORTED);
1781
1782         status = mgmt_bredr_support(hdev);
1783         if (status)
1784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1785
1786         if (!lmp_ssp_capable(hdev))
1787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788                                        MGMT_STATUS_NOT_SUPPORTED);
1789
1790         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1792                                        MGMT_STATUS_REJECTED);
1793
1794         if (cp->val != 0x00 && cp->val != 0x01)
1795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1796                                        MGMT_STATUS_INVALID_PARAMS);
1797
1798         hci_dev_lock(hdev);
1799
1800         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1801                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1802                                       MGMT_STATUS_BUSY);
1803                 goto unlock;
1804         }
1805
1806         if (cp->val) {
1807                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1808         } else {
1809                 if (hdev_is_powered(hdev)) {
1810                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1811                                               MGMT_STATUS_REJECTED);
1812                         goto unlock;
1813                 }
1814
1815                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1816         }
1817
1818         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1819         if (err < 0)
1820                 goto unlock;
1821
1822         if (changed)
1823                 err = new_settings(hdev, sk);
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827         return err;
1828 }
1829
1830 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1831 {
1832         struct cmd_lookup match = { NULL, hdev };
1833
1834         hci_dev_lock(hdev);
1835
1836         if (status) {
1837                 u8 mgmt_err = mgmt_status(status);
1838
1839                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1840                                      &mgmt_err);
1841                 goto unlock;
1842         }
1843
1844         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1845
1846         new_settings(hdev, match.sk);
1847
1848         if (match.sk)
1849                 sock_put(match.sk);
1850
1851         /* Make sure the controller has a good default for
1852          * advertising data. Restrict the update to when LE
1853          * has actually been enabled. During power on, the
1854          * update in powered_update_hci will take care of it.
1855          */
1856         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1857                 struct hci_request req;
1858                 hci_req_init(&req, hdev);
1859                 if (ext_adv_capable(hdev)) {
1860                         int err;
1861
1862                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1863                         if (!err)
1864                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1865                 } else {
1866                         __hci_req_update_adv_data(&req, 0x00);
1867                         __hci_req_update_scan_rsp_data(&req, 0x00);
1868                 }
1869                 hci_req_run(&req, NULL);
1870                 hci_update_background_scan(hdev);
1871         }
1872
1873 unlock:
1874         hci_dev_unlock(hdev);
1875 }
1876
1877 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1878 {
1879         struct mgmt_mode *cp = data;
1880         struct hci_cp_write_le_host_supported hci_cp;
1881         struct mgmt_pending_cmd *cmd;
1882         struct hci_request req;
1883         int err;
1884         u8 val, enabled;
1885
1886         BT_DBG("request for %s", hdev->name);
1887
1888         if (!lmp_le_capable(hdev))
1889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1890                                        MGMT_STATUS_NOT_SUPPORTED);
1891
1892         if (cp->val != 0x00 && cp->val != 0x01)
1893                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1894                                        MGMT_STATUS_INVALID_PARAMS);
1895
1896         /* Bluetooth single mode LE only controllers or dual-mode
1897          * controllers configured as LE only devices, do not allow
1898          * switching LE off. These have either LE enabled explicitly
1899          * or BR/EDR has been previously switched off.
1900          *
1901          * When trying to enable an already enabled LE, then gracefully
1902          * send a positive response. Trying to disable it however will
1903          * result into rejection.
1904          */
1905         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1906                 if (cp->val == 0x01)
1907                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1908
1909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1910                                        MGMT_STATUS_REJECTED);
1911         }
1912
1913         hci_dev_lock(hdev);
1914
1915         val = !!cp->val;
1916         enabled = lmp_host_le_capable(hdev);
1917
1918         if (!val)
1919                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1920
1921         if (!hdev_is_powered(hdev) || val == enabled) {
1922                 bool changed = false;
1923
1924                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1925                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1926                         changed = true;
1927                 }
1928
1929                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1930                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1931                         changed = true;
1932                 }
1933
1934                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1935                 if (err < 0)
1936                         goto unlock;
1937
1938                 if (changed)
1939                         err = new_settings(hdev, sk);
1940
1941                 goto unlock;
1942         }
1943
1944         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1945             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1946                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1947                                       MGMT_STATUS_BUSY);
1948                 goto unlock;
1949         }
1950
1951         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1952         if (!cmd) {
1953                 err = -ENOMEM;
1954                 goto unlock;
1955         }
1956
1957         hci_req_init(&req, hdev);
1958
1959         memset(&hci_cp, 0, sizeof(hci_cp));
1960
1961         if (val) {
1962                 hci_cp.le = val;
1963                 hci_cp.simul = 0x00;
1964         } else {
1965                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1966                         __hci_req_disable_advertising(&req);
1967
1968                 if (ext_adv_capable(hdev))
1969                         __hci_req_clear_ext_adv_sets(&req);
1970         }
1971
1972         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1973                     &hci_cp);
1974
1975         err = hci_req_run(&req, le_enable_complete);
1976         if (err < 0)
1977                 mgmt_pending_remove(cmd);
1978
1979 unlock:
1980         hci_dev_unlock(hdev);
1981         return err;
1982 }
1983
1984 /* This is a helper function to test for pending mgmt commands that can
1985  * cause CoD or EIR HCI commands. We can only allow one such pending
1986  * mgmt command at a time since otherwise we cannot easily track what
1987  * the current values are, will be, and based on that calculate if a new
1988  * HCI command needs to be sent and if yes with what value.
1989  */
1990 static bool pending_eir_or_class(struct hci_dev *hdev)
1991 {
1992         struct mgmt_pending_cmd *cmd;
1993
1994         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1995                 switch (cmd->opcode) {
1996                 case MGMT_OP_ADD_UUID:
1997                 case MGMT_OP_REMOVE_UUID:
1998                 case MGMT_OP_SET_DEV_CLASS:
1999                 case MGMT_OP_SET_POWERED:
2000                         return true;
2001                 }
2002         }
2003
2004         return false;
2005 }
2006
2007 static const u8 bluetooth_base_uuid[] = {
2008                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2009                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2010 };
2011
2012 static u8 get_uuid_size(const u8 *uuid)
2013 {
2014         u32 val;
2015
2016         if (memcmp(uuid, bluetooth_base_uuid, 12))
2017                 return 128;
2018
2019         val = get_unaligned_le32(&uuid[12]);
2020         if (val > 0xffff)
2021                 return 32;
2022
2023         return 16;
2024 }
2025
2026 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2027 {
2028         struct mgmt_pending_cmd *cmd;
2029
2030         hci_dev_lock(hdev);
2031
2032         cmd = pending_find(mgmt_op, hdev);
2033         if (!cmd)
2034                 goto unlock;
2035
2036         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2037                           mgmt_status(status), hdev->dev_class, 3);
2038
2039         mgmt_pending_remove(cmd);
2040
2041 unlock:
2042         hci_dev_unlock(hdev);
2043 }
2044
2045 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2046 {
2047         BT_DBG("status 0x%02x", status);
2048
2049         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2050 }
2051
2052 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2053 {
2054         struct mgmt_cp_add_uuid *cp = data;
2055         struct mgmt_pending_cmd *cmd;
2056         struct hci_request req;
2057         struct bt_uuid *uuid;
2058         int err;
2059
2060         BT_DBG("request for %s", hdev->name);
2061
2062         hci_dev_lock(hdev);
2063
2064         if (pending_eir_or_class(hdev)) {
2065                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2066                                       MGMT_STATUS_BUSY);
2067                 goto failed;
2068         }
2069
2070         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2071         if (!uuid) {
2072                 err = -ENOMEM;
2073                 goto failed;
2074         }
2075
2076         memcpy(uuid->uuid, cp->uuid, 16);
2077         uuid->svc_hint = cp->svc_hint;
2078         uuid->size = get_uuid_size(cp->uuid);
2079
2080         list_add_tail(&uuid->list, &hdev->uuids);
2081
2082         hci_req_init(&req, hdev);
2083
2084         __hci_req_update_class(&req);
2085         __hci_req_update_eir(&req);
2086
2087         err = hci_req_run(&req, add_uuid_complete);
2088         if (err < 0) {
2089                 if (err != -ENODATA)
2090                         goto failed;
2091
2092                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2093                                         hdev->dev_class, 3);
2094                 goto failed;
2095         }
2096
2097         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2098         if (!cmd) {
2099                 err = -ENOMEM;
2100                 goto failed;
2101         }
2102
2103         err = 0;
2104
2105 failed:
2106         hci_dev_unlock(hdev);
2107         return err;
2108 }
2109
2110 static bool enable_service_cache(struct hci_dev *hdev)
2111 {
2112         if (!hdev_is_powered(hdev))
2113                 return false;
2114
2115         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2116                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2117                                    CACHE_TIMEOUT);
2118                 return true;
2119         }
2120
2121         return false;
2122 }
2123
2124 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2125 {
2126         BT_DBG("status 0x%02x", status);
2127
2128         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2129 }
2130
2131 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2132                        u16 len)
2133 {
2134         struct mgmt_cp_remove_uuid *cp = data;
2135         struct mgmt_pending_cmd *cmd;
2136         struct bt_uuid *match, *tmp;
2137         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2138         struct hci_request req;
2139         int err, found;
2140
2141         BT_DBG("request for %s", hdev->name);
2142
2143         hci_dev_lock(hdev);
2144
2145         if (pending_eir_or_class(hdev)) {
2146                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2147                                       MGMT_STATUS_BUSY);
2148                 goto unlock;
2149         }
2150
2151         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2152                 hci_uuids_clear(hdev);
2153
2154                 if (enable_service_cache(hdev)) {
2155                         err = mgmt_cmd_complete(sk, hdev->id,
2156                                                 MGMT_OP_REMOVE_UUID,
2157                                                 0, hdev->dev_class, 3);
2158                         goto unlock;
2159                 }
2160
2161                 goto update_class;
2162         }
2163
2164         found = 0;
2165
2166         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2167                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2168                         continue;
2169
2170                 list_del(&match->list);
2171                 kfree(match);
2172                 found++;
2173         }
2174
2175         if (found == 0) {
2176                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2177                                       MGMT_STATUS_INVALID_PARAMS);
2178                 goto unlock;
2179         }
2180
2181 update_class:
2182         hci_req_init(&req, hdev);
2183
2184         __hci_req_update_class(&req);
2185         __hci_req_update_eir(&req);
2186
2187         err = hci_req_run(&req, remove_uuid_complete);
2188         if (err < 0) {
2189                 if (err != -ENODATA)
2190                         goto unlock;
2191
2192                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2193                                         hdev->dev_class, 3);
2194                 goto unlock;
2195         }
2196
2197         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2198         if (!cmd) {
2199                 err = -ENOMEM;
2200                 goto unlock;
2201         }
2202
2203         err = 0;
2204
2205 unlock:
2206         hci_dev_unlock(hdev);
2207         return err;
2208 }
2209
2210 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2211 {
2212         BT_DBG("status 0x%02x", status);
2213
2214         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2215 }
2216
2217 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2218                          u16 len)
2219 {
2220         struct mgmt_cp_set_dev_class *cp = data;
2221         struct mgmt_pending_cmd *cmd;
2222         struct hci_request req;
2223         int err;
2224
2225         BT_DBG("request for %s", hdev->name);
2226
2227         if (!lmp_bredr_capable(hdev))
2228                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2229                                        MGMT_STATUS_NOT_SUPPORTED);
2230
2231         hci_dev_lock(hdev);
2232
2233         if (pending_eir_or_class(hdev)) {
2234                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2235                                       MGMT_STATUS_BUSY);
2236                 goto unlock;
2237         }
2238
2239         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2240                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2241                                       MGMT_STATUS_INVALID_PARAMS);
2242                 goto unlock;
2243         }
2244
2245         hdev->major_class = cp->major;
2246         hdev->minor_class = cp->minor;
2247
2248         if (!hdev_is_powered(hdev)) {
2249                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2250                                         hdev->dev_class, 3);
2251                 goto unlock;
2252         }
2253
2254         hci_req_init(&req, hdev);
2255
2256         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2257                 hci_dev_unlock(hdev);
2258                 cancel_delayed_work_sync(&hdev->service_cache);
2259                 hci_dev_lock(hdev);
2260                 __hci_req_update_eir(&req);
2261         }
2262
2263         __hci_req_update_class(&req);
2264
2265         err = hci_req_run(&req, set_class_complete);
2266         if (err < 0) {
2267                 if (err != -ENODATA)
2268                         goto unlock;
2269
2270                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2271                                         hdev->dev_class, 3);
2272                 goto unlock;
2273         }
2274
2275         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2276         if (!cmd) {
2277                 err = -ENOMEM;
2278                 goto unlock;
2279         }
2280
2281         err = 0;
2282
2283 unlock:
2284         hci_dev_unlock(hdev);
2285         return err;
2286 }
2287
2288 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2289                           u16 len)
2290 {
2291         struct mgmt_cp_load_link_keys *cp = data;
2292         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2293                                    sizeof(struct mgmt_link_key_info));
2294         u16 key_count, expected_len;
2295         bool changed;
2296         int i;
2297
2298         BT_DBG("request for %s", hdev->name);
2299
2300         if (!lmp_bredr_capable(hdev))
2301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2302                                        MGMT_STATUS_NOT_SUPPORTED);
2303
2304         key_count = __le16_to_cpu(cp->key_count);
2305         if (key_count > max_key_count) {
2306                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2307                            key_count);
2308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309                                        MGMT_STATUS_INVALID_PARAMS);
2310         }
2311
2312         expected_len = struct_size(cp, keys, key_count);
2313         if (expected_len != len) {
2314                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2315                            expected_len, len);
2316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2317                                        MGMT_STATUS_INVALID_PARAMS);
2318         }
2319
2320         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2322                                        MGMT_STATUS_INVALID_PARAMS);
2323
2324         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2325                key_count);
2326
2327         for (i = 0; i < key_count; i++) {
2328                 struct mgmt_link_key_info *key = &cp->keys[i];
2329
2330                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2331                         return mgmt_cmd_status(sk, hdev->id,
2332                                                MGMT_OP_LOAD_LINK_KEYS,
2333                                                MGMT_STATUS_INVALID_PARAMS);
2334         }
2335
2336         hci_dev_lock(hdev);
2337
2338         hci_link_keys_clear(hdev);
2339
2340         if (cp->debug_keys)
2341                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2342         else
2343                 changed = hci_dev_test_and_clear_flag(hdev,
2344                                                       HCI_KEEP_DEBUG_KEYS);
2345
2346         if (changed)
2347                 new_settings(hdev, NULL);
2348
2349         for (i = 0; i < key_count; i++) {
2350                 struct mgmt_link_key_info *key = &cp->keys[i];
2351
2352                 /* Always ignore debug keys and require a new pairing if
2353                  * the user wants to use them.
2354                  */
2355                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2356                         continue;
2357
2358                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2359                                  key->type, key->pin_len, NULL);
2360         }
2361
2362         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2363
2364         hci_dev_unlock(hdev);
2365
2366         return 0;
2367 }
2368
2369 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2370                            u8 addr_type, struct sock *skip_sk)
2371 {
2372         struct mgmt_ev_device_unpaired ev;
2373
2374         bacpy(&ev.addr.bdaddr, bdaddr);
2375         ev.addr.type = addr_type;
2376
2377         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2378                           skip_sk);
2379 }
2380
2381 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2382                          u16 len)
2383 {
2384         struct mgmt_cp_unpair_device *cp = data;
2385         struct mgmt_rp_unpair_device rp;
2386         struct hci_conn_params *params;
2387         struct mgmt_pending_cmd *cmd;
2388         struct hci_conn *conn;
2389         u8 addr_type;
2390         int err;
2391
2392         memset(&rp, 0, sizeof(rp));
2393         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2394         rp.addr.type = cp->addr.type;
2395
2396         if (!bdaddr_type_is_valid(cp->addr.type))
2397                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2398                                          MGMT_STATUS_INVALID_PARAMS,
2399                                          &rp, sizeof(rp));
2400
2401         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2402                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2403                                          MGMT_STATUS_INVALID_PARAMS,
2404                                          &rp, sizeof(rp));
2405
2406         hci_dev_lock(hdev);
2407
2408         if (!hdev_is_powered(hdev)) {
2409                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2410                                         MGMT_STATUS_NOT_POWERED, &rp,
2411                                         sizeof(rp));
2412                 goto unlock;
2413         }
2414
2415         if (cp->addr.type == BDADDR_BREDR) {
2416                 /* If disconnection is requested, then look up the
2417                  * connection. If the remote device is connected, it
2418                  * will be later used to terminate the link.
2419                  *
2420                  * Setting it to NULL explicitly will cause no
2421                  * termination of the link.
2422                  */
2423                 if (cp->disconnect)
2424                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2425                                                        &cp->addr.bdaddr);
2426                 else
2427                         conn = NULL;
2428
2429                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2430                 if (err < 0) {
2431                         err = mgmt_cmd_complete(sk, hdev->id,
2432                                                 MGMT_OP_UNPAIR_DEVICE,
2433                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2434                                                 sizeof(rp));
2435                         goto unlock;
2436                 }
2437
2438                 goto done;
2439         }
2440
2441         /* LE address type */
2442         addr_type = le_addr_type(cp->addr.type);
2443
2444         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2445         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2446         if (err < 0) {
2447                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2448                                         MGMT_STATUS_NOT_PAIRED, &rp,
2449                                         sizeof(rp));
2450                 goto unlock;
2451         }
2452
2453         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2454         if (!conn) {
2455                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2456                 goto done;
2457         }
2458
2459
2460         /* Defer clearing up the connection parameters until closing to
2461          * give a chance of keeping them if a repairing happens.
2462          */
2463         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2464
2465         /* Disable auto-connection parameters if present */
2466         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2467         if (params) {
2468                 if (params->explicit_connect)
2469                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2470                 else
2471                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2472         }
2473
2474         /* If disconnection is not requested, then clear the connection
2475          * variable so that the link is not terminated.
2476          */
2477         if (!cp->disconnect)
2478                 conn = NULL;
2479
2480 done:
2481         /* If the connection variable is set, then termination of the
2482          * link is requested.
