net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 223         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 225         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 226         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 227         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 228         MGMT_STATUS_FAILED,             /* Slot Violation */
 229         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 230         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 231         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 232         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 233         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 234         MGMT_STATUS_BUSY,               /* Controller Busy */
 235         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 236         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 237         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 238         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 239         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 240 };
 241
 242 static u8 mgmt_status(u8 hci_status)
 243 {
 244         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245                 return mgmt_status_table[hci_status];
 246
 247         return MGMT_STATUS_FAILED;
 248 }
 249
 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251                             u16 len, int flag)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, NULL);
 255 }
 256
 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, int flag, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                flag, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 void mgmt_fill_version_info(void *ver)
 280 {
 281         struct mgmt_rp_read_version *rp = ver;
 282
 283         rp->version = MGMT_VERSION;
 284         rp->revision = cpu_to_le16(MGMT_REVISION);
 285 }
 286
 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288                         u16 data_len)
 289 {
 290         struct mgmt_rp_read_version rp;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         mgmt_fill_version_info(&rp);
 295
 296         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297                                  &rp, sizeof(rp));
 298 }
 299
 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301                          u16 data_len)
 302 {
 303         struct mgmt_rp_read_commands *rp;
 304         u16 num_commands, num_events;
 305         size_t rp_size;
 306         int i, err;
 307
 308         BT_DBG("sock %p", sk);
 309
 310         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311                 num_commands = ARRAY_SIZE(mgmt_commands);
 312                 num_events = ARRAY_SIZE(mgmt_events);
 313         } else {
 314                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316         }
 317
 318         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320         rp = kmalloc(rp_size, GFP_KERNEL);
 321         if (!rp)
 322                 return -ENOMEM;
 323
 324         rp->num_commands = cpu_to_le16(num_commands);
 325         rp->num_events = cpu_to_le16(num_events);
 326
 327         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328                 __le16 *opcode = rp->opcodes;
 329
 330                 for (i = 0; i < num_commands; i++, opcode++)
 331                         put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333                 for (i = 0; i < num_events; i++, opcode++)
 334                         put_unaligned_le16(mgmt_events[i], opcode);
 335         } else {
 336                 __le16 *opcode = rp->opcodes;
 337
 338                 for (i = 0; i < num_commands; i++, opcode++)
 339                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341                 for (i = 0; i < num_events; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343         }
 344
 345         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346                                 rp, rp_size);
 347         kfree(rp);
 348
 349         return err;
 350 }
 351
 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353                            u16 data_len)
 354 {
 355         struct mgmt_rp_read_index_list *rp;
 356         struct hci_dev *d;
 357         size_t rp_len;
 358         u16 count;
 359         int err;
 360
 361         BT_DBG("sock %p", sk);
 362
 363         read_lock(&hci_dev_list_lock);
 364
 365         count = 0;
 366         list_for_each_entry(d, &hci_dev_list, list) {
 367                 if (d->dev_type == HCI_PRIMARY &&
 368                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369                         count++;
 370         }
 371
 372         rp_len = sizeof(*rp) + (2 * count);
 373         rp = kmalloc(rp_len, GFP_ATOMIC);
 374         if (!rp) {
 375                 read_unlock(&hci_dev_list_lock);
 376                 return -ENOMEM;
 377         }
 378
 379         count = 0;
 380         list_for_each_entry(d, &hci_dev_list, list) {
 381                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 382                     hci_dev_test_flag(d, HCI_CONFIG) ||
 383                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384                         continue;
 385
 386                 /* Devices marked as raw-only are neither configured
 387                  * nor unconfigured controllers.
 388                  */
 389                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390                         continue;
 391
 392                 if (d->dev_type == HCI_PRIMARY &&
 393                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394                         rp->index[count++] = cpu_to_le16(d->id);
 395                         BT_DBG("Added hci%u", d->id);
 396                 }
 397         }
 398
 399         rp->num_controllers = cpu_to_le16(count);
 400         rp_len = sizeof(*rp) + (2 * count);
 401
 402         read_unlock(&hci_dev_list_lock);
 403
 404         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405                                 0, rp, rp_len);
 406
 407         kfree(rp);
 408
 409         return err;
 410 }
 411
 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413                                   void *data, u16 data_len)
 414 {
 415         struct mgmt_rp_read_unconf_index_list *rp;
 416         struct hci_dev *d;
 417         size_t rp_len;
 418         u16 count;
 419         int err;
 420
 421         BT_DBG("sock %p", sk);
 422
 423         read_lock(&hci_dev_list_lock);
 424
 425         count = 0;
 426         list_for_each_entry(d, &hci_dev_list, list) {
 427                 if (d->dev_type == HCI_PRIMARY &&
 428                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429                         count++;
 430         }
 431
 432         rp_len = sizeof(*rp) + (2 * count);
 433         rp = kmalloc(rp_len, GFP_ATOMIC);
 434         if (!rp) {
 435                 read_unlock(&hci_dev_list_lock);
 436                 return -ENOMEM;
 437         }
 438
 439         count = 0;
 440         list_for_each_entry(d, &hci_dev_list, list) {
 441                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 442                     hci_dev_test_flag(d, HCI_CONFIG) ||
 443                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444                         continue;
 445
 446                 /* Devices marked as raw-only are neither configured
 447                  * nor unconfigured controllers.
 448                  */
 449                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450                         continue;
 451
 452                 if (d->dev_type == HCI_PRIMARY &&
 453                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454                         rp->index[count++] = cpu_to_le16(d->id);
 455                         BT_DBG("Added hci%u", d->id);
 456                 }
 457         }
 458
 459         rp->num_controllers = cpu_to_le16(count);
 460         rp_len = sizeof(*rp) + (2 * count);
 461
 462         read_unlock(&hci_dev_list_lock);
 463
 464         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467         kfree(rp);
 468
 469         return err;
 470 }
 471
 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473                                void *data, u16 data_len)
 474 {
 475         struct mgmt_rp_read_ext_index_list *rp;
 476         struct hci_dev *d;
 477         size_t rp_len;
 478         u16 count;
 479         int err;
 480
 481         BT_DBG("sock %p", sk);
 482
 483         read_lock(&hci_dev_list_lock);
 484
 485         count = 0;
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 488                         count++;
 489         }
 490
 491         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 492         rp = kmalloc(rp_len, GFP_ATOMIC);
 493         if (!rp) {
 494                 read_unlock(&hci_dev_list_lock);
 495                 return -ENOMEM;
 496         }
 497
 498         count = 0;
 499         list_for_each_entry(d, &hci_dev_list, list) {
 500                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 501                     hci_dev_test_flag(d, HCI_CONFIG) ||
 502                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 503                         continue;
 504
 505                 /* Devices marked as raw-only are neither configured
 506                  * nor unconfigured controllers.
 507                  */
 508                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 509                         continue;
 510
 511                 if (d->dev_type == HCI_PRIMARY) {
 512                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 513                                 rp->entry[count].type = 0x01;
 514                         else
 515                                 rp->entry[count].type = 0x00;
 516                 } else if (d->dev_type == HCI_AMP) {
 517                         rp->entry[count].type = 0x02;
 518                 } else {
 519                         continue;
 520                 }
 521
 522                 rp->entry[count].bus = d->bus;
 523                 rp->entry[count++].index = cpu_to_le16(d->id);
 524                 BT_DBG("Added hci%u", d->id);
 525         }
 526
 527         rp->num_controllers = cpu_to_le16(count);
 528         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 542
 543         kfree(rp);
 544
 545         return err;
 546 }
 547
 548 static bool is_configured(struct hci_dev *hdev)
 549 {
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 return false;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 return false;
 557
 558         return true;
 559 }
 560
 561 static __le32 get_missing_options(struct hci_dev *hdev)
 562 {
 563         u32 options = 0;
 564
 565         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 566             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 567                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 568
 569         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 570             !bacmp(&hdev->public_addr, BDADDR_ANY))
 571                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573         return cpu_to_le32(options);
 574 }
 575
 576 static int new_options(struct hci_dev *hdev, struct sock *skip)
 577 {
 578         __le32 options = get_missing_options(hdev);
 579
 580         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582 }
 583
 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585 {
 586         __le32 options = get_missing_options(hdev);
 587
 588         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589                                  sizeof(options));
 590 }
 591
 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593                             void *data, u16 data_len)
 594 {
 595         struct mgmt_rp_read_config_info rp;
 596         u32 options = 0;
 597
 598         BT_DBG("sock %p %s", sk, hdev->name);
 599
 600         hci_dev_lock(hdev);
 601
 602         memset(&rp, 0, sizeof(rp));
 603         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if (hdev->set_bdaddr)
 609                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611         rp.supported_options = cpu_to_le32(options);
 612         rp.missing_options = get_missing_options(hdev);
 613
 614         hci_dev_unlock(hdev);
 615
 616         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617                                  &rp, sizeof(rp));
 618 }
 619
 620 static u32 get_supported_settings(struct hci_dev *hdev)
 621 {
 622         u32 settings = 0;
 623
 624         settings |= MGMT_SETTING_POWERED;
 625         settings |= MGMT_SETTING_BONDABLE;
 626         settings |= MGMT_SETTING_DEBUG_KEYS;
 627         settings |= MGMT_SETTING_CONNECTABLE;
 628         settings |= MGMT_SETTING_DISCOVERABLE;
 629
 630         if (lmp_bredr_capable(hdev)) {
 631                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 632                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 633                 settings |= MGMT_SETTING_BREDR;
 634                 settings |= MGMT_SETTING_LINK_SECURITY;
 635
 636                 if (lmp_ssp_capable(hdev)) {
 637                         settings |= MGMT_SETTING_SSP;
 638                         settings |= MGMT_SETTING_HS;
 639                 }
 640
 641                 if (lmp_sc_capable(hdev))
 642                         settings |= MGMT_SETTING_SECURE_CONN;
 643         }
 644
 645         if (lmp_le_capable(hdev)) {
 646                 settings |= MGMT_SETTING_LE;
 647                 settings |= MGMT_SETTING_ADVERTISING;
 648                 settings |= MGMT_SETTING_SECURE_CONN;
 649                 settings |= MGMT_SETTING_PRIVACY;
 650                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 651         }
 652
 653         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 654             hdev->set_bdaddr)
 655                 settings |= MGMT_SETTING_CONFIGURATION;
 656
 657         return settings;
 658 }
 659
 660 static u32 get_current_settings(struct hci_dev *hdev)
 661 {
 662         u32 settings = 0;
 663
 664         if (hdev_is_powered(hdev))
 665                 settings |= MGMT_SETTING_POWERED;
 666
 667         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 668                 settings |= MGMT_SETTING_CONNECTABLE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 671                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 672
 673         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 674                 settings |= MGMT_SETTING_DISCOVERABLE;
 675
 676         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 677                 settings |= MGMT_SETTING_BONDABLE;
 678
 679         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 680                 settings |= MGMT_SETTING_BREDR;
 681
 682         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 683                 settings |= MGMT_SETTING_LE;
 684
 685         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 686                 settings |= MGMT_SETTING_LINK_SECURITY;
 687
 688         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 689                 settings |= MGMT_SETTING_SSP;
 690
 691         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 692                 settings |= MGMT_SETTING_HS;
 693
 694         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 695                 settings |= MGMT_SETTING_ADVERTISING;
 696
 697         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 698                 settings |= MGMT_SETTING_SECURE_CONN;
 699
 700         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 701                 settings |= MGMT_SETTING_DEBUG_KEYS;
 702
 703         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 704                 settings |= MGMT_SETTING_PRIVACY;
 705
 706         /* The current setting for static address has two purposes. The
 707          * first is to indicate if the static address will be used and
 708          * the second is to indicate if it is actually set.
 709          *
 710          * This means if the static address is not configured, this flag
 711          * will never be set. If the address is configured, then if the
 712          * address is actually used decides if the flag is set or not.
 713          *
 714          * For single mode LE only controllers and dual-mode controllers
 715          * with BR/EDR disabled, the existence of the static address will
 716          * be evaluated.
 717          */
 718         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 719             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 720             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 721                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 722                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 723         }
 724
 725         return settings;
 726 }
 727
 728 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 729 {
 730         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 731 }
 732
 733 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 734                                                   struct hci_dev *hdev,
 735                                                   const void *data)
 736 {
 737         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 738 }
 739
 740 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 741 {
 742         struct mgmt_pending_cmd *cmd;
 743
 744         /* If there's a pending mgmt command the flags will not yet have
 745          * their final values, so check for this first.
 746          */
 747         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 748         if (cmd) {
 749                 struct mgmt_mode *cp = cmd->param;
 750                 if (cp->val == 0x01)
 751                         return LE_AD_GENERAL;
 752                 else if (cp->val == 0x02)
 753                         return LE_AD_LIMITED;
 754         } else {
 755                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 756                         return LE_AD_LIMITED;
 757                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 758                         return LE_AD_GENERAL;
 759         }
 760
 761         return 0;
 762 }
 763
 764 bool mgmt_get_connectable(struct hci_dev *hdev)
 765 {
 766         struct mgmt_pending_cmd *cmd;
 767
 768         /* If there's a pending mgmt command the flag will not yet have
 769          * it's final value, so check for this first.
 770          */
 771         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 772         if (cmd) {
 773                 struct mgmt_mode *cp = cmd->param;
 774
 775                 return cp->val;
 776         }
 777
 778         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 779 }
 780
 781 static void service_cache_off(struct work_struct *work)
 782 {
 783         struct hci_dev *hdev = container_of(work, struct hci_dev,
 784                                             service_cache.work);
 785         struct hci_request req;
 786
 787         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 788                 return;
 789
 790         hci_req_init(&req, hdev);
 791
 792         hci_dev_lock(hdev);
 793
 794         __hci_req_update_eir(&req);
 795         __hci_req_update_class(&req);
 796
 797         hci_dev_unlock(hdev);
 798
 799         hci_req_run(&req, NULL);
 800 }
 801
 802 static void rpa_expired(struct work_struct *work)
 803 {
 804         struct hci_dev *hdev = container_of(work, struct hci_dev,
 805                                             rpa_expired.work);
 806         struct hci_request req;
 807
 808         BT_DBG("");
 809
 810         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 811
 812         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 813                 return;
 814
 815         /* The generation of a new RPA and programming it into the
 816          * controller happens in the hci_req_enable_advertising()
 817          * function.
 818          */
 819         hci_req_init(&req, hdev);
 820         __hci_req_enable_advertising(&req);
 821         hci_req_run(&req, NULL);
 822 }
 823
 824 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 825 {
 826         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 827                 return;
 828
 829         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 830         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 831
 832         /* Non-mgmt controlled devices get this bit set
 833          * implicitly so that pairing works for them, however
 834          * for mgmt we require user-space to explicitly enable
 835          * it
 836          */
 837         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 838 }
 839
 840 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 841                                 void *data, u16 data_len)
 842 {
 843         struct mgmt_rp_read_info rp;
 844
 845         BT_DBG("sock %p %s", sk, hdev->name);
 846
 847         hci_dev_lock(hdev);
 848
 849         memset(&rp, 0, sizeof(rp));
 850
 851         bacpy(&rp.bdaddr, &hdev->bdaddr);
 852
 853         rp.version = hdev->hci_ver;
 854         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 855
 856         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 857         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 858
 859         memcpy(rp.dev_class, hdev->dev_class, 3);
 860
 861         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 862         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 863
 864         hci_dev_unlock(hdev);
 865
 866         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 867                                  sizeof(rp));
 868 }
 869
 870 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 871 {
 872         u16 eir_len = 0;
 873         size_t name_len;
 874
 875         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 876                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
 877                                           hdev->dev_class, 3);
 878
 879         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 880                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
 881                                           hdev->appearance);
 882
 883         name_len = strlen(hdev->dev_name);
 884         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
 885                                   hdev->dev_name, name_len);
 886
 887         name_len = strlen(hdev->short_name);
 888         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
 889                                   hdev->short_name, name_len);
 890
 891         return eir_len;
 892 }
 893
 894 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
 895                                     void *data, u16 data_len)
 896 {
 897         char buf[512];
 898         struct mgmt_rp_read_ext_info *rp = (void *)buf;
 899         u16 eir_len;
 900
 901         BT_DBG("sock %p %s", sk, hdev->name);
 902
 903         memset(&buf, 0, sizeof(buf));
 904
 905         hci_dev_lock(hdev);
 906
 907         bacpy(&rp->bdaddr, &hdev->bdaddr);
 908
 909         rp->version = hdev->hci_ver;
 910         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
 911
 912         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
 913         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
 914
 915
 916         eir_len = append_eir_data_to_buf(hdev, rp->eir);
 917         rp->eir_len = cpu_to_le16(eir_len);
 918
 919         hci_dev_unlock(hdev);
 920
 921         /* If this command is called at least once, then the events
 922          * for class of device and local name changes are disabled
 923          * and only the new extended controller information event
 924          * is used.
 925          */
 926         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
 927         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
 928         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
 929
 930         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
 931                                  sizeof(*rp) + eir_len);
 932 }
 933
 934 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
 935 {
 936         char buf[512];
 937         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
 938         u16 eir_len;
 939
 940         memset(buf, 0, sizeof(buf));
 941
 942         eir_len = append_eir_data_to_buf(hdev, ev->eir);
 943         ev->eir_len = cpu_to_le16(eir_len);
 944
 945         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
 946                                   sizeof(*ev) + eir_len,
 947                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
 948 }
 949
 950 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 951 {
 952         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 953
 954         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
 955                                  sizeof(settings));
 956 }
 957
 958 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 959 {
 960         BT_DBG("%s status 0x%02x", hdev->name, status);
 961
 962         if (hci_conn_count(hdev) == 0) {
 963                 cancel_delayed_work(&hdev->power_off);
 964                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 965         }
 966 }
 967
 968 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
 969 {
 970         struct mgmt_ev_advertising_added ev;
 971
 972         ev.instance = instance;
 973
 974         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
 975 }
 976
 977 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
 978                               u8 instance)
 979 {
 980         struct mgmt_ev_advertising_removed ev;
 981
 982         ev.instance = instance;
 983
 984         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
 985 }
 986
 987 static void cancel_adv_timeout(struct hci_dev *hdev)
 988 {
 989         if (hdev->adv_instance_timeout) {
 990                 hdev->adv_instance_timeout = 0;
 991                 cancel_delayed_work(&hdev->adv_instance_expire);
 992         }
 993 }
 994
 995 static int clean_up_hci_state(struct hci_dev *hdev)
 996 {
 997         struct hci_request req;
 998         struct hci_conn *conn;
 999         bool discov_stopped;
1000         int err;
1001
1002         hci_req_init(&req, hdev);
1003
1004         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1005             test_bit(HCI_PSCAN, &hdev->flags)) {
1006                 u8 scan = 0x00;
1007                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008         }
1009
1010         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1011
1012         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1013                 __hci_req_disable_advertising(&req);
1014
1015         discov_stopped = hci_req_stop_discovery(&req);
1016
1017         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1018                 /* 0x15 == Terminated due to Power Off */
1019                 __hci_abort_conn(&req, conn, 0x15);
1020         }
1021
1022         err = hci_req_run(&req, clean_up_hci_complete);
1023         if (!err && discov_stopped)
1024                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1025
1026         return err;
1027 }
1028
1029 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1030                        u16 len)
1031 {
1032         struct mgmt_mode *cp = data;
1033         struct mgmt_pending_cmd *cmd;
1034         int err;
1035
1036         BT_DBG("request for %s", hdev->name);
1037
1038         if (cp->val != 0x00 && cp->val != 0x01)
1039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1040                                        MGMT_STATUS_INVALID_PARAMS);
1041
1042         hci_dev_lock(hdev);
1043
1044         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1045                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1046                                       MGMT_STATUS_BUSY);
1047                 goto failed;
1048         }
1049
1050         if (!!cp->val == hdev_is_powered(hdev)) {
1051                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1052                 goto failed;
1053         }
1054
1055         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1056         if (!cmd) {
1057                 err = -ENOMEM;
1058                 goto failed;
1059         }
1060
1061         if (cp->val) {
1062                 queue_work(hdev->req_workqueue, &hdev->power_on);
1063                 err = 0;
1064         } else {
1065                 /* Disconnect connections, stop scans, etc */
1066                 err = clean_up_hci_state(hdev);
1067                 if (!err)
1068                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1069                                            HCI_POWER_OFF_TIMEOUT);
1070
1071                 /* ENODATA means there were no HCI commands queued */
1072                 if (err == -ENODATA) {
1073                         cancel_delayed_work(&hdev->power_off);
1074                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1075                         err = 0;
1076                 }
1077         }
1078
1079 failed:
1080         hci_dev_unlock(hdev);
1081         return err;
1082 }
1083
1084 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1085 {
1086         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1087
1088         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1089                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1090 }
1091
1092 int mgmt_new_settings(struct hci_dev *hdev)
1093 {
1094         return new_settings(hdev, NULL);
1095 }
1096
1097 struct cmd_lookup {
1098         struct sock *sk;
1099         struct hci_dev *hdev;
1100         u8 mgmt_status;
1101 };
1102
1103 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1104 {
1105         struct cmd_lookup *match = data;
1106
1107         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1108
1109         list_del(&cmd->list);
1110
1111         if (match->sk == NULL) {
1112                 match->sk = cmd->sk;
1113                 sock_hold(match->sk);
1114         }
1115
1116         mgmt_pending_free(cmd);
1117 }
1118
1119 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1120 {
1121         u8 *status = data;
1122
1123         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1124         mgmt_pending_remove(cmd);
1125 }
1126
1127 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1128 {
1129         if (cmd->cmd_complete) {
1130                 u8 *status = data;
1131
1132                 cmd->cmd_complete(cmd, *status);
1133                 mgmt_pending_remove(cmd);
1134
1135                 return;
1136         }
1137
1138         cmd_status_rsp(cmd, data);
1139 }
1140
1141 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1142 {
1143         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1144                                  cmd->param, cmd->param_len);
1145 }
1146
1147 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1148 {
1149         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1150                                  cmd->param, sizeof(struct mgmt_addr_info));
1151 }
1152
1153 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1154 {
1155         if (!lmp_bredr_capable(hdev))
1156                 return MGMT_STATUS_NOT_SUPPORTED;
1157         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1158                 return MGMT_STATUS_REJECTED;
1159         else
1160                 return MGMT_STATUS_SUCCESS;
1161 }
1162
1163 static u8 mgmt_le_support(struct hci_dev *hdev)
1164 {
1165         if (!lmp_le_capable(hdev))
1166                 return MGMT_STATUS_NOT_SUPPORTED;
1167         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1168                 return MGMT_STATUS_REJECTED;
1169         else
1170                 return MGMT_STATUS_SUCCESS;
1171 }
1172
1173 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1174 {
1175         struct mgmt_pending_cmd *cmd;
1176
1177         BT_DBG("status 0x%02x", status);
1178
1179         hci_dev_lock(hdev);
1180
1181         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1182         if (!cmd)
1183                 goto unlock;
1184
1185         if (status) {
1186                 u8 mgmt_err = mgmt_status(status);
1187                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1188                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1189                 goto remove_cmd;
1190         }
1191
1192         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1193             hdev->discov_timeout > 0) {
1194                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1195                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1196         }
1197
1198         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1199         new_settings(hdev, cmd->sk);
1200
1201 remove_cmd:
1202         mgmt_pending_remove(cmd);
1203
1204 unlock:
1205         hci_dev_unlock(hdev);
1206 }
1207
1208 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1209                             u16 len)
1210 {
1211         struct mgmt_cp_set_discoverable *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         u16 timeout;
1214         int err;
1215
1216         BT_DBG("request for %s", hdev->name);
1217
1218         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1219             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1220                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1221                                        MGMT_STATUS_REJECTED);
1222
1223         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1224                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1225                                        MGMT_STATUS_INVALID_PARAMS);
1226
1227         timeout = __le16_to_cpu(cp->timeout);
1228
1229         /* Disabling discoverable requires that no timeout is set,
1230          * and enabling limited discoverable requires a timeout.