2483          */
2484         if (!conn) {
2485                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2486                                         &rp, sizeof(rp));
2487                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2488                 goto unlock;
2489         }
2490
2491         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2492                                sizeof(*cp));
2493         if (!cmd) {
2494                 err = -ENOMEM;
2495                 goto unlock;
2496         }
2497
2498         cmd->cmd_complete = addr_cmd_complete;
2499
2500         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2501         if (err < 0)
2502                 mgmt_pending_remove(cmd);
2503
2504 unlock:
2505         hci_dev_unlock(hdev);
2506         return err;
2507 }
2508
2509 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2510                       u16 len)
2511 {
2512         struct mgmt_cp_disconnect *cp = data;
2513         struct mgmt_rp_disconnect rp;
2514         struct mgmt_pending_cmd *cmd;
2515         struct hci_conn *conn;
2516         int err;
2517
2518         BT_DBG("");
2519
2520         memset(&rp, 0, sizeof(rp));
2521         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2522         rp.addr.type = cp->addr.type;
2523
2524         if (!bdaddr_type_is_valid(cp->addr.type))
2525                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2526                                          MGMT_STATUS_INVALID_PARAMS,
2527                                          &rp, sizeof(rp));
2528
2529         hci_dev_lock(hdev);
2530
2531         if (!test_bit(HCI_UP, &hdev->flags)) {
2532                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2533                                         MGMT_STATUS_NOT_POWERED, &rp,
2534                                         sizeof(rp));
2535                 goto failed;
2536         }
2537
2538         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2539                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2540                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2541                 goto failed;
2542         }
2543
2544         if (cp->addr.type == BDADDR_BREDR)
2545                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2546                                                &cp->addr.bdaddr);
2547         else
2548                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2549                                                le_addr_type(cp->addr.type));
2550
2551         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2552                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2553                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2554                                         sizeof(rp));
2555                 goto failed;
2556         }
2557
2558         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2559         if (!cmd) {
2560                 err = -ENOMEM;
2561                 goto failed;
2562         }
2563
2564         cmd->cmd_complete = generic_cmd_complete;
2565
2566         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2567         if (err < 0)
2568                 mgmt_pending_remove(cmd);
2569
2570 failed:
2571         hci_dev_unlock(hdev);
2572         return err;
2573 }
2574
2575 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2576 {
2577         switch (link_type) {
2578         case LE_LINK:
2579                 switch (addr_type) {
2580                 case ADDR_LE_DEV_PUBLIC:
2581                         return BDADDR_LE_PUBLIC;
2582
2583                 default:
2584                         /* Fallback to LE Random address type */
2585                         return BDADDR_LE_RANDOM;
2586                 }
2587
2588         default:
2589                 /* Fallback to BR/EDR type */
2590                 return BDADDR_BREDR;
2591         }
2592 }
2593
2594 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2595                            u16 data_len)
2596 {
2597         struct mgmt_rp_get_connections *rp;
2598         struct hci_conn *c;
2599         int err;
2600         u16 i;
2601
2602         BT_DBG("");
2603
2604         hci_dev_lock(hdev);
2605
2606         if (!hdev_is_powered(hdev)) {
2607                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2608                                       MGMT_STATUS_NOT_POWERED);
2609                 goto unlock;
2610         }
2611
2612         i = 0;
2613         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2614                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2615                         i++;
2616         }
2617
2618         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2619         if (!rp) {
2620                 err = -ENOMEM;
2621                 goto unlock;
2622         }
2623
2624         i = 0;
2625         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2626                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2627                         continue;
2628                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2629                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2630                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2631                         continue;
2632                 i++;
2633         }
2634
2635         rp->conn_count = cpu_to_le16(i);
2636
2637         /* Recalculate length in case of filtered SCO connections, etc */
2638         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639                                 struct_size(rp, addr, i));
2640
2641         kfree(rp);
2642
2643 unlock:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649                                    struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651         struct mgmt_pending_cmd *cmd;
2652         int err;
2653
2654         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655                                sizeof(*cp));
2656         if (!cmd)
2657                 return -ENOMEM;
2658
2659         cmd->cmd_complete = addr_cmd_complete;
2660
2661         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2662                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2663         if (err < 0)
2664                 mgmt_pending_remove(cmd);
2665
2666         return err;
2667 }
2668
2669 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2670                           u16 len)
2671 {
2672         struct hci_conn *conn;
2673         struct mgmt_cp_pin_code_reply *cp = data;
2674         struct hci_cp_pin_code_reply reply;
2675         struct mgmt_pending_cmd *cmd;
2676         int err;
2677
2678         BT_DBG("");
2679
2680         hci_dev_lock(hdev);
2681
2682         if (!hdev_is_powered(hdev)) {
2683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2684                                       MGMT_STATUS_NOT_POWERED);
2685                 goto failed;
2686         }
2687
2688         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2689         if (!conn) {
2690                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2691                                       MGMT_STATUS_NOT_CONNECTED);
2692                 goto failed;
2693         }
2694
2695         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2696                 struct mgmt_cp_pin_code_neg_reply ncp;
2697
2698                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2699
2700                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2701
2702                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2703                 if (err >= 0)
2704                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2705                                               MGMT_STATUS_INVALID_PARAMS);
2706
2707                 goto failed;
2708         }
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2711         if (!cmd) {
2712                 err = -ENOMEM;
2713                 goto failed;
2714         }
2715
2716         cmd->cmd_complete = addr_cmd_complete;
2717
2718         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2719         reply.pin_len = cp->pin_len;
2720         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2721
2722         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2723         if (err < 0)
2724                 mgmt_pending_remove(cmd);
2725
2726 failed:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2732                              u16 len)
2733 {
2734         struct mgmt_cp_set_io_capability *cp = data;
2735
2736         BT_DBG("");
2737
2738         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2740                                        MGMT_STATUS_INVALID_PARAMS);
2741
2742         hci_dev_lock(hdev);
2743
2744         hdev->io_capability = cp->io_capability;
2745
2746         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2747                hdev->io_capability);
2748
2749         hci_dev_unlock(hdev);
2750
2751         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2752                                  NULL, 0);
2753 }
2754
2755 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2756 {
2757         struct hci_dev *hdev = conn->hdev;
2758         struct mgmt_pending_cmd *cmd;
2759
2760         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2761                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2762                         continue;
2763
2764                 if (cmd->user_data != conn)
2765                         continue;
2766
2767                 return cmd;
2768         }
2769
2770         return NULL;
2771 }
2772
2773 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2774 {
2775         struct mgmt_rp_pair_device rp;
2776         struct hci_conn *conn = cmd->user_data;
2777         int err;
2778
2779         bacpy(&rp.addr.bdaddr, &conn->dst);
2780         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2781
2782         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2783                                 status, &rp, sizeof(rp));
2784
2785         /* So we don't get further callbacks for this connection */
2786         conn->connect_cfm_cb = NULL;
2787         conn->security_cfm_cb = NULL;
2788         conn->disconn_cfm_cb = NULL;
2789
2790         hci_conn_drop(conn);
2791
2792         /* The device is paired so there is no need to remove
2793          * its connection parameters anymore.
2794          */
2795         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2796
2797         hci_conn_put(conn);
2798
2799         return err;
2800 }
2801
2802 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2803 {
2804         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2805         struct mgmt_pending_cmd *cmd;
2806
2807         cmd = find_pairing(conn);
2808         if (cmd) {
2809                 cmd->cmd_complete(cmd, status);
2810                 mgmt_pending_remove(cmd);
2811         }
2812 }
2813
2814 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2815 {
2816         struct mgmt_pending_cmd *cmd;
2817
2818         BT_DBG("status %u", status);
2819
2820         cmd = find_pairing(conn);
2821         if (!cmd) {
2822                 BT_DBG("Unable to find a pending command");
2823                 return;
2824         }
2825
2826         cmd->cmd_complete(cmd, mgmt_status(status));
2827         mgmt_pending_remove(cmd);
2828 }
2829
2830 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2831 {
2832         struct mgmt_pending_cmd *cmd;
2833
2834         BT_DBG("status %u", status);
2835
2836         if (!status)
2837                 return;
2838
2839         cmd = find_pairing(conn);
2840         if (!cmd) {
2841                 BT_DBG("Unable to find a pending command");
2842                 return;
2843         }
2844
2845         cmd->cmd_complete(cmd, mgmt_status(status));
2846         mgmt_pending_remove(cmd);
2847 }
2848
2849 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2850                        u16 len)
2851 {
2852         struct mgmt_cp_pair_device *cp = data;
2853         struct mgmt_rp_pair_device rp;
2854         struct mgmt_pending_cmd *cmd;
2855         u8 sec_level, auth_type;
2856         struct hci_conn *conn;
2857         int err;
2858
2859         BT_DBG("");
2860
2861         memset(&rp, 0, sizeof(rp));
2862         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2863         rp.addr.type = cp->addr.type;
2864
2865         if (!bdaddr_type_is_valid(cp->addr.type))
2866                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867                                          MGMT_STATUS_INVALID_PARAMS,
2868                                          &rp, sizeof(rp));
2869
2870         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2871                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2872                                          MGMT_STATUS_INVALID_PARAMS,
2873                                          &rp, sizeof(rp));
2874
2875         hci_dev_lock(hdev);
2876
2877         if (!hdev_is_powered(hdev)) {
2878                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2879                                         MGMT_STATUS_NOT_POWERED, &rp,
2880                                         sizeof(rp));
2881                 goto unlock;
2882         }
2883
2884         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2885                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2886                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2887                                         sizeof(rp));
2888                 goto unlock;
2889         }
2890
2891         sec_level = BT_SECURITY_MEDIUM;
2892         auth_type = HCI_AT_DEDICATED_BONDING;
2893
2894         if (cp->addr.type == BDADDR_BREDR) {
2895                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2896                                        auth_type);
2897         } else {
2898                 u8 addr_type = le_addr_type(cp->addr.type);
2899                 struct hci_conn_params *p;
2900
2901                 /* When pairing a new device, it is expected to remember
2902                  * this device for future connections. Adding the connection
2903                  * parameter information ahead of time allows tracking
2904                  * of the slave preferred values and will speed up any
2905                  * further connection establishment.
2906                  *
2907                  * If connection parameters already exist, then they
2908                  * will be kept and this function does nothing.
2909                  */
2910                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2911
2912                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2913                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2914
2915                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2916                                            addr_type, sec_level,
2917                                            HCI_LE_CONN_TIMEOUT);
2918         }
2919
2920         if (IS_ERR(conn)) {
2921                 int status;
2922
2923                 if (PTR_ERR(conn) == -EBUSY)
2924                         status = MGMT_STATUS_BUSY;
2925                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2926                         status = MGMT_STATUS_NOT_SUPPORTED;
2927                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2928                         status = MGMT_STATUS_REJECTED;
2929                 else
2930                         status = MGMT_STATUS_CONNECT_FAILED;
2931
2932                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933                                         status, &rp, sizeof(rp));
2934                 goto unlock;
2935         }
2936
2937         if (conn->connect_cfm_cb) {
2938                 hci_conn_drop(conn);
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2941                 goto unlock;
2942         }
2943
2944         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2945         if (!cmd) {
2946                 err = -ENOMEM;
2947                 hci_conn_drop(conn);
2948                 goto unlock;
2949         }
2950
2951         cmd->cmd_complete = pairing_complete;
2952
2953         /* For LE, just connecting isn't a proof that the pairing finished */
2954         if (cp->addr.type == BDADDR_BREDR) {
2955                 conn->connect_cfm_cb = pairing_complete_cb;
2956                 conn->security_cfm_cb = pairing_complete_cb;
2957                 conn->disconn_cfm_cb = pairing_complete_cb;
2958         } else {
2959                 conn->connect_cfm_cb = le_pairing_complete_cb;
2960                 conn->security_cfm_cb = le_pairing_complete_cb;
2961                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2962         }
2963
2964         conn->io_capability = cp->io_cap;
2965         cmd->user_data = hci_conn_get(conn);
2966
2967         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2968             hci_conn_security(conn, sec_level, auth_type, true)) {
2969                 cmd->cmd_complete(cmd, 0);
2970                 mgmt_pending_remove(cmd);
2971         }
2972
2973         err = 0;
2974
2975 unlock:
2976         hci_dev_unlock(hdev);
2977         return err;
2978 }
2979
2980 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981                               u16 len)
2982 {
2983         struct mgmt_addr_info *addr = data;
2984         struct mgmt_pending_cmd *cmd;
2985         struct hci_conn *conn;
2986         int err;
2987
2988         BT_DBG("");
2989
2990         hci_dev_lock(hdev);
2991
2992         if (!hdev_is_powered(hdev)) {
2993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2994                                       MGMT_STATUS_NOT_POWERED);
2995                 goto unlock;
2996         }
2997
2998         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2999         if (!cmd) {
3000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001                                       MGMT_STATUS_INVALID_PARAMS);
3002                 goto unlock;
3003         }
3004
3005         conn = cmd->user_data;
3006
3007         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3009                                       MGMT_STATUS_INVALID_PARAMS);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3014         mgmt_pending_remove(cmd);
3015
3016         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3017                                 addr, sizeof(*addr));
3018 unlock:
3019         hci_dev_unlock(hdev);
3020         return err;
3021 }
3022
3023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3024                              struct mgmt_addr_info *addr, u16 mgmt_op,
3025                              u16 hci_op, __le32 passkey)
3026 {
3027         struct mgmt_pending_cmd *cmd;
3028         struct hci_conn *conn;
3029         int err;
3030
3031         hci_dev_lock(hdev);
3032
3033         if (!hdev_is_powered(hdev)) {
3034                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3035                                         MGMT_STATUS_NOT_POWERED, addr,
3036                                         sizeof(*addr));
3037                 goto done;
3038         }
3039
3040         if (addr->type == BDADDR_BREDR)
3041                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3042         else
3043                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3044                                                le_addr_type(addr->type));
3045
3046         if (!conn) {
3047                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3048                                         MGMT_STATUS_NOT_CONNECTED, addr,
3049                                         sizeof(*addr));
3050                 goto done;
3051         }
3052
3053         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3054                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3055                 if (!err)
3056                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3057                                                 MGMT_STATUS_SUCCESS, addr,
3058                                                 sizeof(*addr));
3059                 else
3060                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3061                                                 MGMT_STATUS_FAILED, addr,
3062                                                 sizeof(*addr));
3063
3064                 goto done;
3065         }
3066
3067         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3068         if (!cmd) {
3069                 err = -ENOMEM;
3070                 goto done;
3071         }
3072
3073         cmd->cmd_complete = addr_cmd_complete;
3074
3075         /* Continue with pairing via HCI */
3076         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3077                 struct hci_cp_user_passkey_reply cp;
3078
3079                 bacpy(&cp.bdaddr, &addr->bdaddr);
3080                 cp.passkey = passkey;
3081                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3082         } else
3083                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3084                                    &addr->bdaddr);
3085
3086         if (err < 0)
3087                 mgmt_pending_remove(cmd);
3088
3089 done:
3090         hci_dev_unlock(hdev);
3091         return err;
3092 }
3093
3094 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3095                               void *data, u16 len)
3096 {
3097         struct mgmt_cp_pin_code_neg_reply *cp = data;
3098
3099         BT_DBG("");
3100
3101         return user_pairing_resp(sk, hdev, &cp->addr,
3102                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3103                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3104 }
3105
3106 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3107                               u16 len)
3108 {
3109         struct mgmt_cp_user_confirm_reply *cp = data;
3110
3111         BT_DBG("");
3112
3113         if (len != sizeof(*cp))
3114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3115                                        MGMT_STATUS_INVALID_PARAMS);
3116
3117         return user_pairing_resp(sk, hdev, &cp->addr,
3118                                  MGMT_OP_USER_CONFIRM_REPLY,
3119                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3120 }
3121
3122 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3123                                   void *data, u16 len)
3124 {
3125         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3126
3127         BT_DBG("");
3128
3129         return user_pairing_resp(sk, hdev, &cp->addr,
3130                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3131                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3132 }
3133
3134 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3135                               u16 len)
3136 {
3137         struct mgmt_cp_user_passkey_reply *cp = data;
3138
3139         BT_DBG("");
3140
3141         return user_pairing_resp(sk, hdev, &cp->addr,
3142                                  MGMT_OP_USER_PASSKEY_REPLY,
3143                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3144 }
3145
3146 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3147                                   void *data, u16 len)
3148 {
3149         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3150
3151         BT_DBG("");
3152
3153         return user_pairing_resp(sk, hdev, &cp->addr,
3154                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3155                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3156 }
3157
3158 static void adv_expire(struct hci_dev *hdev, u32 flags)
3159 {
3160         struct adv_info *adv_instance;
3161         struct hci_request req;
3162         int err;
3163
3164         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3165         if (!adv_instance)
3166                 return;
3167
3168         /* stop if current instance doesn't need to be changed */
3169         if (!(adv_instance->flags & flags))
3170                 return;
3171
3172         cancel_adv_timeout(hdev);
3173
3174         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3175         if (!adv_instance)
3176                 return;
3177
3178         hci_req_init(&req, hdev);
3179         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3180                                               true);
3181         if (err)
3182                 return;
3183
3184         hci_req_run(&req, NULL);
3185 }
3186
3187 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3188 {
3189         struct mgmt_cp_set_local_name *cp;
3190         struct mgmt_pending_cmd *cmd;
3191
3192         BT_DBG("status 0x%02x", status);
3193
3194         hci_dev_lock(hdev);
3195
3196         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3197         if (!cmd)
3198                 goto unlock;
3199
3200         cp = cmd->param;
3201
3202         if (status) {
3203                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3204                                 mgmt_status(status));
3205         } else {
3206                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3207                                   cp, sizeof(*cp));
3208
3209                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3210                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3211         }
3212
3213         mgmt_pending_remove(cmd);
3214
3215 unlock:
3216         hci_dev_unlock(hdev);
3217 }
3218
3219 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3220                           u16 len)
3221 {
3222         struct mgmt_cp_set_local_name *cp = data;
3223         struct mgmt_pending_cmd *cmd;
3224         struct hci_request req;
3225         int err;
3226
3227         BT_DBG("");
3228
3229         hci_dev_lock(hdev);
3230
3231         /* If the old values are the same as the new ones just return a
3232          * direct command complete event.
3233          */
3234         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3235             !memcmp(hdev->short_name, cp->short_name,
3236                     sizeof(hdev->short_name))) {
3237                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3238                                         data, len);
3239                 goto failed;
3240         }
3241
3242         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3243
3244         if (!hdev_is_powered(hdev)) {
3245                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3246
3247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3248                                         data, len);
3249                 if (err < 0)
3250                         goto failed;
3251
3252                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3253                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3254                 ext_info_changed(hdev, sk);
3255
3256                 goto failed;
3257         }
3258
3259         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3260         if (!cmd) {
3261                 err = -ENOMEM;
3262                 goto failed;
3263         }
3264
3265         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3266
3267         hci_req_init(&req, hdev);
3268
3269         if (lmp_bredr_capable(hdev)) {
3270                 __hci_req_update_name(&req);
3271                 __hci_req_update_eir(&req);
3272         }
3273
3274         /* The name is stored in the scan response data and so
3275          * no need to udpate the advertising data here.
3276          */
3277         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3278                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3279
3280         err = hci_req_run(&req, set_name_complete);
3281         if (err < 0)
3282                 mgmt_pending_remove(cmd);
3283
3284 failed:
3285         hci_dev_unlock(hdev);
3286         return err;
3287 }
3288
3289 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3290                           u16 len)
3291 {
3292         struct mgmt_cp_set_appearance *cp = data;
3293         u16 apperance;
3294         int err;
3295
3296         BT_DBG("");
3297
3298         if (!lmp_le_capable(hdev))
3299                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3300                                        MGMT_STATUS_NOT_SUPPORTED);
3301
3302         apperance = le16_to_cpu(cp->appearance);
3303
3304         hci_dev_lock(hdev);
3305
3306         if (hdev->appearance != apperance) {
3307                 hdev->appearance = apperance;
3308
3309                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3310                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3311
3312                 ext_info_changed(hdev, sk);
3313         }
3314
3315         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3316                                 0);
3317
3318         hci_dev_unlock(hdev);
3319
3320         return err;
3321 }
3322
3323 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3324                                  void *data, u16 len)
3325 {
3326         struct mgmt_rp_get_phy_confguration rp;
3327
3328         BT_DBG("sock %p %s", sk, hdev->name);
3329
3330         hci_dev_lock(hdev);
3331
3332         memset(&rp, 0, sizeof(rp));
3333
3334         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3335         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3336         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3337
3338         hci_dev_unlock(hdev);
3339
3340         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3341                                  &rp, sizeof(rp));
3342 }
3343
3344 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3345 {
3346         struct mgmt_ev_phy_configuration_changed ev;
3347
3348         memset(&ev, 0, sizeof(ev));
3349
3350         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3351
3352         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3353                           sizeof(ev), skip);
3354 }
3355
3356 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3357                                      u16 opcode, struct sk_buff *skb)
3358 {
3359         struct mgmt_pending_cmd *cmd;
3360
3361         BT_DBG("status 0x%02x", status);
3362
3363         hci_dev_lock(hdev);
3364
3365         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3366         if (!cmd)
3367                 goto unlock;
3368
3369         if (status) {
3370                 mgmt_cmd_status(cmd->sk, hdev->id,
3371                                 MGMT_OP_SET_PHY_CONFIGURATION,
3372                                 mgmt_status(status));
3373         } else {
3374                 mgmt_cmd_complete(cmd->sk, hdev->id,
3375                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3376                                   NULL, 0);
3377
3378                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3379         }
3380
3381         mgmt_pending_remove(cmd);
3382
3383 unlock:
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3388                                  void *data, u16 len)
3389 {
3390         struct mgmt_cp_set_phy_confguration *cp = data;
3391         struct hci_cp_le_set_default_phy cp_phy;
3392         struct mgmt_pending_cmd *cmd;
3393         struct hci_request req;
3394         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3395         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3396         bool changed = false;
3397         int err;
3398
3399         BT_DBG("sock %p %s", sk, hdev->name);
3400
3401         configurable_phys = get_configurable_phys(hdev);
3402         supported_phys = get_supported_phys(hdev);
3403         selected_phys = __le32_to_cpu(cp->selected_phys);
3404
3405         if (selected_phys & ~supported_phys)
3406                 return mgmt_cmd_status(sk, hdev->id,
3407                                        MGMT_OP_SET_PHY_CONFIGURATION,
3408                                        MGMT_STATUS_INVALID_PARAMS);
3409
3410         unconfigure_phys = supported_phys & ~configurable_phys;
3411
3412         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3413                 return mgmt_cmd_status(sk, hdev->id,
3414                                        MGMT_OP_SET_PHY_CONFIGURATION,
3415                                        MGMT_STATUS_INVALID_PARAMS);
3416
3417         if (selected_phys == get_selected_phys(hdev))
3418                 return mgmt_cmd_complete(sk, hdev->id,
3419                                          MGMT_OP_SET_PHY_CONFIGURATION,
3420                                          0, NULL, 0);
3421
3422         hci_dev_lock(hdev);
3423
3424         if (!hdev_is_powered(hdev)) {
3425                 err = mgmt_cmd_status(sk, hdev->id,
3426                                       MGMT_OP_SET_PHY_CONFIGURATION,
3427                                       MGMT_STATUS_REJECTED);
3428                 goto unlock;
3429         }
3430
3431         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3432                 err = mgmt_cmd_status(sk, hdev->id,
3433                                       MGMT_OP_SET_PHY_CONFIGURATION,
3434                                       MGMT_STATUS_BUSY);
3435                 goto unlock;
3436         }
3437
3438         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3439                 pkt_type |= (HCI_DH3 | HCI_DM3);
3440         else
3441                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3442
3443         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3444                 pkt_type |= (HCI_DH5 | HCI_DM5);
3445         else
3446                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3447
3448         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3449                 pkt_type &= ~HCI_2DH1;
3450         else
3451                 pkt_type |= HCI_2DH1;
3452
3453         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3454                 pkt_type &= ~HCI_2DH3;
3455         else
3456                 pkt_type |= HCI_2DH3;
3457
3458         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3459                 pkt_type &= ~HCI_2DH5;
3460         else
3461                 pkt_type |= HCI_2DH5;
3462
3463         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3464                 pkt_type &= ~HCI_3DH1;
3465         else
3466                 pkt_type |= HCI_3DH1;
3467
3468         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3469                 pkt_type &= ~HCI_3DH3;
3470         else
3471                 pkt_type |= HCI_3DH3;
3472
3473         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3474                 pkt_type &= ~HCI_3DH5;
3475         else
3476                 pkt_type |= HCI_3DH5;
3477
3478         if (pkt_type != hdev->pkt_type) {
3479                 hdev->pkt_type = pkt_type;
3480                 changed = true;
3481         }
3482
3483         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3484             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3485                 if (changed)
3486                         mgmt_phy_configuration_changed(hdev, sk);
3487
3488                 err = mgmt_cmd_complete(sk, hdev->id,
3489                                         MGMT_OP_SET_PHY_CONFIGURATION,
3490                                         0, NULL, 0);
3491
3492                 goto unlock;
3493         }
3494
3495         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3496                                len);
3497         if (!cmd) {
3498                 err = -ENOMEM;
3499                 goto unlock;
3500         }
3501
3502         hci_req_init(&req, hdev);
3503
3504         memset(&cp_phy, 0, sizeof(cp_phy));
3505
3506         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3507                 cp_phy.all_phys |= 0x01;
3508
3509         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3510                 cp_phy.all_phys |= 0x02;
3511
3512         if (selected_phys & MGMT_PHY_LE_1M_TX)
3513                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3514
3515         if (selected_phys & MGMT_PHY_LE_2M_TX)
3516                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3517
3518         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3519                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3520
3521         if (selected_phys & MGMT_PHY_LE_1M_RX)
3522                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3523
3524         if (selected_phys & MGMT_PHY_LE_2M_RX)
3525                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3526
3527         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3528                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3529
3530         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3531
3532         err = hci_req_run_skb(&req, set_default_phy_complete);
3533         if (err < 0)
3534                 mgmt_pending_remove(cmd);
3535
3536 unlock:
3537         hci_dev_unlock(hdev);
3538
3539         return err;
3540 }
3541
3542 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3543                                          u16 opcode, struct sk_buff *skb)
3544 {
3545         struct mgmt_rp_read_local_oob_data mgmt_rp;
3546         size_t rp_size = sizeof(mgmt_rp);
3547         struct mgmt_pending_cmd *cmd;
3548
3549         BT_DBG("%s status %u", hdev->name, status);
3550
3551         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3552         if (!cmd)
3553                 return;
3554
3555         if (status || !skb) {
3556                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3557                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3558                 goto remove;
3559         }
3560
3561         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3562
3563         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3564                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3565
3566                 if (skb->len < sizeof(*rp)) {
3567                         mgmt_cmd_status(cmd->sk, hdev->id,
3568                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3569                                         MGMT_STATUS_FAILED);
3570                         goto remove;
3571                 }
3572
3573                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3574                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3575
3576                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3577         } else {
3578                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3579
3580                 if (skb->len < sizeof(*rp)) {
3581                         mgmt_cmd_status(cmd->sk, hdev->id,
3582                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3583                                         MGMT_STATUS_FAILED);
3584                         goto remove;
3585                 }
3586
3587                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3588                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3589
3590                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3591                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3592         }
3593
3594         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3595                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3596
3597 remove:
3598         mgmt_pending_remove(cmd);
3599 }
3600
3601 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3602                                void *data, u16 data_len)
3603 {
3604         struct mgmt_pending_cmd *cmd;
3605         struct hci_request req;
3606         int err;
3607
3608         BT_DBG("%s", hdev->name);
3609
3610         hci_dev_lock(hdev);
3611
3612         if (!hdev_is_powered(hdev)) {
3613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3614                                       MGMT_STATUS_NOT_POWERED);
3615                 goto unlock;
3616         }
3617
3618         if (!lmp_ssp_capable(hdev)) {
3619                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3620                                       MGMT_STATUS_NOT_SUPPORTED);
3621                 goto unlock;
3622         }
3623
3624         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3625                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3626                                       MGMT_STATUS_BUSY);
3627                 goto unlock;
3628         }
3629
3630         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3631         if (!cmd) {
3632                 err = -ENOMEM;
3633                 goto unlock;
3634         }
3635
3636         hci_req_init(&req, hdev);
3637
3638         if (bredr_sc_enabled(hdev))
3639                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3640         else
3641                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3642
3643         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3644         if (err < 0)
3645                 mgmt_pending_remove(cmd);
3646
3647 unlock:
3648         hci_dev_unlock(hdev);
3649         return err;
3650 }
3651
3652 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3653                                void *data, u16 len)
3654 {
3655         struct mgmt_addr_info *addr = data;
3656         int err;
3657
3658         BT_DBG("%s ", hdev->name);
3659
3660         if (!bdaddr_type_is_valid(addr->type))
3661                 return mgmt_cmd_complete(sk, hdev->id,
3662                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3663                                          MGMT_STATUS_INVALID_PARAMS,
3664                                          addr, sizeof(*addr));
3665
3666         hci_dev_lock(hdev);
3667
3668         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3669                 struct mgmt_cp_add_remote_oob_data *cp = data;
3670                 u8 status;
3671
3672                 if (cp->addr.type != BDADDR_BREDR) {
3673                         err = mgmt_cmd_complete(sk, hdev->id,
3674                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3675                                                 MGMT_STATUS_INVALID_PARAMS,
3676                                                 &cp->addr, sizeof(cp->addr));
3677                         goto unlock;
3678                 }
3679
3680                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3681                                               cp->addr.type, cp->hash,
3682                                               cp->rand, NULL, NULL);
3683                 if (err < 0)
3684                         status = MGMT_STATUS_FAILED;
3685                 else
3686                         status = MGMT_STATUS_SUCCESS;
3687
3688                 err = mgmt_cmd_complete(sk, hdev->id,
3689                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3690                                         &cp->addr, sizeof(cp->addr));
3691         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3692                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3693                 u8 *rand192, *hash192, *rand256, *hash256;
3694                 u8 status;
3695
3696                 if (bdaddr_type_is_le(cp->addr.type)) {
3697                         /* Enforce zero-valued 192-bit parameters as
3698                          * long as legacy SMP OOB isn't implemented.
3699                          */
3700                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3701                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3702                                 err = mgmt_cmd_complete(sk, hdev->id,
3703                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3704                                                         MGMT_STATUS_INVALID_PARAMS,
3705                                                         addr, sizeof(*addr));
3706                                 goto unlock;
3707                         }
3708
3709                         rand192 = NULL;
3710                         hash192 = NULL;
3711                 } else {
3712                         /* In case one of the P-192 values is set to zero,
3713                          * then just disable OOB data for P-192.
3714                          */
3715                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3716                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3717                                 rand192 = NULL;
3718                                 hash192 = NULL;
3719                         } else {
3720                                 rand192 = cp->rand192;
3721                                 hash192 = cp->hash192;
3722                         }
3723                 }
3724
3725                 /* In case one of the P-256 values is set to zero, then just
3726                  * disable OOB data for P-256.
3727                  */
3728                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3729                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3730                         rand256 = NULL;
3731                         hash256 = NULL;
3732                 } else {
3733                         rand256 = cp->rand256;
3734                         hash256 = cp->hash256;
3735                 }
3736
3737                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3738                                               cp->addr.type, hash192, rand192,
3739                                               hash256, rand256);
3740                 if (err < 0)
3741                         status = MGMT_STATUS_FAILED;
3742                 else
3743                         status = MGMT_STATUS_SUCCESS;
3744
3745                 err = mgmt_cmd_complete(sk, hdev->id,
3746                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3747                                         status, &cp->addr, sizeof(cp->addr));
3748         } else {
3749                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3750                            len);
3751                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3752                                       MGMT_STATUS_INVALID_PARAMS);
3753         }
3754
3755 unlock:
3756         hci_dev_unlock(hdev);
3757         return err;
3758 }
3759
3760 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3761                                   void *data, u16 len)
3762 {
3763         struct mgmt_cp_remove_remote_oob_data *cp = data;
3764         u8 status;
3765         int err;
3766
3767         BT_DBG("%s", hdev->name);
3768
3769         if (cp->addr.type != BDADDR_BREDR)
3770                 return mgmt_cmd_complete(sk, hdev->id,
3771                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3772                                          MGMT_STATUS_INVALID_PARAMS,
3773                                          &cp->addr, sizeof(cp->addr));
3774
3775         hci_dev_lock(hdev);
3776
3777         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3778                 hci_remote_oob_data_clear(hdev);
3779                 status = MGMT_STATUS_SUCCESS;
3780                 goto done;
3781         }
3782
3783         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3784         if (err < 0)
3785                 status = MGMT_STATUS_INVALID_PARAMS;
3786         else
3787                 status = MGMT_STATUS_SUCCESS;
3788
3789 done:
3790         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3791                                 status, &cp->addr, sizeof(cp->addr));
3792
3793         hci_dev_unlock(hdev);
3794         return err;
3795 }
3796
3797 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3798 {
3799         struct mgmt_pending_cmd *cmd;
3800
3801         BT_DBG("status %d", status);
3802
3803         hci_dev_lock(hdev);
3804
3805         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3806         if (!cmd)
3807                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3808
3809         if (!cmd)
3810                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3811
3812         if (cmd) {
3813                 cmd->cmd_complete(cmd, mgmt_status(status));
3814                 mgmt_pending_remove(cmd);
3815         }
3816
3817         hci_dev_unlock(hdev);
3818 }
3819
3820 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3821                                     uint8_t *mgmt_status)
3822 {
3823         switch (type) {
3824         case DISCOV_TYPE_LE:
3825                 *mgmt_status = mgmt_le_support(hdev);
3826                 if (*mgmt_status)
3827                         return false;
3828                 break;
3829         case DISCOV_TYPE_INTERLEAVED:
3830                 *mgmt_status = mgmt_le_support(hdev);
3831                 if (*mgmt_status)
3832                         return false;
3833                 /* Intentional fall-through */
3834         case DISCOV_TYPE_BREDR:
3835                 *mgmt_status = mgmt_bredr_support(hdev);
3836                 if (*mgmt_status)
3837                         return false;
3838                 break;
3839         default:
3840                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3841                 return false;
3842         }
3843
3844         return true;
3845 }
3846
3847 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3848                                     u16 op, void *data, u16 len)
3849 {
3850         struct mgmt_cp_start_discovery *cp = data;
3851         struct mgmt_pending_cmd *cmd;
3852         u8 status;
3853         int err;
3854
3855         BT_DBG("%s", hdev->name);
3856
3857         hci_dev_lock(hdev);
3858
3859         if (!hdev_is_powered(hdev)) {
3860                 err = mgmt_cmd_complete(sk, hdev->id, op,
3861                                         MGMT_STATUS_NOT_POWERED,
3862                                         &cp->type, sizeof(cp->type));
3863                 goto failed;
3864         }
3865
3866         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3867             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3868                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3869                                         &cp->type, sizeof(cp->type));
3870                 goto failed;
3871         }
3872
3873         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3874                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3875                                         &cp->type, sizeof(cp->type));
3876                 goto failed;
3877         }
3878
3879         /* Clear the discovery filter first to free any previously
3880          * allocated memory for the UUID list.
3881          */
3882         hci_discovery_filter_clear(hdev);
3883
3884         hdev->discovery.type = cp->type;
3885         hdev->discovery.report_invalid_rssi = false;
3886         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3887                 hdev->discovery.limited = true;
3888         else
3889                 hdev->discovery.limited = false;
3890
3891         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3892         if (!cmd) {
3893                 err = -ENOMEM;
3894                 goto failed;
3895         }
3896
3897         cmd->cmd_complete = generic_cmd_complete;
3898
3899         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3900         queue_work(hdev->req_workqueue, &hdev->discov_update);
3901         err = 0;
3902
3903 failed:
3904         hci_dev_unlock(hdev);
3905         return err;
3906 }
3907
3908 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3909                            void *data, u16 len)
3910 {
3911         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3912                                         data, len);
3913 }
3914
3915 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3916                                    void *data, u16 len)
3917 {
3918         return start_discovery_internal(sk, hdev,
3919                                         MGMT_OP_START_LIMITED_DISCOVERY,
3920                                         data, len);
3921 }
3922
3923 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3924                                           u8 status)
3925 {
3926         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3927                                  cmd->param, 1);
3928 }
3929
3930 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3931                                    void *data, u16 len)
3932 {
3933         struct mgmt_cp_start_service_discovery *cp = data;
3934         struct mgmt_pending_cmd *cmd;
3935         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3936         u16 uuid_count, expected_len;
3937         u8 status;
3938         int err;
3939
3940         BT_DBG("%s", hdev->name);
3941
3942         hci_dev_lock(hdev);
3943
3944         if (!hdev_is_powered(hdev)) {
3945                 err = mgmt_cmd_complete(sk, hdev->id,
3946                                         MGMT_OP_START_SERVICE_DISCOVERY,
3947                                         MGMT_STATUS_NOT_POWERED,
3948                                         &cp->type, sizeof(cp->type));
3949                 goto failed;
3950         }
3951
3952         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3953             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3954                 err = mgmt_cmd_complete(sk, hdev->id,
3955                                         MGMT_OP_START_SERVICE_DISCOVERY,
3956                                         MGMT_STATUS_BUSY, &cp->type,
3957                                         sizeof(cp->type));
3958                 goto failed;
3959         }
3960
3961         uuid_count = __le16_to_cpu(cp->uuid_count);
3962         if (uuid_count > max_uuid_count) {
3963                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3964                            uuid_count);
3965                 err = mgmt_cmd_complete(sk, hdev->id,
3966                                         MGMT_OP_START_SERVICE_DISCOVERY,
3967                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3968                                         sizeof(cp->type));
3969                 goto failed;
3970         }
3971
3972         expected_len = sizeof(*cp) + uuid_count * 16;
3973         if (expected_len != len) {
3974                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3975                            expected_len, len);
3976                 err = mgmt_cmd_complete(sk, hdev->id,
3977                                         MGMT_OP_START_SERVICE_DISCOVERY,
3978                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3979                                         sizeof(cp->type));
3980                 goto failed;
3981         }
3982
3983         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3984                 err = mgmt_cmd_complete(sk, hdev->id,
3985                                         MGMT_OP_START_SERVICE_DISCOVERY,
3986                                         status, &cp->type, sizeof(cp->type));
3987                 goto failed;
3988         }
3989
3990         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3991                                hdev, data, len);
3992         if (!cmd) {
3993                 err = -ENOMEM;
3994                 goto failed;
3995         }
3996
3997         cmd->cmd_complete = service_discovery_cmd_complete;
3998
3999         /* Clear the discovery filter first to free any previously
4000          * allocated memory for the UUID list.
4001          */
4002         hci_discovery_filter_clear(hdev);
4003
4004         hdev->discovery.result_filtering = true;
4005         hdev->discovery.type = cp->type;
4006         hdev->discovery.rssi = cp->rssi;
4007         hdev->discovery.uuid_count = uuid_count;
4008
4009         if (uuid_count > 0) {
4010                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4011                                                 GFP_KERNEL);
4012                 if (!hdev->discovery.uuids) {
4013                         err = mgmt_cmd_complete(sk, hdev->id,
4014                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4015                                                 MGMT_STATUS_FAILED,
4016                                                 &cp->type, sizeof(cp->type));
4017                         mgmt_pending_remove(cmd);
4018                         goto failed;
4019                 }
4020         }
4021
4022         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4023         queue_work(hdev->req_workqueue, &hdev->discov_update);
4024         err = 0;
4025
4026 failed:
4027         hci_dev_unlock(hdev);
4028         return err;
4029 }
4030
4031 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4032 {
4033         struct mgmt_pending_cmd *cmd;
4034
4035         BT_DBG("status %d", status);
4036
4037         hci_dev_lock(hdev);
4038
4039         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4040         if (cmd) {
4041                 cmd->cmd_complete(cmd, mgmt_status(status));
4042                 mgmt_pending_remove(cmd);
4043         }
4044
4045         hci_dev_unlock(hdev);
4046 }
4047
4048 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4049                           u16 len)
4050 {
4051         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4052         struct mgmt_pending_cmd *cmd;
4053         int err;
4054
4055         BT_DBG("%s", hdev->name);
4056
4057         hci_dev_lock(hdev);
4058
4059         if (!hci_discovery_active(hdev)) {
4060                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4061                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4062                                         sizeof(mgmt_cp->type));
4063                 goto unlock;
4064         }
4065
4066         if (hdev->discovery.type != mgmt_cp->type) {
4067                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4068                                         MGMT_STATUS_INVALID_PARAMS,
4069                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4070                 goto unlock;
4071         }
4072
4073         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4074         if (!cmd) {
4075                 err = -ENOMEM;
4076                 goto unlock;
4077         }
4078
4079         cmd->cmd_complete = generic_cmd_complete;
4080
4081         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4082         queue_work(hdev->req_workqueue, &hdev->discov_update);
4083         err = 0;
4084
4085 unlock:
4086         hci_dev_unlock(hdev);
4087         return err;
4088 }
4089
4090 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4091                         u16 len)
4092 {
4093         struct mgmt_cp_confirm_name *cp = data;
4094         struct inquiry_entry *e;
4095         int err;
4096
4097         BT_DBG("%s", hdev->name);
4098
4099         hci_dev_lock(hdev);
4100
4101         if (!hci_discovery_active(hdev)) {
4102                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103                                         MGMT_STATUS_FAILED, &cp->addr,
4104                                         sizeof(cp->addr));
4105                 goto failed;
4106         }
4107
4108         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4109         if (!e) {
4110                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4111                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4112                                         sizeof(cp->addr));
4113                 goto failed;
4114         }
4115
4116         if (cp->name_known) {
4117                 e->name_state = NAME_KNOWN;
4118                 list_del(&e->list);
4119         } else {
4120                 e->name_state = NAME_NEEDED;
4121                 hci_inquiry_cache_update_resolve(hdev, e);
4122         }
4123
4124         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4125                                 &cp->addr, sizeof(cp->addr));
4126
4127 failed:
4128         hci_dev_unlock(hdev);
4129         return err;
4130 }
4131
4132 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4133                         u16 len)
4134 {
4135         struct mgmt_cp_block_device *cp = data;
4136         u8 status;
4137         int err;
4138
4139         BT_DBG("%s", hdev->name);
4140
4141         if (!bdaddr_type_is_valid(cp->addr.type))
4142                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4143                                          MGMT_STATUS_INVALID_PARAMS,
4144                                          &cp->addr, sizeof(cp->addr));
4145
4146         hci_dev_lock(hdev);
4147
4148         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4149                                   cp->addr.type);
4150         if (err < 0) {
4151                 status = MGMT_STATUS_FAILED;
4152                 goto done;
4153         }
4154
4155         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4156                    sk);
4157         status = MGMT_STATUS_SUCCESS;
4158
4159 done:
4160         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4161                                 &cp->addr, sizeof(cp->addr));
4162
4163         hci_dev_unlock(hdev);
4164
4165         return err;
4166 }
4167
4168 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4169                           u16 len)
4170 {
4171         struct mgmt_cp_unblock_device *cp = data;
4172         u8 status;
4173         int err;
4174
4175         BT_DBG("%s", hdev->name);
4176
4177         if (!bdaddr_type_is_valid(cp->addr.type))
4178                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4179                                          MGMT_STATUS_INVALID_PARAMS,
4180                                          &cp->addr, sizeof(cp->addr));
4181
4182         hci_dev_lock(hdev);
4183
4184         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4185                                   cp->addr.type);
4186         if (err < 0) {
4187                 status = MGMT_STATUS_INVALID_PARAMS;
4188                 goto done;
4189         }
4190
4191         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4192                    sk);
4193         status = MGMT_STATUS_SUCCESS;
4194
4195 done:
4196         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4197                                 &cp->addr, sizeof(cp->addr));
4198
4199         hci_dev_unlock(hdev);
4200
4201         return err;
4202 }
4203
4204 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4205                          u16 len)
4206 {
4207         struct mgmt_cp_set_device_id *cp = data;
4208         struct hci_request req;
4209         int err;
4210         __u16 source;
4211
4212         BT_DBG("%s", hdev->name);
4213
4214         source = __le16_to_cpu(cp->source);
4215
4216         if (source > 0x0002)
4217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4218                                        MGMT_STATUS_INVALID_PARAMS);
4219
4220         hci_dev_lock(hdev);
4221
4222         hdev->devid_source = source;
4223         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4224         hdev->devid_product = __le16_to_cpu(cp->product);
4225         hdev->devid_version = __le16_to_cpu(cp->version);
4226
4227         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4228                                 NULL, 0);
4229
4230         hci_req_init(&req, hdev);
4231         __hci_req_update_eir(&req);
4232         hci_req_run(&req, NULL);
4233
4234         hci_dev_unlock(hdev);
4235
4236         return err;
4237 }
4238
4239 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4240                                         u16 opcode)
4241 {
4242         BT_DBG("status %d", status);
4243 }
4244
4245 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4246                                      u16 opcode)
4247 {
4248         struct cmd_lookup match = { NULL, hdev };
4249         struct hci_request req;
4250         u8 instance;
4251         struct adv_info *adv_instance;
4252         int err;
4253
4254         hci_dev_lock(hdev);
4255
4256         if (status) {
4257                 u8 mgmt_err = mgmt_status(status);
4258
4259                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4260                                      cmd_status_rsp, &mgmt_err);
4261                 goto unlock;
4262         }
4263
4264         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4265                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4266         else
4267                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4268
4269         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4270                              &match);
4271
4272         new_settings(hdev, match.sk);
4273
4274         if (match.sk)
4275                 sock_put(match.sk);
4276
4277         /* If "Set Advertising" was just disabled and instance advertising was
4278          * set up earlier, then re-enable multi-instance advertising.