1231          */
1232         if ((cp->val == 0x00 && timeout > 0) ||
1233             (cp->val == 0x02 && timeout == 0))
1234                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1235                                        MGMT_STATUS_INVALID_PARAMS);
1236
1237         hci_dev_lock(hdev);
1238
1239         if (!hdev_is_powered(hdev) && timeout > 0) {
1240                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1241                                       MGMT_STATUS_NOT_POWERED);
1242                 goto failed;
1243         }
1244
1245         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1246             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1247                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1248                                       MGMT_STATUS_BUSY);
1249                 goto failed;
1250         }
1251
1252         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1253                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1254                                       MGMT_STATUS_REJECTED);
1255                 goto failed;
1256         }
1257
1258         if (!hdev_is_powered(hdev)) {
1259                 bool changed = false;
1260
1261                 /* Setting limited discoverable when powered off is
1262                  * not a valid operation since it requires a timeout
1263                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1264                  */
1265                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1266                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1267                         changed = true;
1268                 }
1269
1270                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1271                 if (err < 0)
1272                         goto failed;
1273
1274                 if (changed)
1275                         err = new_settings(hdev, sk);
1276
1277                 goto failed;
1278         }
1279
1280         /* If the current mode is the same, then just update the timeout
1281          * value with the new value. And if only the timeout gets updated,
1282          * then no need for any HCI transactions.
1283          */
1284         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1285             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1286                                                    HCI_LIMITED_DISCOVERABLE)) {
1287                 cancel_delayed_work(&hdev->discov_off);
1288                 hdev->discov_timeout = timeout;
1289
1290                 if (cp->val && hdev->discov_timeout > 0) {
1291                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1292                         queue_delayed_work(hdev->req_workqueue,
1293                                            &hdev->discov_off, to);
1294                 }
1295
1296                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1297                 goto failed;
1298         }
1299
1300         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1301         if (!cmd) {
1302                 err = -ENOMEM;
1303                 goto failed;
1304         }
1305
1306         /* Cancel any potential discoverable timeout that might be
1307          * still active and store new timeout value. The arming of
1308          * the timeout happens in the complete handler.
1309          */
1310         cancel_delayed_work(&hdev->discov_off);
1311         hdev->discov_timeout = timeout;
1312
1313         if (cp->val)
1314                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1315         else
1316                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1317
1318         /* Limited discoverable mode */
1319         if (cp->val == 0x02)
1320                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1321         else
1322                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1323
1324         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1325         err = 0;
1326
1327 failed:
1328         hci_dev_unlock(hdev);
1329         return err;
1330 }
1331
1332 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1333 {
1334         struct mgmt_pending_cmd *cmd;
1335
1336         BT_DBG("status 0x%02x", status);
1337
1338         hci_dev_lock(hdev);
1339
1340         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1341         if (!cmd)
1342                 goto unlock;
1343
1344         if (status) {
1345                 u8 mgmt_err = mgmt_status(status);
1346                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1347                 goto remove_cmd;
1348         }
1349
1350         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1351         new_settings(hdev, cmd->sk);
1352
1353 remove_cmd:
1354         mgmt_pending_remove(cmd);
1355
1356 unlock:
1357         hci_dev_unlock(hdev);
1358 }
1359
1360 static int set_connectable_update_settings(struct hci_dev *hdev,
1361                                            struct sock *sk, u8 val)
1362 {
1363         bool changed = false;
1364         int err;
1365
1366         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1367                 changed = true;
1368
1369         if (val) {
1370                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1371         } else {
1372                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1373                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1374         }
1375
1376         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1377         if (err < 0)
1378                 return err;
1379
1380         if (changed) {
1381                 hci_req_update_scan(hdev);
1382                 hci_update_background_scan(hdev);
1383                 return new_settings(hdev, sk);
1384         }
1385
1386         return 0;
1387 }
1388
1389 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1390                            u16 len)
1391 {
1392         struct mgmt_mode *cp = data;
1393         struct mgmt_pending_cmd *cmd;
1394         int err;
1395
1396         BT_DBG("request for %s", hdev->name);
1397
1398         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1399             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1401                                        MGMT_STATUS_REJECTED);
1402
1403         if (cp->val != 0x00 && cp->val != 0x01)
1404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1405                                        MGMT_STATUS_INVALID_PARAMS);
1406
1407         hci_dev_lock(hdev);
1408
1409         if (!hdev_is_powered(hdev)) {
1410                 err = set_connectable_update_settings(hdev, sk, cp->val);
1411                 goto failed;
1412         }
1413
1414         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1415             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1417                                       MGMT_STATUS_BUSY);
1418                 goto failed;
1419         }
1420
1421         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1422         if (!cmd) {
1423                 err = -ENOMEM;
1424                 goto failed;
1425         }
1426
1427         if (cp->val) {
1428                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1429         } else {
1430                 if (hdev->discov_timeout > 0)
1431                         cancel_delayed_work(&hdev->discov_off);
1432
1433                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1434                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1435                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1436         }
1437
1438         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1439         err = 0;
1440
1441 failed:
1442         hci_dev_unlock(hdev);
1443         return err;
1444 }
1445
1446 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1447                         u16 len)
1448 {
1449         struct mgmt_mode *cp = data;
1450         bool changed;
1451         int err;
1452
1453         BT_DBG("request for %s", hdev->name);
1454
1455         if (cp->val != 0x00 && cp->val != 0x01)
1456                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1457                                        MGMT_STATUS_INVALID_PARAMS);
1458
1459         hci_dev_lock(hdev);
1460
1461         if (cp->val)
1462                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1463         else
1464                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1465
1466         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1467         if (err < 0)
1468                 goto unlock;
1469
1470         if (changed) {
1471                 /* In limited privacy mode the change of bondable mode
1472                  * may affect the local advertising address.
1473                  */
1474                 if (hdev_is_powered(hdev) &&
1475                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1476                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1477                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1478                         queue_work(hdev->req_workqueue,
1479                                    &hdev->discoverable_update);
1480
1481                 err = new_settings(hdev, sk);
1482         }
1483
1484 unlock:
1485         hci_dev_unlock(hdev);
1486         return err;
1487 }
1488
1489 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1490                              u16 len)
1491 {
1492         struct mgmt_mode *cp = data;
1493         struct mgmt_pending_cmd *cmd;
1494         u8 val, status;
1495         int err;
1496
1497         BT_DBG("request for %s", hdev->name);
1498
1499         status = mgmt_bredr_support(hdev);
1500         if (status)
1501                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1502                                        status);
1503
1504         if (cp->val != 0x00 && cp->val != 0x01)
1505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1506                                        MGMT_STATUS_INVALID_PARAMS);
1507
1508         hci_dev_lock(hdev);
1509
1510         if (!hdev_is_powered(hdev)) {
1511                 bool changed = false;
1512
1513                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1514                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1515                         changed = true;
1516                 }
1517
1518                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1519                 if (err < 0)
1520                         goto failed;
1521
1522                 if (changed)
1523                         err = new_settings(hdev, sk);
1524
1525                 goto failed;
1526         }
1527
1528         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1529                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1530                                       MGMT_STATUS_BUSY);
1531                 goto failed;
1532         }
1533
1534         val = !!cp->val;
1535
1536         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1537                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1538                 goto failed;
1539         }
1540
1541         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1542         if (!cmd) {
1543                 err = -ENOMEM;
1544                 goto failed;
1545         }
1546
1547         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1548         if (err < 0) {
1549                 mgmt_pending_remove(cmd);
1550                 goto failed;
1551         }
1552
1553 failed:
1554         hci_dev_unlock(hdev);
1555         return err;
1556 }
1557
1558 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1559 {
1560         struct mgmt_mode *cp = data;
1561         struct mgmt_pending_cmd *cmd;
1562         u8 status;
1563         int err;
1564
1565         BT_DBG("request for %s", hdev->name);
1566
1567         status = mgmt_bredr_support(hdev);
1568         if (status)
1569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1570
1571         if (!lmp_ssp_capable(hdev))
1572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1573                                        MGMT_STATUS_NOT_SUPPORTED);
1574
1575         if (cp->val != 0x00 && cp->val != 0x01)
1576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1577                                        MGMT_STATUS_INVALID_PARAMS);
1578
1579         hci_dev_lock(hdev);
1580
1581         if (!hdev_is_powered(hdev)) {
1582                 bool changed;
1583
1584                 if (cp->val) {
1585                         changed = !hci_dev_test_and_set_flag(hdev,
1586                                                              HCI_SSP_ENABLED);
1587                 } else {
1588                         changed = hci_dev_test_and_clear_flag(hdev,
1589                                                               HCI_SSP_ENABLED);
1590                         if (!changed)
1591                                 changed = hci_dev_test_and_clear_flag(hdev,
1592                                                                       HCI_HS_ENABLED);
1593                         else
1594                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1595                 }
1596
1597                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1598                 if (err < 0)
1599                         goto failed;
1600
1601                 if (changed)
1602                         err = new_settings(hdev, sk);
1603
1604                 goto failed;
1605         }
1606
1607         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1608                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1609                                       MGMT_STATUS_BUSY);
1610                 goto failed;
1611         }
1612
1613         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1614                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1615                 goto failed;
1616         }
1617
1618         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1619         if (!cmd) {
1620                 err = -ENOMEM;
1621                 goto failed;
1622         }
1623
1624         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1625                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1626                              sizeof(cp->val), &cp->val);
1627
1628         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1629         if (err < 0) {
1630                 mgmt_pending_remove(cmd);
1631                 goto failed;
1632         }
1633
1634 failed:
1635         hci_dev_unlock(hdev);
1636         return err;
1637 }
1638
1639 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1640 {
1641         struct mgmt_mode *cp = data;
1642         bool changed;
1643         u8 status;
1644         int err;
1645
1646         BT_DBG("request for %s", hdev->name);
1647
1648         status = mgmt_bredr_support(hdev);
1649         if (status)
1650                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1651
1652         if (!lmp_ssp_capable(hdev))
1653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1654                                        MGMT_STATUS_NOT_SUPPORTED);
1655
1656         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1658                                        MGMT_STATUS_REJECTED);
1659
1660         if (cp->val != 0x00 && cp->val != 0x01)
1661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1662                                        MGMT_STATUS_INVALID_PARAMS);
1663
1664         hci_dev_lock(hdev);
1665
1666         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1667                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1668                                       MGMT_STATUS_BUSY);
1669                 goto unlock;
1670         }
1671
1672         if (cp->val) {
1673                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1674         } else {
1675                 if (hdev_is_powered(hdev)) {
1676                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1677                                               MGMT_STATUS_REJECTED);
1678                         goto unlock;
1679                 }
1680
1681                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1682         }
1683
1684         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1685         if (err < 0)
1686                 goto unlock;
1687
1688         if (changed)
1689                 err = new_settings(hdev, sk);
1690
1691 unlock:
1692         hci_dev_unlock(hdev);
1693         return err;
1694 }
1695
1696 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1697 {
1698         struct cmd_lookup match = { NULL, hdev };
1699
1700         hci_dev_lock(hdev);
1701
1702         if (status) {
1703                 u8 mgmt_err = mgmt_status(status);
1704
1705                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1706                                      &mgmt_err);
1707                 goto unlock;
1708         }
1709
1710         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1711
1712         new_settings(hdev, match.sk);
1713
1714         if (match.sk)
1715                 sock_put(match.sk);
1716
1717         /* Make sure the controller has a good default for
1718          * advertising data. Restrict the update to when LE
1719          * has actually been enabled. During power on, the
1720          * update in powered_update_hci will take care of it.
1721          */
1722         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1723                 struct hci_request req;
1724
1725                 hci_req_init(&req, hdev);
1726                 __hci_req_update_adv_data(&req, 0x00);
1727                 __hci_req_update_scan_rsp_data(&req, 0x00);
1728                 hci_req_run(&req, NULL);
1729                 hci_update_background_scan(hdev);
1730         }
1731
1732 unlock:
1733         hci_dev_unlock(hdev);
1734 }
1735
1736 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738         struct mgmt_mode *cp = data;
1739         struct hci_cp_write_le_host_supported hci_cp;
1740         struct mgmt_pending_cmd *cmd;
1741         struct hci_request req;
1742         int err;
1743         u8 val, enabled;
1744
1745         BT_DBG("request for %s", hdev->name);
1746
1747         if (!lmp_le_capable(hdev))
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1749                                        MGMT_STATUS_NOT_SUPPORTED);
1750
1751         if (cp->val != 0x00 && cp->val != 0x01)
1752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1753                                        MGMT_STATUS_INVALID_PARAMS);
1754
1755         /* Bluetooth single mode LE only controllers or dual-mode
1756          * controllers configured as LE only devices, do not allow
1757          * switching LE off. These have either LE enabled explicitly
1758          * or BR/EDR has been previously switched off.
1759          *
1760          * When trying to enable an already enabled LE, then gracefully
1761          * send a positive response. Trying to disable it however will
1762          * result into rejection.
1763          */
1764         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1765                 if (cp->val == 0x01)
1766                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1767
1768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1769                                        MGMT_STATUS_REJECTED);
1770         }
1771
1772         hci_dev_lock(hdev);
1773
1774         val = !!cp->val;
1775         enabled = lmp_host_le_capable(hdev);
1776
1777         if (!val)
1778                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1779
1780         if (!hdev_is_powered(hdev) || val == enabled) {
1781                 bool changed = false;
1782
1783                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1784                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1785                         changed = true;
1786                 }
1787
1788                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1789                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1790                         changed = true;
1791                 }
1792
1793                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1794                 if (err < 0)
1795                         goto unlock;
1796
1797                 if (changed)
1798                         err = new_settings(hdev, sk);
1799
1800                 goto unlock;
1801         }
1802
1803         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1804             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1805                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1806                                       MGMT_STATUS_BUSY);
1807                 goto unlock;
1808         }
1809
1810         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1811         if (!cmd) {
1812                 err = -ENOMEM;
1813                 goto unlock;
1814         }
1815
1816         hci_req_init(&req, hdev);
1817
1818         memset(&hci_cp, 0, sizeof(hci_cp));
1819
1820         if (val) {
1821                 hci_cp.le = val;
1822                 hci_cp.simul = 0x00;
1823         } else {
1824                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1825                         __hci_req_disable_advertising(&req);
1826         }
1827
1828         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1829                     &hci_cp);
1830
1831         err = hci_req_run(&req, le_enable_complete);
1832         if (err < 0)
1833                 mgmt_pending_remove(cmd);
1834
1835 unlock:
1836         hci_dev_unlock(hdev);
1837         return err;
1838 }
1839
1840 /* This is a helper function to test for pending mgmt commands that can
1841  * cause CoD or EIR HCI commands. We can only allow one such pending
1842  * mgmt command at a time since otherwise we cannot easily track what
1843  * the current values are, will be, and based on that calculate if a new
1844  * HCI command needs to be sent and if yes with what value.
1845  */
1846 static bool pending_eir_or_class(struct hci_dev *hdev)
1847 {
1848         struct mgmt_pending_cmd *cmd;
1849
1850         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1851                 switch (cmd->opcode) {
1852                 case MGMT_OP_ADD_UUID:
1853                 case MGMT_OP_REMOVE_UUID:
1854                 case MGMT_OP_SET_DEV_CLASS:
1855                 case MGMT_OP_SET_POWERED:
1856                         return true;
1857                 }
1858         }
1859
1860         return false;
1861 }
1862
1863 static const u8 bluetooth_base_uuid[] = {
1864                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1865                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1866 };
1867
1868 static u8 get_uuid_size(const u8 *uuid)
1869 {
1870         u32 val;
1871
1872         if (memcmp(uuid, bluetooth_base_uuid, 12))
1873                 return 128;
1874
1875         val = get_unaligned_le32(&uuid[12]);
1876         if (val > 0xffff)
1877                 return 32;
1878
1879         return 16;
1880 }
1881
1882 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1883 {
1884         struct mgmt_pending_cmd *cmd;
1885
1886         hci_dev_lock(hdev);
1887
1888         cmd = pending_find(mgmt_op, hdev);
1889         if (!cmd)
1890                 goto unlock;
1891
1892         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
1893                           mgmt_status(status), hdev->dev_class, 3);
1894
1895         mgmt_pending_remove(cmd);
1896
1897 unlock:
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1902 {
1903         BT_DBG("status 0x%02x", status);
1904
1905         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1906 }
1907
1908 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1909 {
1910         struct mgmt_cp_add_uuid *cp = data;
1911         struct mgmt_pending_cmd *cmd;
1912         struct hci_request req;
1913         struct bt_uuid *uuid;
1914         int err;
1915
1916         BT_DBG("request for %s", hdev->name);
1917
1918         hci_dev_lock(hdev);
1919
1920         if (pending_eir_or_class(hdev)) {
1921                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1922                                       MGMT_STATUS_BUSY);
1923                 goto failed;
1924         }
1925
1926         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1927         if (!uuid) {
1928                 err = -ENOMEM;
1929                 goto failed;
1930         }
1931
1932         memcpy(uuid->uuid, cp->uuid, 16);
1933         uuid->svc_hint = cp->svc_hint;
1934         uuid->size = get_uuid_size(cp->uuid);
1935
1936         list_add_tail(&uuid->list, &hdev->uuids);
1937
1938         hci_req_init(&req, hdev);
1939
1940         __hci_req_update_class(&req);
1941         __hci_req_update_eir(&req);
1942
1943         err = hci_req_run(&req, add_uuid_complete);
1944         if (err < 0) {
1945                 if (err != -ENODATA)
1946                         goto failed;
1947
1948                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1949                                         hdev->dev_class, 3);
1950                 goto failed;
1951         }
1952
1953         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1954         if (!cmd) {
1955                 err = -ENOMEM;
1956                 goto failed;
1957         }
1958
1959         err = 0;
1960
1961 failed:
1962         hci_dev_unlock(hdev);
1963         return err;
1964 }
1965
1966 static bool enable_service_cache(struct hci_dev *hdev)
1967 {
1968         if (!hdev_is_powered(hdev))
1969                 return false;
1970
1971         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
1972                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1973                                    CACHE_TIMEOUT);
1974                 return true;
1975         }
1976
1977         return false;
1978 }
1979
1980 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1981 {
1982         BT_DBG("status 0x%02x", status);
1983
1984         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1985 }
1986
1987 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1988                        u16 len)
1989 {
1990         struct mgmt_cp_remove_uuid *cp = data;
1991         struct mgmt_pending_cmd *cmd;
1992         struct bt_uuid *match, *tmp;
1993         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1994         struct hci_request req;
1995         int err, found;
1996
1997         BT_DBG("request for %s", hdev->name);
1998
1999         hci_dev_lock(hdev);
2000
2001         if (pending_eir_or_class(hdev)) {
2002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2003                                       MGMT_STATUS_BUSY);
2004                 goto unlock;
2005         }
2006
2007         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2008                 hci_uuids_clear(hdev);
2009
2010                 if (enable_service_cache(hdev)) {
2011                         err = mgmt_cmd_complete(sk, hdev->id,
2012                                                 MGMT_OP_REMOVE_UUID,
2013                                                 0, hdev->dev_class, 3);
2014                         goto unlock;
2015                 }
2016
2017                 goto update_class;
2018         }
2019
2020         found = 0;
2021
2022         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2023                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2024                         continue;
2025
2026                 list_del(&match->list);
2027                 kfree(match);
2028                 found++;
2029         }
2030
2031         if (found == 0) {
2032                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2033                                       MGMT_STATUS_INVALID_PARAMS);
2034                 goto unlock;
2035         }
2036
2037 update_class:
2038         hci_req_init(&req, hdev);
2039
2040         __hci_req_update_class(&req);
2041         __hci_req_update_eir(&req);
2042
2043         err = hci_req_run(&req, remove_uuid_complete);
2044         if (err < 0) {
2045                 if (err != -ENODATA)
2046                         goto unlock;
2047
2048                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2049                                         hdev->dev_class, 3);
2050                 goto unlock;
2051         }
2052
2053         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2054         if (!cmd) {
2055                 err = -ENOMEM;
2056                 goto unlock;
2057         }
2058
2059         err = 0;
2060
2061 unlock:
2062         hci_dev_unlock(hdev);
2063         return err;
2064 }
2065
2066 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2067 {
2068         BT_DBG("status 0x%02x", status);
2069
2070         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2071 }
2072
2073 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2074                          u16 len)
2075 {
2076         struct mgmt_cp_set_dev_class *cp = data;
2077         struct mgmt_pending_cmd *cmd;
2078         struct hci_request req;
2079         int err;
2080
2081         BT_DBG("request for %s", hdev->name);
2082
2083         if (!lmp_bredr_capable(hdev))
2084                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2085                                        MGMT_STATUS_NOT_SUPPORTED);
2086
2087         hci_dev_lock(hdev);
2088
2089         if (pending_eir_or_class(hdev)) {
2090                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2091                                       MGMT_STATUS_BUSY);
2092                 goto unlock;
2093         }
2094
2095         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2097                                       MGMT_STATUS_INVALID_PARAMS);
2098                 goto unlock;
2099         }
2100
2101         hdev->major_class = cp->major;
2102         hdev->minor_class = cp->minor;
2103
2104         if (!hdev_is_powered(hdev)) {
2105                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2106                                         hdev->dev_class, 3);
2107                 goto unlock;
2108         }
2109
2110         hci_req_init(&req, hdev);
2111
2112         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2113                 hci_dev_unlock(hdev);
2114                 cancel_delayed_work_sync(&hdev->service_cache);
2115                 hci_dev_lock(hdev);
2116                 __hci_req_update_eir(&req);
2117         }
2118
2119         __hci_req_update_class(&req);
2120
2121         err = hci_req_run(&req, set_class_complete);
2122         if (err < 0) {
2123                 if (err != -ENODATA)
2124                         goto unlock;
2125
2126                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2127                                         hdev->dev_class, 3);
2128                 goto unlock;
2129         }
2130
2131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2132         if (!cmd) {
2133                 err = -ENOMEM;
2134                 goto unlock;
2135         }
2136
2137         err = 0;
2138
2139 unlock:
2140         hci_dev_unlock(hdev);
2141         return err;
2142 }
2143
2144 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2145                           u16 len)
2146 {
2147         struct mgmt_cp_load_link_keys *cp = data;
2148         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2149                                    sizeof(struct mgmt_link_key_info));
2150         u16 key_count, expected_len;
2151         bool changed;
2152         int i;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         if (!lmp_bredr_capable(hdev))
2157                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2158                                        MGMT_STATUS_NOT_SUPPORTED);
2159
2160         key_count = __le16_to_cpu(cp->key_count);
2161         if (key_count > max_key_count) {
2162                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2163                            key_count);
2164                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2165                                        MGMT_STATUS_INVALID_PARAMS);
2166         }
2167
2168         expected_len = sizeof(*cp) + key_count *
2169                                         sizeof(struct mgmt_link_key_info);
2170         if (expected_len != len) {
2171                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2172                            expected_len, len);
2173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2174                                        MGMT_STATUS_INVALID_PARAMS);
2175         }
2176
2177         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2178                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2179                                        MGMT_STATUS_INVALID_PARAMS);
2180
2181         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2182                key_count);
2183
2184         for (i = 0; i < key_count; i++) {
2185                 struct mgmt_link_key_info *key = &cp->keys[i];
2186
2187                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2188                         return mgmt_cmd_status(sk, hdev->id,
2189                                                MGMT_OP_LOAD_LINK_KEYS,
2190                                                MGMT_STATUS_INVALID_PARAMS);
2191         }
2192
2193         hci_dev_lock(hdev);
2194
2195         hci_link_keys_clear(hdev);
2196
2197         if (cp->debug_keys)
2198                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2199         else
2200                 changed = hci_dev_test_and_clear_flag(hdev,
2201                                                       HCI_KEEP_DEBUG_KEYS);
2202
2203         if (changed)
2204                 new_settings(hdev, NULL);
2205
2206         for (i = 0; i < key_count; i++) {
2207                 struct mgmt_link_key_info *key = &cp->keys[i];
2208
2209                 /* Always ignore debug keys and require a new pairing if
2210                  * the user wants to use them.