4279          */
4280         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4281             list_empty(&hdev->adv_instances))
4282                 goto unlock;
4283
4284         instance = hdev->cur_adv_instance;
4285         if (!instance) {
4286                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4287                                                         struct adv_info, list);
4288                 if (!adv_instance)
4289                         goto unlock;
4290
4291                 instance = adv_instance->instance;
4292         }
4293
4294         hci_req_init(&req, hdev);
4295
4296         err = __hci_req_schedule_adv_instance(&req, instance, true);
4297
4298         if (!err)
4299                 err = hci_req_run(&req, enable_advertising_instance);
4300
4301         if (err)
4302                 bt_dev_err(hdev, "failed to re-configure advertising");
4303
4304 unlock:
4305         hci_dev_unlock(hdev);
4306 }
4307
4308 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4309                            u16 len)
4310 {
4311         struct mgmt_mode *cp = data;
4312         struct mgmt_pending_cmd *cmd;
4313         struct hci_request req;
4314         u8 val, status;
4315         int err;
4316
4317         BT_DBG("request for %s", hdev->name);
4318
4319         status = mgmt_le_support(hdev);
4320         if (status)
4321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4322                                        status);
4323
4324         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4325                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4326                                        MGMT_STATUS_INVALID_PARAMS);
4327
4328         hci_dev_lock(hdev);
4329
4330         val = !!cp->val;
4331
4332         /* The following conditions are ones which mean that we should
4333          * not do any HCI communication but directly send a mgmt
4334          * response to user space (after toggling the flag if
4335          * necessary).
4336          */
4337         if (!hdev_is_powered(hdev) ||
4338             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4339              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4340             hci_conn_num(hdev, LE_LINK) > 0 ||
4341             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4342              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4343                 bool changed;
4344
4345                 if (cp->val) {
4346                         hdev->cur_adv_instance = 0x00;
4347                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4348                         if (cp->val == 0x02)
4349                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350                         else
4351                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4352                 } else {
4353                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4354                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4355                 }
4356
4357                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4358                 if (err < 0)
4359                         goto unlock;
4360
4361                 if (changed)
4362                         err = new_settings(hdev, sk);
4363
4364                 goto unlock;
4365         }
4366
4367         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4368             pending_find(MGMT_OP_SET_LE, hdev)) {
4369                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4370                                       MGMT_STATUS_BUSY);
4371                 goto unlock;
4372         }
4373
4374         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4375         if (!cmd) {
4376                 err = -ENOMEM;
4377                 goto unlock;
4378         }
4379
4380         hci_req_init(&req, hdev);
4381
4382         if (cp->val == 0x02)
4383                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4384         else
4385                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4386
4387         cancel_adv_timeout(hdev);
4388
4389         if (val) {
4390                 /* Switch to instance "0" for the Set Advertising setting.
4391                  * We cannot use update_[adv|scan_rsp]_data() here as the
4392                  * HCI_ADVERTISING flag is not yet set.
4393                  */
4394                 hdev->cur_adv_instance = 0x00;
4395
4396                 if (ext_adv_capable(hdev)) {
4397                         __hci_req_start_ext_adv(&req, 0x00);
4398                 } else {
4399                         __hci_req_update_adv_data(&req, 0x00);
4400                         __hci_req_update_scan_rsp_data(&req, 0x00);
4401                         __hci_req_enable_advertising(&req);
4402                 }
4403         } else {
4404                 __hci_req_disable_advertising(&req);
4405         }
4406
4407         err = hci_req_run(&req, set_advertising_complete);
4408         if (err < 0)
4409                 mgmt_pending_remove(cmd);
4410
4411 unlock:
4412         hci_dev_unlock(hdev);
4413         return err;
4414 }
4415
4416 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4417                               void *data, u16 len)
4418 {
4419         struct mgmt_cp_set_static_address *cp = data;
4420         int err;
4421
4422         BT_DBG("%s", hdev->name);
4423
4424         if (!lmp_le_capable(hdev))
4425                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4426                                        MGMT_STATUS_NOT_SUPPORTED);
4427
4428         if (hdev_is_powered(hdev))
4429                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4430                                        MGMT_STATUS_REJECTED);
4431
4432         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4433                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4434                         return mgmt_cmd_status(sk, hdev->id,
4435                                                MGMT_OP_SET_STATIC_ADDRESS,
4436                                                MGMT_STATUS_INVALID_PARAMS);
4437
4438                 /* Two most significant bits shall be set */
4439                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4440                         return mgmt_cmd_status(sk, hdev->id,
4441                                                MGMT_OP_SET_STATIC_ADDRESS,
4442                                                MGMT_STATUS_INVALID_PARAMS);
4443         }
4444
4445         hci_dev_lock(hdev);
4446
4447         bacpy(&hdev->static_addr, &cp->bdaddr);
4448
4449         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4450         if (err < 0)
4451                 goto unlock;
4452
4453         err = new_settings(hdev, sk);
4454
4455 unlock:
4456         hci_dev_unlock(hdev);
4457         return err;
4458 }
4459
4460 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4461                            void *data, u16 len)
4462 {
4463         struct mgmt_cp_set_scan_params *cp = data;
4464         __u16 interval, window;
4465         int err;
4466
4467         BT_DBG("%s", hdev->name);
4468
4469         if (!lmp_le_capable(hdev))
4470                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4471                                        MGMT_STATUS_NOT_SUPPORTED);
4472
4473         interval = __le16_to_cpu(cp->interval);
4474
4475         if (interval < 0x0004 || interval > 0x4000)
4476                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4477                                        MGMT_STATUS_INVALID_PARAMS);
4478
4479         window = __le16_to_cpu(cp->window);
4480
4481         if (window < 0x0004 || window > 0x4000)
4482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4483                                        MGMT_STATUS_INVALID_PARAMS);
4484
4485         if (window > interval)
4486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4487                                        MGMT_STATUS_INVALID_PARAMS);
4488
4489         hci_dev_lock(hdev);
4490
4491         hdev->le_scan_interval = interval;
4492         hdev->le_scan_window = window;
4493
4494         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4495                                 NULL, 0);
4496
4497         /* If background scan is running, restart it so new parameters are
4498          * loaded.
4499          */
4500         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4501             hdev->discovery.state == DISCOVERY_STOPPED) {
4502                 struct hci_request req;
4503
4504                 hci_req_init(&req, hdev);
4505
4506                 hci_req_add_le_scan_disable(&req);
4507                 hci_req_add_le_passive_scan(&req);
4508
4509                 hci_req_run(&req, NULL);
4510         }
4511
4512         hci_dev_unlock(hdev);
4513
4514         return err;
4515 }
4516
4517 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4518                                       u16 opcode)
4519 {
4520         struct mgmt_pending_cmd *cmd;
4521
4522         BT_DBG("status 0x%02x", status);
4523
4524         hci_dev_lock(hdev);
4525
4526         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4527         if (!cmd)
4528                 goto unlock;
4529
4530         if (status) {
4531                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4532                                 mgmt_status(status));
4533         } else {
4534                 struct mgmt_mode *cp = cmd->param;
4535
4536                 if (cp->val)
4537                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4538                 else
4539                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4540
4541                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4542                 new_settings(hdev, cmd->sk);
4543         }
4544
4545         mgmt_pending_remove(cmd);
4546
4547 unlock:
4548         hci_dev_unlock(hdev);
4549 }
4550
4551 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4552                                 void *data, u16 len)
4553 {
4554         struct mgmt_mode *cp = data;
4555         struct mgmt_pending_cmd *cmd;
4556         struct hci_request req;
4557         int err;
4558
4559         BT_DBG("%s", hdev->name);
4560
4561         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4562             hdev->hci_ver < BLUETOOTH_VER_1_2)
4563                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4564                                        MGMT_STATUS_NOT_SUPPORTED);
4565
4566         if (cp->val != 0x00 && cp->val != 0x01)
4567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4568                                        MGMT_STATUS_INVALID_PARAMS);
4569
4570         hci_dev_lock(hdev);
4571
4572         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4573                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4574                                       MGMT_STATUS_BUSY);
4575                 goto unlock;
4576         }
4577
4578         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4579                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4580                                         hdev);
4581                 goto unlock;
4582         }
4583
4584         if (!hdev_is_powered(hdev)) {
4585                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4586                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4587                                         hdev);
4588                 new_settings(hdev, sk);
4589                 goto unlock;
4590         }
4591
4592         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4593                                data, len);
4594         if (!cmd) {
4595                 err = -ENOMEM;
4596                 goto unlock;
4597         }
4598
4599         hci_req_init(&req, hdev);
4600
4601         __hci_req_write_fast_connectable(&req, cp->val);
4602
4603         err = hci_req_run(&req, fast_connectable_complete);
4604         if (err < 0) {
4605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4606                                       MGMT_STATUS_FAILED);
4607                 mgmt_pending_remove(cmd);
4608         }
4609
4610 unlock:
4611         hci_dev_unlock(hdev);
4612
4613         return err;
4614 }
4615
4616 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4617 {
4618         struct mgmt_pending_cmd *cmd;
4619
4620         BT_DBG("status 0x%02x", status);
4621
4622         hci_dev_lock(hdev);
4623
4624         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4625         if (!cmd)
4626                 goto unlock;
4627
4628         if (status) {
4629                 u8 mgmt_err = mgmt_status(status);
4630
4631                 /* We need to restore the flag if related HCI commands
4632                  * failed.
4633                  */
4634                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4635
4636                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4637         } else {
4638                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4639                 new_settings(hdev, cmd->sk);
4640         }
4641
4642         mgmt_pending_remove(cmd);
4643
4644 unlock:
4645         hci_dev_unlock(hdev);
4646 }
4647
4648 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4649 {
4650         struct mgmt_mode *cp = data;
4651         struct mgmt_pending_cmd *cmd;
4652         struct hci_request req;
4653         int err;
4654
4655         BT_DBG("request for %s", hdev->name);
4656
4657         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4658                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659                                        MGMT_STATUS_NOT_SUPPORTED);
4660
4661         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4662                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4663                                        MGMT_STATUS_REJECTED);
4664
4665         if (cp->val != 0x00 && cp->val != 0x01)
4666                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4667                                        MGMT_STATUS_INVALID_PARAMS);
4668
4669         hci_dev_lock(hdev);
4670
4671         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4672                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4673                 goto unlock;
4674         }
4675
4676         if (!hdev_is_powered(hdev)) {
4677                 if (!cp->val) {
4678                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4679                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4680                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4681                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4682                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4683                 }
4684
4685                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4686
4687                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4688                 if (err < 0)
4689                         goto unlock;
4690
4691                 err = new_settings(hdev, sk);
4692                 goto unlock;
4693         }
4694
4695         /* Reject disabling when powered on */
4696         if (!cp->val) {
4697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4698                                       MGMT_STATUS_REJECTED);
4699                 goto unlock;
4700         } else {
4701                 /* When configuring a dual-mode controller to operate
4702                  * with LE only and using a static address, then switching
4703                  * BR/EDR back on is not allowed.
4704                  *
4705                  * Dual-mode controllers shall operate with the public
4706                  * address as its identity address for BR/EDR and LE. So
4707                  * reject the attempt to create an invalid configuration.
4708                  *
4709                  * The same restrictions applies when secure connections
4710                  * has been enabled. For BR/EDR this is a controller feature
4711                  * while for LE it is a host stack feature. This means that
4712                  * switching BR/EDR back on when secure connections has been
4713                  * enabled is not a supported transaction.
4714                  */
4715                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4716                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4717                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4718                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4719                                               MGMT_STATUS_REJECTED);
4720                         goto unlock;
4721                 }
4722         }
4723
4724         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4725                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4726                                       MGMT_STATUS_BUSY);
4727                 goto unlock;
4728         }
4729
4730         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4731         if (!cmd) {
4732                 err = -ENOMEM;
4733                 goto unlock;
4734         }
4735
4736         /* We need to flip the bit already here so that
4737          * hci_req_update_adv_data generates the correct flags.
4738          */
4739         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4740
4741         hci_req_init(&req, hdev);
4742
4743         __hci_req_write_fast_connectable(&req, false);
4744         __hci_req_update_scan(&req);
4745
4746         /* Since only the advertising data flags will change, there
4747          * is no need to update the scan response data.