2211                  */
2212                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2213                         continue;
2214
2215                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2216                                  key->type, key->pin_len, NULL);
2217         }
2218
2219         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2220
2221         hci_dev_unlock(hdev);
2222
2223         return 0;
2224 }
2225
2226 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2227                            u8 addr_type, struct sock *skip_sk)
2228 {
2229         struct mgmt_ev_device_unpaired ev;
2230
2231         bacpy(&ev.addr.bdaddr, bdaddr);
2232         ev.addr.type = addr_type;
2233
2234         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2235                           skip_sk);
2236 }
2237
2238 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2239                          u16 len)
2240 {
2241         struct mgmt_cp_unpair_device *cp = data;
2242         struct mgmt_rp_unpair_device rp;
2243         struct hci_conn_params *params;
2244         struct mgmt_pending_cmd *cmd;
2245         struct hci_conn *conn;
2246         u8 addr_type;
2247         int err;
2248
2249         memset(&rp, 0, sizeof(rp));
2250         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2251         rp.addr.type = cp->addr.type;
2252
2253         if (!bdaddr_type_is_valid(cp->addr.type))
2254                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2255                                          MGMT_STATUS_INVALID_PARAMS,
2256                                          &rp, sizeof(rp));
2257
2258         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2259                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2260                                          MGMT_STATUS_INVALID_PARAMS,
2261                                          &rp, sizeof(rp));
2262
2263         hci_dev_lock(hdev);
2264
2265         if (!hdev_is_powered(hdev)) {
2266                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2267                                         MGMT_STATUS_NOT_POWERED, &rp,
2268                                         sizeof(rp));
2269                 goto unlock;
2270         }
2271
2272         if (cp->addr.type == BDADDR_BREDR) {
2273                 /* If disconnection is requested, then look up the
2274                  * connection. If the remote device is connected, it
2275                  * will be later used to terminate the link.
2276                  *
2277                  * Setting it to NULL explicitly will cause no
2278                  * termination of the link.
2279                  */
2280                 if (cp->disconnect)
2281                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2282                                                        &cp->addr.bdaddr);
2283                 else
2284                         conn = NULL;
2285
2286                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2287                 if (err < 0) {
2288                         err = mgmt_cmd_complete(sk, hdev->id,
2289                                                 MGMT_OP_UNPAIR_DEVICE,
2290                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2291                                                 sizeof(rp));
2292                         goto unlock;
2293                 }
2294
2295                 goto done;
2296         }
2297
2298         /* LE address type */
2299         addr_type = le_addr_type(cp->addr.type);
2300
2301         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2302
2303         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2304         if (err < 0) {
2305                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2306                                         MGMT_STATUS_NOT_PAIRED, &rp,
2307                                         sizeof(rp));
2308                 goto unlock;
2309         }
2310
2311         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2312         if (!conn) {
2313                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2314                 goto done;
2315         }
2316
2317         /* Abort any ongoing SMP pairing */
2318         smp_cancel_pairing(conn);
2319
2320         /* Defer clearing up the connection parameters until closing to
2321          * give a chance of keeping them if a repairing happens.
2322          */
2323         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2324
2325         /* Disable auto-connection parameters if present */
2326         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2327         if (params) {
2328                 if (params->explicit_connect)
2329                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2330                 else
2331                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2332         }
2333
2334         /* If disconnection is not requested, then clear the connection
2335          * variable so that the link is not terminated.
2336          */
2337         if (!cp->disconnect)
2338                 conn = NULL;
2339
2340 done:
2341         /* If the connection variable is set, then termination of the
2342          * link is requested.
2343          */
2344         if (!conn) {
2345                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2346                                         &rp, sizeof(rp));
2347                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2348                 goto unlock;
2349         }
2350
2351         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2352                                sizeof(*cp));
2353         if (!cmd) {
2354                 err = -ENOMEM;
2355                 goto unlock;
2356         }
2357
2358         cmd->cmd_complete = addr_cmd_complete;
2359
2360         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2361         if (err < 0)
2362                 mgmt_pending_remove(cmd);
2363
2364 unlock:
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2370                       u16 len)
2371 {
2372         struct mgmt_cp_disconnect *cp = data;
2373         struct mgmt_rp_disconnect rp;
2374         struct mgmt_pending_cmd *cmd;
2375         struct hci_conn *conn;
2376         int err;
2377
2378         BT_DBG("");
2379
2380         memset(&rp, 0, sizeof(rp));
2381         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2382         rp.addr.type = cp->addr.type;
2383
2384         if (!bdaddr_type_is_valid(cp->addr.type))
2385                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2386                                          MGMT_STATUS_INVALID_PARAMS,
2387                                          &rp, sizeof(rp));
2388
2389         hci_dev_lock(hdev);
2390
2391         if (!test_bit(HCI_UP, &hdev->flags)) {
2392                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2393                                         MGMT_STATUS_NOT_POWERED, &rp,
2394                                         sizeof(rp));
2395                 goto failed;
2396         }
2397
2398         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2399                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2400                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2401                 goto failed;
2402         }
2403
2404         if (cp->addr.type == BDADDR_BREDR)
2405                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2406                                                &cp->addr.bdaddr);
2407         else
2408                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2409                                                le_addr_type(cp->addr.type));
2410
2411         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2412                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2413                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2414                                         sizeof(rp));
2415                 goto failed;
2416         }
2417
2418         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2419         if (!cmd) {
2420                 err = -ENOMEM;
2421                 goto failed;
2422         }
2423
2424         cmd->cmd_complete = generic_cmd_complete;
2425
2426         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2427         if (err < 0)
2428                 mgmt_pending_remove(cmd);
2429
2430 failed:
2431         hci_dev_unlock(hdev);
2432         return err;
2433 }
2434
2435 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2436 {
2437         switch (link_type) {
2438         case LE_LINK:
2439                 switch (addr_type) {
2440                 case ADDR_LE_DEV_PUBLIC:
2441                         return BDADDR_LE_PUBLIC;
2442
2443                 default:
2444                         /* Fallback to LE Random address type */
2445                         return BDADDR_LE_RANDOM;
2446                 }
2447
2448         default:
2449                 /* Fallback to BR/EDR type */
2450                 return BDADDR_BREDR;
2451         }
2452 }
2453
2454 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2455                            u16 data_len)
2456 {
2457         struct mgmt_rp_get_connections *rp;
2458         struct hci_conn *c;
2459         size_t rp_len;
2460         int err;
2461         u16 i;
2462
2463         BT_DBG("");
2464
2465         hci_dev_lock(hdev);
2466
2467         if (!hdev_is_powered(hdev)) {
2468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2469                                       MGMT_STATUS_NOT_POWERED);
2470                 goto unlock;
2471         }
2472
2473         i = 0;
2474         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2475                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2476                         i++;
2477         }
2478
2479         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2480         rp = kmalloc(rp_len, GFP_KERNEL);
2481         if (!rp) {
2482                 err = -ENOMEM;
2483                 goto unlock;
2484         }
2485
2486         i = 0;
2487         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2488                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2489                         continue;
2490                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2491                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2492                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2493                         continue;
2494                 i++;
2495         }
2496
2497         rp->conn_count = cpu_to_le16(i);
2498
2499         /* Recalculate length in case of filtered SCO connections, etc */
2500         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2501
2502         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2503                                 rp_len);
2504
2505         kfree(rp);
2506
2507 unlock:
2508         hci_dev_unlock(hdev);
2509         return err;
2510 }
2511
2512 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2513                                    struct mgmt_cp_pin_code_neg_reply *cp)
2514 {
2515         struct mgmt_pending_cmd *cmd;
2516         int err;
2517
2518         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2519                                sizeof(*cp));
2520         if (!cmd)
2521                 return -ENOMEM;
2522
2523         cmd->cmd_complete = addr_cmd_complete;
2524
2525         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2526                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2527         if (err < 0)
2528                 mgmt_pending_remove(cmd);
2529
2530         return err;
2531 }
2532
2533 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2534                           u16 len)
2535 {
2536         struct hci_conn *conn;
2537         struct mgmt_cp_pin_code_reply *cp = data;
2538         struct hci_cp_pin_code_reply reply;
2539         struct mgmt_pending_cmd *cmd;
2540         int err;
2541
2542         BT_DBG("");
2543
2544         hci_dev_lock(hdev);
2545
2546         if (!hdev_is_powered(hdev)) {
2547                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2548                                       MGMT_STATUS_NOT_POWERED);
2549                 goto failed;
2550         }
2551
2552         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2553         if (!conn) {
2554                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2555                                       MGMT_STATUS_NOT_CONNECTED);
2556                 goto failed;
2557         }
2558
2559         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2560                 struct mgmt_cp_pin_code_neg_reply ncp;
2561
2562                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2563
2564                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2565
2566                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2567                 if (err >= 0)
2568                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2569                                               MGMT_STATUS_INVALID_PARAMS);
2570
2571                 goto failed;
2572         }
2573
2574         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2575         if (!cmd) {
2576                 err = -ENOMEM;
2577                 goto failed;
2578         }
2579
2580         cmd->cmd_complete = addr_cmd_complete;
2581
2582         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2583         reply.pin_len = cp->pin_len;
2584         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2585
2586         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2587         if (err < 0)
2588                 mgmt_pending_remove(cmd);
2589
2590 failed:
2591         hci_dev_unlock(hdev);
2592         return err;
2593 }
2594
2595 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2596                              u16 len)
2597 {
2598         struct mgmt_cp_set_io_capability *cp = data;
2599
2600         BT_DBG("");
2601
2602         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2603                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2604                                        MGMT_STATUS_INVALID_PARAMS);
2605
2606         hci_dev_lock(hdev);
2607
2608         hdev->io_capability = cp->io_capability;
2609
2610         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2611                hdev->io_capability);
2612
2613         hci_dev_unlock(hdev);
2614
2615         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2616                                  NULL, 0);
2617 }
2618
2619 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2620 {
2621         struct hci_dev *hdev = conn->hdev;
2622         struct mgmt_pending_cmd *cmd;
2623
2624         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2625                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2626                         continue;
2627
2628                 if (cmd->user_data != conn)
2629                         continue;
2630
2631                 return cmd;
2632         }
2633
2634         return NULL;
2635 }
2636
2637 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2638 {
2639         struct mgmt_rp_pair_device rp;
2640         struct hci_conn *conn = cmd->user_data;
2641         int err;
2642
2643         bacpy(&rp.addr.bdaddr, &conn->dst);
2644         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2645
2646         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2647                                 status, &rp, sizeof(rp));
2648
2649         /* So we don't get further callbacks for this connection */
2650         conn->connect_cfm_cb = NULL;
2651         conn->security_cfm_cb = NULL;
2652         conn->disconn_cfm_cb = NULL;
2653
2654         hci_conn_drop(conn);
2655
2656         /* The device is paired so there is no need to remove
2657          * its connection parameters anymore.
2658          */
2659         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2660
2661         hci_conn_put(conn);
2662
2663         return err;
2664 }
2665
2666 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2667 {
2668         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2669         struct mgmt_pending_cmd *cmd;
2670
2671         cmd = find_pairing(conn);
2672         if (cmd) {
2673                 cmd->cmd_complete(cmd, status);
2674                 mgmt_pending_remove(cmd);
2675         }
2676 }
2677
2678 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2679 {
2680         struct mgmt_pending_cmd *cmd;
2681
2682         BT_DBG("status %u", status);
2683
2684         cmd = find_pairing(conn);
2685         if (!cmd) {
2686                 BT_DBG("Unable to find a pending command");
2687                 return;
2688         }
2689
2690         cmd->cmd_complete(cmd, mgmt_status(status));
2691         mgmt_pending_remove(cmd);
2692 }
2693
2694 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2695 {
2696         struct mgmt_pending_cmd *cmd;
2697
2698         BT_DBG("status %u", status);
2699
2700         if (!status)
2701                 return;
2702
2703         cmd = find_pairing(conn);
2704         if (!cmd) {
2705                 BT_DBG("Unable to find a pending command");
2706                 return;
2707         }
2708
2709         cmd->cmd_complete(cmd, mgmt_status(status));
2710         mgmt_pending_remove(cmd);
2711 }
2712
2713 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2714                        u16 len)
2715 {
2716         struct mgmt_cp_pair_device *cp = data;
2717         struct mgmt_rp_pair_device rp;
2718         struct mgmt_pending_cmd *cmd;
2719         u8 sec_level, auth_type;
2720         struct hci_conn *conn;
2721         int err;
2722
2723         BT_DBG("");
2724
2725         memset(&rp, 0, sizeof(rp));
2726         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2727         rp.addr.type = cp->addr.type;
2728
2729         if (!bdaddr_type_is_valid(cp->addr.type))
2730                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2731                                          MGMT_STATUS_INVALID_PARAMS,
2732                                          &rp, sizeof(rp));
2733
2734         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2735                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2736                                          MGMT_STATUS_INVALID_PARAMS,
2737                                          &rp, sizeof(rp));
2738
2739         hci_dev_lock(hdev);
2740
2741         if (!hdev_is_powered(hdev)) {
2742                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2743                                         MGMT_STATUS_NOT_POWERED, &rp,
2744                                         sizeof(rp));
2745                 goto unlock;
2746         }
2747
2748         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2749                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2750                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2751                                         sizeof(rp));
2752                 goto unlock;
2753         }
2754
2755         sec_level = BT_SECURITY_MEDIUM;
2756         auth_type = HCI_AT_DEDICATED_BONDING;
2757
2758         if (cp->addr.type == BDADDR_BREDR) {
2759                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2760                                        auth_type);
2761         } else {
2762                 u8 addr_type = le_addr_type(cp->addr.type);
2763                 struct hci_conn_params *p;
2764
2765                 /* When pairing a new device, it is expected to remember
2766                  * this device for future connections. Adding the connection
2767                  * parameter information ahead of time allows tracking
2768                  * of the slave preferred values and will speed up any
2769                  * further connection establishment.
2770                  *
2771                  * If connection parameters already exist, then they
2772                  * will be kept and this function does nothing.
2773                  */
2774                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2775
2776                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2777                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2778
2779                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2780                                            addr_type, sec_level,
2781                                            HCI_LE_CONN_TIMEOUT);
2782         }
2783
2784         if (IS_ERR(conn)) {
2785                 int status;
2786
2787                 if (PTR_ERR(conn) == -EBUSY)
2788                         status = MGMT_STATUS_BUSY;
2789                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2790                         status = MGMT_STATUS_NOT_SUPPORTED;
2791                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2792                         status = MGMT_STATUS_REJECTED;
2793                 else
2794                         status = MGMT_STATUS_CONNECT_FAILED;
2795
2796                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2797                                         status, &rp, sizeof(rp));
2798                 goto unlock;
2799         }
2800
2801         if (conn->connect_cfm_cb) {
2802                 hci_conn_drop(conn);
2803                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2804                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2805                 goto unlock;
2806         }
2807
2808         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2809         if (!cmd) {
2810                 err = -ENOMEM;
2811                 hci_conn_drop(conn);
2812                 goto unlock;
2813         }
2814
2815         cmd->cmd_complete = pairing_complete;
2816
2817         /* For LE, just connecting isn't a proof that the pairing finished */
2818         if (cp->addr.type == BDADDR_BREDR) {
2819                 conn->connect_cfm_cb = pairing_complete_cb;
2820                 conn->security_cfm_cb = pairing_complete_cb;
2821                 conn->disconn_cfm_cb = pairing_complete_cb;
2822         } else {
2823                 conn->connect_cfm_cb = le_pairing_complete_cb;
2824                 conn->security_cfm_cb = le_pairing_complete_cb;
2825                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2826         }
2827
2828         conn->io_capability = cp->io_cap;
2829         cmd->user_data = hci_conn_get(conn);
2830
2831         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2832             hci_conn_security(conn, sec_level, auth_type, true)) {
2833                 cmd->cmd_complete(cmd, 0);
2834                 mgmt_pending_remove(cmd);
2835         }
2836
2837         err = 0;
2838
2839 unlock:
2840         hci_dev_unlock(hdev);
2841         return err;
2842 }
2843
2844 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2845                               u16 len)
2846 {
2847         struct mgmt_addr_info *addr = data;
2848         struct mgmt_pending_cmd *cmd;
2849         struct hci_conn *conn;
2850         int err;
2851
2852         BT_DBG("");
2853
2854         hci_dev_lock(hdev);
2855
2856         if (!hdev_is_powered(hdev)) {
2857                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2858                                       MGMT_STATUS_NOT_POWERED);
2859                 goto unlock;
2860         }
2861
2862         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2863         if (!cmd) {
2864                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2865                                       MGMT_STATUS_INVALID_PARAMS);
2866                 goto unlock;
2867         }
2868
2869         conn = cmd->user_data;
2870
2871         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2872                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2873                                       MGMT_STATUS_INVALID_PARAMS);
2874                 goto unlock;
2875         }
2876
2877         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
2878         mgmt_pending_remove(cmd);
2879
2880         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2881                                 addr, sizeof(*addr));
2882 unlock:
2883         hci_dev_unlock(hdev);
2884         return err;
2885 }
2886
2887 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2888                              struct mgmt_addr_info *addr, u16 mgmt_op,
2889                              u16 hci_op, __le32 passkey)
2890 {
2891         struct mgmt_pending_cmd *cmd;
2892         struct hci_conn *conn;
2893         int err;
2894
2895         hci_dev_lock(hdev);
2896
2897         if (!hdev_is_powered(hdev)) {
2898                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2899                                         MGMT_STATUS_NOT_POWERED, addr,
2900                                         sizeof(*addr));
2901                 goto done;
2902         }
2903
2904         if (addr->type == BDADDR_BREDR)
2905                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2906         else
2907                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
2908                                                le_addr_type(addr->type));
2909
2910         if (!conn) {
2911                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2912                                         MGMT_STATUS_NOT_CONNECTED, addr,
2913                                         sizeof(*addr));
2914                 goto done;
2915         }
2916
2917         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2918                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2919                 if (!err)
2920                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2921                                                 MGMT_STATUS_SUCCESS, addr,
2922                                                 sizeof(*addr));
2923                 else
2924                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2925                                                 MGMT_STATUS_FAILED, addr,
2926                                                 sizeof(*addr));
2927
2928                 goto done;
2929         }
2930
2931         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2932         if (!cmd) {
2933                 err = -ENOMEM;
2934                 goto done;
2935         }
2936
2937         cmd->cmd_complete = addr_cmd_complete;
2938
2939         /* Continue with pairing via HCI */
2940         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2941                 struct hci_cp_user_passkey_reply cp;
2942
2943                 bacpy(&cp.bdaddr, &addr->bdaddr);
2944                 cp.passkey = passkey;
2945                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2946         } else
2947                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2948                                    &addr->bdaddr);
2949
2950         if (err < 0)
2951                 mgmt_pending_remove(cmd);
2952
2953 done:
2954         hci_dev_unlock(hdev);
2955         return err;
2956 }
2957
2958 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2959                               void *data, u16 len)
2960 {
2961         struct mgmt_cp_pin_code_neg_reply *cp = data;
2962
2963         BT_DBG("");
2964
2965         return user_pairing_resp(sk, hdev, &cp->addr,
2966                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2967                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2968 }
2969
2970 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2971                               u16 len)
2972 {
2973         struct mgmt_cp_user_confirm_reply *cp = data;
2974
2975         BT_DBG("");
2976
2977         if (len != sizeof(*cp))
2978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2979                                        MGMT_STATUS_INVALID_PARAMS);
2980
2981         return user_pairing_resp(sk, hdev, &cp->addr,
2982                                  MGMT_OP_USER_CONFIRM_REPLY,
2983                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2984 }
2985
2986 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2987                                   void *data, u16 len)
2988 {
2989         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2990
2991         BT_DBG("");
2992
2993         return user_pairing_resp(sk, hdev, &cp->addr,
2994                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2995                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2996 }
2997
2998 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2999                               u16 len)
3000 {
3001         struct mgmt_cp_user_passkey_reply *cp = data;
3002
3003         BT_DBG("");
3004
3005         return user_pairing_resp(sk, hdev, &cp->addr,
3006                                  MGMT_OP_USER_PASSKEY_REPLY,
3007                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3008 }
3009
3010 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3011                                   void *data, u16 len)
3012 {
3013         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3014
3015         BT_DBG("");
3016
3017         return user_pairing_resp(sk, hdev, &cp->addr,
3018                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3019                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3020 }
3021
3022 static void adv_expire(struct hci_dev *hdev, u32 flags)
3023 {
3024         struct adv_info *adv_instance;
3025         struct hci_request req;
3026         int err;
3027
3028         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3029         if (!adv_instance)
3030                 return;
3031
3032         /* stop if current instance doesn't need to be changed */
3033         if (!(adv_instance->flags & flags))
3034                 return;
3035
3036         cancel_adv_timeout(hdev);
3037
3038         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3039         if (!adv_instance)
3040                 return;
3041
3042         hci_req_init(&req, hdev);
3043         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3044                                               true);
3045         if (err)
3046                 return;
3047
3048         hci_req_run(&req, NULL);
3049 }
3050
3051 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3052 {
3053         struct mgmt_cp_set_local_name *cp;
3054         struct mgmt_pending_cmd *cmd;
3055
3056         BT_DBG("status 0x%02x", status);
3057
3058         hci_dev_lock(hdev);
3059
3060         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3061         if (!cmd)
3062                 goto unlock;
3063
3064         cp = cmd->param;
3065
3066         if (status) {
3067                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3068                                 mgmt_status(status));
3069         } else {
3070                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3071                                   cp, sizeof(*cp));
3072
3073                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3074                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3075         }
3076
3077         mgmt_pending_remove(cmd);
3078
3079 unlock:
3080         hci_dev_unlock(hdev);
3081 }
3082
3083 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3084                           u16 len)
3085 {
3086         struct mgmt_cp_set_local_name *cp = data;
3087         struct mgmt_pending_cmd *cmd;
3088         struct hci_request req;
3089         int err;
3090
3091         BT_DBG("");
3092
3093         hci_dev_lock(hdev);
3094
3095         /* If the old values are the same as the new ones just return a
3096          * direct command complete event.