4748          */
4749         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4750
4751         err = hci_req_run(&req, set_bredr_complete);
4752         if (err < 0)
4753                 mgmt_pending_remove(cmd);
4754
4755 unlock:
4756         hci_dev_unlock(hdev);
4757         return err;
4758 }
4759
4760 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4761 {
4762         struct mgmt_pending_cmd *cmd;
4763         struct mgmt_mode *cp;
4764
4765         BT_DBG("%s status %u", hdev->name, status);
4766
4767         hci_dev_lock(hdev);
4768
4769         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4770         if (!cmd)
4771                 goto unlock;
4772
4773         if (status) {
4774                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4775                                 mgmt_status(status));
4776                 goto remove;
4777         }
4778
4779         cp = cmd->param;
4780
4781         switch (cp->val) {
4782         case 0x00:
4783                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4784                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4785                 break;
4786         case 0x01:
4787                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4788                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4789                 break;
4790         case 0x02:
4791                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4792                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4793                 break;
4794         }
4795
4796         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4797         new_settings(hdev, cmd->sk);
4798
4799 remove:
4800         mgmt_pending_remove(cmd);
4801 unlock:
4802         hci_dev_unlock(hdev);
4803 }
4804
4805 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4806                            void *data, u16 len)
4807 {
4808         struct mgmt_mode *cp = data;
4809         struct mgmt_pending_cmd *cmd;
4810         struct hci_request req;
4811         u8 val;
4812         int err;
4813
4814         BT_DBG("request for %s", hdev->name);
4815
4816         if (!lmp_sc_capable(hdev) &&
4817             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4819                                        MGMT_STATUS_NOT_SUPPORTED);
4820
4821         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4822             lmp_sc_capable(hdev) &&
4823             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4824                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4825                                        MGMT_STATUS_REJECTED);
4826
4827         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4828                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4829                                   MGMT_STATUS_INVALID_PARAMS);
4830
4831         hci_dev_lock(hdev);
4832
4833         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4834             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4835                 bool changed;
4836
4837                 if (cp->val) {
4838                         changed = !hci_dev_test_and_set_flag(hdev,
4839                                                              HCI_SC_ENABLED);
4840                         if (cp->val == 0x02)
4841                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4842                         else
4843                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4844                 } else {
4845                         changed = hci_dev_test_and_clear_flag(hdev,
4846                                                               HCI_SC_ENABLED);
4847                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4848                 }
4849
4850                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4851                 if (err < 0)
4852                         goto failed;
4853
4854                 if (changed)
4855                         err = new_settings(hdev, sk);
4856
4857                 goto failed;
4858         }
4859
4860         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4861                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4862                                       MGMT_STATUS_BUSY);
4863                 goto failed;
4864         }
4865
4866         val = !!cp->val;
4867
4868         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4869             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4870                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4871                 goto failed;
4872         }
4873
4874         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4875         if (!cmd) {
4876                 err = -ENOMEM;
4877                 goto failed;
4878         }
4879
4880         hci_req_init(&req, hdev);
4881         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4882         err = hci_req_run(&req, sc_enable_complete);
4883         if (err < 0) {
4884                 mgmt_pending_remove(cmd);
4885                 goto failed;
4886         }
4887
4888 failed:
4889         hci_dev_unlock(hdev);
4890         return err;
4891 }
4892
4893 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4894                           void *data, u16 len)
4895 {
4896         struct mgmt_mode *cp = data;
4897         bool changed, use_changed;
4898         int err;
4899
4900         BT_DBG("request for %s", hdev->name);
4901
4902         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4903                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4904                                        MGMT_STATUS_INVALID_PARAMS);
4905
4906         hci_dev_lock(hdev);
4907
4908         if (cp->val)
4909                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4910         else
4911                 changed = hci_dev_test_and_clear_flag(hdev,
4912                                                       HCI_KEEP_DEBUG_KEYS);
4913
4914         if (cp->val == 0x02)
4915                 use_changed = !hci_dev_test_and_set_flag(hdev,
4916                                                          HCI_USE_DEBUG_KEYS);
4917         else
4918                 use_changed = hci_dev_test_and_clear_flag(hdev,
4919                                                           HCI_USE_DEBUG_KEYS);
4920
4921         if (hdev_is_powered(hdev) && use_changed &&
4922             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4923                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4924                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4925                              sizeof(mode), &mode);
4926         }
4927
4928         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4929         if (err < 0)
4930                 goto unlock;
4931
4932         if (changed)
4933                 err = new_settings(hdev, sk);
4934
4935 unlock:
4936         hci_dev_unlock(hdev);
4937         return err;
4938 }
4939
4940 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4941                        u16 len)
4942 {
4943         struct mgmt_cp_set_privacy *cp = cp_data;
4944         bool changed;
4945         int err;
4946
4947         BT_DBG("request for %s", hdev->name);
4948
4949         if (!lmp_le_capable(hdev))
4950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951                                        MGMT_STATUS_NOT_SUPPORTED);
4952
4953         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4955                                        MGMT_STATUS_INVALID_PARAMS);
4956
4957         if (hdev_is_powered(hdev))
4958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4959                                        MGMT_STATUS_REJECTED);
4960
4961         hci_dev_lock(hdev);
4962
4963         /* If user space supports this command it is also expected to
4964          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4965          */
4966         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4967
4968         if (cp->privacy) {
4969                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4970                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4971                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4972                 hci_adv_instances_set_rpa_expired(hdev, true);
4973                 if (cp->privacy == 0x02)
4974                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4975                 else
4976                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4977         } else {
4978                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4979                 memset(hdev->irk, 0, sizeof(hdev->irk));
4980                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4981                 hci_adv_instances_set_rpa_expired(hdev, false);
4982                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4983         }
4984
4985         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4986         if (err < 0)
4987                 goto unlock;
4988
4989         if (changed)
4990                 err = new_settings(hdev, sk);
4991
4992 unlock:
4993         hci_dev_unlock(hdev);
4994         return err;
4995 }
4996
4997 static bool irk_is_valid(struct mgmt_irk_info *irk)
4998 {
4999         switch (irk->addr.type) {
5000         case BDADDR_LE_PUBLIC:
5001                 return true;
5002
5003         case BDADDR_LE_RANDOM:
5004                 /* Two most significant bits shall be set */
5005                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5006                         return false;
5007                 return true;
5008         }
5009
5010         return false;
5011 }
5012
5013 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014                      u16 len)
5015 {
5016         struct mgmt_cp_load_irks *cp = cp_data;
5017         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5018                                    sizeof(struct mgmt_irk_info));
5019         u16 irk_count, expected_len;
5020         int i, err;
5021
5022         BT_DBG("request for %s", hdev->name);
5023
5024         if (!lmp_le_capable(hdev))
5025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5026                                        MGMT_STATUS_NOT_SUPPORTED);
5027
5028         irk_count = __le16_to_cpu(cp->irk_count);
5029         if (irk_count > max_irk_count) {
5030                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5031                            irk_count);
5032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033                                        MGMT_STATUS_INVALID_PARAMS);
5034         }
5035
5036         expected_len = struct_size(cp, irks, irk_count);
5037         if (expected_len != len) {
5038                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5039                            expected_len, len);
5040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5041                                        MGMT_STATUS_INVALID_PARAMS);
5042         }
5043
5044         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5045
5046         for (i = 0; i < irk_count; i++) {
5047                 struct mgmt_irk_info *key = &cp->irks[i];
5048
5049                 if (!irk_is_valid(key))
5050                         return mgmt_cmd_status(sk, hdev->id,
5051                                                MGMT_OP_LOAD_IRKS,
5052                                                MGMT_STATUS_INVALID_PARAMS);
5053         }
5054
5055         hci_dev_lock(hdev);
5056
5057         hci_smp_irks_clear(hdev);
5058
5059         for (i = 0; i < irk_count; i++) {
5060                 struct mgmt_irk_info *irk = &cp->irks[i];
5061
5062                 hci_add_irk(hdev, &irk->addr.bdaddr,
5063                             le_addr_type(irk->addr.type), irk->val,
5064                             BDADDR_ANY);
5065         }
5066
5067         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5068
5069         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5070
5071         hci_dev_unlock(hdev);
5072
5073         return err;
5074 }
5075
5076 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5077 {
5078         if (key->master != 0x00 && key->master != 0x01)
5079                 return false;
5080
5081         switch (key->addr.type) {
5082         case BDADDR_LE_PUBLIC:
5083                 return true;
5084
5085         case BDADDR_LE_RANDOM:
5086                 /* Two most significant bits shall be set */
5087                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5088                         return false;
5089                 return true;
5090         }
5091
5092         return false;
5093 }
5094
5095 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5096                                void *cp_data, u16 len)
5097 {
5098         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5099         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5100                                    sizeof(struct mgmt_ltk_info));
5101         u16 key_count, expected_len;
5102         int i, err;
5103
5104         BT_DBG("request for %s", hdev->name);
5105
5106         if (!lmp_le_capable(hdev))
5107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5108                                        MGMT_STATUS_NOT_SUPPORTED);
5109
5110         key_count = __le16_to_cpu(cp->key_count);
5111         if (key_count > max_key_count) {
5112                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5113                            key_count);
5114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115                                        MGMT_STATUS_INVALID_PARAMS);
5116         }
5117
5118         expected_len = struct_size(cp, keys, key_count);
5119         if (expected_len != len) {
5120                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5121                            expected_len, len);
5122                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5123                                        MGMT_STATUS_INVALID_PARAMS);
5124         }
5125
5126         BT_DBG("%s key_count %u", hdev->name, key_count);
5127
5128         for (i = 0; i < key_count; i++) {
5129                 struct mgmt_ltk_info *key = &cp->keys[i];
5130
5131                 if (!ltk_is_valid(key))
5132                         return mgmt_cmd_status(sk, hdev->id,
5133                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5134                                                MGMT_STATUS_INVALID_PARAMS);
5135         }
5136
5137         hci_dev_lock(hdev);
5138
5139         hci_smp_ltks_clear(hdev);
5140
5141         for (i = 0; i < key_count; i++) {
5142                 struct mgmt_ltk_info *key = &cp->keys[i];
5143                 u8 type, authenticated;
5144
5145                 switch (key->type) {
5146                 case MGMT_LTK_UNAUTHENTICATED:
5147                         authenticated = 0x00;
5148                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5149                         break;
5150                 case MGMT_LTK_AUTHENTICATED:
5151                         authenticated = 0x01;
5152                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5153                         break;
5154                 case MGMT_LTK_P256_UNAUTH:
5155                         authenticated = 0x00;
5156                         type = SMP_LTK_P256;
5157                         break;
5158                 case MGMT_LTK_P256_AUTH:
5159                         authenticated = 0x01;
5160                         type = SMP_LTK_P256;
5161                         break;
5162                 case MGMT_LTK_P256_DEBUG:
5163                         authenticated = 0x00;
5164                         type = SMP_LTK_P256_DEBUG;
5165                         /* fall through */
5166                 default:
5167                         continue;
5168                 }
5169
5170                 hci_add_ltk(hdev, &key->addr.bdaddr,
5171                             le_addr_type(key->addr.type), type, authenticated,
5172                             key->val, key->enc_size, key->ediv, key->rand);
5173         }
5174
5175         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5176                            NULL, 0);
5177
5178         hci_dev_unlock(hdev);
5179
5180         return err;
5181 }
5182
5183 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5184 {
5185         struct hci_conn *conn = cmd->user_data;
5186         struct mgmt_rp_get_conn_info rp;
5187         int err;
5188
5189         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5190
5191         if (status == MGMT_STATUS_SUCCESS) {
5192                 rp.rssi = conn->rssi;
5193                 rp.tx_power = conn->tx_power;
5194                 rp.max_tx_power = conn->max_tx_power;
5195         } else {
5196                 rp.rssi = HCI_RSSI_INVALID;
5197                 rp.tx_power = HCI_TX_POWER_INVALID;
5198                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5199         }
5200
5201         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5202                                 status, &rp, sizeof(rp));
5203
5204         hci_conn_drop(conn);
5205         hci_conn_put(conn);
5206
5207         return err;
5208 }
5209
5210 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5211                                        u16 opcode)
5212 {
5213         struct hci_cp_read_rssi *cp;
5214         struct mgmt_pending_cmd *cmd;
5215         struct hci_conn *conn;
5216         u16 handle;
5217         u8 status;
5218
5219         BT_DBG("status 0x%02x", hci_status);
5220
5221         hci_dev_lock(hdev);
5222
5223         /* Commands sent in request are either Read RSSI or Read Transmit Power
5224          * Level so we check which one was last sent to retrieve connection
5225          * handle.  Both commands have handle as first parameter so it's safe to
5226          * cast data on the same command struct.
5227          *
5228          * First command sent is always Read RSSI and we fail only if it fails.
5229          * In other case we simply override error to indicate success as we
5230          * already remembered if TX power value is actually valid.
5231          */
5232         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5233         if (!cp) {
5234                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5235                 status = MGMT_STATUS_SUCCESS;
5236         } else {
5237                 status = mgmt_status(hci_status);
5238         }
5239
5240         if (!cp) {
5241                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5242                 goto unlock;
5243         }
5244
5245         handle = __le16_to_cpu(cp->handle);
5246         conn = hci_conn_hash_lookup_handle(hdev, handle);
5247         if (!conn) {
5248                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5249                            handle);
5250                 goto unlock;
5251         }
5252
5253         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5254         if (!cmd)
5255                 goto unlock;
5256
5257         cmd->cmd_complete(cmd, status);
5258         mgmt_pending_remove(cmd);
5259
5260 unlock:
5261         hci_dev_unlock(hdev);
5262 }
5263
5264 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5265                          u16 len)
5266 {
5267         struct mgmt_cp_get_conn_info *cp = data;
5268         struct mgmt_rp_get_conn_info rp;
5269         struct hci_conn *conn;
5270         unsigned long conn_info_age;
5271         int err = 0;
5272
5273         BT_DBG("%s", hdev->name);
5274
5275         memset(&rp, 0, sizeof(rp));
5276         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5277         rp.addr.type = cp->addr.type;
5278
5279         if (!bdaddr_type_is_valid(cp->addr.type))
5280                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5281                                          MGMT_STATUS_INVALID_PARAMS,
5282                                          &rp, sizeof(rp));
5283
5284         hci_dev_lock(hdev);
5285
5286         if (!hdev_is_powered(hdev)) {
5287                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5288                                         MGMT_STATUS_NOT_POWERED, &rp,
5289                                         sizeof(rp));
5290                 goto unlock;
5291         }
5292
5293         if (cp->addr.type == BDADDR_BREDR)
5294                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5295                                                &cp->addr.bdaddr);
5296         else
5297                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5298
5299         if (!conn || conn->state != BT_CONNECTED) {
5300                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5301                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5302                                         sizeof(rp));
5303                 goto unlock;
5304         }
5305
5306         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5307                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5308                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5309                 goto unlock;
5310         }
5311
5312         /* To avoid client trying to guess when to poll again for information we
5313          * calculate conn info age as random value between min/max set in hdev.
5314          */
5315         conn_info_age = hdev->conn_info_min_age +
5316                         prandom_u32_max(hdev->conn_info_max_age -
5317                                         hdev->conn_info_min_age);
5318
5319         /* Query controller to refresh cached values if they are too old or were
5320          * never read.
5321          */
5322         if (time_after(jiffies, conn->conn_info_timestamp +
5323                        msecs_to_jiffies(conn_info_age)) ||
5324             !conn->conn_info_timestamp) {
5325                 struct hci_request req;
5326                 struct hci_cp_read_tx_power req_txp_cp;
5327                 struct hci_cp_read_rssi req_rssi_cp;
5328                 struct mgmt_pending_cmd *cmd;
5329
5330                 hci_req_init(&req, hdev);
5331                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5332                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5333                             &req_rssi_cp);
5334
5335                 /* For LE links TX power does not change thus we don't need to
5336                  * query for it once value is known.
5337                  */
5338                 if (!bdaddr_type_is_le(cp->addr.type) ||
5339                     conn->tx_power == HCI_TX_POWER_INVALID) {
5340                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5341                         req_txp_cp.type = 0x00;
5342                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5343                                     sizeof(req_txp_cp), &req_txp_cp);
5344                 }
5345
5346                 /* Max TX power needs to be read only once per connection */
5347                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5348                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5349                         req_txp_cp.type = 0x01;
5350                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5351                                     sizeof(req_txp_cp), &req_txp_cp);
5352                 }
5353
5354                 err = hci_req_run(&req, conn_info_refresh_complete);
5355                 if (err < 0)
5356                         goto unlock;
5357
5358                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5359                                        data, len);
5360                 if (!cmd) {
5361                         err = -ENOMEM;
5362                         goto unlock;
5363                 }
5364
5365                 hci_conn_hold(conn);
5366                 cmd->user_data = hci_conn_get(conn);
5367                 cmd->cmd_complete = conn_info_cmd_complete;
5368
5369                 conn->conn_info_timestamp = jiffies;
5370         } else {
5371                 /* Cache is valid, just reply with values cached in hci_conn */
5372                 rp.rssi = conn->rssi;
5373                 rp.tx_power = conn->tx_power;
5374                 rp.max_tx_power = conn->max_tx_power;
5375
5376                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5377                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5378         }
5379
5380 unlock:
5381         hci_dev_unlock(hdev);
5382         return err;
5383 }
5384
5385 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5386 {
5387         struct hci_conn *conn = cmd->user_data;
5388         struct mgmt_rp_get_clock_info rp;
5389         struct hci_dev *hdev;
5390         int err;
5391
5392         memset(&rp, 0, sizeof(rp));
5393         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5394
5395         if (status)
5396                 goto complete;
5397
5398         hdev = hci_dev_get(cmd->index);
5399         if (hdev) {
5400                 rp.local_clock = cpu_to_le32(hdev->clock);
5401                 hci_dev_put(hdev);
5402         }
5403
5404         if (conn) {
5405                 rp.piconet_clock = cpu_to_le32(conn->clock);
5406                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5407         }
5408
5409 complete:
5410         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5411                                 sizeof(rp));
5412
5413         if (conn) {
5414                 hci_conn_drop(conn);
5415                 hci_conn_put(conn);
5416         }
5417
5418         return err;
5419 }
5420
5421 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5422 {
5423         struct hci_cp_read_clock *hci_cp;
5424         struct mgmt_pending_cmd *cmd;
5425         struct hci_conn *conn;
5426
5427         BT_DBG("%s status %u", hdev->name, status);
5428
5429         hci_dev_lock(hdev);
5430
5431         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5432         if (!hci_cp)
5433                 goto unlock;
5434
5435         if (hci_cp->which) {
5436                 u16 handle = __le16_to_cpu(hci_cp->handle);
5437                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5438         } else {
5439                 conn = NULL;
5440         }
5441
5442         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5443         if (!cmd)
5444                 goto unlock;
5445
5446         cmd->cmd_complete(cmd, mgmt_status(status));
5447         mgmt_pending_remove(cmd);
5448
5449 unlock:
5450         hci_dev_unlock(hdev);
5451 }
5452
5453 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5454                          u16 len)
5455 {
5456         struct mgmt_cp_get_clock_info *cp = data;
5457         struct mgmt_rp_get_clock_info rp;
5458         struct hci_cp_read_clock hci_cp;
5459         struct mgmt_pending_cmd *cmd;
5460         struct hci_request req;
5461         struct hci_conn *conn;
5462         int err;
5463
5464         BT_DBG("%s", hdev->name);
5465
5466         memset(&rp, 0, sizeof(rp));
5467         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5468         rp.addr.type = cp->addr.type;
5469
5470         if (cp->addr.type != BDADDR_BREDR)
5471                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5472                                          MGMT_STATUS_INVALID_PARAMS,
5473                                          &rp, sizeof(rp));
5474
5475         hci_dev_lock(hdev);
5476
5477         if (!hdev_is_powered(hdev)) {
5478                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5479                                         MGMT_STATUS_NOT_POWERED, &rp,
5480                                         sizeof(rp));
5481                 goto unlock;
5482         }
5483
5484         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5485                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5486                                                &cp->addr.bdaddr);
5487                 if (!conn || conn->state != BT_CONNECTED) {
5488                         err = mgmt_cmd_complete(sk, hdev->id,
5489                                                 MGMT_OP_GET_CLOCK_INFO,
5490                                                 MGMT_STATUS_NOT_CONNECTED,
5491                                                 &rp, sizeof(rp));
5492                         goto unlock;
5493                 }
5494         } else {
5495                 conn = NULL;
5496         }
5497
5498         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5499         if (!cmd) {
5500                 err = -ENOMEM;
5501                 goto unlock;
5502         }
5503
5504         cmd->cmd_complete = clock_info_cmd_complete;
5505
5506         hci_req_init(&req, hdev);
5507
5508         memset(&hci_cp, 0, sizeof(hci_cp));
5509         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5510
5511         if (conn) {
5512                 hci_conn_hold(conn);
5513                 cmd->user_data = hci_conn_get(conn);
5514
5515                 hci_cp.handle = cpu_to_le16(conn->handle);
5516                 hci_cp.which = 0x01; /* Piconet clock */
5517                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5518         }
5519
5520         err = hci_req_run(&req, get_clock_info_complete);
5521         if (err < 0)
5522                 mgmt_pending_remove(cmd);
5523
5524 unlock:
5525         hci_dev_unlock(hdev);
5526         return err;
5527 }
5528
5529 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5530 {
5531         struct hci_conn *conn;
5532
5533         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5534         if (!conn)
5535                 return false;
5536
5537         if (conn->dst_type != type)
5538                 return false;
5539
5540         if (conn->state != BT_CONNECTED)
5541                 return false;
5542
5543         return true;
5544 }
5545
5546 /* This function requires the caller holds hdev->lock */
5547 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5548                                u8 addr_type, u8 auto_connect)
5549 {
5550         struct hci_conn_params *params;
5551
5552         params = hci_conn_params_add(hdev, addr, addr_type);
5553         if (!params)
5554                 return -EIO;
5555
5556         if (params->auto_connect == auto_connect)
5557                 return 0;
5558
5559         list_del_init(&params->action);
5560
5561         switch (auto_connect) {
5562         case HCI_AUTO_CONN_DISABLED:
5563         case HCI_AUTO_CONN_LINK_LOSS:
5564                 /* If auto connect is being disabled when we're trying to
5565                  * connect to device, keep connecting.
5566                  */
5567                 if (params->explicit_connect)
5568                         list_add(&params->action, &hdev->pend_le_conns);
5569                 break;
5570         case HCI_AUTO_CONN_REPORT:
5571                 if (params->explicit_connect)
5572                         list_add(&params->action, &hdev->pend_le_conns);
5573                 else
5574                         list_add(&params->action, &hdev->pend_le_reports);
5575                 break;
5576         case HCI_AUTO_CONN_DIRECT:
5577         case HCI_AUTO_CONN_ALWAYS:
5578                 if (!is_connected(hdev, addr, addr_type))
5579                         list_add(&params->action, &hdev->pend_le_conns);
5580                 break;
5581         }
5582
5583         params->auto_connect = auto_connect;
5584
5585         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5586                auto_connect);
5587
5588         return 0;
5589 }
5590
5591 static void device_added(struct sock *sk, struct hci_dev *hdev,
5592                          bdaddr_t *bdaddr, u8 type, u8 action)
5593 {
5594         struct mgmt_ev_device_added ev;
5595
5596         bacpy(&ev.addr.bdaddr, bdaddr);
5597         ev.addr.type = type;
5598         ev.action = action;
5599
5600         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5601 }
5602
5603 static int add_device(struct sock *sk, struct hci_dev *hdev,
5604                       void *data, u16 len)
5605 {
5606         struct mgmt_cp_add_device *cp = data;
5607         u8 auto_conn, addr_type;
5608         int err;
5609
5610         BT_DBG("%s", hdev->name);
5611
5612         if (!bdaddr_type_is_valid(cp->addr.type) ||
5613             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5614                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5615                                          MGMT_STATUS_INVALID_PARAMS,
5616                                          &cp->addr, sizeof(cp->addr));
5617
5618         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5619                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5620                                          MGMT_STATUS_INVALID_PARAMS,
5621                                          &cp->addr, sizeof(cp->addr));
5622
5623         hci_dev_lock(hdev);
5624
5625         if (cp->addr.type == BDADDR_BREDR) {
5626                 /* Only incoming connections action is supported for now */
5627                 if (cp->action != 0x01) {
5628                         err = mgmt_cmd_complete(sk, hdev->id,
5629                                                 MGMT_OP_ADD_DEVICE,
5630                                                 MGMT_STATUS_INVALID_PARAMS,
5631                                                 &cp->addr, sizeof(cp->addr));
5632                         goto unlock;
5633                 }
5634
5635                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5636                                           cp->addr.type);
5637                 if (err)
5638                         goto unlock;
5639
5640                 hci_req_update_scan(hdev);
5641
5642                 goto added;
5643         }
5644
5645         addr_type = le_addr_type(cp->addr.type);
5646
5647         if (cp->action == 0x02)
5648                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5649         else if (cp->action == 0x01)
5650                 auto_conn = HCI_AUTO_CONN_DIRECT;
5651         else
5652                 auto_conn = HCI_AUTO_CONN_REPORT;
5653
5654         /* Kernel internally uses conn_params with resolvable private
5655          * address, but Add Device allows only identity addresses.
5656          * Make sure it is enforced before calling
5657          * hci_conn_params_lookup.
5658          */
5659         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5660                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5661                                         MGMT_STATUS_INVALID_PARAMS,
5662                                         &cp->addr, sizeof(cp->addr));
5663                 goto unlock;
5664         }
5665
5666         /* If the connection parameters don't exist for this device,
5667          * they will be created and configured with defaults.