3097          */
3098         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3099             !memcmp(hdev->short_name, cp->short_name,
3100                     sizeof(hdev->short_name))) {
3101                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3102                                         data, len);
3103                 goto failed;
3104         }
3105
3106         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3107
3108         if (!hdev_is_powered(hdev)) {
3109                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3110
3111                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3112                                         data, len);
3113                 if (err < 0)
3114                         goto failed;
3115
3116                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3117                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3118                 ext_info_changed(hdev, sk);
3119
3120                 goto failed;
3121         }
3122
3123         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3124         if (!cmd) {
3125                 err = -ENOMEM;
3126                 goto failed;
3127         }
3128
3129         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3130
3131         hci_req_init(&req, hdev);
3132
3133         if (lmp_bredr_capable(hdev)) {
3134                 __hci_req_update_name(&req);
3135                 __hci_req_update_eir(&req);
3136         }
3137
3138         /* The name is stored in the scan response data and so
3139          * no need to udpate the advertising data here.
3140          */
3141         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3142                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3143
3144         err = hci_req_run(&req, set_name_complete);
3145         if (err < 0)
3146                 mgmt_pending_remove(cmd);
3147
3148 failed:
3149         hci_dev_unlock(hdev);
3150         return err;
3151 }
3152
3153 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3154                           u16 len)
3155 {
3156         struct mgmt_cp_set_appearance *cp = data;
3157         u16 apperance;
3158         int err;
3159
3160         BT_DBG("");
3161
3162         if (!lmp_le_capable(hdev))
3163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3164                                        MGMT_STATUS_NOT_SUPPORTED);
3165
3166         apperance = le16_to_cpu(cp->appearance);
3167
3168         hci_dev_lock(hdev);
3169
3170         if (hdev->appearance != apperance) {
3171                 hdev->appearance = apperance;
3172
3173                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3174                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3175
3176                 ext_info_changed(hdev, sk);
3177         }
3178
3179         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3180                                 0);
3181
3182         hci_dev_unlock(hdev);
3183
3184         return err;
3185 }
3186
3187 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3188                                          u16 opcode, struct sk_buff *skb)
3189 {
3190         struct mgmt_rp_read_local_oob_data mgmt_rp;
3191         size_t rp_size = sizeof(mgmt_rp);
3192         struct mgmt_pending_cmd *cmd;
3193
3194         BT_DBG("%s status %u", hdev->name, status);
3195
3196         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3197         if (!cmd)
3198                 return;
3199
3200         if (status || !skb) {
3201                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3202                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3203                 goto remove;
3204         }
3205
3206         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3207
3208         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3209                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3210
3211                 if (skb->len < sizeof(*rp)) {
3212                         mgmt_cmd_status(cmd->sk, hdev->id,
3213                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3214                                         MGMT_STATUS_FAILED);
3215                         goto remove;
3216                 }
3217
3218                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3219                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3220
3221                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3222         } else {
3223                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3224
3225                 if (skb->len < sizeof(*rp)) {
3226                         mgmt_cmd_status(cmd->sk, hdev->id,
3227                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3228                                         MGMT_STATUS_FAILED);
3229                         goto remove;
3230                 }
3231
3232                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3233                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3234
3235                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3236                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3237         }
3238
3239         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3240                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3241
3242 remove:
3243         mgmt_pending_remove(cmd);
3244 }
3245
3246 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3247                                void *data, u16 data_len)
3248 {
3249         struct mgmt_pending_cmd *cmd;
3250         struct hci_request req;
3251         int err;
3252
3253         BT_DBG("%s", hdev->name);
3254
3255         hci_dev_lock(hdev);
3256
3257         if (!hdev_is_powered(hdev)) {
3258                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3259                                       MGMT_STATUS_NOT_POWERED);
3260                 goto unlock;
3261         }
3262
3263         if (!lmp_ssp_capable(hdev)) {
3264                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3265                                       MGMT_STATUS_NOT_SUPPORTED);
3266                 goto unlock;
3267         }
3268
3269         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3270                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3271                                       MGMT_STATUS_BUSY);
3272                 goto unlock;
3273         }
3274
3275         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3276         if (!cmd) {
3277                 err = -ENOMEM;
3278                 goto unlock;
3279         }
3280
3281         hci_req_init(&req, hdev);
3282
3283         if (bredr_sc_enabled(hdev))
3284                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3285         else
3286                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3287
3288         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3289         if (err < 0)
3290                 mgmt_pending_remove(cmd);
3291
3292 unlock:
3293         hci_dev_unlock(hdev);
3294         return err;
3295 }
3296
3297 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3298                                void *data, u16 len)
3299 {
3300         struct mgmt_addr_info *addr = data;
3301         int err;
3302
3303         BT_DBG("%s ", hdev->name);
3304
3305         if (!bdaddr_type_is_valid(addr->type))
3306                 return mgmt_cmd_complete(sk, hdev->id,
3307                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3308                                          MGMT_STATUS_INVALID_PARAMS,
3309                                          addr, sizeof(*addr));
3310
3311         hci_dev_lock(hdev);
3312
3313         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3314                 struct mgmt_cp_add_remote_oob_data *cp = data;
3315                 u8 status;
3316
3317                 if (cp->addr.type != BDADDR_BREDR) {
3318                         err = mgmt_cmd_complete(sk, hdev->id,
3319                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3320                                                 MGMT_STATUS_INVALID_PARAMS,
3321                                                 &cp->addr, sizeof(cp->addr));
3322                         goto unlock;
3323                 }
3324
3325                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3326                                               cp->addr.type, cp->hash,
3327                                               cp->rand, NULL, NULL);
3328                 if (err < 0)
3329                         status = MGMT_STATUS_FAILED;
3330                 else
3331                         status = MGMT_STATUS_SUCCESS;
3332
3333                 err = mgmt_cmd_complete(sk, hdev->id,
3334                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3335                                         &cp->addr, sizeof(cp->addr));
3336         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3337                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3338                 u8 *rand192, *hash192, *rand256, *hash256;
3339                 u8 status;
3340
3341                 if (bdaddr_type_is_le(cp->addr.type)) {
3342                         /* Enforce zero-valued 192-bit parameters as
3343                          * long as legacy SMP OOB isn't implemented.
3344                          */
3345                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3346                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3347                                 err = mgmt_cmd_complete(sk, hdev->id,
3348                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3349                                                         MGMT_STATUS_INVALID_PARAMS,
3350                                                         addr, sizeof(*addr));
3351                                 goto unlock;
3352                         }
3353
3354                         rand192 = NULL;
3355                         hash192 = NULL;
3356                 } else {
3357                         /* In case one of the P-192 values is set to zero,
3358                          * then just disable OOB data for P-192.
3359                          */
3360                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3361                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3362                                 rand192 = NULL;
3363                                 hash192 = NULL;
3364                         } else {
3365                                 rand192 = cp->rand192;
3366                                 hash192 = cp->hash192;
3367                         }
3368                 }
3369
3370                 /* In case one of the P-256 values is set to zero, then just
3371                  * disable OOB data for P-256.
3372                  */
3373                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3374                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3375                         rand256 = NULL;
3376                         hash256 = NULL;
3377                 } else {
3378                         rand256 = cp->rand256;
3379                         hash256 = cp->hash256;
3380                 }
3381
3382                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3383                                               cp->addr.type, hash192, rand192,
3384                                               hash256, rand256);
3385                 if (err < 0)
3386                         status = MGMT_STATUS_FAILED;
3387                 else
3388                         status = MGMT_STATUS_SUCCESS;
3389
3390                 err = mgmt_cmd_complete(sk, hdev->id,
3391                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3392                                         status, &cp->addr, sizeof(cp->addr));
3393         } else {
3394                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3395                            len);
3396                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3397                                       MGMT_STATUS_INVALID_PARAMS);
3398         }
3399
3400 unlock:
3401         hci_dev_unlock(hdev);
3402         return err;
3403 }
3404
3405 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3406                                   void *data, u16 len)
3407 {
3408         struct mgmt_cp_remove_remote_oob_data *cp = data;
3409         u8 status;
3410         int err;
3411
3412         BT_DBG("%s", hdev->name);
3413
3414         if (cp->addr.type != BDADDR_BREDR)
3415                 return mgmt_cmd_complete(sk, hdev->id,
3416                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3417                                          MGMT_STATUS_INVALID_PARAMS,
3418                                          &cp->addr, sizeof(cp->addr));
3419
3420         hci_dev_lock(hdev);
3421
3422         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3423                 hci_remote_oob_data_clear(hdev);
3424                 status = MGMT_STATUS_SUCCESS;
3425                 goto done;
3426         }
3427
3428         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3429         if (err < 0)
3430                 status = MGMT_STATUS_INVALID_PARAMS;
3431         else
3432                 status = MGMT_STATUS_SUCCESS;
3433
3434 done:
3435         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3436                                 status, &cp->addr, sizeof(cp->addr));
3437
3438         hci_dev_unlock(hdev);
3439         return err;
3440 }
3441
3442 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3443 {
3444         struct mgmt_pending_cmd *cmd;
3445
3446         BT_DBG("status %d", status);
3447
3448         hci_dev_lock(hdev);
3449
3450         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3451         if (!cmd)
3452                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3453
3454         if (!cmd)
3455                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3456
3457         if (cmd) {
3458                 cmd->cmd_complete(cmd, mgmt_status(status));
3459                 mgmt_pending_remove(cmd);
3460         }
3461
3462         hci_dev_unlock(hdev);
3463 }
3464
3465 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3466                                     uint8_t *mgmt_status)
3467 {
3468         switch (type) {
3469         case DISCOV_TYPE_LE:
3470                 *mgmt_status = mgmt_le_support(hdev);
3471                 if (*mgmt_status)
3472                         return false;
3473                 break;
3474         case DISCOV_TYPE_INTERLEAVED:
3475                 *mgmt_status = mgmt_le_support(hdev);
3476                 if (*mgmt_status)
3477                         return false;
3478                 /* Intentional fall-through */
3479         case DISCOV_TYPE_BREDR:
3480                 *mgmt_status = mgmt_bredr_support(hdev);
3481                 if (*mgmt_status)
3482                         return false;
3483                 break;
3484         default:
3485                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3486                 return false;
3487         }
3488
3489         return true;
3490 }
3491
3492 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3493                                     u16 op, void *data, u16 len)
3494 {
3495         struct mgmt_cp_start_discovery *cp = data;
3496         struct mgmt_pending_cmd *cmd;
3497         u8 status;
3498         int err;
3499
3500         BT_DBG("%s", hdev->name);
3501
3502         hci_dev_lock(hdev);
3503
3504         if (!hdev_is_powered(hdev)) {
3505                 err = mgmt_cmd_complete(sk, hdev->id, op,
3506                                         MGMT_STATUS_NOT_POWERED,
3507                                         &cp->type, sizeof(cp->type));
3508                 goto failed;
3509         }
3510
3511         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3512             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3513                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3514                                         &cp->type, sizeof(cp->type));
3515                 goto failed;
3516         }
3517
3518         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3519                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3520                                         &cp->type, sizeof(cp->type));
3521                 goto failed;
3522         }
3523
3524         /* Clear the discovery filter first to free any previously
3525          * allocated memory for the UUID list.
3526          */
3527         hci_discovery_filter_clear(hdev);
3528
3529         hdev->discovery.type = cp->type;
3530         hdev->discovery.report_invalid_rssi = false;
3531         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3532                 hdev->discovery.limited = true;
3533         else
3534                 hdev->discovery.limited = false;
3535
3536         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3537         if (!cmd) {
3538                 err = -ENOMEM;
3539                 goto failed;
3540         }
3541
3542         cmd->cmd_complete = generic_cmd_complete;
3543
3544         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3545         queue_work(hdev->req_workqueue, &hdev->discov_update);
3546         err = 0;
3547
3548 failed:
3549         hci_dev_unlock(hdev);
3550         return err;
3551 }
3552
3553 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3554                            void *data, u16 len)
3555 {
3556         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3557                                         data, len);
3558 }
3559
3560 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3561                                    void *data, u16 len)
3562 {
3563         return start_discovery_internal(sk, hdev,
3564                                         MGMT_OP_START_LIMITED_DISCOVERY,
3565                                         data, len);
3566 }
3567
3568 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3569                                           u8 status)
3570 {
3571         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3572                                  cmd->param, 1);
3573 }
3574
3575 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3576                                    void *data, u16 len)
3577 {
3578         struct mgmt_cp_start_service_discovery *cp = data;
3579         struct mgmt_pending_cmd *cmd;
3580         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3581         u16 uuid_count, expected_len;
3582         u8 status;
3583         int err;
3584
3585         BT_DBG("%s", hdev->name);
3586
3587         hci_dev_lock(hdev);
3588
3589         if (!hdev_is_powered(hdev)) {
3590                 err = mgmt_cmd_complete(sk, hdev->id,
3591                                         MGMT_OP_START_SERVICE_DISCOVERY,
3592                                         MGMT_STATUS_NOT_POWERED,
3593                                         &cp->type, sizeof(cp->type));
3594                 goto failed;
3595         }
3596
3597         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3598             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3599                 err = mgmt_cmd_complete(sk, hdev->id,
3600                                         MGMT_OP_START_SERVICE_DISCOVERY,
3601                                         MGMT_STATUS_BUSY, &cp->type,
3602                                         sizeof(cp->type));
3603                 goto failed;
3604         }
3605
3606         uuid_count = __le16_to_cpu(cp->uuid_count);
3607         if (uuid_count > max_uuid_count) {
3608                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3609                            uuid_count);
3610                 err = mgmt_cmd_complete(sk, hdev->id,
3611                                         MGMT_OP_START_SERVICE_DISCOVERY,
3612                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3613                                         sizeof(cp->type));
3614                 goto failed;
3615         }
3616
3617         expected_len = sizeof(*cp) + uuid_count * 16;
3618         if (expected_len != len) {
3619                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3620                            expected_len, len);
3621                 err = mgmt_cmd_complete(sk, hdev->id,
3622                                         MGMT_OP_START_SERVICE_DISCOVERY,
3623                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3624                                         sizeof(cp->type));
3625                 goto failed;
3626         }
3627
3628         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3629                 err = mgmt_cmd_complete(sk, hdev->id,
3630                                         MGMT_OP_START_SERVICE_DISCOVERY,
3631                                         status, &cp->type, sizeof(cp->type));
3632                 goto failed;
3633         }
3634
3635         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3636                                hdev, data, len);
3637         if (!cmd) {
3638                 err = -ENOMEM;
3639                 goto failed;
3640         }
3641
3642         cmd->cmd_complete = service_discovery_cmd_complete;
3643
3644         /* Clear the discovery filter first to free any previously
3645          * allocated memory for the UUID list.
3646          */
3647         hci_discovery_filter_clear(hdev);
3648
3649         hdev->discovery.result_filtering = true;
3650         hdev->discovery.type = cp->type;
3651         hdev->discovery.rssi = cp->rssi;
3652         hdev->discovery.uuid_count = uuid_count;
3653
3654         if (uuid_count > 0) {
3655                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
3656                                                 GFP_KERNEL);
3657                 if (!hdev->discovery.uuids) {
3658                         err = mgmt_cmd_complete(sk, hdev->id,
3659                                                 MGMT_OP_START_SERVICE_DISCOVERY,
3660                                                 MGMT_STATUS_FAILED,
3661                                                 &cp->type, sizeof(cp->type));
3662                         mgmt_pending_remove(cmd);
3663                         goto failed;
3664                 }
3665         }
3666
3667         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3668         queue_work(hdev->req_workqueue, &hdev->discov_update);
3669         err = 0;
3670
3671 failed:
3672         hci_dev_unlock(hdev);
3673         return err;
3674 }
3675
3676 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
3677 {
3678         struct mgmt_pending_cmd *cmd;
3679
3680         BT_DBG("status %d", status);
3681
3682         hci_dev_lock(hdev);
3683
3684         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3685         if (cmd) {
3686                 cmd->cmd_complete(cmd, mgmt_status(status));
3687                 mgmt_pending_remove(cmd);
3688         }
3689
3690         hci_dev_unlock(hdev);
3691 }
3692
3693 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3694                           u16 len)
3695 {
3696         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3697         struct mgmt_pending_cmd *cmd;
3698         int err;
3699
3700         BT_DBG("%s", hdev->name);
3701
3702         hci_dev_lock(hdev);
3703
3704         if (!hci_discovery_active(hdev)) {
3705                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3706                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
3707                                         sizeof(mgmt_cp->type));
3708                 goto unlock;
3709         }
3710
3711         if (hdev->discovery.type != mgmt_cp->type) {
3712                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3713                                         MGMT_STATUS_INVALID_PARAMS,
3714                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
3715                 goto unlock;
3716         }
3717
3718         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
3719         if (!cmd) {
3720                 err = -ENOMEM;
3721                 goto unlock;
3722         }
3723
3724         cmd->cmd_complete = generic_cmd_complete;
3725
3726         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3727         queue_work(hdev->req_workqueue, &hdev->discov_update);
3728         err = 0;
3729
3730 unlock:
3731         hci_dev_unlock(hdev);
3732         return err;
3733 }
3734
3735 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3736                         u16 len)
3737 {
3738         struct mgmt_cp_confirm_name *cp = data;
3739         struct inquiry_entry *e;
3740         int err;
3741
3742         BT_DBG("%s", hdev->name);
3743
3744         hci_dev_lock(hdev);
3745
3746         if (!hci_discovery_active(hdev)) {
3747                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3748                                         MGMT_STATUS_FAILED, &cp->addr,
3749                                         sizeof(cp->addr));
3750                 goto failed;
3751         }
3752
3753         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3754         if (!e) {
3755                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3756                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3757                                         sizeof(cp->addr));
3758                 goto failed;
3759         }
3760
3761         if (cp->name_known) {
3762                 e->name_state = NAME_KNOWN;
3763                 list_del(&e->list);
3764         } else {
3765                 e->name_state = NAME_NEEDED;
3766                 hci_inquiry_cache_update_resolve(hdev, e);
3767         }
3768
3769         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
3770                                 &cp->addr, sizeof(cp->addr));
3771
3772 failed:
3773         hci_dev_unlock(hdev);
3774         return err;
3775 }
3776
3777 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3778                         u16 len)
3779 {
3780         struct mgmt_cp_block_device *cp = data;
3781         u8 status;
3782         int err;
3783
3784         BT_DBG("%s", hdev->name);
3785
3786         if (!bdaddr_type_is_valid(cp->addr.type))
3787                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3788                                          MGMT_STATUS_INVALID_PARAMS,
3789                                          &cp->addr, sizeof(cp->addr));
3790
3791         hci_dev_lock(hdev);
3792
3793         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3794                                   cp->addr.type);
3795         if (err < 0) {
3796                 status = MGMT_STATUS_FAILED;
3797                 goto done;
3798         }
3799
3800         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3801                    sk);
3802         status = MGMT_STATUS_SUCCESS;
3803
3804 done:
3805         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3806                                 &cp->addr, sizeof(cp->addr));
3807
3808         hci_dev_unlock(hdev);
3809
3810         return err;
3811 }
3812
3813 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3814                           u16 len)
3815 {
3816         struct mgmt_cp_unblock_device *cp = data;
3817         u8 status;
3818         int err;
3819
3820         BT_DBG("%s", hdev->name);
3821
3822         if (!bdaddr_type_is_valid(cp->addr.type))
3823                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3824                                          MGMT_STATUS_INVALID_PARAMS,
3825                                          &cp->addr, sizeof(cp->addr));
3826
3827         hci_dev_lock(hdev);
3828
3829         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
3830                                   cp->addr.type);
3831         if (err < 0) {
3832                 status = MGMT_STATUS_INVALID_PARAMS;
3833                 goto done;
3834         }
3835
3836         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3837                    sk);
3838         status = MGMT_STATUS_SUCCESS;
3839
3840 done:
3841         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3842                                 &cp->addr, sizeof(cp->addr));
3843
3844         hci_dev_unlock(hdev);
3845
3846         return err;
3847 }
3848
3849 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3850                          u16 len)
3851 {
3852         struct mgmt_cp_set_device_id *cp = data;
3853         struct hci_request req;
3854         int err;
3855         __u16 source;
3856
3857         BT_DBG("%s", hdev->name);
3858
3859         source = __le16_to_cpu(cp->source);
3860
3861         if (source > 0x0002)
3862                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3863                                        MGMT_STATUS_INVALID_PARAMS);
3864
3865         hci_dev_lock(hdev);
3866
3867         hdev->devid_source = source;
3868         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3869         hdev->devid_product = __le16_to_cpu(cp->product);
3870         hdev->devid_version = __le16_to_cpu(cp->version);
3871
3872         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
3873                                 NULL, 0);
3874
3875         hci_req_init(&req, hdev);
3876         __hci_req_update_eir(&req);
3877         hci_req_run(&req, NULL);
3878
3879         hci_dev_unlock(hdev);
3880
3881         return err;
3882 }
3883
3884 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
3885                                         u16 opcode)
3886 {
3887         BT_DBG("status %d", status);
3888 }
3889
3890 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
3891                                      u16 opcode)
3892 {
3893         struct cmd_lookup match = { NULL, hdev };
3894         struct hci_request req;
3895         u8 instance;
3896         struct adv_info *adv_instance;
3897         int err;
3898
3899         hci_dev_lock(hdev);
3900
3901         if (status) {
3902                 u8 mgmt_err = mgmt_status(status);
3903
3904                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3905                                      cmd_status_rsp, &mgmt_err);
3906                 goto unlock;
3907         }
3908
3909         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3910                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
3911         else
3912                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3913
3914         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3915                              &match);
3916
3917         new_settings(hdev, match.sk);
3918
3919         if (match.sk)
3920                 sock_put(match.sk);
3921
3922         /* If "Set Advertising" was just disabled and instance advertising was
3923          * set up earlier, then re-enable multi-instance advertising.
3924          */
3925         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3926             list_empty(&hdev->adv_instances))
3927                 goto unlock;
3928
3929         instance = hdev->cur_adv_instance;
3930         if (!instance) {
3931                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
3932                                                         struct adv_info, list);
3933                 if (!adv_instance)
3934                         goto unlock;
3935
3936                 instance = adv_instance->instance;
3937         }
3938
3939         hci_req_init(&req, hdev);
3940
3941         err = __hci_req_schedule_adv_instance(&req, instance, true);
3942
3943         if (!err)
3944                 err = hci_req_run(&req, enable_advertising_instance);
3945
3946         if (err)
3947                 bt_dev_err(hdev, "failed to re-configure advertising");
3948
3949 unlock:
3950         hci_dev_unlock(hdev);
3951 }
3952
3953 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3954                            u16 len)
3955 {
3956         struct mgmt_mode *cp = data;
3957         struct mgmt_pending_cmd *cmd;
3958         struct hci_request req;
3959         u8 val, status;
3960         int err;
3961
3962         BT_DBG("request for %s", hdev->name);
3963
3964         status = mgmt_le_support(hdev);
3965         if (status)
3966                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3967                                        status);
3968
3969         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
3970                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3971                                        MGMT_STATUS_INVALID_PARAMS);
3972
3973         hci_dev_lock(hdev);
3974
3975         val = !!cp->val;
3976
3977         /* The following conditions are ones which mean that we should
3978          * not do any HCI communication but directly send a mgmt
3979          * response to user space (after toggling the flag if
3980          * necessary).
3981          */
3982         if (!hdev_is_powered(hdev) ||
3983             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
3984              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
3985             hci_conn_num(hdev, LE_LINK) > 0 ||
3986             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3987              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
3988                 bool changed;
3989
3990                 if (cp->val) {
3991                         hdev->cur_adv_instance = 0x00;
3992                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
3993                         if (cp->val == 0x02)
3994                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3995                         else
3996                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3997                 } else {
3998                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
3999                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4000                 }
4001
4002                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4003                 if (err < 0)
4004                         goto unlock;
4005
4006                 if (changed)
4007                         err = new_settings(hdev, sk);
4008
4009                 goto unlock;
4010         }
4011
4012         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4013             pending_find(MGMT_OP_SET_LE, hdev)) {
4014                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4015                                       MGMT_STATUS_BUSY);
4016                 goto unlock;
4017         }
4018
4019         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4020         if (!cmd) {
4021                 err = -ENOMEM;
4022                 goto unlock;
4023         }
4024
4025         hci_req_init(&req, hdev);
4026
4027         if (cp->val == 0x02)
4028                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4029         else
4030                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4031
4032         cancel_adv_timeout(hdev);
4033
4034         if (val) {
4035                 /* Switch to instance "0" for the Set Advertising setting.
4036                  * We cannot use update_[adv|scan_rsp]_data() here as the
4037                  * HCI_ADVERTISING flag is not yet set.
4038                  */
4039                 hdev->cur_adv_instance = 0x00;
4040                 __hci_req_update_adv_data(&req, 0x00);
4041                 __hci_req_update_scan_rsp_data(&req, 0x00);
4042                 __hci_req_enable_advertising(&req);
4043         } else {
4044                 __hci_req_disable_advertising(&req);
4045         }
4046
4047         err = hci_req_run(&req, set_advertising_complete);
4048         if (err < 0)
4049                 mgmt_pending_remove(cmd);
4050
4051 unlock:
4052         hci_dev_unlock(hdev);
4053         return err;
4054 }
4055
4056 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4057                               void *data, u16 len)
4058 {
4059         struct mgmt_cp_set_static_address *cp = data;
4060         int err;
4061
4062         BT_DBG("%s", hdev->name);
4063
4064         if (!lmp_le_capable(hdev))
4065                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4066                                        MGMT_STATUS_NOT_SUPPORTED);
4067
4068         if (hdev_is_powered(hdev))
4069                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4070                                        MGMT_STATUS_REJECTED);
4071
4072         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4073                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4074                         return mgmt_cmd_status(sk, hdev->id,
4075                                                MGMT_OP_SET_STATIC_ADDRESS,
4076                                                MGMT_STATUS_INVALID_PARAMS);
4077
4078                 /* Two most significant bits shall be set */
4079                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4080                         return mgmt_cmd_status(sk, hdev->id,
4081                                                MGMT_OP_SET_STATIC_ADDRESS,
4082                                                MGMT_STATUS_INVALID_PARAMS);
4083         }
4084
4085         hci_dev_lock(hdev);
4086
4087         bacpy(&hdev->static_addr, &cp->bdaddr);
4088
4089         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4090         if (err < 0)
4091                 goto unlock;
4092
4093         err = new_settings(hdev, sk);
4094
4095 unlock:
4096         hci_dev_unlock(hdev);
4097         return err;
4098 }
4099
4100 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4101                            void *data, u16 len)
4102 {
4103         struct mgmt_cp_set_scan_params *cp = data;
4104         __u16 interval, window;
4105         int err;
4106
4107         BT_DBG("%s", hdev->name);
4108
4109         if (!lmp_le_capable(hdev))
4110                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4111                                        MGMT_STATUS_NOT_SUPPORTED);
4112
4113         interval = __le16_to_cpu(cp->interval);
4114
4115         if (interval < 0x0004 || interval > 0x4000)
4116                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4117                                        MGMT_STATUS_INVALID_PARAMS);
4118
4119         window = __le16_to_cpu(cp->window);
4120
4121         if (window < 0x0004 || window > 0x4000)
4122                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4123                                        MGMT_STATUS_INVALID_PARAMS);
4124
4125         if (window > interval)
4126                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4127                                        MGMT_STATUS_INVALID_PARAMS);
4128
4129         hci_dev_lock(hdev);
4130
4131         hdev->le_scan_interval = interval;
4132         hdev->le_scan_window = window;
4133
4134         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4135                                 NULL, 0);
4136
4137         /* If background scan is running, restart it so new parameters are
4138          * loaded.
4139          */
4140         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4141             hdev->discovery.state == DISCOVERY_STOPPED) {
4142                 struct hci_request req;
4143
4144                 hci_req_init(&req, hdev);
4145
4146                 hci_req_add_le_scan_disable(&req);
4147                 hci_req_add_le_passive_scan(&req);
4148
4149                 hci_req_run(&req, NULL);
4150         }
4151
4152         hci_dev_unlock(hdev);
4153
4154         return err;
4155 }
4156
4157 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4158                                       u16 opcode)
4159 {
4160         struct mgmt_pending_cmd *cmd;
4161
4162         BT_DBG("status 0x%02x", status);
4163
4164         hci_dev_lock(hdev);
4165
4166         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4167         if (!cmd)
4168                 goto unlock;
4169
4170         if (status) {
4171                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4172                                 mgmt_status(status));
4173         } else {
4174                 struct mgmt_mode *cp = cmd->param;
4175
4176                 if (cp->val)
4177                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4178                 else
4179                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4180
4181                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4182                 new_settings(hdev, cmd->sk);
4183         }
4184
4185         mgmt_pending_remove(cmd);
4186
4187 unlock:
4188         hci_dev_unlock(hdev);
4189 }
4190
4191 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4192                                 void *data, u16 len)
4193 {
4194         struct mgmt_mode *cp = data;
4195         struct mgmt_pending_cmd *cmd;
4196         struct hci_request req;
4197         int err;
4198
4199         BT_DBG("%s", hdev->name);
4200
4201         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4202             hdev->hci_ver < BLUETOOTH_VER_1_2)
4203                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4204                                        MGMT_STATUS_NOT_SUPPORTED);
4205
4206         if (cp->val != 0x00 && cp->val != 0x01)
4207                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4208                                        MGMT_STATUS_INVALID_PARAMS);
4209
4210         hci_dev_lock(hdev);
4211
4212         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4213                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4214                                       MGMT_STATUS_BUSY);
4215                 goto unlock;
4216         }
4217
4218         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4219                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4220                                         hdev);
4221                 goto unlock;
4222         }
4223
4224         if (!hdev_is_powered(hdev)) {
4225                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4226                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4227                                         hdev);
4228                 new_settings(hdev, sk);
4229                 goto unlock;
4230         }
4231
4232         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4233                                data, len);
4234         if (!cmd) {
4235                 err = -ENOMEM;
4236                 goto unlock;
4237         }
4238
4239         hci_req_init(&req, hdev);
4240
4241         __hci_req_write_fast_connectable(&req, cp->val);
4242
4243         err = hci_req_run(&req, fast_connectable_complete);
4244         if (err < 0) {
4245                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4246                                       MGMT_STATUS_FAILED);
4247                 mgmt_pending_remove(cmd);
4248         }
4249
4250 unlock:
4251         hci_dev_unlock(hdev);
4252
4253         return err;
4254 }
4255
4256 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4257 {
4258         struct mgmt_pending_cmd *cmd;
4259
4260         BT_DBG("status 0x%02x", status);
4261
4262         hci_dev_lock(hdev);
4263
4264         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4265         if (!cmd)
4266                 goto unlock;
4267
4268         if (status) {
4269                 u8 mgmt_err = mgmt_status(status);
4270
4271                 /* We need to restore the flag if related HCI commands
4272                  * failed.
4273                  */
4274                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4275
4276                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4277         } else {
4278                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4279                 new_settings(hdev, cmd->sk);
4280         }
4281
4282         mgmt_pending_remove(cmd);
4283
4284 unlock:
4285         hci_dev_unlock(hdev);
4286 }
4287
4288 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4289 {
4290         struct mgmt_mode *cp = data;
4291         struct mgmt_pending_cmd *cmd;
4292         struct hci_request req;
4293         int err;
4294
4295         BT_DBG("request for %s", hdev->name);
4296
4297         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4298                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4299                                        MGMT_STATUS_NOT_SUPPORTED);
4300
4301         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4302                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4303                                        MGMT_STATUS_REJECTED);
4304
4305         if (cp->val != 0x00 && cp->val != 0x01)
4306                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4307                                        MGMT_STATUS_INVALID_PARAMS);
4308
4309         hci_dev_lock(hdev);
4310
4311         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4312                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4313                 goto unlock;
4314         }
4315
4316         if (!hdev_is_powered(hdev)) {
4317                 if (!cp->val) {
4318                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4319                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4320                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4321                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4322                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4323                 }
4324
4325                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4326
4327                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4328                 if (err < 0)
4329                         goto unlock;
4330
4331                 err = new_settings(hdev, sk);
4332                 goto unlock;
4333         }
4334
4335         /* Reject disabling when powered on */
4336         if (!cp->val) {
4337                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4338                                       MGMT_STATUS_REJECTED);
4339                 goto unlock;
4340         } else {
4341                 /* When configuring a dual-mode controller to operate
4342                  * with LE only and using a static address, then switching
4343                  * BR/EDR back on is not allowed.
4344                  *
4345                  * Dual-mode controllers shall operate with the public
4346                  * address as its identity address for BR/EDR and LE. So
4347                  * reject the attempt to create an invalid configuration.
4348                  *
4349                  * The same restrictions applies when secure connections
4350                  * has been enabled. For BR/EDR this is a controller feature
4351                  * while for LE it is a host stack feature. This means that
4352                  * switching BR/EDR back on when secure connections has been
4353                  * enabled is not a supported transaction.
4354                  */
4355                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4356                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4357                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4358                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4359                                               MGMT_STATUS_REJECTED);
4360                         goto unlock;
4361                 }
4362         }
4363
4364         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4365                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4366                                       MGMT_STATUS_BUSY);
4367                 goto unlock;
4368         }
4369
4370         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4371         if (!cmd) {
4372                 err = -ENOMEM;
4373                 goto unlock;
4374         }
4375
4376         /* We need to flip the bit already here so that
4377          * hci_req_update_adv_data generates the correct flags.
4378          */
4379         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4380
4381         hci_req_init(&req, hdev);
4382
4383         __hci_req_write_fast_connectable(&req, false);
4384         __hci_req_update_scan(&req);
4385
4386         /* Since only the advertising data flags will change, there
4387          * is no need to update the scan response data.
4388          */
4389         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4390
4391         err = hci_req_run(&req, set_bredr_complete);
4392         if (err < 0)
4393                 mgmt_pending_remove(cmd);
4394
4395 unlock:
4396         hci_dev_unlock(hdev);
4397         return err;
4398 }
4399
4400 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4401 {
4402         struct mgmt_pending_cmd *cmd;
4403         struct mgmt_mode *cp;
4404
4405         BT_DBG("%s status %u", hdev->name, status);
4406
4407         hci_dev_lock(hdev);
4408
4409         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4410         if (!cmd)
4411                 goto unlock;
4412
4413         if (status) {
4414                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4415                                 mgmt_status(status));
4416                 goto remove;
4417         }
4418
4419         cp = cmd->param;
4420
4421         switch (cp->val) {
4422         case 0x00:
4423                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4424                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4425                 break;
4426         case 0x01:
4427                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4428                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4429                 break;
4430         case 0x02:
4431                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4432                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4433                 break;
4434         }
4435
4436         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4437         new_settings(hdev, cmd->sk);
4438
4439 remove:
4440         mgmt_pending_remove(cmd);
4441 unlock:
4442         hci_dev_unlock(hdev);
4443 }
4444
4445 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4446                            void *data, u16 len)
4447 {
4448         struct mgmt_mode *cp = data;
4449         struct mgmt_pending_cmd *cmd;
4450         struct hci_request req;
4451         u8 val;
4452         int err;
4453
4454         BT_DBG("request for %s", hdev->name);
4455
4456         if (!lmp_sc_capable(hdev) &&
4457             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4458                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4459                                        MGMT_STATUS_NOT_SUPPORTED);
4460
4461         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4462             lmp_sc_capable(hdev) &&
4463             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4464                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4465                                        MGMT_STATUS_REJECTED);
4466
4467         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4468                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4469                                   MGMT_STATUS_INVALID_PARAMS);
4470
4471         hci_dev_lock(hdev);
4472
4473         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4474             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4475                 bool changed;
4476
4477                 if (cp->val) {
4478                         changed = !hci_dev_test_and_set_flag(hdev,
4479                                                              HCI_SC_ENABLED);
4480                         if (cp->val == 0x02)
4481                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4482                         else
4483                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4484                 } else {
4485                         changed = hci_dev_test_and_clear_flag(hdev,
4486                                                               HCI_SC_ENABLED);
4487                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4488                 }
4489
4490                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4491                 if (err < 0)
4492                         goto failed;
4493
4494                 if (changed)
4495                         err = new_settings(hdev, sk);
4496
4497                 goto failed;
4498         }
4499
4500         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4501                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4502                                       MGMT_STATUS_BUSY);
4503                 goto failed;
4504         }
4505
4506         val = !!cp->val;
4507
4508         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4509             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4510                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4511                 goto failed;
4512         }
4513
4514         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4515         if (!cmd) {
4516                 err = -ENOMEM;
4517                 goto failed;
4518         }
4519
4520         hci_req_init(&req, hdev);
4521         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4522         err = hci_req_run(&req, sc_enable_complete);
4523         if (err < 0) {
4524                 mgmt_pending_remove(cmd);
4525                 goto failed;
4526         }
4527
4528 failed:
4529         hci_dev_unlock(hdev);
4530         return err;
4531 }
4532
4533 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4534                           void *data, u16 len)
4535 {
4536         struct mgmt_mode *cp = data;
4537         bool changed, use_changed;
4538         int err;
4539
4540         BT_DBG("request for %s", hdev->name);
4541
4542         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4543                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4544                                        MGMT_STATUS_INVALID_PARAMS);
4545
4546         hci_dev_lock(hdev);
4547
4548         if (cp->val)
4549                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4550         else
4551                 changed = hci_dev_test_and_clear_flag(hdev,
4552                                                       HCI_KEEP_DEBUG_KEYS);
4553
4554         if (cp->val == 0x02)
4555                 use_changed = !hci_dev_test_and_set_flag(hdev,
4556                                                          HCI_USE_DEBUG_KEYS);
4557         else
4558                 use_changed = hci_dev_test_and_clear_flag(hdev,
4559                                                           HCI_USE_DEBUG_KEYS);
4560
4561         if (hdev_is_powered(hdev) && use_changed &&
4562             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4563                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4564                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4565                              sizeof(mode), &mode);
4566         }
4567
4568         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4569         if (err < 0)
4570                 goto unlock;
4571
4572         if (changed)
4573                 err = new_settings(hdev, sk);
4574
4575 unlock:
4576         hci_dev_unlock(hdev);
4577         return err;
4578 }
4579
4580 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4581                        u16 len)
4582 {
4583         struct mgmt_cp_set_privacy *cp = cp_data;
4584         bool changed;
4585         int err;
4586
4587         BT_DBG("request for %s", hdev->name);
4588
4589         if (!lmp_le_capable(hdev))
4590                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4591                                        MGMT_STATUS_NOT_SUPPORTED);
4592
4593         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4594                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4595                                        MGMT_STATUS_INVALID_PARAMS);
4596
4597         if (hdev_is_powered(hdev))
4598                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4599                                        MGMT_STATUS_REJECTED);
4600
4601         hci_dev_lock(hdev);
4602
4603         /* If user space supports this command it is also expected to
4604          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4605          */
4606         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4607
4608         if (cp->privacy) {
4609                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4610                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4611                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4612                 if (cp->privacy == 0x02)
4613                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4614                 else
4615                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4616         } else {
4617                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4618                 memset(hdev->irk, 0, sizeof(hdev->irk));
4619                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4620                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4621         }
4622
4623         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4624         if (err < 0)
4625                 goto unlock;
4626
4627         if (changed)
4628                 err = new_settings(hdev, sk);
4629
4630 unlock:
4631         hci_dev_unlock(hdev);
4632         return err;
4633 }
4634
4635 static bool irk_is_valid(struct mgmt_irk_info *irk)
4636 {
4637         switch (irk->addr.type) {
4638         case BDADDR_LE_PUBLIC:
4639                 return true;
4640
4641         case BDADDR_LE_RANDOM:
4642                 /* Two most significant bits shall be set */
4643                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4644                         return false;
4645                 return true;
4646         }
4647
4648         return false;
4649 }
4650
4651 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4652                      u16 len)
4653 {
4654         struct mgmt_cp_load_irks *cp = cp_data;
4655         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4656                                    sizeof(struct mgmt_irk_info));
4657         u16 irk_count, expected_len;
4658         int i, err;
4659
4660         BT_DBG("request for %s", hdev->name);
4661
4662         if (!lmp_le_capable(hdev))
4663                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4664                                        MGMT_STATUS_NOT_SUPPORTED);
4665
4666         irk_count = __le16_to_cpu(cp->irk_count);
4667         if (irk_count > max_irk_count) {
4668                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
4669                            irk_count);
4670                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4671                                        MGMT_STATUS_INVALID_PARAMS);
4672         }
4673
4674         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4675         if (expected_len != len) {
4676                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
4677                            expected_len, len);
4678                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4679                                        MGMT_STATUS_INVALID_PARAMS);
4680         }
4681
4682         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4683
4684         for (i = 0; i < irk_count; i++) {
4685                 struct mgmt_irk_info *key = &cp->irks[i];
4686
4687                 if (!irk_is_valid(key))
4688                         return mgmt_cmd_status(sk, hdev->id,
4689                                                MGMT_OP_LOAD_IRKS,
4690                                                MGMT_STATUS_INVALID_PARAMS);
4691         }
4692
4693         hci_dev_lock(hdev);
4694
4695         hci_smp_irks_clear(hdev);
4696
4697         for (i = 0; i < irk_count; i++) {
4698                 struct mgmt_irk_info *irk = &cp->irks[i];
4699
4700                 hci_add_irk(hdev, &irk->addr.bdaddr,
4701                             le_addr_type(irk->addr.type), irk->val,
4702                             BDADDR_ANY);
4703         }
4704
4705         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4706
4707         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4708
4709         hci_dev_unlock(hdev);
4710
4711         return err;
4712 }
4713
4714 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4715 {
4716         if (key->master != 0x00 && key->master != 0x01)
4717                 return false;
4718
4719         switch (key->addr.type) {
4720         case BDADDR_LE_PUBLIC:
4721                 return true;
4722
4723         case BDADDR_LE_RANDOM:
4724                 /* Two most significant bits shall be set */
4725                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4726                         return false;
4727                 return true;
4728         }
4729
4730         return false;
4731 }
4732
4733 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4734                                void *cp_data, u16 len)
4735 {
4736         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4737         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4738                                    sizeof(struct mgmt_ltk_info));
4739         u16 key_count, expected_len;
4740         int i, err;
4741
4742         BT_DBG("request for %s", hdev->name);
4743
4744         if (!lmp_le_capable(hdev))
4745                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4746                                        MGMT_STATUS_NOT_SUPPORTED);
4747
4748         key_count = __le16_to_cpu(cp->key_count);
4749         if (key_count > max_key_count) {
4750                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
4751                            key_count);
4752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4753                                        MGMT_STATUS_INVALID_PARAMS);
4754         }
4755
4756         expected_len = sizeof(*cp) + key_count *
4757                                         sizeof(struct mgmt_ltk_info);
4758         if (expected_len != len) {
4759                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
4760                            expected_len, len);
4761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4762                                        MGMT_STATUS_INVALID_PARAMS);
4763         }
4764
4765         BT_DBG("%s key_count %u", hdev->name, key_count);
4766
4767         for (i = 0; i < key_count; i++) {
4768                 struct mgmt_ltk_info *key = &cp->keys[i];
4769
4770                 if (!ltk_is_valid(key))
4771                         return mgmt_cmd_status(sk, hdev->id,
4772                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
4773                                                MGMT_STATUS_INVALID_PARAMS);
4774         }
4775
4776         hci_dev_lock(hdev);
4777
4778         hci_smp_ltks_clear(hdev);
4779
4780         for (i = 0; i < key_count; i++) {
4781                 struct mgmt_ltk_info *key = &cp->keys[i];
4782                 u8 type, authenticated;
4783
4784                 switch (key->type) {
4785                 case MGMT_LTK_UNAUTHENTICATED:
4786                         authenticated = 0x00;
4787                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4788                         break;
4789                 case MGMT_LTK_AUTHENTICATED:
4790                         authenticated = 0x01;
4791                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4792                         break;
4793                 case MGMT_LTK_P256_UNAUTH:
4794                         authenticated = 0x00;
4795                         type = SMP_LTK_P256;
4796                         break;
4797                 case MGMT_LTK_P256_AUTH:
4798                         authenticated = 0x01;
4799                         type = SMP_LTK_P256;
4800                         break;
4801                 case MGMT_LTK_P256_DEBUG:
4802                         authenticated = 0x00;
4803                         type = SMP_LTK_P256_DEBUG;
4804                         /* fall through */
4805                 default:
4806                         continue;
4807                 }
4808
4809                 hci_add_ltk(hdev, &key->addr.bdaddr,
4810                             le_addr_type(key->addr.type), type, authenticated,
4811                             key->val, key->enc_size, key->ediv, key->rand);
4812         }
4813
4814         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4815                            NULL, 0);
4816
4817         hci_dev_unlock(hdev);
4818
4819         return err;
4820 }
4821
4822 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4823 {
4824         struct hci_conn *conn = cmd->user_data;
4825         struct mgmt_rp_get_conn_info rp;
4826         int err;
4827
4828         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
4829
4830         if (status == MGMT_STATUS_SUCCESS) {
4831                 rp.rssi = conn->rssi;
4832                 rp.tx_power = conn->tx_power;
4833                 rp.max_tx_power = conn->max_tx_power;
4834         } else {
4835                 rp.rssi = HCI_RSSI_INVALID;
4836                 rp.tx_power = HCI_TX_POWER_INVALID;
4837                 rp.max_tx_power = HCI_TX_POWER_INVALID;
4838         }
4839
4840         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4841                                 status, &rp, sizeof(rp));
4842
4843         hci_conn_drop(conn);
4844         hci_conn_put(conn);
4845
4846         return err;
4847 }
4848
4849 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
4850                                        u16 opcode)
4851 {
4852         struct hci_cp_read_rssi *cp;
4853         struct mgmt_pending_cmd *cmd;
4854         struct hci_conn *conn;
4855         u16 handle;
4856         u8 status;
4857
4858         BT_DBG("status 0x%02x", hci_status);
4859
4860         hci_dev_lock(hdev);
4861
4862         /* Commands sent in request are either Read RSSI or Read Transmit Power
4863          * Level so we check which one was last sent to retrieve connection
4864          * handle.  Both commands have handle as first parameter so it's safe to
4865          * cast data on the same command struct.
4866          *
4867          * First command sent is always Read RSSI and we fail only if it fails.
4868          * In other case we simply override error to indicate success as we
4869          * already remembered if TX power value is actually valid.