5668          */
5669         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5670                                 auto_conn) < 0) {
5671                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5672                                         MGMT_STATUS_FAILED, &cp->addr,
5673                                         sizeof(cp->addr));
5674                 goto unlock;
5675         }
5676
5677         hci_update_background_scan(hdev);
5678
5679 added:
5680         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5681
5682         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5683                                 MGMT_STATUS_SUCCESS, &cp->addr,
5684                                 sizeof(cp->addr));
5685
5686 unlock:
5687         hci_dev_unlock(hdev);
5688         return err;
5689 }
5690
5691 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5692                            bdaddr_t *bdaddr, u8 type)
5693 {
5694         struct mgmt_ev_device_removed ev;
5695
5696         bacpy(&ev.addr.bdaddr, bdaddr);
5697         ev.addr.type = type;
5698
5699         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5700 }
5701
5702 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5703                          void *data, u16 len)
5704 {
5705         struct mgmt_cp_remove_device *cp = data;
5706         int err;
5707
5708         BT_DBG("%s", hdev->name);
5709
5710         hci_dev_lock(hdev);
5711
5712         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5713                 struct hci_conn_params *params;
5714                 u8 addr_type;
5715
5716                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5717                         err = mgmt_cmd_complete(sk, hdev->id,
5718                                                 MGMT_OP_REMOVE_DEVICE,
5719                                                 MGMT_STATUS_INVALID_PARAMS,
5720                                                 &cp->addr, sizeof(cp->addr));
5721                         goto unlock;
5722                 }
5723
5724                 if (cp->addr.type == BDADDR_BREDR) {
5725                         err = hci_bdaddr_list_del(&hdev->whitelist,
5726                                                   &cp->addr.bdaddr,
5727                                                   cp->addr.type);
5728                         if (err) {
5729                                 err = mgmt_cmd_complete(sk, hdev->id,
5730                                                         MGMT_OP_REMOVE_DEVICE,
5731                                                         MGMT_STATUS_INVALID_PARAMS,
5732                                                         &cp->addr,
5733                                                         sizeof(cp->addr));
5734                                 goto unlock;
5735                         }
5736
5737                         hci_req_update_scan(hdev);
5738
5739                         device_removed(sk, hdev, &cp->addr.bdaddr,
5740                                        cp->addr.type);
5741                         goto complete;
5742                 }
5743
5744                 addr_type = le_addr_type(cp->addr.type);
5745
5746                 /* Kernel internally uses conn_params with resolvable private
5747                  * address, but Remove Device allows only identity addresses.
5748                  * Make sure it is enforced before calling
5749                  * hci_conn_params_lookup.
5750                  */
5751                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5752                         err = mgmt_cmd_complete(sk, hdev->id,
5753                                                 MGMT_OP_REMOVE_DEVICE,
5754                                                 MGMT_STATUS_INVALID_PARAMS,
5755                                                 &cp->addr, sizeof(cp->addr));
5756                         goto unlock;
5757                 }
5758
5759                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5760                                                 addr_type);
5761                 if (!params) {
5762                         err = mgmt_cmd_complete(sk, hdev->id,
5763                                                 MGMT_OP_REMOVE_DEVICE,
5764                                                 MGMT_STATUS_INVALID_PARAMS,
5765                                                 &cp->addr, sizeof(cp->addr));
5766                         goto unlock;
5767                 }
5768
5769                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5770                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5771                         err = mgmt_cmd_complete(sk, hdev->id,
5772                                                 MGMT_OP_REMOVE_DEVICE,
5773                                                 MGMT_STATUS_INVALID_PARAMS,
5774                                                 &cp->addr, sizeof(cp->addr));
5775                         goto unlock;
5776                 }
5777
5778                 list_del(&params->action);
5779                 list_del(&params->list);
5780                 kfree(params);
5781                 hci_update_background_scan(hdev);
5782
5783                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5784         } else {
5785                 struct hci_conn_params *p, *tmp;
5786                 struct bdaddr_list *b, *btmp;
5787
5788                 if (cp->addr.type) {
5789                         err = mgmt_cmd_complete(sk, hdev->id,
5790                                                 MGMT_OP_REMOVE_DEVICE,
5791                                                 MGMT_STATUS_INVALID_PARAMS,
5792                                                 &cp->addr, sizeof(cp->addr));
5793                         goto unlock;
5794                 }
5795
5796                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5797                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5798                         list_del(&b->list);
5799                         kfree(b);
5800                 }
5801
5802                 hci_req_update_scan(hdev);
5803
5804                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5805                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5806                                 continue;
5807                         device_removed(sk, hdev, &p->addr, p->addr_type);
5808                         if (p->explicit_connect) {
5809                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5810                                 continue;
5811                         }
5812                         list_del(&p->action);
5813                         list_del(&p->list);
5814                         kfree(p);
5815                 }
5816
5817                 BT_DBG("All LE connection parameters were removed");
5818
5819                 hci_update_background_scan(hdev);
5820         }
5821
5822 complete:
5823         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5824                                 MGMT_STATUS_SUCCESS, &cp->addr,
5825                                 sizeof(cp->addr));
5826 unlock:
5827         hci_dev_unlock(hdev);
5828         return err;
5829 }
5830
5831 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5832                            u16 len)
5833 {
5834         struct mgmt_cp_load_conn_param *cp = data;
5835         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5836                                      sizeof(struct mgmt_conn_param));
5837         u16 param_count, expected_len;
5838         int i;
5839
5840         if (!lmp_le_capable(hdev))
5841                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5842                                        MGMT_STATUS_NOT_SUPPORTED);
5843
5844         param_count = __le16_to_cpu(cp->param_count);
5845         if (param_count > max_param_count) {
5846                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5847                            param_count);
5848                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5849                                        MGMT_STATUS_INVALID_PARAMS);
5850         }
5851
5852         expected_len = struct_size(cp, params, param_count);
5853         if (expected_len != len) {
5854                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5855                            expected_len, len);
5856                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5857                                        MGMT_STATUS_INVALID_PARAMS);
5858         }
5859
5860         BT_DBG("%s param_count %u", hdev->name, param_count);
5861
5862         hci_dev_lock(hdev);
5863
5864         hci_conn_params_clear_disabled(hdev);
5865
5866         for (i = 0; i < param_count; i++) {
5867                 struct mgmt_conn_param *param = &cp->params[i];
5868                 struct hci_conn_params *hci_param;
5869                 u16 min, max, latency, timeout;
5870                 u8 addr_type;
5871
5872                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5873                        param->addr.type);
5874
5875                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5876                         addr_type = ADDR_LE_DEV_PUBLIC;
5877                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5878                         addr_type = ADDR_LE_DEV_RANDOM;
5879                 } else {
5880                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5881                         continue;
5882                 }
5883
5884                 min = le16_to_cpu(param->min_interval);
5885                 max = le16_to_cpu(param->max_interval);
5886                 latency = le16_to_cpu(param->latency);
5887                 timeout = le16_to_cpu(param->timeout);
5888
5889                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5890                        min, max, latency, timeout);
5891
5892                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5893                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5894                         continue;
5895                 }
5896
5897                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5898                                                 addr_type);
5899                 if (!hci_param) {
5900                         bt_dev_err(hdev, "failed to add connection parameters");
5901                         continue;
5902                 }
5903
5904                 hci_param->conn_min_interval = min;
5905                 hci_param->conn_max_interval = max;
5906                 hci_param->conn_latency = latency;
5907                 hci_param->supervision_timeout = timeout;
5908         }
5909
5910         hci_dev_unlock(hdev);
5911
5912         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5913                                  NULL, 0);
5914 }
5915
5916 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5917                                void *data, u16 len)
5918 {
5919         struct mgmt_cp_set_external_config *cp = data;
5920         bool changed;
5921         int err;
5922
5923         BT_DBG("%s", hdev->name);
5924
5925         if (hdev_is_powered(hdev))
5926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5927                                        MGMT_STATUS_REJECTED);
5928
5929         if (cp->config != 0x00 && cp->config != 0x01)
5930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5931                                          MGMT_STATUS_INVALID_PARAMS);
5932
5933         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5934                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5935                                        MGMT_STATUS_NOT_SUPPORTED);
5936
5937         hci_dev_lock(hdev);
5938
5939         if (cp->config)
5940                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5941         else
5942                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5943
5944         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5945         if (err < 0)
5946                 goto unlock;
5947
5948         if (!changed)
5949                 goto unlock;
5950
5951         err = new_options(hdev, sk);
5952
5953         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5954                 mgmt_index_removed(hdev);
5955
5956                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5957                         hci_dev_set_flag(hdev, HCI_CONFIG);
5958                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5959
5960                         queue_work(hdev->req_workqueue, &hdev->power_on);
5961                 } else {
5962                         set_bit(HCI_RAW, &hdev->flags);
5963                         mgmt_index_added(hdev);
5964                 }
5965         }
5966
5967 unlock:
5968         hci_dev_unlock(hdev);
5969         return err;
5970 }
5971
5972 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5973                               void *data, u16 len)
5974 {
5975         struct mgmt_cp_set_public_address *cp = data;
5976         bool changed;
5977         int err;
5978
5979         BT_DBG("%s", hdev->name);
5980
5981         if (hdev_is_powered(hdev))
5982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5983                                        MGMT_STATUS_REJECTED);
5984
5985         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5986                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5987                                        MGMT_STATUS_INVALID_PARAMS);
5988
5989         if (!hdev->set_bdaddr)
5990                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5991                                        MGMT_STATUS_NOT_SUPPORTED);
5992
5993         hci_dev_lock(hdev);
5994
5995         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5996         bacpy(&hdev->public_addr, &cp->bdaddr);
5997
5998         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5999         if (err < 0)
6000                 goto unlock;
6001
6002         if (!changed)
6003                 goto unlock;
6004
6005         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6006                 err = new_options(hdev, sk);
6007
6008         if (is_configured(hdev)) {
6009                 mgmt_index_removed(hdev);
6010
6011                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6012
6013                 hci_dev_set_flag(hdev, HCI_CONFIG);
6014                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6015
6016                 queue_work(hdev->req_workqueue, &hdev->power_on);
6017         }
6018
6019 unlock:
6020         hci_dev_unlock(hdev);
6021         return err;
6022 }
6023
6024 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6025                                              u16 opcode, struct sk_buff *skb)
6026 {
6027         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6028         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6029         u8 *h192, *r192, *h256, *r256;
6030         struct mgmt_pending_cmd *cmd;
6031         u16 eir_len;
6032         int err;
6033
6034         BT_DBG("%s status %u", hdev->name, status);
6035
6036         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6037         if (!cmd)
6038                 return;
6039
6040         mgmt_cp = cmd->param;
6041
6042         if (status) {
6043                 status = mgmt_status(status);
6044                 eir_len = 0;
6045
6046                 h192 = NULL;
6047                 r192 = NULL;
6048                 h256 = NULL;
6049                 r256 = NULL;
6050         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6051                 struct hci_rp_read_local_oob_data *rp;
6052
6053                 if (skb->len != sizeof(*rp)) {
6054                         status = MGMT_STATUS_FAILED;
6055                         eir_len = 0;
6056                 } else {
6057                         status = MGMT_STATUS_SUCCESS;
6058                         rp = (void *)skb->data;
6059
6060                         eir_len = 5 + 18 + 18;
6061                         h192 = rp->hash;
6062                         r192 = rp->rand;
6063                         h256 = NULL;
6064                         r256 = NULL;
6065                 }
6066         } else {
6067                 struct hci_rp_read_local_oob_ext_data *rp;
6068
6069                 if (skb->len != sizeof(*rp)) {
6070                         status = MGMT_STATUS_FAILED;
6071                         eir_len = 0;
6072                 } else {
6073                         status = MGMT_STATUS_SUCCESS;
6074                         rp = (void *)skb->data;
6075
6076                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6077                                 eir_len = 5 + 18 + 18;
6078                                 h192 = NULL;
6079                                 r192 = NULL;
6080                         } else {
6081                                 eir_len = 5 + 18 + 18 + 18 + 18;
6082                                 h192 = rp->hash192;
6083                                 r192 = rp->rand192;
6084                         }
6085
6086                         h256 = rp->hash256;
6087                         r256 = rp->rand256;
6088                 }
6089         }
6090
6091         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6092         if (!mgmt_rp)
6093                 goto done;
6094
6095         if (status)
6096                 goto send_rsp;
6097
6098         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6099                                   hdev->dev_class, 3);
6100
6101         if (h192 && r192) {
6102                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6103                                           EIR_SSP_HASH_C192, h192, 16);
6104                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6105                                           EIR_SSP_RAND_R192, r192, 16);
6106         }
6107
6108         if (h256 && r256) {
6109                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6110                                           EIR_SSP_HASH_C256, h256, 16);
6111                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6112                                           EIR_SSP_RAND_R256, r256, 16);
6113         }
6114
6115 send_rsp:
6116         mgmt_rp->type = mgmt_cp->type;
6117         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6118
6119         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6120                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6121                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6122         if (err < 0 || status)
6123                 goto done;
6124
6125         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6126
6127         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6128                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6129                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6130 done:
6131         kfree(mgmt_rp);
6132         mgmt_pending_remove(cmd);
6133 }
6134
6135 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6136                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6137 {
6138         struct mgmt_pending_cmd *cmd;
6139         struct hci_request req;
6140         int err;
6141
6142         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6143                                cp, sizeof(*cp));
6144         if (!cmd)
6145                 return -ENOMEM;
6146
6147         hci_req_init(&req, hdev);
6148
6149         if (bredr_sc_enabled(hdev))
6150                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6151         else
6152                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6153
6154         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6155         if (err < 0) {
6156                 mgmt_pending_remove(cmd);
6157                 return err;
6158         }
6159
6160         return 0;
6161 }
6162
6163 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6164                                    void *data, u16 data_len)
6165 {
6166         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6167         struct mgmt_rp_read_local_oob_ext_data *rp;
6168         size_t rp_len;
6169         u16 eir_len;
6170         u8 status, flags, role, addr[7], hash[16], rand[16];
6171         int err;
6172
6173         BT_DBG("%s", hdev->name);
6174
6175         if (hdev_is_powered(hdev)) {
6176                 switch (cp->type) {
6177                 case BIT(BDADDR_BREDR):
6178                         status = mgmt_bredr_support(hdev);
6179                         if (status)
6180                                 eir_len = 0;
6181                         else
6182                                 eir_len = 5;
6183                         break;
6184                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6185                         status = mgmt_le_support(hdev);
6186                         if (status)
6187                                 eir_len = 0;
6188                         else
6189                                 eir_len = 9 + 3 + 18 + 18 + 3;
6190                         break;
6191                 default:
6192                         status = MGMT_STATUS_INVALID_PARAMS;
6193                         eir_len = 0;
6194                         break;
6195                 }
6196         } else {
6197                 status = MGMT_STATUS_NOT_POWERED;
6198                 eir_len = 0;
6199         }
6200
6201         rp_len = sizeof(*rp) + eir_len;
6202         rp = kmalloc(rp_len, GFP_ATOMIC);
6203         if (!rp)
6204                 return -ENOMEM;
6205
6206         if (status)
6207                 goto complete;
6208
6209         hci_dev_lock(hdev);
6210
6211         eir_len = 0;
6212         switch (cp->type) {
6213         case BIT(BDADDR_BREDR):
6214                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6215                         err = read_local_ssp_oob_req(hdev, sk, cp);
6216                         hci_dev_unlock(hdev);
6217                         if (!err)
6218                                 goto done;
6219
6220                         status = MGMT_STATUS_FAILED;
6221                         goto complete;
6222                 } else {
6223                         eir_len = eir_append_data(rp->eir, eir_len,
6224                                                   EIR_CLASS_OF_DEV,
6225                                                   hdev->dev_class, 3);
6226                 }
6227                 break;
6228         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6229                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6230                     smp_generate_oob(hdev, hash, rand) < 0) {
6231                         hci_dev_unlock(hdev);
6232                         status = MGMT_STATUS_FAILED;
6233                         goto complete;
6234                 }
6235
6236                 /* This should return the active RPA, but since the RPA
6237                  * is only programmed on demand, it is really hard to fill
6238                  * this in at the moment. For now disallow retrieving
6239                  * local out-of-band data when privacy is in use.
6240                  *
6241                  * Returning the identity address will not help here since
6242                  * pairing happens before the identity resolving key is
6243                  * known and thus the connection establishment happens
6244                  * based on the RPA and not the identity address.
6245                  */
6246                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6247                         hci_dev_unlock(hdev);
6248                         status = MGMT_STATUS_REJECTED;
6249                         goto complete;
6250                 }
6251
6252                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6253                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6254                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6255                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6256                         memcpy(addr, &hdev->static_addr, 6);
6257                         addr[6] = 0x01;
6258                 } else {
6259                         memcpy(addr, &hdev->bdaddr, 6);
6260                         addr[6] = 0x00;
6261                 }
6262
6263                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6264                                           addr, sizeof(addr));
6265
6266                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6267                         role = 0x02;
6268                 else
6269                         role = 0x01;
6270
6271                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6272                                           &role, sizeof(role));
6273
6274                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6275                         eir_len = eir_append_data(rp->eir, eir_len,
6276                                                   EIR_LE_SC_CONFIRM,
6277                                                   hash, sizeof(hash));
6278
6279                         eir_len = eir_append_data(rp->eir, eir_len,
6280                                                   EIR_LE_SC_RANDOM,
6281                                                   rand, sizeof(rand));
6282                 }
6283
6284                 flags = mgmt_get_adv_discov_flags(hdev);
6285
6286                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6287                         flags |= LE_AD_NO_BREDR;
6288
6289                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6290                                           &flags, sizeof(flags));
6291                 break;
6292         }
6293
6294         hci_dev_unlock(hdev);
6295
6296         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6297
6298         status = MGMT_STATUS_SUCCESS;
6299
6300 complete:
6301         rp->type = cp->type;
6302         rp->eir_len = cpu_to_le16(eir_len);
6303
6304         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6305                                 status, rp, sizeof(*rp) + eir_len);
6306         if (err < 0 || status)
6307                 goto done;
6308
6309         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6310                                  rp, sizeof(*rp) + eir_len,
6311                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6312
6313 done:
6314         kfree(rp);
6315
6316         return err;
6317 }
6318
6319 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6320 {
6321         u32 flags = 0;
6322
6323         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6324         flags |= MGMT_ADV_FLAG_DISCOV;
6325         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6326         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6327         flags |= MGMT_ADV_FLAG_APPEARANCE;
6328         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6329
6330         /* In extended adv TX_POWER returned from Set Adv Param
6331          * will be always valid.
6332          */
6333         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6334             ext_adv_capable(hdev))
6335                 flags |= MGMT_ADV_FLAG_TX_POWER;
6336
6337         if (ext_adv_capable(hdev)) {
6338                 flags |= MGMT_ADV_FLAG_SEC_1M;
6339
6340                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6341                         flags |= MGMT_ADV_FLAG_SEC_2M;
6342
6343                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6344                         flags |= MGMT_ADV_FLAG_SEC_CODED;
6345         }
6346
6347         return flags;
6348 }
6349
6350 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6351                              void *data, u16 data_len)
6352 {
6353         struct mgmt_rp_read_adv_features *rp;
6354         size_t rp_len;
6355         int err;
6356         struct adv_info *adv_instance;
6357         u32 supported_flags;
6358         u8 *instance;
6359
6360         BT_DBG("%s", hdev->name);
6361
6362         if (!lmp_le_capable(hdev))
6363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6364                                        MGMT_STATUS_REJECTED);
6365
6366         hci_dev_lock(hdev);
6367
6368         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6369         rp = kmalloc(rp_len, GFP_ATOMIC);
6370         if (!rp) {
6371                 hci_dev_unlock(hdev);
6372                 return -ENOMEM;
6373         }
6374
6375         supported_flags = get_supported_adv_flags(hdev);
6376
6377         rp->supported_flags = cpu_to_le32(supported_flags);
6378         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6379         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6380         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6381         rp->num_instances = hdev->adv_instance_cnt;
6382
6383         instance = rp->instance;
6384         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6385                 *instance = adv_instance->instance;
6386                 instance++;
6387         }
6388
6389         hci_dev_unlock(hdev);
6390
6391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6392                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6393
6394         kfree(rp);
6395
6396         return err;
6397 }
6398
6399 static u8 calculate_name_len(struct hci_dev *hdev)
6400 {
6401         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6402
6403         return append_local_name(hdev, buf, 0);
6404 }
6405
6406 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6407                            bool is_adv_data)
6408 {
6409         u8 max_len = HCI_MAX_AD_LENGTH;
6410
6411         if (is_adv_data) {
6412                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6413                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6414                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6415                         max_len -= 3;
6416
6417                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6418                         max_len -= 3;
6419         } else {
6420                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6421                         max_len -= calculate_name_len(hdev);
6422
6423                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6424                         max_len -= 4;
6425         }
6426
6427         return max_len;
6428 }
6429
6430 static bool flags_managed(u32 adv_flags)
6431 {
6432         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6433                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6434                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6435 }
6436
6437 static bool tx_power_managed(u32 adv_flags)
6438 {
6439         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6440 }
6441
6442 static bool name_managed(u32 adv_flags)
6443 {
6444         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6445 }
6446
6447 static bool appearance_managed(u32 adv_flags)
6448 {
6449         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6450 }
6451
6452 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6453                               u8 len, bool is_adv_data)
6454 {
6455         int i, cur_len;
6456         u8 max_len;
6457
6458         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6459
6460         if (len > max_len)
6461                 return false;
6462
6463         /* Make sure that the data is correctly formatted. */
6464         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6465                 cur_len = data[i];
6466
6467                 if (!cur_len)
6468                         continue;
6469
6470                 if (data[i + 1] == EIR_FLAGS &&
6471                     (!is_adv_data || flags_managed(adv_flags)))
6472                         return false;
6473
6474                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6475                         return false;
6476
6477                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6478                         return false;
6479
6480                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6481                         return false;
6482
6483                 if (data[i + 1] == EIR_APPEARANCE &&
6484                     appearance_managed(adv_flags))
6485                         return false;
6486
6487                 /* If the current field length would exceed the total data
6488                  * length, then it's invalid.
6489                  */
6490                 if (i + cur_len >= len)
6491                         return false;
6492         }
6493
6494         return true;
6495 }
6496
6497 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6498                                      u16 opcode)
6499 {
6500         struct mgmt_pending_cmd *cmd;
6501         struct mgmt_cp_add_advertising *cp;
6502         struct mgmt_rp_add_advertising rp;
6503         struct adv_info *adv_instance, *n;
6504         u8 instance;
6505
6506         BT_DBG("status %d", status);
6507
6508         hci_dev_lock(hdev);
6509
6510         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6511
6512         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6513                 if (!adv_instance->pending)
6514                         continue;
6515
6516                 if (!status) {
6517                         adv_instance->pending = false;
6518                         continue;
6519                 }
6520
6521                 instance = adv_instance->instance;
6522
6523                 if (hdev->cur_adv_instance == instance)
6524                         cancel_adv_timeout(hdev);
6525
6526                 hci_remove_adv_instance(hdev, instance);
6527                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6528         }
6529
6530         if (!cmd)
6531                 goto unlock;
6532
6533         cp = cmd->param;
6534         rp.instance = cp->instance;
6535
6536         if (status)
6537                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6538                                 mgmt_status(status));
6539         else
6540                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6541                                   mgmt_status(status), &rp, sizeof(rp));
6542
6543         mgmt_pending_remove(cmd);
6544
6545 unlock:
6546         hci_dev_unlock(hdev);
6547 }
6548
6549 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6550                            void *data, u16 data_len)
6551 {
6552         struct mgmt_cp_add_advertising *cp = data;
6553         struct mgmt_rp_add_advertising rp;
6554         u32 flags;
6555         u32 supported_flags, phy_flags;
6556         u8 status;
6557         u16 timeout, duration;
6558         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6559         u8 schedule_instance = 0;
6560         struct adv_info *next_instance;
6561         int err;
6562         struct mgmt_pending_cmd *cmd;
6563         struct hci_request req;
6564
6565         BT_DBG("%s", hdev->name);
6566
6567         status = mgmt_le_support(hdev);
6568         if (status)
6569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6570                                        status);
6571
6572         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6573                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6574                                        MGMT_STATUS_INVALID_PARAMS);
6575
6576         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6577                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6578                                        MGMT_STATUS_INVALID_PARAMS);
6579
6580         flags = __le32_to_cpu(cp->flags);
6581         timeout = __le16_to_cpu(cp->timeout);
6582         duration = __le16_to_cpu(cp->duration);
6583
6584         /* The current implementation only supports a subset of the specified
6585          * flags. Also need to check mutual exclusiveness of sec flags.
6586          */
6587         supported_flags = get_supported_adv_flags(hdev);
6588         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6589         if (flags & ~supported_flags ||
6590             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6591                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6592                                        MGMT_STATUS_INVALID_PARAMS);
6593
6594         hci_dev_lock(hdev);
6595
6596         if (timeout && !hdev_is_powered(hdev)) {
6597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6598                                       MGMT_STATUS_REJECTED);
6599                 goto unlock;
6600         }
6601
6602         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6603             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6604             pending_find(MGMT_OP_SET_LE, hdev)) {
6605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6606                                       MGMT_STATUS_BUSY);
6607                 goto unlock;
6608         }
6609
6610         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6611             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6612                                cp->scan_rsp_len, false)) {
6613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6614                                       MGMT_STATUS_INVALID_PARAMS);
6615                 goto unlock;
6616         }
6617
6618         err = hci_add_adv_instance(hdev, cp->instance, flags,
6619                                    cp->adv_data_len, cp->data,
6620                                    cp->scan_rsp_len,
6621                                    cp->data + cp->adv_data_len,
6622                                    timeout, duration);
6623         if (err < 0) {
6624                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6625                                       MGMT_STATUS_FAILED);
6626                 goto unlock;
6627         }
6628
6629         /* Only trigger an advertising added event if a new instance was
6630          * actually added.
6631          */
6632         if (hdev->adv_instance_cnt > prev_instance_cnt)
6633                 mgmt_advertising_added(sk, hdev, cp->instance);
6634
6635         if (hdev->cur_adv_instance == cp->instance) {
6636                 /* If the currently advertised instance is being changed then
6637                  * cancel the current advertising and schedule the next
6638                  * instance. If there is only one instance then the overridden
6639                  * advertising data will be visible right away.
6640                  */
6641                 cancel_adv_timeout(hdev);
6642
6643                 next_instance = hci_get_next_instance(hdev, cp->instance);
6644                 if (next_instance)
6645                         schedule_instance = next_instance->instance;
6646         } else if (!hdev->adv_instance_timeout) {
6647                 /* Immediately advertise the new instance if no other
6648                  * instance is currently being advertised.
6649                  */
6650                 schedule_instance = cp->instance;
6651         }
6652
6653         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6654          * there is no instance to be advertised then we have no HCI
6655          * communication to make. Simply return.
6656          */
6657         if (!hdev_is_powered(hdev) ||
6658             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6659             !schedule_instance) {
6660                 rp.instance = cp->instance;
6661                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6662                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6663                 goto unlock;
6664         }
6665
6666         /* We're good to go, update advertising data, parameters, and start
6667          * advertising.
6668          */
6669         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6670                                data_len);
6671         if (!cmd) {
6672                 err = -ENOMEM;
6673                 goto unlock;
6674         }
6675
6676         hci_req_init(&req, hdev);
6677
6678         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6679
6680         if (!err)
6681                 err = hci_req_run(&req, add_advertising_complete);
6682
6683         if (err < 0)
6684                 mgmt_pending_remove(cmd);
6685
6686 unlock:
6687         hci_dev_unlock(hdev);
6688
6689         return err;
6690 }
6691
6692 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6693                                         u16 opcode)
6694 {
6695         struct mgmt_pending_cmd *cmd;
6696         struct mgmt_cp_remove_advertising *cp;
6697         struct mgmt_rp_remove_advertising rp;
6698
6699         BT_DBG("status %d", status);
6700
6701         hci_dev_lock(hdev);
6702
6703         /* A failure status here only means that we failed to disable
6704          * advertising. Otherwise, the advertising instance has been removed,
6705          * so report success.
6706          */
6707         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6708         if (!cmd)
6709                 goto unlock;
6710
6711         cp = cmd->param;
6712         rp.instance = cp->instance;
6713
6714         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6715                           &rp, sizeof(rp));
6716         mgmt_pending_remove(cmd);
6717
6718 unlock:
6719         hci_dev_unlock(hdev);
6720 }
6721
6722 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6723                               void *data, u16 data_len)
6724 {
6725         struct mgmt_cp_remove_advertising *cp = data;
6726         struct mgmt_rp_remove_advertising rp;
6727         struct mgmt_pending_cmd *cmd;
6728         struct hci_request req;
6729         int err;
6730
6731         BT_DBG("%s", hdev->name);
6732
6733         hci_dev_lock(hdev);
6734
6735         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6736                 err = mgmt_cmd_status(sk, hdev->id,
6737                                       MGMT_OP_REMOVE_ADVERTISING,
6738                                       MGMT_STATUS_INVALID_PARAMS);
6739                 goto unlock;
6740         }
6741
6742         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6743             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6744             pending_find(MGMT_OP_SET_LE, hdev)) {
6745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6746                                       MGMT_STATUS_BUSY);
6747                 goto unlock;
6748         }
6749
6750         if (list_empty(&hdev->adv_instances)) {
6751                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6752                                       MGMT_STATUS_INVALID_PARAMS);
6753                 goto unlock;
6754         }
6755
6756         hci_req_init(&req, hdev);
6757
6758         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6759
6760         if (list_empty(&hdev->adv_instances))
6761                 __hci_req_disable_advertising(&req);
6762
6763         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6764          * flag is set or the device isn't powered then we have no HCI
6765          * communication to make. Simply return.
6766          */
6767         if (skb_queue_empty(&req.cmd_q) ||
6768             !hdev_is_powered(hdev) ||
6769             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6770                 hci_req_purge(&req);
6771                 rp.instance = cp->instance;
6772                 err = mgmt_cmd_complete(sk, hdev->id,
6773                                         MGMT_OP_REMOVE_ADVERTISING,
6774                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6775                 goto unlock;
6776         }
6777
6778         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6779                                data_len);
6780         if (!cmd) {
6781                 err = -ENOMEM;
6782                 goto unlock;
6783         }
6784
6785         err = hci_req_run(&req, remove_advertising_complete);
6786         if (err < 0)
6787                 mgmt_pending_remove(cmd);
6788
6789 unlock:
6790         hci_dev_unlock(hdev);
6791
6792         return err;
6793 }
6794
6795 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6796                              void *data, u16 data_len)
6797 {
6798         struct mgmt_cp_get_adv_size_info *cp = data;
6799         struct mgmt_rp_get_adv_size_info rp;
6800         u32 flags, supported_flags;
6801         int err;
6802
6803         BT_DBG("%s", hdev->name);
6804
6805         if (!lmp_le_capable(hdev))
6806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6807                                        MGMT_STATUS_REJECTED);
6808
6809         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6810                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6811                                        MGMT_STATUS_INVALID_PARAMS);
6812
6813         flags = __le32_to_cpu(cp->flags);
6814
6815         /* The current implementation only supports a subset of the specified
6816          * flags.
6817          */
6818         supported_flags = get_supported_adv_flags(hdev);
6819         if (flags & ~supported_flags)
6820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6821                                        MGMT_STATUS_INVALID_PARAMS);
6822
6823         rp.instance = cp->instance;
6824         rp.flags = cp->flags;
6825         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6826         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6827
6828         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6829                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6830
6831         return err;
6832 }
6833
6834 static const struct hci_mgmt_handler mgmt_handlers[] = {
6835         { NULL }, /* 0x0000 (no command) */
6836         { read_version,            MGMT_READ_VERSION_SIZE,
6837                                                 HCI_MGMT_NO_HDEV |
6838                                                 HCI_MGMT_UNTRUSTED },
6839         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6840                                                 HCI_MGMT_NO_HDEV |
6841                                                 HCI_MGMT_UNTRUSTED },
6842         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6843                                                 HCI_MGMT_NO_HDEV |
6844                                                 HCI_MGMT_UNTRUSTED },
6845         { read_controller_info,    MGMT_READ_INFO_SIZE,
6846                                                 HCI_MGMT_UNTRUSTED },
6847         { set_powered,             MGMT_SETTING_SIZE },
6848         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6849         { set_connectable,         MGMT_SETTING_SIZE },
6850         { set_fast_connectable,    MGMT_SETTING_SIZE },
6851         { set_bondable,            MGMT_SETTING_SIZE },
6852         { set_link_security,       MGMT_SETTING_SIZE },
6853         { set_ssp,                 MGMT_SETTING_SIZE },
6854         { set_hs,                  MGMT_SETTING_SIZE },
6855         { set_le,                  MGMT_SETTING_SIZE },
6856         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6857         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6858         { add_uuid,                MGMT_ADD_UUID_SIZE },
6859         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6860         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6861                                                 HCI_MGMT_VAR_LEN },
6862         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6863                                                 HCI_MGMT_VAR_LEN },
6864         { disconnect,              MGMT_DISCONNECT_SIZE },
6865         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6866         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6867         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6868         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6869         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6870         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6871         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6872         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6873         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6874         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6875         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6876         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6877         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6878                                                 HCI_MGMT_VAR_LEN },
6879         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6880         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6881         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6882         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6883         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6884         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6885         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6886         { set_advertising,         MGMT_SETTING_SIZE },
6887         { set_bredr,               MGMT_SETTING_SIZE },
6888         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6889         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6890         { set_secure_conn,         MGMT_SETTING_SIZE },
6891         { set_debug_keys,          MGMT_SETTING_SIZE },
6892         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6893         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6894                                                 HCI_MGMT_VAR_LEN },
6895         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6896         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6897         { add_device,              MGMT_ADD_DEVICE_SIZE },
6898         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6899         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6900                                                 HCI_MGMT_VAR_LEN },
6901         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6902                                                 HCI_MGMT_NO_HDEV |
6903                                                 HCI_MGMT_UNTRUSTED },
6904         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6905                                                 HCI_MGMT_UNCONFIGURED |
6906                                                 HCI_MGMT_UNTRUSTED },
6907         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6908                                                 HCI_MGMT_UNCONFIGURED },
6909         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6910                                                 HCI_MGMT_UNCONFIGURED },
6911         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6912                                                 HCI_MGMT_VAR_LEN },
6913         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6914         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6915                                                 HCI_MGMT_NO_HDEV |
6916                                                 HCI_MGMT_UNTRUSTED },
6917         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6918         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6919                                                 HCI_MGMT_VAR_LEN },
6920         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6921         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6922         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6923         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6924                                                 HCI_MGMT_UNTRUSTED },
6925         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6926         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6927         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6928 };
6929
6930 void mgmt_index_added(struct hci_dev *hdev)
6931 {
6932         struct mgmt_ev_ext_index ev;
6933
6934         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6935                 return;
6936
6937         switch (hdev->dev_type) {
6938         case HCI_PRIMARY:
6939                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6940                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6941                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6942                         ev.type = 0x01;
6943                 } else {
6944                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6945                                          HCI_MGMT_INDEX_EVENTS);
6946                         ev.type = 0x00;
6947                 }
6948                 break;
6949         case HCI_AMP:
6950                 ev.type = 0x02;
6951                 break;
6952         default:
6953                 return;
6954         }
6955
6956         ev.bus = hdev->bus;
6957
6958         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6959                          HCI_MGMT_EXT_INDEX_EVENTS);
6960 }
6961
6962 void mgmt_index_removed(struct hci_dev *hdev)
6963 {
6964         struct mgmt_ev_ext_index ev;
6965         u8 status = MGMT_STATUS_INVALID_INDEX;
6966
6967         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6968                 return;
6969
6970         switch (hdev->dev_type) {
6971         case HCI_PRIMARY:
6972                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6973
6974                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6975                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6976                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6977                         ev.type = 0x01;
6978                 } else {
6979                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6980                                          HCI_MGMT_INDEX_EVENTS);
6981                         ev.type = 0x00;
6982                 }
6983                 break;
6984         case HCI_AMP:
6985                 ev.type = 0x02;
6986                 break;
6987         default:
6988                 return;
6989         }
6990
6991         ev.bus = hdev->bus;
6992
6993         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6994                          HCI_MGMT_EXT_INDEX_EVENTS);
6995 }
6996
6997 /* This function requires the caller holds hdev->lock */
6998 static void restart_le_actions(struct hci_dev *hdev)
6999 {
7000         struct hci_conn_params *p;
7001
7002         list_for_each_entry(p, &hdev->le_conn_params, list) {
7003                 /* Needed for AUTO_OFF case where might not "really"
7004                  * have been powered off.
7005                  */
7006                 list_del_init(&p->action);
7007
7008                 switch (p->auto_connect) {
7009                 case HCI_AUTO_CONN_DIRECT:
7010                 case HCI_AUTO_CONN_ALWAYS:
7011                         list_add(&p->action, &hdev->pend_le_conns);
7012                         break;
7013                 case HCI_AUTO_CONN_REPORT:
7014                         list_add(&p->action, &hdev->pend_le_reports);
7015                         break;
7016                 default:
7017                         break;
7018                 }
7019         }
7020 }
7021
7022 void mgmt_power_on(struct hci_dev *hdev, int err)
7023 {
7024         struct cmd_lookup match = { NULL, hdev };
7025
7026         BT_DBG("err %d", err);
7027
7028         hci_dev_lock(hdev);
7029
7030         if (!err) {
7031                 restart_le_actions(hdev);
7032                 hci_update_background_scan(hdev);
7033         }
7034
7035         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7036
7037         new_settings(hdev, match.sk);
7038
7039         if (match.sk)
7040                 sock_put(match.sk);
7041
7042         hci_dev_unlock(hdev);
7043 }
7044
7045 void __mgmt_power_off(struct hci_dev *hdev)
7046 {
7047         struct cmd_lookup match = { NULL, hdev };
7048         u8 status, zero_cod[] = { 0, 0, 0 };
7049
7050         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7051
7052         /* If the power off is because of hdev unregistration let
7053          * use the appropriate INVALID_INDEX status. Otherwise use
7054          * NOT_POWERED. We cover both scenarios here since later in
7055          * mgmt_index_removed() any hci_conn callbacks will have already
7056          * been triggered, potentially causing misleading DISCONNECTED
7057          * status responses.
7058          */
7059         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7060                 status = MGMT_STATUS_INVALID_INDEX;
7061         else
7062                 status = MGMT_STATUS_NOT_POWERED;
7063
7064         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7065
7066         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7067                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7068                                    zero_cod, sizeof(zero_cod),
7069                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7070                 ext_info_changed(hdev, NULL);
7071         }
7072
7073         new_settings(hdev, match.sk);
7074
7075         if (match.sk)
7076                 sock_put(match.sk);
7077 }
7078
7079 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7080 {
7081         struct mgmt_pending_cmd *cmd;
7082         u8 status;
7083
7084         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7085         if (!cmd)
7086                 return;
7087
7088         if (err == -ERFKILL)
7089                 status = MGMT_STATUS_RFKILLED;
7090         else
7091                 status = MGMT_STATUS_FAILED;
7092
7093         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7094
7095         mgmt_pending_remove(cmd);
7096 }
7097
7098 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7099                        bool persistent)
7100 {
7101         struct mgmt_ev_new_link_key ev;
7102
7103         memset(&ev, 0, sizeof(ev));
7104
7105         ev.store_hint = persistent;
7106         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7107         ev.key.addr.type = BDADDR_BREDR;
7108         ev.key.type = key->type;
7109         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7110         ev.key.pin_len = key->pin_len;
7111
7112         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7113 }
7114
7115 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7116 {
7117         switch (ltk->type) {
7118         case SMP_LTK:
7119         case SMP_LTK_SLAVE:
7120                 if (ltk->authenticated)
7121                         return MGMT_LTK_AUTHENTICATED;
7122                 return MGMT_LTK_UNAUTHENTICATED;
7123         case SMP_LTK_P256:
7124                 if (ltk->authenticated)
7125                         return MGMT_LTK_P256_AUTH;
7126                 return MGMT_LTK_P256_UNAUTH;
7127         case SMP_LTK_P256_DEBUG:
7128                 return MGMT_LTK_P256_DEBUG;
7129         }
7130
7131         return MGMT_LTK_UNAUTHENTICATED;
7132 }
7133
7134 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7135 {
7136         struct mgmt_ev_new_long_term_key ev;
7137
7138         memset(&ev, 0, sizeof(ev));
7139
7140         /* Devices using resolvable or non-resolvable random addresses
7141          * without providing an identity resolving key don't require
7142          * to store long term keys. Their addresses will change the
7143          * next time around.
7144          *
7145          * Only when a remote device provides an identity address
7146          * make sure the long term key is stored. If the remote
7147          * identity is known, the long term keys are internally
7148          * mapped to the identity address. So allow static random
7149          * and public addresses here.
7150          */
7151         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7152             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7153                 ev.store_hint = 0x00;
7154         else
7155                 ev.store_hint = persistent;
7156
7157         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7158         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7159         ev.key.type = mgmt_ltk_type(key);
7160         ev.key.enc_size = key->enc_size;
7161         ev.key.ediv = key->ediv;
7162         ev.key.rand = key->rand;
7163
7164         if (key->type == SMP_LTK)
7165                 ev.key.master = 1;
7166
7167         /* Make sure we copy only the significant bytes based on the
7168          * encryption key size, and set the rest of the value to zeroes.