4870          */
4871         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4872         if (!cp) {
4873                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4874                 status = MGMT_STATUS_SUCCESS;
4875         } else {
4876                 status = mgmt_status(hci_status);
4877         }
4878
4879         if (!cp) {
4880                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
4881                 goto unlock;
4882         }
4883
4884         handle = __le16_to_cpu(cp->handle);
4885         conn = hci_conn_hash_lookup_handle(hdev, handle);
4886         if (!conn) {
4887                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
4888                            handle);
4889                 goto unlock;
4890         }
4891
4892         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
4893         if (!cmd)
4894                 goto unlock;
4895
4896         cmd->cmd_complete(cmd, status);
4897         mgmt_pending_remove(cmd);
4898
4899 unlock:
4900         hci_dev_unlock(hdev);
4901 }
4902
4903 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4904                          u16 len)
4905 {
4906         struct mgmt_cp_get_conn_info *cp = data;
4907         struct mgmt_rp_get_conn_info rp;
4908         struct hci_conn *conn;
4909         unsigned long conn_info_age;
4910         int err = 0;
4911
4912         BT_DBG("%s", hdev->name);
4913
4914         memset(&rp, 0, sizeof(rp));
4915         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4916         rp.addr.type = cp->addr.type;
4917
4918         if (!bdaddr_type_is_valid(cp->addr.type))
4919                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4920                                          MGMT_STATUS_INVALID_PARAMS,
4921                                          &rp, sizeof(rp));
4922
4923         hci_dev_lock(hdev);
4924
4925         if (!hdev_is_powered(hdev)) {
4926                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4927                                         MGMT_STATUS_NOT_POWERED, &rp,
4928                                         sizeof(rp));
4929                 goto unlock;
4930         }
4931
4932         if (cp->addr.type == BDADDR_BREDR)
4933                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4934                                                &cp->addr.bdaddr);
4935         else
4936                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4937
4938         if (!conn || conn->state != BT_CONNECTED) {
4939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4940                                         MGMT_STATUS_NOT_CONNECTED, &rp,
4941                                         sizeof(rp));
4942                 goto unlock;
4943         }
4944
4945         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
4946                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4947                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
4948                 goto unlock;
4949         }
4950
4951         /* To avoid client trying to guess when to poll again for information we
4952          * calculate conn info age as random value between min/max set in hdev.
4953          */
4954         conn_info_age = hdev->conn_info_min_age +
4955                         prandom_u32_max(hdev->conn_info_max_age -
4956                                         hdev->conn_info_min_age);
4957
4958         /* Query controller to refresh cached values if they are too old or were
4959          * never read.
4960          */
4961         if (time_after(jiffies, conn->conn_info_timestamp +
4962                        msecs_to_jiffies(conn_info_age)) ||
4963             !conn->conn_info_timestamp) {
4964                 struct hci_request req;
4965                 struct hci_cp_read_tx_power req_txp_cp;
4966                 struct hci_cp_read_rssi req_rssi_cp;
4967                 struct mgmt_pending_cmd *cmd;
4968
4969                 hci_req_init(&req, hdev);
4970                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4971                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4972                             &req_rssi_cp);
4973
4974                 /* For LE links TX power does not change thus we don't need to
4975                  * query for it once value is known.
4976                  */
4977                 if (!bdaddr_type_is_le(cp->addr.type) ||
4978                     conn->tx_power == HCI_TX_POWER_INVALID) {
4979                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4980                         req_txp_cp.type = 0x00;
4981                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4982                                     sizeof(req_txp_cp), &req_txp_cp);
4983                 }
4984
4985                 /* Max TX power needs to be read only once per connection */
4986                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4987                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4988                         req_txp_cp.type = 0x01;
4989                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4990                                     sizeof(req_txp_cp), &req_txp_cp);
4991                 }
4992
4993                 err = hci_req_run(&req, conn_info_refresh_complete);
4994                 if (err < 0)
4995                         goto unlock;
4996
4997                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4998                                        data, len);
4999                 if (!cmd) {
5000                         err = -ENOMEM;
5001                         goto unlock;
5002                 }
5003
5004                 hci_conn_hold(conn);
5005                 cmd->user_data = hci_conn_get(conn);
5006                 cmd->cmd_complete = conn_info_cmd_complete;
5007
5008                 conn->conn_info_timestamp = jiffies;
5009         } else {
5010                 /* Cache is valid, just reply with values cached in hci_conn */
5011                 rp.rssi = conn->rssi;
5012                 rp.tx_power = conn->tx_power;
5013                 rp.max_tx_power = conn->max_tx_power;
5014
5015                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5016                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5017         }
5018
5019 unlock:
5020         hci_dev_unlock(hdev);
5021         return err;
5022 }
5023
5024 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5025 {
5026         struct hci_conn *conn = cmd->user_data;
5027         struct mgmt_rp_get_clock_info rp;
5028         struct hci_dev *hdev;
5029         int err;
5030
5031         memset(&rp, 0, sizeof(rp));
5032         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5033
5034         if (status)
5035                 goto complete;
5036
5037         hdev = hci_dev_get(cmd->index);
5038         if (hdev) {
5039                 rp.local_clock = cpu_to_le32(hdev->clock);
5040                 hci_dev_put(hdev);
5041         }
5042
5043         if (conn) {
5044                 rp.piconet_clock = cpu_to_le32(conn->clock);
5045                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5046         }
5047
5048 complete:
5049         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5050                                 sizeof(rp));
5051
5052         if (conn) {
5053                 hci_conn_drop(conn);
5054                 hci_conn_put(conn);
5055         }
5056
5057         return err;
5058 }
5059
5060 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5061 {
5062         struct hci_cp_read_clock *hci_cp;
5063         struct mgmt_pending_cmd *cmd;
5064         struct hci_conn *conn;
5065
5066         BT_DBG("%s status %u", hdev->name, status);
5067
5068         hci_dev_lock(hdev);
5069
5070         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5071         if (!hci_cp)
5072                 goto unlock;
5073
5074         if (hci_cp->which) {
5075                 u16 handle = __le16_to_cpu(hci_cp->handle);
5076                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5077         } else {
5078                 conn = NULL;
5079         }
5080
5081         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5082         if (!cmd)
5083                 goto unlock;
5084
5085         cmd->cmd_complete(cmd, mgmt_status(status));
5086         mgmt_pending_remove(cmd);
5087
5088 unlock:
5089         hci_dev_unlock(hdev);
5090 }
5091
5092 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5093                          u16 len)
5094 {
5095         struct mgmt_cp_get_clock_info *cp = data;
5096         struct mgmt_rp_get_clock_info rp;
5097         struct hci_cp_read_clock hci_cp;
5098         struct mgmt_pending_cmd *cmd;
5099         struct hci_request req;
5100         struct hci_conn *conn;
5101         int err;
5102
5103         BT_DBG("%s", hdev->name);
5104
5105         memset(&rp, 0, sizeof(rp));
5106         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5107         rp.addr.type = cp->addr.type;
5108
5109         if (cp->addr.type != BDADDR_BREDR)
5110                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5111                                          MGMT_STATUS_INVALID_PARAMS,
5112                                          &rp, sizeof(rp));
5113
5114         hci_dev_lock(hdev);
5115
5116         if (!hdev_is_powered(hdev)) {
5117                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5118                                         MGMT_STATUS_NOT_POWERED, &rp,
5119                                         sizeof(rp));
5120                 goto unlock;
5121         }
5122
5123         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5124                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5125                                                &cp->addr.bdaddr);
5126                 if (!conn || conn->state != BT_CONNECTED) {
5127                         err = mgmt_cmd_complete(sk, hdev->id,
5128                                                 MGMT_OP_GET_CLOCK_INFO,
5129                                                 MGMT_STATUS_NOT_CONNECTED,
5130                                                 &rp, sizeof(rp));
5131                         goto unlock;
5132                 }
5133         } else {
5134                 conn = NULL;
5135         }
5136
5137         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5138         if (!cmd) {
5139                 err = -ENOMEM;
5140                 goto unlock;
5141         }
5142
5143         cmd->cmd_complete = clock_info_cmd_complete;
5144
5145         hci_req_init(&req, hdev);
5146
5147         memset(&hci_cp, 0, sizeof(hci_cp));
5148         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5149
5150         if (conn) {
5151                 hci_conn_hold(conn);
5152                 cmd->user_data = hci_conn_get(conn);
5153
5154                 hci_cp.handle = cpu_to_le16(conn->handle);
5155                 hci_cp.which = 0x01; /* Piconet clock */
5156                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5157         }
5158
5159         err = hci_req_run(&req, get_clock_info_complete);
5160         if (err < 0)
5161                 mgmt_pending_remove(cmd);
5162
5163 unlock:
5164         hci_dev_unlock(hdev);
5165         return err;
5166 }
5167
5168 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5169 {
5170         struct hci_conn *conn;
5171
5172         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5173         if (!conn)
5174                 return false;
5175
5176         if (conn->dst_type != type)
5177                 return false;
5178
5179         if (conn->state != BT_CONNECTED)
5180                 return false;
5181
5182         return true;
5183 }
5184
5185 /* This function requires the caller holds hdev->lock */
5186 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5187                                u8 addr_type, u8 auto_connect)
5188 {
5189         struct hci_conn_params *params;
5190
5191         params = hci_conn_params_add(hdev, addr, addr_type);
5192         if (!params)
5193                 return -EIO;
5194
5195         if (params->auto_connect == auto_connect)
5196                 return 0;
5197
5198         list_del_init(&params->action);
5199
5200         switch (auto_connect) {
5201         case HCI_AUTO_CONN_DISABLED:
5202         case HCI_AUTO_CONN_LINK_LOSS:
5203                 /* If auto connect is being disabled when we're trying to
5204                  * connect to device, keep connecting.
5205                  */
5206                 if (params->explicit_connect)
5207                         list_add(&params->action, &hdev->pend_le_conns);
5208                 break;
5209         case HCI_AUTO_CONN_REPORT:
5210                 if (params->explicit_connect)
5211                         list_add(&params->action, &hdev->pend_le_conns);
5212                 else
5213                         list_add(&params->action, &hdev->pend_le_reports);
5214                 break;
5215         case HCI_AUTO_CONN_DIRECT:
5216         case HCI_AUTO_CONN_ALWAYS:
5217                 if (!is_connected(hdev, addr, addr_type))
5218                         list_add(&params->action, &hdev->pend_le_conns);
5219                 break;
5220         }
5221
5222         params->auto_connect = auto_connect;
5223
5224         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5225                auto_connect);
5226
5227         return 0;
5228 }
5229
5230 static void device_added(struct sock *sk, struct hci_dev *hdev,
5231                          bdaddr_t *bdaddr, u8 type, u8 action)
5232 {
5233         struct mgmt_ev_device_added ev;
5234
5235         bacpy(&ev.addr.bdaddr, bdaddr);
5236         ev.addr.type = type;
5237         ev.action = action;
5238
5239         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5240 }
5241
5242 static int add_device(struct sock *sk, struct hci_dev *hdev,
5243                       void *data, u16 len)
5244 {
5245         struct mgmt_cp_add_device *cp = data;
5246         u8 auto_conn, addr_type;
5247         int err;
5248
5249         BT_DBG("%s", hdev->name);
5250
5251         if (!bdaddr_type_is_valid(cp->addr.type) ||
5252             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5253                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5254                                          MGMT_STATUS_INVALID_PARAMS,
5255                                          &cp->addr, sizeof(cp->addr));
5256
5257         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5258                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5259                                          MGMT_STATUS_INVALID_PARAMS,
5260                                          &cp->addr, sizeof(cp->addr));
5261
5262         hci_dev_lock(hdev);
5263
5264         if (cp->addr.type == BDADDR_BREDR) {
5265                 /* Only incoming connections action is supported for now */
5266                 if (cp->action != 0x01) {
5267                         err = mgmt_cmd_complete(sk, hdev->id,
5268                                                 MGMT_OP_ADD_DEVICE,
5269                                                 MGMT_STATUS_INVALID_PARAMS,
5270                                                 &cp->addr, sizeof(cp->addr));
5271                         goto unlock;
5272                 }
5273
5274                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5275                                           cp->addr.type);
5276                 if (err)
5277                         goto unlock;
5278
5279                 hci_req_update_scan(hdev);
5280
5281                 goto added;
5282         }
5283
5284         addr_type = le_addr_type(cp->addr.type);
5285
5286         if (cp->action == 0x02)
5287                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5288         else if (cp->action == 0x01)
5289                 auto_conn = HCI_AUTO_CONN_DIRECT;
5290         else
5291                 auto_conn = HCI_AUTO_CONN_REPORT;
5292
5293         /* Kernel internally uses conn_params with resolvable private
5294          * address, but Add Device allows only identity addresses.
5295          * Make sure it is enforced before calling
5296          * hci_conn_params_lookup.
5297          */
5298         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5299                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5300                                         MGMT_STATUS_INVALID_PARAMS,
5301                                         &cp->addr, sizeof(cp->addr));
5302                 goto unlock;
5303         }
5304
5305         /* If the connection parameters don't exist for this device,
5306          * they will be created and configured with defaults.
5307          */
5308         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5309                                 auto_conn) < 0) {
5310                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5311                                         MGMT_STATUS_FAILED, &cp->addr,
5312                                         sizeof(cp->addr));
5313                 goto unlock;
5314         }
5315
5316         hci_update_background_scan(hdev);
5317
5318 added:
5319         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5320
5321         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5322                                 MGMT_STATUS_SUCCESS, &cp->addr,
5323                                 sizeof(cp->addr));
5324
5325 unlock:
5326         hci_dev_unlock(hdev);
5327         return err;
5328 }
5329
5330 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5331                            bdaddr_t *bdaddr, u8 type)
5332 {
5333         struct mgmt_ev_device_removed ev;
5334
5335         bacpy(&ev.addr.bdaddr, bdaddr);
5336         ev.addr.type = type;
5337
5338         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5339 }
5340
5341 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5342                          void *data, u16 len)
5343 {
5344         struct mgmt_cp_remove_device *cp = data;
5345         int err;
5346
5347         BT_DBG("%s", hdev->name);
5348
5349         hci_dev_lock(hdev);
5350
5351         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5352                 struct hci_conn_params *params;
5353                 u8 addr_type;
5354
5355                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5356                         err = mgmt_cmd_complete(sk, hdev->id,
5357                                                 MGMT_OP_REMOVE_DEVICE,
5358                                                 MGMT_STATUS_INVALID_PARAMS,
5359                                                 &cp->addr, sizeof(cp->addr));
5360                         goto unlock;
5361                 }
5362
5363                 if (cp->addr.type == BDADDR_BREDR) {
5364                         err = hci_bdaddr_list_del(&hdev->whitelist,
5365                                                   &cp->addr.bdaddr,
5366                                                   cp->addr.type);
5367                         if (err) {
5368                                 err = mgmt_cmd_complete(sk, hdev->id,
5369                                                         MGMT_OP_REMOVE_DEVICE,
5370                                                         MGMT_STATUS_INVALID_PARAMS,
5371                                                         &cp->addr,
5372                                                         sizeof(cp->addr));
5373                                 goto unlock;
5374                         }
5375
5376                         hci_req_update_scan(hdev);
5377
5378                         device_removed(sk, hdev, &cp->addr.bdaddr,
5379                                        cp->addr.type);
5380                         goto complete;
5381                 }
5382
5383                 addr_type = le_addr_type(cp->addr.type);
5384
5385                 /* Kernel internally uses conn_params with resolvable private
5386                  * address, but Remove Device allows only identity addresses.
5387                  * Make sure it is enforced before calling
5388                  * hci_conn_params_lookup.
5389                  */
5390                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5391                         err = mgmt_cmd_complete(sk, hdev->id,
5392                                                 MGMT_OP_REMOVE_DEVICE,
5393                                                 MGMT_STATUS_INVALID_PARAMS,
5394                                                 &cp->addr, sizeof(cp->addr));
5395                         goto unlock;
5396                 }
5397
5398                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5399                                                 addr_type);
5400                 if (!params) {
5401                         err = mgmt_cmd_complete(sk, hdev->id,
5402                                                 MGMT_OP_REMOVE_DEVICE,
5403                                                 MGMT_STATUS_INVALID_PARAMS,
5404                                                 &cp->addr, sizeof(cp->addr));
5405                         goto unlock;
5406                 }
5407
5408                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5409                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5410                         err = mgmt_cmd_complete(sk, hdev->id,
5411                                                 MGMT_OP_REMOVE_DEVICE,
5412                                                 MGMT_STATUS_INVALID_PARAMS,
5413                                                 &cp->addr, sizeof(cp->addr));
5414                         goto unlock;
5415                 }
5416
5417                 list_del(&params->action);
5418                 list_del(&params->list);
5419                 kfree(params);
5420                 hci_update_background_scan(hdev);
5421
5422                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5423         } else {
5424                 struct hci_conn_params *p, *tmp;
5425                 struct bdaddr_list *b, *btmp;
5426
5427                 if (cp->addr.type) {
5428                         err = mgmt_cmd_complete(sk, hdev->id,
5429                                                 MGMT_OP_REMOVE_DEVICE,
5430                                                 MGMT_STATUS_INVALID_PARAMS,
5431                                                 &cp->addr, sizeof(cp->addr));
5432                         goto unlock;
5433                 }
5434
5435                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5436                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5437                         list_del(&b->list);
5438                         kfree(b);
5439                 }
5440
5441                 hci_req_update_scan(hdev);
5442
5443                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5444                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5445                                 continue;
5446                         device_removed(sk, hdev, &p->addr, p->addr_type);
5447                         if (p->explicit_connect) {
5448                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5449                                 continue;
5450                         }
5451                         list_del(&p->action);
5452                         list_del(&p->list);
5453                         kfree(p);
5454                 }
5455
5456                 BT_DBG("All LE connection parameters were removed");
5457
5458                 hci_update_background_scan(hdev);
5459         }
5460
5461 complete:
5462         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5463                                 MGMT_STATUS_SUCCESS, &cp->addr,
5464                                 sizeof(cp->addr));
5465 unlock:
5466         hci_dev_unlock(hdev);
5467         return err;
5468 }
5469
5470 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5471                            u16 len)
5472 {
5473         struct mgmt_cp_load_conn_param *cp = data;
5474         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5475                                      sizeof(struct mgmt_conn_param));
5476         u16 param_count, expected_len;
5477         int i;
5478
5479         if (!lmp_le_capable(hdev))
5480                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5481                                        MGMT_STATUS_NOT_SUPPORTED);
5482
5483         param_count = __le16_to_cpu(cp->param_count);
5484         if (param_count > max_param_count) {
5485                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5486                            param_count);
5487                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5488                                        MGMT_STATUS_INVALID_PARAMS);
5489         }
5490
5491         expected_len = sizeof(*cp) + param_count *
5492                                         sizeof(struct mgmt_conn_param);
5493         if (expected_len != len) {
5494                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5495                            expected_len, len);
5496                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5497                                        MGMT_STATUS_INVALID_PARAMS);
5498         }
5499
5500         BT_DBG("%s param_count %u", hdev->name, param_count);
5501
5502         hci_dev_lock(hdev);
5503
5504         hci_conn_params_clear_disabled(hdev);
5505
5506         for (i = 0; i < param_count; i++) {
5507                 struct mgmt_conn_param *param = &cp->params[i];
5508                 struct hci_conn_params *hci_param;
5509                 u16 min, max, latency, timeout;
5510                 u8 addr_type;
5511
5512                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5513                        param->addr.type);
5514
5515                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5516                         addr_type = ADDR_LE_DEV_PUBLIC;
5517                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5518                         addr_type = ADDR_LE_DEV_RANDOM;
5519                 } else {
5520                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5521                         continue;
5522                 }
5523
5524                 min = le16_to_cpu(param->min_interval);
5525                 max = le16_to_cpu(param->max_interval);
5526                 latency = le16_to_cpu(param->latency);
5527                 timeout = le16_to_cpu(param->timeout);
5528
5529                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5530                        min, max, latency, timeout);
5531
5532                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5533                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5534                         continue;
5535                 }
5536
5537                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5538                                                 addr_type);
5539                 if (!hci_param) {
5540                         bt_dev_err(hdev, "failed to add connection parameters");
5541                         continue;
5542                 }
5543
5544                 hci_param->conn_min_interval = min;
5545                 hci_param->conn_max_interval = max;
5546                 hci_param->conn_latency = latency;
5547                 hci_param->supervision_timeout = timeout;
5548         }
5549
5550         hci_dev_unlock(hdev);
5551
5552         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5553                                  NULL, 0);
5554 }
5555
5556 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5557                                void *data, u16 len)
5558 {
5559         struct mgmt_cp_set_external_config *cp = data;
5560         bool changed;
5561         int err;
5562
5563         BT_DBG("%s", hdev->name);
5564
5565         if (hdev_is_powered(hdev))
5566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5567                                        MGMT_STATUS_REJECTED);
5568
5569         if (cp->config != 0x00 && cp->config != 0x01)
5570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5571                                          MGMT_STATUS_INVALID_PARAMS);
5572
5573         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5574                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5575                                        MGMT_STATUS_NOT_SUPPORTED);
5576
5577         hci_dev_lock(hdev);
5578
5579         if (cp->config)
5580                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5581         else
5582                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5583
5584         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5585         if (err < 0)
5586                 goto unlock;
5587
5588         if (!changed)
5589                 goto unlock;
5590
5591         err = new_options(hdev, sk);
5592
5593         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5594                 mgmt_index_removed(hdev);
5595
5596                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5597                         hci_dev_set_flag(hdev, HCI_CONFIG);
5598                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5599
5600                         queue_work(hdev->req_workqueue, &hdev->power_on);
5601                 } else {
5602                         set_bit(HCI_RAW, &hdev->flags);
5603                         mgmt_index_added(hdev);
5604                 }
5605         }
5606
5607 unlock:
5608         hci_dev_unlock(hdev);
5609         return err;
5610 }
5611
5612 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5613                               void *data, u16 len)
5614 {
5615         struct mgmt_cp_set_public_address *cp = data;
5616         bool changed;
5617         int err;
5618
5619         BT_DBG("%s", hdev->name);
5620
5621         if (hdev_is_powered(hdev))
5622                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5623                                        MGMT_STATUS_REJECTED);
5624
5625         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5627                                        MGMT_STATUS_INVALID_PARAMS);
5628
5629         if (!hdev->set_bdaddr)
5630                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5631                                        MGMT_STATUS_NOT_SUPPORTED);
5632
5633         hci_dev_lock(hdev);
5634
5635         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5636         bacpy(&hdev->public_addr, &cp->bdaddr);
5637
5638         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5639         if (err < 0)
5640                 goto unlock;
5641
5642         if (!changed)
5643                 goto unlock;
5644
5645         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5646                 err = new_options(hdev, sk);
5647
5648         if (is_configured(hdev)) {
5649                 mgmt_index_removed(hdev);
5650
5651                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
5652
5653                 hci_dev_set_flag(hdev, HCI_CONFIG);
5654                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5655
5656                 queue_work(hdev->req_workqueue, &hdev->power_on);
5657         }
5658
5659 unlock:
5660         hci_dev_unlock(hdev);
5661         return err;
5662 }
5663
5664 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
5665                                              u16 opcode, struct sk_buff *skb)
5666 {
5667         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
5668         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
5669         u8 *h192, *r192, *h256, *r256;
5670         struct mgmt_pending_cmd *cmd;
5671         u16 eir_len;
5672         int err;
5673
5674         BT_DBG("%s status %u", hdev->name, status);
5675
5676         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
5677         if (!cmd)
5678                 return;
5679
5680         mgmt_cp = cmd->param;
5681
5682         if (status) {
5683                 status = mgmt_status(status);
5684                 eir_len = 0;
5685
5686                 h192 = NULL;
5687                 r192 = NULL;
5688                 h256 = NULL;
5689                 r256 = NULL;
5690         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
5691                 struct hci_rp_read_local_oob_data *rp;
5692
5693                 if (skb->len != sizeof(*rp)) {
5694                         status = MGMT_STATUS_FAILED;
5695                         eir_len = 0;
5696                 } else {
5697                         status = MGMT_STATUS_SUCCESS;
5698                         rp = (void *)skb->data;
5699
5700                         eir_len = 5 + 18 + 18;
5701                         h192 = rp->hash;
5702                         r192 = rp->rand;
5703                         h256 = NULL;
5704                         r256 = NULL;
5705                 }
5706         } else {
5707                 struct hci_rp_read_local_oob_ext_data *rp;
5708
5709                 if (skb->len != sizeof(*rp)) {
5710                         status = MGMT_STATUS_FAILED;
5711                         eir_len = 0;
5712                 } else {
5713                         status = MGMT_STATUS_SUCCESS;
5714                         rp = (void *)skb->data;
5715
5716                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5717                                 eir_len = 5 + 18 + 18;
5718                                 h192 = NULL;
5719                                 r192 = NULL;
5720                         } else {
5721                                 eir_len = 5 + 18 + 18 + 18 + 18;
5722                                 h192 = rp->hash192;
5723                                 r192 = rp->rand192;
5724                         }
5725
5726                         h256 = rp->hash256;
5727                         r256 = rp->rand256;
5728                 }
5729         }
5730
5731         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
5732         if (!mgmt_rp)
5733                 goto done;
5734
5735         if (status)
5736                 goto send_rsp;
5737
5738         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
5739                                   hdev->dev_class, 3);
5740
5741         if (h192 && r192) {
5742                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5743                                           EIR_SSP_HASH_C192, h192, 16);
5744                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5745                                           EIR_SSP_RAND_R192, r192, 16);
5746         }
5747
5748         if (h256 && r256) {
5749                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5750                                           EIR_SSP_HASH_C256, h256, 16);
5751                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5752                                           EIR_SSP_RAND_R256, r256, 16);
5753         }
5754
5755 send_rsp:
5756         mgmt_rp->type = mgmt_cp->type;
5757         mgmt_rp->eir_len = cpu_to_le16(eir_len);
5758
5759         err = mgmt_cmd_complete(cmd->sk, hdev->id,
5760                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
5761                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
5762         if (err < 0 || status)
5763                 goto done;
5764
5765         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
5766
5767         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5768                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
5769                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
5770 done:
5771         kfree(mgmt_rp);
5772         mgmt_pending_remove(cmd);
5773 }
5774
5775 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
5776                                   struct mgmt_cp_read_local_oob_ext_data *cp)
5777 {
5778         struct mgmt_pending_cmd *cmd;
5779         struct hci_request req;
5780         int err;
5781
5782         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
5783                                cp, sizeof(*cp));
5784         if (!cmd)
5785                 return -ENOMEM;
5786
5787         hci_req_init(&req, hdev);
5788
5789         if (bredr_sc_enabled(hdev))
5790                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
5791         else
5792                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
5793
5794         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
5795         if (err < 0) {
5796                 mgmt_pending_remove(cmd);
5797                 return err;
5798         }
5799
5800         return 0;
5801 }
5802
5803 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
5804                                    void *data, u16 data_len)
5805 {
5806         struct mgmt_cp_read_local_oob_ext_data *cp = data;
5807         struct mgmt_rp_read_local_oob_ext_data *rp;
5808         size_t rp_len;
5809         u16 eir_len;
5810         u8 status, flags, role, addr[7], hash[16], rand[16];
5811         int err;
5812
5813         BT_DBG("%s", hdev->name);
5814
5815         if (hdev_is_powered(hdev)) {
5816                 switch (cp->type) {
5817                 case BIT(BDADDR_BREDR):
5818                         status = mgmt_bredr_support(hdev);
5819                         if (status)
5820                                 eir_len = 0;
5821                         else
5822                                 eir_len = 5;
5823                         break;
5824                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5825                         status = mgmt_le_support(hdev);
5826                         if (status)
5827                                 eir_len = 0;
5828                         else
5829                                 eir_len = 9 + 3 + 18 + 18 + 3;
5830                         break;
5831                 default:
5832                         status = MGMT_STATUS_INVALID_PARAMS;
5833                         eir_len = 0;
5834                         break;
5835                 }
5836         } else {
5837                 status = MGMT_STATUS_NOT_POWERED;
5838                 eir_len = 0;
5839         }
5840
5841         rp_len = sizeof(*rp) + eir_len;
5842         rp = kmalloc(rp_len, GFP_ATOMIC);
5843         if (!rp)
5844                 return -ENOMEM;
5845
5846         if (status)
5847                 goto complete;
5848
5849         hci_dev_lock(hdev);
5850
5851         eir_len = 0;
5852         switch (cp->type) {
5853         case BIT(BDADDR_BREDR):
5854                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5855                         err = read_local_ssp_oob_req(hdev, sk, cp);
5856                         hci_dev_unlock(hdev);
5857                         if (!err)
5858                                 goto done;
5859
5860                         status = MGMT_STATUS_FAILED;
5861                         goto complete;
5862                 } else {
5863                         eir_len = eir_append_data(rp->eir, eir_len,
5864                                                   EIR_CLASS_OF_DEV,
5865                                                   hdev->dev_class, 3);
5866                 }
5867                 break;
5868         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5869                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5870                     smp_generate_oob(hdev, hash, rand) < 0) {
5871                         hci_dev_unlock(hdev);
5872                         status = MGMT_STATUS_FAILED;
5873                         goto complete;
5874                 }
5875
5876                 /* This should return the active RPA, but since the RPA
5877                  * is only programmed on demand, it is really hard to fill
5878                  * this in at the moment. For now disallow retrieving
5879                  * local out-of-band data when privacy is in use.
5880                  *
5881                  * Returning the identity address will not help here since
5882                  * pairing happens before the identity resolving key is
5883                  * known and thus the connection establishment happens
5884                  * based on the RPA and not the identity address.
5885                  */
5886                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5887                         hci_dev_unlock(hdev);
5888                         status = MGMT_STATUS_REJECTED;
5889                         goto complete;
5890                 }
5891
5892                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
5893                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
5894                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5895                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
5896                         memcpy(addr, &hdev->static_addr, 6);
5897                         addr[6] = 0x01;
5898                 } else {
5899                         memcpy(addr, &hdev->bdaddr, 6);
5900                         addr[6] = 0x00;
5901                 }
5902
5903                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
5904                                           addr, sizeof(addr));
5905
5906                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5907                         role = 0x02;
5908                 else
5909                         role = 0x01;
5910
5911                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
5912                                           &role, sizeof(role));
5913
5914                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
5915                         eir_len = eir_append_data(rp->eir, eir_len,
5916                                                   EIR_LE_SC_CONFIRM,
5917                                                   hash, sizeof(hash));
5918
5919                         eir_len = eir_append_data(rp->eir, eir_len,
5920                                                   EIR_LE_SC_RANDOM,
5921                                                   rand, sizeof(rand));
5922                 }
5923
5924                 flags = mgmt_get_adv_discov_flags(hdev);
5925
5926                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5927                         flags |= LE_AD_NO_BREDR;
5928
5929                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
5930                                           &flags, sizeof(flags));
5931                 break;
5932         }
5933
5934         hci_dev_unlock(hdev);
5935
5936         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
5937
5938         status = MGMT_STATUS_SUCCESS;
5939
5940 complete:
5941         rp->type = cp->type;
5942         rp->eir_len = cpu_to_le16(eir_len);
5943
5944         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5945                                 status, rp, sizeof(*rp) + eir_len);
5946         if (err < 0 || status)
5947                 goto done;
5948
5949         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5950                                  rp, sizeof(*rp) + eir_len,
5951                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
5952
5953 done:
5954         kfree(rp);
5955
5956         return err;
5957 }
5958
5959 static u32 get_supported_adv_flags(struct hci_dev *hdev)
5960 {
5961         u32 flags = 0;
5962
5963         flags |= MGMT_ADV_FLAG_CONNECTABLE;
5964         flags |= MGMT_ADV_FLAG_DISCOV;
5965         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
5966         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
5967         flags |= MGMT_ADV_FLAG_APPEARANCE;
5968         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
5969
5970         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
5971                 flags |= MGMT_ADV_FLAG_TX_POWER;
5972
5973         return flags;
5974 }
5975
5976 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
5977                              void *data, u16 data_len)
5978 {
5979         struct mgmt_rp_read_adv_features *rp;
5980         size_t rp_len;
5981         int err;
5982         struct adv_info *adv_instance;
5983         u32 supported_flags;
5984         u8 *instance;
5985
5986         BT_DBG("%s", hdev->name);
5987
5988         if (!lmp_le_capable(hdev))
5989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5990                                        MGMT_STATUS_REJECTED);
5991
5992         hci_dev_lock(hdev);
5993
5994         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
5995         rp = kmalloc(rp_len, GFP_ATOMIC);
5996         if (!rp) {
5997                 hci_dev_unlock(hdev);
5998                 return -ENOMEM;
5999         }
6000
6001         supported_flags = get_supported_adv_flags(hdev);
6002
6003         rp->supported_flags = cpu_to_le32(supported_flags);
6004         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6005         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6006         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6007         rp->num_instances = hdev->adv_instance_cnt;
6008
6009         instance = rp->instance;
6010         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6011                 *instance = adv_instance->instance;
6012                 instance++;
6013         }
6014
6015         hci_dev_unlock(hdev);
6016
6017         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6018                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6019
6020         kfree(rp);
6021
6022         return err;
6023 }
6024
6025 static u8 calculate_name_len(struct hci_dev *hdev)
6026 {
6027         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6028
6029         return append_local_name(hdev, buf, 0);
6030 }
6031
6032 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6033                            bool is_adv_data)
6034 {
6035         u8 max_len = HCI_MAX_AD_LENGTH;
6036
6037         if (is_adv_data) {
6038                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6039                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6040                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6041                         max_len -= 3;
6042
6043                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6044                         max_len -= 3;
6045         } else {
6046                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6047                         max_len -= calculate_name_len(hdev);
6048
6049                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6050                         max_len -= 4;
6051         }
6052
6053         return max_len;
6054 }
6055
6056 static bool flags_managed(u32 adv_flags)
6057 {
6058         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6059                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6060                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6061 }
6062
6063 static bool tx_power_managed(u32 adv_flags)
6064 {
6065         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6066 }
6067
6068 static bool name_managed(u32 adv_flags)
6069 {
6070         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6071 }
6072
6073 static bool appearance_managed(u32 adv_flags)
6074 {
6075         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6076 }
6077
6078 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6079                               u8 len, bool is_adv_data)
6080 {
6081         int i, cur_len;
6082         u8 max_len;
6083
6084         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6085
6086         if (len > max_len)
6087                 return false;
6088
6089         /* Make sure that the data is correctly formatted. */
6090         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6091                 cur_len = data[i];
6092
6093                 if (data[i + 1] == EIR_FLAGS &&
6094                     (!is_adv_data || flags_managed(adv_flags)))
6095                         return false;
6096
6097                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6098                         return false;
6099
6100                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6101                         return false;
6102
6103                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6104                         return false;
6105
6106                 if (data[i + 1] == EIR_APPEARANCE &&
6107                     appearance_managed(adv_flags))
6108                         return false;
6109
6110                 /* If the current field length would exceed the total data
6111                  * length, then it's invalid.
6112                  */
6113                 if (i + cur_len >= len)
6114                         return false;
6115         }
6116
6117         return true;
6118 }
6119
6120 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6121                                      u16 opcode)
6122 {
6123         struct mgmt_pending_cmd *cmd;
6124         struct mgmt_cp_add_advertising *cp;
6125         struct mgmt_rp_add_advertising rp;
6126         struct adv_info *adv_instance, *n;
6127         u8 instance;
6128
6129         BT_DBG("status %d", status);
6130
6131         hci_dev_lock(hdev);
6132
6133         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6134
6135         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6136                 if (!adv_instance->pending)
6137                         continue;
6138
6139                 if (!status) {
6140                         adv_instance->pending = false;
6141                         continue;
6142                 }
6143
6144                 instance = adv_instance->instance;
6145
6146                 if (hdev->cur_adv_instance == instance)
6147                         cancel_adv_timeout(hdev);
6148
6149                 hci_remove_adv_instance(hdev, instance);
6150                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6151         }
6152
6153         if (!cmd)
6154                 goto unlock;
6155
6156         cp = cmd->param;
6157         rp.instance = cp->instance;
6158
6159         if (status)
6160                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6161                                 mgmt_status(status));
6162         else
6163                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6164                                   mgmt_status(status), &rp, sizeof(rp));
6165
6166         mgmt_pending_remove(cmd);
6167
6168 unlock:
6169         hci_dev_unlock(hdev);
6170 }
6171
6172 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6173                            void *data, u16 data_len)
6174 {
6175         struct mgmt_cp_add_advertising *cp = data;
6176         struct mgmt_rp_add_advertising rp;
6177         u32 flags;
6178         u32 supported_flags;
6179         u8 status;
6180         u16 timeout, duration;
6181         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6182         u8 schedule_instance = 0;
6183         struct adv_info *next_instance;
6184         int err;
6185         struct mgmt_pending_cmd *cmd;
6186         struct hci_request req;
6187
6188         BT_DBG("%s", hdev->name);
6189
6190         status = mgmt_le_support(hdev);
6191         if (status)
6192                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6193                                        status);
6194
6195         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6196                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6197                                        MGMT_STATUS_INVALID_PARAMS);
6198
6199         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6200                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6201                                        MGMT_STATUS_INVALID_PARAMS);
6202
6203         flags = __le32_to_cpu(cp->flags);
6204         timeout = __le16_to_cpu(cp->timeout);
6205         duration = __le16_to_cpu(cp->duration);
6206
6207         /* The current implementation only supports a subset of the specified
6208          * flags.
6209          */
6210         supported_flags = get_supported_adv_flags(hdev);
6211         if (flags & ~supported_flags)
6212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6213                                        MGMT_STATUS_INVALID_PARAMS);
6214
6215         hci_dev_lock(hdev);
6216
6217         if (timeout && !hdev_is_powered(hdev)) {
6218                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6219                                       MGMT_STATUS_REJECTED);
6220                 goto unlock;
6221         }
6222
6223         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6224             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6225             pending_find(MGMT_OP_SET_LE, hdev)) {
6226                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6227                                       MGMT_STATUS_BUSY);
6228                 goto unlock;
6229         }
6230
6231         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6232             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6233                                cp->scan_rsp_len, false)) {
6234                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6235                                       MGMT_STATUS_INVALID_PARAMS);
6236                 goto unlock;
6237         }
6238
6239         err = hci_add_adv_instance(hdev, cp->instance, flags,
6240                                    cp->adv_data_len, cp->data,
6241                                    cp->scan_rsp_len,
6242                                    cp->data + cp->adv_data_len,
6243                                    timeout, duration);
6244         if (err < 0) {
6245                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6246                                       MGMT_STATUS_FAILED);
6247                 goto unlock;
6248         }
6249
6250         /* Only trigger an advertising added event if a new instance was
6251          * actually added.
6252          */
6253         if (hdev->adv_instance_cnt > prev_instance_cnt)
6254                 mgmt_advertising_added(sk, hdev, cp->instance);
6255
6256         if (hdev->cur_adv_instance == cp->instance) {
6257                 /* If the currently advertised instance is being changed then
6258                  * cancel the current advertising and schedule the next
6259                  * instance. If there is only one instance then the overridden
6260                  * advertising data will be visible right away.
6261                  */
6262                 cancel_adv_timeout(hdev);
6263
6264                 next_instance = hci_get_next_instance(hdev, cp->instance);
6265                 if (next_instance)
6266                         schedule_instance = next_instance->instance;
6267         } else if (!hdev->adv_instance_timeout) {
6268                 /* Immediately advertise the new instance if no other
6269                  * instance is currently being advertised.
6270                  */
6271                 schedule_instance = cp->instance;
6272         }
6273
6274         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6275          * there is no instance to be advertised then we have no HCI
6276          * communication to make. Simply return.
6277          */
6278         if (!hdev_is_powered(hdev) ||
6279             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6280             !schedule_instance) {
6281                 rp.instance = cp->instance;
6282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6283                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6284                 goto unlock;
6285         }
6286
6287         /* We're good to go, update advertising data, parameters, and start
6288          * advertising.
6289          */
6290         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6291                                data_len);
6292         if (!cmd) {
6293                 err = -ENOMEM;
6294                 goto unlock;
6295         }
6296
6297         hci_req_init(&req, hdev);
6298
6299         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6300
6301         if (!err)
6302                 err = hci_req_run(&req, add_advertising_complete);
6303
6304         if (err < 0)
6305                 mgmt_pending_remove(cmd);
6306
6307 unlock:
6308         hci_dev_unlock(hdev);
6309
6310         return err;
6311 }
6312
6313 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6314                                         u16 opcode)
6315 {
6316         struct mgmt_pending_cmd *cmd;
6317         struct mgmt_cp_remove_advertising *cp;
6318         struct mgmt_rp_remove_advertising rp;
6319
6320         BT_DBG("status %d", status);
6321
6322         hci_dev_lock(hdev);
6323
6324         /* A failure status here only means that we failed to disable
6325          * advertising. Otherwise, the advertising instance has been removed,
6326          * so report success.
6327          */
6328         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6329         if (!cmd)
6330                 goto unlock;
6331
6332         cp = cmd->param;
6333         rp.instance = cp->instance;
6334
6335         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6336                           &rp, sizeof(rp));
6337         mgmt_pending_remove(cmd);
6338
6339 unlock:
6340         hci_dev_unlock(hdev);
6341 }
6342
6343 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6344                               void *data, u16 data_len)
6345 {
6346         struct mgmt_cp_remove_advertising *cp = data;
6347         struct mgmt_rp_remove_advertising rp;
6348         struct mgmt_pending_cmd *cmd;
6349         struct hci_request req;
6350         int err;
6351
6352         BT_DBG("%s", hdev->name);
6353
6354         hci_dev_lock(hdev);
6355
6356         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6357                 err = mgmt_cmd_status(sk, hdev->id,
6358                                       MGMT_OP_REMOVE_ADVERTISING,
6359                                       MGMT_STATUS_INVALID_PARAMS);
6360                 goto unlock;
6361         }
6362
6363         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6364             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6365             pending_find(MGMT_OP_SET_LE, hdev)) {
6366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6367                                       MGMT_STATUS_BUSY);
6368                 goto unlock;
6369         }
6370
6371         if (list_empty(&hdev->adv_instances)) {
6372                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6373                                       MGMT_STATUS_INVALID_PARAMS);
6374                 goto unlock;
6375         }
6376
6377         hci_req_init(&req, hdev);
6378
6379         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6380
6381         if (list_empty(&hdev->adv_instances))
6382                 __hci_req_disable_advertising(&req);
6383
6384         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6385          * flag is set or the device isn't powered then we have no HCI
6386          * communication to make. Simply return.
6387          */
6388         if (skb_queue_empty(&req.cmd_q) ||
6389             !hdev_is_powered(hdev) ||
6390             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6391                 hci_req_purge(&req);
6392                 rp.instance = cp->instance;
6393                 err = mgmt_cmd_complete(sk, hdev->id,
6394                                         MGMT_OP_REMOVE_ADVERTISING,
6395                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6396                 goto unlock;
6397         }
6398
6399         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6400                                data_len);
6401         if (!cmd) {
6402                 err = -ENOMEM;
6403                 goto unlock;
6404         }
6405
6406         err = hci_req_run(&req, remove_advertising_complete);
6407         if (err < 0)
6408                 mgmt_pending_remove(cmd);
6409
6410 unlock:
6411         hci_dev_unlock(hdev);
6412
6413         return err;
6414 }
6415
6416 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6417                              void *data, u16 data_len)
6418 {
6419         struct mgmt_cp_get_adv_size_info *cp = data;
6420         struct mgmt_rp_get_adv_size_info rp;
6421         u32 flags, supported_flags;
6422         int err;
6423
6424         BT_DBG("%s", hdev->name);
6425
6426         if (!lmp_le_capable(hdev))
6427                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6428                                        MGMT_STATUS_REJECTED);
6429
6430         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6431                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6432                                        MGMT_STATUS_INVALID_PARAMS);
6433
6434         flags = __le32_to_cpu(cp->flags);
6435
6436         /* The current implementation only supports a subset of the specified
6437          * flags.
6438          */
6439         supported_flags = get_supported_adv_flags(hdev);
6440         if (flags & ~supported_flags)
6441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6442                                        MGMT_STATUS_INVALID_PARAMS);
6443
6444         rp.instance = cp->instance;
6445         rp.flags = cp->flags;
6446         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6447         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6448
6449         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6450                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6451
6452         return err;
6453 }
6454
6455 static const struct hci_mgmt_handler mgmt_handlers[] = {
6456         { NULL }, /* 0x0000 (no command) */
6457         { read_version,            MGMT_READ_VERSION_SIZE,
6458                                                 HCI_MGMT_NO_HDEV |
6459                                                 HCI_MGMT_UNTRUSTED },
6460         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6461                                                 HCI_MGMT_NO_HDEV |
6462                                                 HCI_MGMT_UNTRUSTED },
6463         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6464                                                 HCI_MGMT_NO_HDEV |
6465                                                 HCI_MGMT_UNTRUSTED },
6466         { read_controller_info,    MGMT_READ_INFO_SIZE,
6467                                                 HCI_MGMT_UNTRUSTED },
6468         { set_powered,             MGMT_SETTING_SIZE },
6469         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6470         { set_connectable,         MGMT_SETTING_SIZE },
6471         { set_fast_connectable,    MGMT_SETTING_SIZE },
6472         { set_bondable,            MGMT_SETTING_SIZE },
6473         { set_link_security,       MGMT_SETTING_SIZE },
6474         { set_ssp,                 MGMT_SETTING_SIZE },
6475         { set_hs,                  MGMT_SETTING_SIZE },
6476         { set_le,                  MGMT_SETTING_SIZE },
6477         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6478         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6479         { add_uuid,                MGMT_ADD_UUID_SIZE },
6480         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6481         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6482                                                 HCI_MGMT_VAR_LEN },
6483         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6484                                                 HCI_MGMT_VAR_LEN },
6485         { disconnect,              MGMT_DISCONNECT_SIZE },
6486         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6487         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6488         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6489         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6490         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6491         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6492         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6493         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6494         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6495         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6496         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6497         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6498         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6499                                                 HCI_MGMT_VAR_LEN },
6500         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6501         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6502         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6503         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6504         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6505         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6506         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6507         { set_advertising,         MGMT_SETTING_SIZE },
6508         { set_bredr,               MGMT_SETTING_SIZE },
6509         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6510         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6511         { set_secure_conn,         MGMT_SETTING_SIZE },
6512         { set_debug_keys,          MGMT_SETTING_SIZE },
6513         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6514         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6515                                                 HCI_MGMT_VAR_LEN },
6516         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6517         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6518         { add_device,              MGMT_ADD_DEVICE_SIZE },
6519         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6520         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6521                                                 HCI_MGMT_VAR_LEN },
6522         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6523                                                 HCI_MGMT_NO_HDEV |
6524                                                 HCI_MGMT_UNTRUSTED },
6525         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6526                                                 HCI_MGMT_UNCONFIGURED |
6527                                                 HCI_MGMT_UNTRUSTED },
6528         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6529                                                 HCI_MGMT_UNCONFIGURED },
6530         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6531                                                 HCI_MGMT_UNCONFIGURED },
6532         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6533                                                 HCI_MGMT_VAR_LEN },
6534         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6535         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6536                                                 HCI_MGMT_NO_HDEV |
6537                                                 HCI_MGMT_UNTRUSTED },
6538         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6539         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6540                                                 HCI_MGMT_VAR_LEN },
6541         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6542         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6543         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6544         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6545                                                 HCI_MGMT_UNTRUSTED },
6546         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6547 };
6548
6549 void mgmt_index_added(struct hci_dev *hdev)
6550 {
6551         struct mgmt_ev_ext_index ev;
6552
6553         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6554                 return;
6555
6556         switch (hdev->dev_type) {
6557         case HCI_PRIMARY:
6558                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6559                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6560                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6561                         ev.type = 0x01;
6562                 } else {
6563                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6564                                          HCI_MGMT_INDEX_EVENTS);
6565                         ev.type = 0x00;
6566                 }
6567                 break;
6568         case HCI_AMP:
6569                 ev.type = 0x02;
6570                 break;
6571         default:
6572                 return;
6573         }
6574
6575         ev.bus = hdev->bus;
6576
6577         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6578                          HCI_MGMT_EXT_INDEX_EVENTS);
6579 }
6580
6581 void mgmt_index_removed(struct hci_dev *hdev)
6582 {
6583         struct mgmt_ev_ext_index ev;
6584         u8 status = MGMT_STATUS_INVALID_INDEX;
6585
6586         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6587                 return;
6588
6589         switch (hdev->dev_type) {
6590         case HCI_PRIMARY:
6591                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6592
6593                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6594                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6595                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6596                         ev.type = 0x01;
6597                 } else {
6598                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6599                                          HCI_MGMT_INDEX_EVENTS);
6600                         ev.type = 0x00;
6601                 }
6602                 break;
6603         case HCI_AMP:
6604                 ev.type = 0x02;
6605                 break;
6606         default:
6607                 return;
6608         }
6609
6610         ev.bus = hdev->bus;
6611
6612         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6613                          HCI_MGMT_EXT_INDEX_EVENTS);
6614 }
6615
6616 /* This function requires the caller holds hdev->lock */
6617 static void restart_le_actions(struct hci_dev *hdev)
6618 {
6619         struct hci_conn_params *p;
6620
6621         list_for_each_entry(p, &hdev->le_conn_params, list) {
6622                 /* Needed for AUTO_OFF case where might not "really"
6623                  * have been powered off.