7169          */
7170         memcpy(ev.key.val, key->val, key->enc_size);
7171         memset(ev.key.val + key->enc_size, 0,
7172                sizeof(ev.key.val) - key->enc_size);
7173
7174         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7175 }
7176
7177 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7178 {
7179         struct mgmt_ev_new_irk ev;
7180
7181         memset(&ev, 0, sizeof(ev));
7182
7183         ev.store_hint = persistent;
7184
7185         bacpy(&ev.rpa, &irk->rpa);
7186         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7187         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7188         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7189
7190         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7191 }
7192
7193 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7194                    bool persistent)
7195 {
7196         struct mgmt_ev_new_csrk ev;
7197
7198         memset(&ev, 0, sizeof(ev));
7199
7200         /* Devices using resolvable or non-resolvable random addresses
7201          * without providing an identity resolving key don't require
7202          * to store signature resolving keys. Their addresses will change
7203          * the next time around.
7204          *
7205          * Only when a remote device provides an identity address
7206          * make sure the signature resolving key is stored. So allow
7207          * static random and public addresses here.
7208          */
7209         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7210             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7211                 ev.store_hint = 0x00;
7212         else
7213                 ev.store_hint = persistent;
7214
7215         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7216         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7217         ev.key.type = csrk->type;
7218         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7219
7220         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7221 }
7222
7223 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7224                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7225                          u16 max_interval, u16 latency, u16 timeout)
7226 {
7227         struct mgmt_ev_new_conn_param ev;
7228
7229         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7230                 return;
7231
7232         memset(&ev, 0, sizeof(ev));
7233         bacpy(&ev.addr.bdaddr, bdaddr);
7234         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7235         ev.store_hint = store_hint;
7236         ev.min_interval = cpu_to_le16(min_interval);
7237         ev.max_interval = cpu_to_le16(max_interval);
7238         ev.latency = cpu_to_le16(latency);
7239         ev.timeout = cpu_to_le16(timeout);
7240
7241         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7242 }
7243
7244 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7245                            u32 flags, u8 *name, u8 name_len)
7246 {
7247         char buf[512];
7248         struct mgmt_ev_device_connected *ev = (void *) buf;
7249         u16 eir_len = 0;
7250
7251         bacpy(&ev->addr.bdaddr, &conn->dst);
7252         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7253
7254         ev->flags = __cpu_to_le32(flags);
7255
7256         /* We must ensure that the EIR Data fields are ordered and
7257          * unique. Keep it simple for now and avoid the problem by not
7258          * adding any BR/EDR data to the LE adv.
7259          */
7260         if (conn->le_adv_data_len > 0) {
7261                 memcpy(&ev->eir[eir_len],
7262                        conn->le_adv_data, conn->le_adv_data_len);
7263                 eir_len = conn->le_adv_data_len;
7264         } else {
7265                 if (name_len > 0)
7266                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7267                                                   name, name_len);
7268
7269                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7270                         eir_len = eir_append_data(ev->eir, eir_len,
7271                                                   EIR_CLASS_OF_DEV,
7272                                                   conn->dev_class, 3);
7273         }
7274
7275         ev->eir_len = cpu_to_le16(eir_len);
7276
7277         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7278                     sizeof(*ev) + eir_len, NULL);
7279 }
7280
7281 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7282 {
7283         struct sock **sk = data;
7284
7285         cmd->cmd_complete(cmd, 0);
7286
7287         *sk = cmd->sk;
7288         sock_hold(*sk);
7289
7290         mgmt_pending_remove(cmd);
7291 }
7292
7293 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7294 {
7295         struct hci_dev *hdev = data;
7296         struct mgmt_cp_unpair_device *cp = cmd->param;
7297
7298         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7299
7300         cmd->cmd_complete(cmd, 0);
7301         mgmt_pending_remove(cmd);
7302 }
7303
7304 bool mgmt_powering_down(struct hci_dev *hdev)
7305 {
7306         struct mgmt_pending_cmd *cmd;
7307         struct mgmt_mode *cp;
7308
7309         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7310         if (!cmd)
7311                 return false;
7312
7313         cp = cmd->param;
7314         if (!cp->val)
7315                 return true;
7316
7317         return false;
7318 }
7319
7320 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7321                               u8 link_type, u8 addr_type, u8 reason,
7322                               bool mgmt_connected)
7323 {
7324         struct mgmt_ev_device_disconnected ev;
7325         struct sock *sk = NULL;
7326
7327         /* The connection is still in hci_conn_hash so test for 1
7328          * instead of 0 to know if this is the last one.
7329          */
7330         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7331                 cancel_delayed_work(&hdev->power_off);
7332                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7333         }
7334
7335         if (!mgmt_connected)
7336                 return;
7337
7338         if (link_type != ACL_LINK && link_type != LE_LINK)
7339                 return;
7340
7341         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7342
7343         bacpy(&ev.addr.bdaddr, bdaddr);
7344         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7345         ev.reason = reason;
7346
7347         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7348
7349         if (sk)
7350                 sock_put(sk);
7351
7352         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7353                              hdev);
7354 }
7355
7356 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7357                             u8 link_type, u8 addr_type, u8 status)
7358 {
7359         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7360         struct mgmt_cp_disconnect *cp;
7361         struct mgmt_pending_cmd *cmd;
7362
7363         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7364                              hdev);
7365
7366         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7367         if (!cmd)
7368                 return;
7369
7370         cp = cmd->param;
7371
7372         if (bacmp(bdaddr, &cp->addr.bdaddr))
7373                 return;
7374
7375         if (cp->addr.type != bdaddr_type)
7376                 return;
7377
7378         cmd->cmd_complete(cmd, mgmt_status(status));
7379         mgmt_pending_remove(cmd);
7380 }
7381
7382 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7383                          u8 addr_type, u8 status)
7384 {
7385         struct mgmt_ev_connect_failed ev;
7386
7387         /* The connection is still in hci_conn_hash so test for 1
7388          * instead of 0 to know if this is the last one.
7389          */
7390         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7391                 cancel_delayed_work(&hdev->power_off);
7392                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7393         }
7394
7395         bacpy(&ev.addr.bdaddr, bdaddr);
7396         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7397         ev.status = mgmt_status(status);
7398
7399         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7400 }
7401
7402 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7403 {
7404         struct mgmt_ev_pin_code_request ev;
7405
7406         bacpy(&ev.addr.bdaddr, bdaddr);
7407         ev.addr.type = BDADDR_BREDR;
7408         ev.secure = secure;
7409
7410         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7411 }
7412
7413 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7414                                   u8 status)
7415 {
7416         struct mgmt_pending_cmd *cmd;
7417
7418         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7419         if (!cmd)
7420                 return;
7421
7422         cmd->cmd_complete(cmd, mgmt_status(status));
7423         mgmt_pending_remove(cmd);
7424 }
7425
7426 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7427                                       u8 status)
7428 {
7429         struct mgmt_pending_cmd *cmd;
7430
7431         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7432         if (!cmd)
7433                 return;
7434
7435         cmd->cmd_complete(cmd, mgmt_status(status));
7436         mgmt_pending_remove(cmd);
7437 }
7438
7439 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7440                               u8 link_type, u8 addr_type, u32 value,
7441                               u8 confirm_hint)
7442 {
7443         struct mgmt_ev_user_confirm_request ev;
7444
7445         BT_DBG("%s", hdev->name);
7446
7447         bacpy(&ev.addr.bdaddr, bdaddr);
7448         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7449         ev.confirm_hint = confirm_hint;
7450         ev.value = cpu_to_le32(value);
7451
7452         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7453                           NULL);
7454 }
7455
7456 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7457                               u8 link_type, u8 addr_type)
7458 {
7459         struct mgmt_ev_user_passkey_request ev;
7460
7461         BT_DBG("%s", hdev->name);
7462
7463         bacpy(&ev.addr.bdaddr, bdaddr);
7464         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7465
7466         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7467                           NULL);
7468 }
7469
7470 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7471                                       u8 link_type, u8 addr_type, u8 status,
7472                                       u8 opcode)
7473 {
7474         struct mgmt_pending_cmd *cmd;
7475
7476         cmd = pending_find(opcode, hdev);
7477         if (!cmd)
7478                 return -ENOENT;
7479
7480         cmd->cmd_complete(cmd, mgmt_status(status));
7481         mgmt_pending_remove(cmd);
7482
7483         return 0;
7484 }
7485
7486 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7487                                      u8 link_type, u8 addr_type, u8 status)
7488 {
7489         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7490                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7491 }
7492
7493 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7494                                          u8 link_type, u8 addr_type, u8 status)
7495 {
7496         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7497                                           status,
7498                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7499 }
7500
7501 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7502                                      u8 link_type, u8 addr_type, u8 status)
7503 {
7504         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7505                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7506 }
7507
7508 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7509                                          u8 link_type, u8 addr_type, u8 status)
7510 {
7511         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7512                                           status,
7513                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7514 }
7515
7516 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7517                              u8 link_type, u8 addr_type, u32 passkey,
7518                              u8 entered)
7519 {
7520         struct mgmt_ev_passkey_notify ev;
7521
7522         BT_DBG("%s", hdev->name);
7523
7524         bacpy(&ev.addr.bdaddr, bdaddr);
7525         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7526         ev.passkey = __cpu_to_le32(passkey);
7527         ev.entered = entered;
7528
7529         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7530 }
7531
7532 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7533 {
7534         struct mgmt_ev_auth_failed ev;
7535         struct mgmt_pending_cmd *cmd;
7536         u8 status = mgmt_status(hci_status);
7537
7538         bacpy(&ev.addr.bdaddr, &conn->dst);
7539         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7540         ev.status = status;
7541
7542         cmd = find_pairing(conn);
7543
7544         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7545                     cmd ? cmd->sk : NULL);
7546
7547         if (cmd) {
7548                 cmd->cmd_complete(cmd, status);
7549                 mgmt_pending_remove(cmd);
7550         }
7551 }
7552
7553 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7554 {
7555         struct cmd_lookup match = { NULL, hdev };
7556         bool changed;
7557
7558         if (status) {
7559                 u8 mgmt_err = mgmt_status(status);
7560                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7561                                      cmd_status_rsp, &mgmt_err);
7562                 return;
7563         }
7564
7565         if (test_bit(HCI_AUTH, &hdev->flags))
7566                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7567         else
7568                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7569
7570         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7571                              &match);
7572
7573         if (changed)
7574                 new_settings(hdev, match.sk);
7575
7576         if (match.sk)
7577                 sock_put(match.sk);
7578 }
7579
7580 static void clear_eir(struct hci_request *req)
7581 {
7582         struct hci_dev *hdev = req->hdev;
7583         struct hci_cp_write_eir cp;
7584
7585         if (!lmp_ext_inq_capable(hdev))
7586                 return;
7587
7588         memset(hdev->eir, 0, sizeof(hdev->eir));
7589
7590         memset(&cp, 0, sizeof(cp));
7591
7592         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7593 }
7594
7595 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7596 {
7597         struct cmd_lookup match = { NULL, hdev };
7598         struct hci_request req;
7599         bool changed = false;
7600
7601         if (status) {
7602                 u8 mgmt_err = mgmt_status(status);
7603
7604                 if (enable && hci_dev_test_and_clear_flag(hdev,
7605                                                           HCI_SSP_ENABLED)) {
7606                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7607                         new_settings(hdev, NULL);
7608                 }
7609
7610                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7611                                      &mgmt_err);
7612                 return;
7613         }
7614
7615         if (enable) {
7616                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7617         } else {
7618                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7619                 if (!changed)
7620                         changed = hci_dev_test_and_clear_flag(hdev,
7621                                                               HCI_HS_ENABLED);
7622                 else
7623                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7624         }
7625
7626         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7627
7628         if (changed)
7629                 new_settings(hdev, match.sk);
7630
7631         if (match.sk)
7632                 sock_put(match.sk);
7633
7634         hci_req_init(&req, hdev);
7635
7636         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7637                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7638                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7639                                     sizeof(enable), &enable);
7640                 __hci_req_update_eir(&req);
7641         } else {
7642                 clear_eir(&req);
7643         }
7644
7645         hci_req_run(&req, NULL);
7646 }
7647
7648 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7649 {
7650         struct cmd_lookup *match = data;
7651
7652         if (match->sk == NULL) {
7653                 match->sk = cmd->sk;
7654                 sock_hold(match->sk);
7655         }
7656 }
7657
7658 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7659                                     u8 status)
7660 {
7661         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7662
7663         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7664         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7665         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7666
7667         if (!status) {
7668                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7669                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7670                 ext_info_changed(hdev, NULL);
7671         }
7672
7673         if (match.sk)
7674                 sock_put(match.sk);
7675 }
7676
7677 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7678 {
7679         struct mgmt_cp_set_local_name ev;
7680         struct mgmt_pending_cmd *cmd;
7681
7682         if (status)
7683                 return;
7684
7685         memset(&ev, 0, sizeof(ev));
7686         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7687         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7688
7689         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7690         if (!cmd) {
7691                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7692
7693                 /* If this is a HCI command related to powering on the
7694                  * HCI dev don't send any mgmt signals.
7695                  */
7696                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7697                         return;
7698         }
7699
7700         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7701                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7702         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7703 }
7704
7705 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7706 {
7707         int i;
7708
7709         for (i = 0; i < uuid_count; i++) {
7710                 if (!memcmp(uuid, uuids[i], 16))
7711                         return true;
7712         }
7713
7714         return false;
7715 }
7716
7717 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7718 {
7719         u16 parsed = 0;
7720
7721         while (parsed < eir_len) {
7722                 u8 field_len = eir[0];
7723                 u8 uuid[16];
7724                 int i;
7725
7726                 if (field_len == 0)
7727                         break;
7728
7729                 if (eir_len - parsed < field_len + 1)
7730                         break;
7731
7732                 switch (eir[1]) {
7733                 case EIR_UUID16_ALL:
7734                 case EIR_UUID16_SOME:
7735                         for (i = 0; i + 3 <= field_len; i += 2) {
7736                                 memcpy(uuid, bluetooth_base_uuid, 16);
7737                                 uuid[13] = eir[i + 3];
7738                                 uuid[12] = eir[i + 2];
7739                                 if (has_uuid(uuid, uuid_count, uuids))
7740                                         return true;
7741                         }
7742                         break;
7743                 case EIR_UUID32_ALL:
7744                 case EIR_UUID32_SOME:
7745                         for (i = 0; i + 5 <= field_len; i += 4) {
7746                                 memcpy(uuid, bluetooth_base_uuid, 16);
7747                                 uuid[15] = eir[i + 5];
7748                                 uuid[14] = eir[i + 4];
7749                                 uuid[13] = eir[i + 3];
7750                                 uuid[12] = eir[i + 2];
7751                                 if (has_uuid(uuid, uuid_count, uuids))
7752                                         return true;
7753                         }
7754                         break;
7755                 case EIR_UUID128_ALL:
7756                 case EIR_UUID128_SOME:
7757                         for (i = 0; i + 17 <= field_len; i += 16) {
7758                                 memcpy(uuid, eir + i + 2, 16);
7759                                 if (has_uuid(uuid, uuid_count, uuids))
7760                                         return true;
7761                         }
7762                         break;
7763                 }
7764
7765                 parsed += field_len + 1;
7766                 eir += field_len + 1;
7767         }
7768
7769         return false;
7770 }
7771
7772 static void restart_le_scan(struct hci_dev *hdev)
7773 {
7774         /* If controller is not scanning we are done. */
7775         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7776                 return;
7777
7778         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7779                        hdev->discovery.scan_start +
7780                        hdev->discovery.scan_duration))
7781                 return;
7782
7783         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7784                            DISCOV_LE_RESTART_DELAY);
7785 }
7786
7787 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7788                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7789 {
7790         /* If a RSSI threshold has been specified, and
7791          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7792          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7793          * is set, let it through for further processing, as we might need to
7794          * restart the scan.
7795          *
7796          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7797          * the results are also dropped.
7798          */
7799         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7800             (rssi == HCI_RSSI_INVALID ||
7801             (rssi < hdev->discovery.rssi &&
7802              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7803                 return  false;
7804
7805         if (hdev->discovery.uuid_count != 0) {
7806                 /* If a list of UUIDs is provided in filter, results with no
7807                  * matching UUID should be dropped.
7808                  */
7809                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7810                                    hdev->discovery.uuids) &&
7811                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7812                                    hdev->discovery.uuid_count,
7813                                    hdev->discovery.uuids))
7814                         return false;
7815         }
7816
7817         /* If duplicate filtering does not report RSSI changes, then restart
7818          * scanning to ensure updated result with updated RSSI values.
7819          */
7820         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7821                 restart_le_scan(hdev);
7822
7823                 /* Validate RSSI value against the RSSI threshold once more. */
7824                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7825                     rssi < hdev->discovery.rssi)
7826                         return false;
7827         }
7828
7829         return true;
7830 }
7831
7832 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7833                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7834                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7835 {
7836         char buf[512];
7837         struct mgmt_ev_device_found *ev = (void *)buf;
7838         size_t ev_size;
7839
7840         /* Don't send events for a non-kernel initiated discovery. With
7841          * LE one exception is if we have pend_le_reports > 0 in which
7842          * case we're doing passive scanning and want these events.
7843          */
7844         if (!hci_discovery_active(hdev)) {
7845                 if (link_type == ACL_LINK)
7846                         return;
7847                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7848                         return;
7849         }
7850
7851         if (hdev->discovery.result_filtering) {
7852                 /* We are using service discovery */
7853                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7854                                      scan_rsp_len))
7855                         return;
7856         }
7857
7858         if (hdev->discovery.limited) {
7859                 /* Check for limited discoverable bit */
7860                 if (dev_class) {
7861                         if (!(dev_class[1] & 0x20))
7862                                 return;
7863                 } else {
7864                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7865                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7866                                 return;
7867                 }
7868         }
7869
7870         /* Make sure that the buffer is big enough. The 5 extra bytes
7871          * are for the potential CoD field.
7872          */
7873         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7874                 return;
7875
7876         memset(buf, 0, sizeof(buf));
7877
7878         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7879          * RSSI value was reported as 0 when not available. This behavior
7880          * is kept when using device discovery. This is required for full
7881          * backwards compatibility with the API.
7882          *
7883          * However when using service discovery, the value 127 will be
7884          * returned when the RSSI is not available.
7885          */
7886         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7887             link_type == ACL_LINK)
7888                 rssi = 0;
7889
7890         bacpy(&ev->addr.bdaddr, bdaddr);
7891         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7892         ev->rssi = rssi;
7893         ev->flags = cpu_to_le32(flags);
7894
7895         if (eir_len > 0)
7896                 /* Copy EIR or advertising data into event */
7897                 memcpy(ev->eir, eir, eir_len);
7898
7899         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7900                                        NULL))
7901                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7902                                           dev_class, 3);
7903
7904         if (scan_rsp_len > 0)
7905                 /* Append scan response data to event */
7906                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7907
7908         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7909         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7910
7911         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7912 }
7913
7914 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7915                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7916 {
7917         struct mgmt_ev_device_found *ev;
7918         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7919         u16 eir_len;
7920
7921         ev = (struct mgmt_ev_device_found *) buf;
7922
7923         memset(buf, 0, sizeof(buf));
7924
7925         bacpy(&ev->addr.bdaddr, bdaddr);
7926         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7927         ev->rssi = rssi;
7928
7929         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7930                                   name_len);
7931
7932         ev->eir_len = cpu_to_le16(eir_len);
7933
7934         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7935 }
7936
7937 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7938 {
7939         struct mgmt_ev_discovering ev;
7940
7941         BT_DBG("%s discovering %u", hdev->name, discovering);
7942
7943         memset(&ev, 0, sizeof(ev));
7944         ev.type = hdev->discovery.type;
7945         ev.discovering = discovering;
7946
7947         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7948 }
7949
7950 static struct hci_mgmt_chan chan = {
7951         .channel        = HCI_CHANNEL_CONTROL,
7952         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7953         .handlers       = mgmt_handlers,
7954         .hdev_init      = mgmt_init_hdev,
7955 };
7956
7957 int mgmt_init(void)
7958 {
7959         return hci_mgmt_chan_register(&chan);
7960 }
7961
7962 void mgmt_exit(void)
7963 {
7964         hci_mgmt_chan_unregister(&chan);
7965 }