6624                  */
6625                 list_del_init(&p->action);
6626
6627                 switch (p->auto_connect) {
6628                 case HCI_AUTO_CONN_DIRECT:
6629                 case HCI_AUTO_CONN_ALWAYS:
6630                         list_add(&p->action, &hdev->pend_le_conns);
6631                         break;
6632                 case HCI_AUTO_CONN_REPORT:
6633                         list_add(&p->action, &hdev->pend_le_reports);
6634                         break;
6635                 default:
6636                         break;
6637                 }
6638         }
6639 }
6640
6641 void mgmt_power_on(struct hci_dev *hdev, int err)
6642 {
6643         struct cmd_lookup match = { NULL, hdev };
6644
6645         BT_DBG("err %d", err);
6646
6647         hci_dev_lock(hdev);
6648
6649         if (!err) {
6650                 restart_le_actions(hdev);
6651                 hci_update_background_scan(hdev);
6652         }
6653
6654         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6655
6656         new_settings(hdev, match.sk);
6657
6658         if (match.sk)
6659                 sock_put(match.sk);
6660
6661         hci_dev_unlock(hdev);
6662 }
6663
6664 void __mgmt_power_off(struct hci_dev *hdev)
6665 {
6666         struct cmd_lookup match = { NULL, hdev };
6667         u8 status, zero_cod[] = { 0, 0, 0 };
6668
6669         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6670
6671         /* If the power off is because of hdev unregistration let
6672          * use the appropriate INVALID_INDEX status. Otherwise use
6673          * NOT_POWERED. We cover both scenarios here since later in
6674          * mgmt_index_removed() any hci_conn callbacks will have already
6675          * been triggered, potentially causing misleading DISCONNECTED
6676          * status responses.
6677          */
6678         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6679                 status = MGMT_STATUS_INVALID_INDEX;
6680         else
6681                 status = MGMT_STATUS_NOT_POWERED;
6682
6683         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6684
6685         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
6686                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6687                                    zero_cod, sizeof(zero_cod),
6688                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
6689                 ext_info_changed(hdev, NULL);
6690         }
6691
6692         new_settings(hdev, match.sk);
6693
6694         if (match.sk)
6695                 sock_put(match.sk);
6696 }
6697
6698 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6699 {
6700         struct mgmt_pending_cmd *cmd;
6701         u8 status;
6702
6703         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6704         if (!cmd)
6705                 return;
6706
6707         if (err == -ERFKILL)
6708                 status = MGMT_STATUS_RFKILLED;
6709         else
6710                 status = MGMT_STATUS_FAILED;
6711
6712         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6713
6714         mgmt_pending_remove(cmd);
6715 }
6716
6717 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6718                        bool persistent)
6719 {
6720         struct mgmt_ev_new_link_key ev;
6721
6722         memset(&ev, 0, sizeof(ev));
6723
6724         ev.store_hint = persistent;
6725         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6726         ev.key.addr.type = BDADDR_BREDR;
6727         ev.key.type = key->type;
6728         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6729         ev.key.pin_len = key->pin_len;
6730
6731         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6732 }
6733
6734 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6735 {
6736         switch (ltk->type) {
6737         case SMP_LTK:
6738         case SMP_LTK_SLAVE:
6739                 if (ltk->authenticated)
6740                         return MGMT_LTK_AUTHENTICATED;
6741                 return MGMT_LTK_UNAUTHENTICATED;
6742         case SMP_LTK_P256:
6743                 if (ltk->authenticated)
6744                         return MGMT_LTK_P256_AUTH;
6745                 return MGMT_LTK_P256_UNAUTH;
6746         case SMP_LTK_P256_DEBUG:
6747                 return MGMT_LTK_P256_DEBUG;
6748         }
6749
6750         return MGMT_LTK_UNAUTHENTICATED;
6751 }
6752
6753 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6754 {
6755         struct mgmt_ev_new_long_term_key ev;
6756
6757         memset(&ev, 0, sizeof(ev));
6758
6759         /* Devices using resolvable or non-resolvable random addresses
6760          * without providing an identity resolving key don't require
6761          * to store long term keys. Their addresses will change the
6762          * next time around.
6763          *
6764          * Only when a remote device provides an identity address
6765          * make sure the long term key is stored. If the remote
6766          * identity is known, the long term keys are internally
6767          * mapped to the identity address. So allow static random
6768          * and public addresses here.
6769          */
6770         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6771             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6772                 ev.store_hint = 0x00;
6773         else
6774                 ev.store_hint = persistent;
6775
6776         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6777         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6778         ev.key.type = mgmt_ltk_type(key);
6779         ev.key.enc_size = key->enc_size;
6780         ev.key.ediv = key->ediv;
6781         ev.key.rand = key->rand;
6782
6783         if (key->type == SMP_LTK)
6784                 ev.key.master = 1;
6785
6786         /* Make sure we copy only the significant bytes based on the
6787          * encryption key size, and set the rest of the value to zeroes.
6788          */
6789         memcpy(ev.key.val, key->val, key->enc_size);
6790         memset(ev.key.val + key->enc_size, 0,
6791                sizeof(ev.key.val) - key->enc_size);
6792
6793         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6794 }
6795
6796 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
6797 {
6798         struct mgmt_ev_new_irk ev;
6799
6800         memset(&ev, 0, sizeof(ev));
6801
6802         ev.store_hint = persistent;
6803
6804         bacpy(&ev.rpa, &irk->rpa);
6805         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6806         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6807         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6808
6809         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6810 }
6811
6812 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6813                    bool persistent)
6814 {
6815         struct mgmt_ev_new_csrk ev;
6816
6817         memset(&ev, 0, sizeof(ev));
6818
6819         /* Devices using resolvable or non-resolvable random addresses
6820          * without providing an identity resolving key don't require
6821          * to store signature resolving keys. Their addresses will change
6822          * the next time around.
6823          *
6824          * Only when a remote device provides an identity address
6825          * make sure the signature resolving key is stored. So allow
6826          * static random and public addresses here.
6827          */
6828         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6829             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6830                 ev.store_hint = 0x00;
6831         else
6832                 ev.store_hint = persistent;
6833
6834         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6835         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6836         ev.key.type = csrk->type;
6837         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6838
6839         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6840 }
6841
6842 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6843                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6844                          u16 max_interval, u16 latency, u16 timeout)
6845 {
6846         struct mgmt_ev_new_conn_param ev;
6847
6848         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6849                 return;
6850
6851         memset(&ev, 0, sizeof(ev));
6852         bacpy(&ev.addr.bdaddr, bdaddr);
6853         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6854         ev.store_hint = store_hint;
6855         ev.min_interval = cpu_to_le16(min_interval);
6856         ev.max_interval = cpu_to_le16(max_interval);
6857         ev.latency = cpu_to_le16(latency);
6858         ev.timeout = cpu_to_le16(timeout);
6859
6860         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6861 }
6862
6863 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6864                            u32 flags, u8 *name, u8 name_len)
6865 {
6866         char buf[512];
6867         struct mgmt_ev_device_connected *ev = (void *) buf;
6868         u16 eir_len = 0;
6869
6870         bacpy(&ev->addr.bdaddr, &conn->dst);
6871         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6872
6873         ev->flags = __cpu_to_le32(flags);
6874
6875         /* We must ensure that the EIR Data fields are ordered and
6876          * unique. Keep it simple for now and avoid the problem by not
6877          * adding any BR/EDR data to the LE adv.
6878          */
6879         if (conn->le_adv_data_len > 0) {
6880                 memcpy(&ev->eir[eir_len],
6881                        conn->le_adv_data, conn->le_adv_data_len);
6882                 eir_len = conn->le_adv_data_len;
6883         } else {
6884                 if (name_len > 0)
6885                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6886                                                   name, name_len);
6887
6888                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6889                         eir_len = eir_append_data(ev->eir, eir_len,
6890                                                   EIR_CLASS_OF_DEV,
6891                                                   conn->dev_class, 3);
6892         }
6893
6894         ev->eir_len = cpu_to_le16(eir_len);
6895
6896         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6897                     sizeof(*ev) + eir_len, NULL);
6898 }
6899
6900 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6901 {
6902         struct sock **sk = data;
6903
6904         cmd->cmd_complete(cmd, 0);
6905
6906         *sk = cmd->sk;
6907         sock_hold(*sk);
6908
6909         mgmt_pending_remove(cmd);
6910 }
6911
6912 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6913 {
6914         struct hci_dev *hdev = data;
6915         struct mgmt_cp_unpair_device *cp = cmd->param;
6916
6917         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6918
6919         cmd->cmd_complete(cmd, 0);
6920         mgmt_pending_remove(cmd);
6921 }
6922
6923 bool mgmt_powering_down(struct hci_dev *hdev)
6924 {
6925         struct mgmt_pending_cmd *cmd;
6926         struct mgmt_mode *cp;
6927
6928         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6929         if (!cmd)
6930                 return false;
6931
6932         cp = cmd->param;
6933         if (!cp->val)
6934                 return true;
6935
6936         return false;
6937 }
6938
6939 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6940                               u8 link_type, u8 addr_type, u8 reason,
6941                               bool mgmt_connected)
6942 {
6943         struct mgmt_ev_device_disconnected ev;
6944         struct sock *sk = NULL;
6945
6946         /* The connection is still in hci_conn_hash so test for 1
6947          * instead of 0 to know if this is the last one.
6948          */
6949         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6950                 cancel_delayed_work(&hdev->power_off);
6951                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6952         }
6953
6954         if (!mgmt_connected)
6955                 return;
6956
6957         if (link_type != ACL_LINK && link_type != LE_LINK)
6958                 return;
6959
6960         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6961
6962         bacpy(&ev.addr.bdaddr, bdaddr);
6963         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6964         ev.reason = reason;
6965
6966         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6967
6968         if (sk)
6969                 sock_put(sk);
6970
6971         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6972                              hdev);
6973 }
6974
6975 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6976                             u8 link_type, u8 addr_type, u8 status)
6977 {
6978         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6979         struct mgmt_cp_disconnect *cp;
6980         struct mgmt_pending_cmd *cmd;
6981
6982         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6983                              hdev);
6984
6985         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6986         if (!cmd)
6987                 return;
6988
6989         cp = cmd->param;
6990
6991         if (bacmp(bdaddr, &cp->addr.bdaddr))
6992                 return;
6993
6994         if (cp->addr.type != bdaddr_type)
6995                 return;
6996
6997         cmd->cmd_complete(cmd, mgmt_status(status));
6998         mgmt_pending_remove(cmd);
6999 }
7000
7001 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7002                          u8 addr_type, u8 status)
7003 {
7004         struct mgmt_ev_connect_failed ev;
7005
7006         /* The connection is still in hci_conn_hash so test for 1
7007          * instead of 0 to know if this is the last one.
7008          */
7009         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7010                 cancel_delayed_work(&hdev->power_off);
7011                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7012         }
7013
7014         bacpy(&ev.addr.bdaddr, bdaddr);
7015         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7016         ev.status = mgmt_status(status);
7017
7018         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7019 }
7020
7021 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7022 {
7023         struct mgmt_ev_pin_code_request ev;
7024
7025         bacpy(&ev.addr.bdaddr, bdaddr);
7026         ev.addr.type = BDADDR_BREDR;
7027         ev.secure = secure;
7028
7029         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7030 }
7031
7032 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7033                                   u8 status)
7034 {
7035         struct mgmt_pending_cmd *cmd;
7036
7037         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7038         if (!cmd)
7039                 return;
7040
7041         cmd->cmd_complete(cmd, mgmt_status(status));
7042         mgmt_pending_remove(cmd);
7043 }
7044
7045 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7046                                       u8 status)
7047 {
7048         struct mgmt_pending_cmd *cmd;
7049
7050         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7051         if (!cmd)
7052                 return;
7053
7054         cmd->cmd_complete(cmd, mgmt_status(status));
7055         mgmt_pending_remove(cmd);
7056 }
7057
7058 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7059                               u8 link_type, u8 addr_type, u32 value,
7060                               u8 confirm_hint)
7061 {
7062         struct mgmt_ev_user_confirm_request ev;
7063
7064         BT_DBG("%s", hdev->name);
7065
7066         bacpy(&ev.addr.bdaddr, bdaddr);
7067         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7068         ev.confirm_hint = confirm_hint;
7069         ev.value = cpu_to_le32(value);
7070
7071         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7072                           NULL);
7073 }
7074
7075 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7076                               u8 link_type, u8 addr_type)
7077 {
7078         struct mgmt_ev_user_passkey_request ev;
7079
7080         BT_DBG("%s", hdev->name);
7081
7082         bacpy(&ev.addr.bdaddr, bdaddr);
7083         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7084
7085         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7086                           NULL);
7087 }
7088
7089 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7090                                       u8 link_type, u8 addr_type, u8 status,
7091                                       u8 opcode)
7092 {
7093         struct mgmt_pending_cmd *cmd;
7094
7095         cmd = pending_find(opcode, hdev);
7096         if (!cmd)
7097                 return -ENOENT;
7098
7099         cmd->cmd_complete(cmd, mgmt_status(status));
7100         mgmt_pending_remove(cmd);
7101
7102         return 0;
7103 }
7104
7105 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7106                                      u8 link_type, u8 addr_type, u8 status)
7107 {
7108         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7109                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7110 }
7111
7112 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7113                                          u8 link_type, u8 addr_type, u8 status)
7114 {
7115         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7116                                           status,
7117                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7118 }
7119
7120 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7121                                      u8 link_type, u8 addr_type, u8 status)
7122 {
7123         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7124                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7125 }
7126
7127 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7128                                          u8 link_type, u8 addr_type, u8 status)
7129 {
7130         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7131                                           status,
7132                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7133 }
7134
7135 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7136                              u8 link_type, u8 addr_type, u32 passkey,
7137                              u8 entered)
7138 {
7139         struct mgmt_ev_passkey_notify ev;
7140
7141         BT_DBG("%s", hdev->name);
7142
7143         bacpy(&ev.addr.bdaddr, bdaddr);
7144         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7145         ev.passkey = __cpu_to_le32(passkey);
7146         ev.entered = entered;
7147
7148         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7149 }
7150
7151 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7152 {
7153         struct mgmt_ev_auth_failed ev;
7154         struct mgmt_pending_cmd *cmd;
7155         u8 status = mgmt_status(hci_status);
7156
7157         bacpy(&ev.addr.bdaddr, &conn->dst);
7158         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7159         ev.status = status;
7160
7161         cmd = find_pairing(conn);
7162
7163         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7164                     cmd ? cmd->sk : NULL);
7165
7166         if (cmd) {
7167                 cmd->cmd_complete(cmd, status);
7168                 mgmt_pending_remove(cmd);
7169         }
7170 }
7171
7172 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7173 {
7174         struct cmd_lookup match = { NULL, hdev };
7175         bool changed;
7176
7177         if (status) {
7178                 u8 mgmt_err = mgmt_status(status);
7179                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7180                                      cmd_status_rsp, &mgmt_err);
7181                 return;
7182         }
7183
7184         if (test_bit(HCI_AUTH, &hdev->flags))
7185                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7186         else
7187                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7188
7189         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7190                              &match);
7191
7192         if (changed)
7193                 new_settings(hdev, match.sk);
7194
7195         if (match.sk)
7196                 sock_put(match.sk);
7197 }
7198
7199 static void clear_eir(struct hci_request *req)
7200 {
7201         struct hci_dev *hdev = req->hdev;
7202         struct hci_cp_write_eir cp;
7203
7204         if (!lmp_ext_inq_capable(hdev))
7205                 return;
7206
7207         memset(hdev->eir, 0, sizeof(hdev->eir));
7208
7209         memset(&cp, 0, sizeof(cp));
7210
7211         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7212 }
7213
7214 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7215 {
7216         struct cmd_lookup match = { NULL, hdev };
7217         struct hci_request req;
7218         bool changed = false;
7219
7220         if (status) {
7221                 u8 mgmt_err = mgmt_status(status);
7222
7223                 if (enable && hci_dev_test_and_clear_flag(hdev,
7224                                                           HCI_SSP_ENABLED)) {
7225                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7226                         new_settings(hdev, NULL);
7227                 }
7228
7229                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7230                                      &mgmt_err);
7231                 return;
7232         }
7233
7234         if (enable) {
7235                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7236         } else {
7237                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7238                 if (!changed)
7239                         changed = hci_dev_test_and_clear_flag(hdev,
7240                                                               HCI_HS_ENABLED);
7241                 else
7242                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7243         }
7244
7245         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7246
7247         if (changed)
7248                 new_settings(hdev, match.sk);
7249
7250         if (match.sk)
7251                 sock_put(match.sk);
7252
7253         hci_req_init(&req, hdev);
7254
7255         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7256                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7257                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7258                                     sizeof(enable), &enable);
7259                 __hci_req_update_eir(&req);
7260         } else {
7261                 clear_eir(&req);
7262         }
7263
7264         hci_req_run(&req, NULL);
7265 }
7266
7267 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7268 {
7269         struct cmd_lookup *match = data;
7270
7271         if (match->sk == NULL) {
7272                 match->sk = cmd->sk;
7273                 sock_hold(match->sk);
7274         }
7275 }
7276
7277 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7278                                     u8 status)
7279 {
7280         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7281
7282         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7283         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7284         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7285
7286         if (!status) {
7287                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7288                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7289                 ext_info_changed(hdev, NULL);
7290         }
7291
7292         if (match.sk)
7293                 sock_put(match.sk);
7294 }
7295
7296 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7297 {
7298         struct mgmt_cp_set_local_name ev;
7299         struct mgmt_pending_cmd *cmd;
7300
7301         if (status)
7302                 return;
7303
7304         memset(&ev, 0, sizeof(ev));
7305         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7306         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7307
7308         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7309         if (!cmd) {
7310                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7311
7312                 /* If this is a HCI command related to powering on the
7313                  * HCI dev don't send any mgmt signals.
7314                  */
7315                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7316                         return;
7317         }
7318
7319         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7320                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7321         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7322 }
7323
7324 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7325 {
7326         int i;
7327
7328         for (i = 0; i < uuid_count; i++) {
7329                 if (!memcmp(uuid, uuids[i], 16))
7330                         return true;
7331         }
7332
7333         return false;
7334 }
7335
7336 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7337 {
7338         u16 parsed = 0;
7339
7340         while (parsed < eir_len) {
7341                 u8 field_len = eir[0];
7342                 u8 uuid[16];
7343                 int i;
7344
7345                 if (field_len == 0)
7346                         break;
7347
7348                 if (eir_len - parsed < field_len + 1)
7349                         break;
7350
7351                 switch (eir[1]) {
7352                 case EIR_UUID16_ALL:
7353                 case EIR_UUID16_SOME:
7354                         for (i = 0; i + 3 <= field_len; i += 2) {
7355                                 memcpy(uuid, bluetooth_base_uuid, 16);
7356                                 uuid[13] = eir[i + 3];
7357                                 uuid[12] = eir[i + 2];
7358                                 if (has_uuid(uuid, uuid_count, uuids))
7359                                         return true;
7360                         }
7361                         break;
7362                 case EIR_UUID32_ALL:
7363                 case EIR_UUID32_SOME:
7364                         for (i = 0; i + 5 <= field_len; i += 4) {
7365                                 memcpy(uuid, bluetooth_base_uuid, 16);
7366                                 uuid[15] = eir[i + 5];
7367                                 uuid[14] = eir[i + 4];
7368                                 uuid[13] = eir[i + 3];
7369                                 uuid[12] = eir[i + 2];
7370                                 if (has_uuid(uuid, uuid_count, uuids))
7371                                         return true;
7372                         }
7373                         break;
7374                 case EIR_UUID128_ALL:
7375                 case EIR_UUID128_SOME:
7376                         for (i = 0; i + 17 <= field_len; i += 16) {
7377                                 memcpy(uuid, eir + i + 2, 16);
7378                                 if (has_uuid(uuid, uuid_count, uuids))
7379                                         return true;
7380                         }
7381                         break;
7382                 }
7383
7384                 parsed += field_len + 1;
7385                 eir += field_len + 1;
7386         }
7387
7388         return false;
7389 }
7390
7391 static void restart_le_scan(struct hci_dev *hdev)
7392 {
7393         /* If controller is not scanning we are done. */
7394         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7395                 return;
7396
7397         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7398                        hdev->discovery.scan_start +
7399                        hdev->discovery.scan_duration))
7400                 return;
7401
7402         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7403                            DISCOV_LE_RESTART_DELAY);
7404 }
7405
7406 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7407                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7408 {
7409         /* If a RSSI threshold has been specified, and
7410          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7411          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7412          * is set, let it through for further processing, as we might need to
7413          * restart the scan.
7414          *
7415          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7416          * the results are also dropped.
7417          */
7418         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7419             (rssi == HCI_RSSI_INVALID ||
7420             (rssi < hdev->discovery.rssi &&
7421              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7422                 return  false;
7423
7424         if (hdev->discovery.uuid_count != 0) {
7425                 /* If a list of UUIDs is provided in filter, results with no
7426                  * matching UUID should be dropped.
7427                  */
7428                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7429                                    hdev->discovery.uuids) &&
7430                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7431                                    hdev->discovery.uuid_count,
7432                                    hdev->discovery.uuids))
7433                         return false;
7434         }
7435
7436         /* If duplicate filtering does not report RSSI changes, then restart
7437          * scanning to ensure updated result with updated RSSI values.
7438          */
7439         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7440                 restart_le_scan(hdev);
7441
7442                 /* Validate RSSI value against the RSSI threshold once more. */
7443                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7444                     rssi < hdev->discovery.rssi)
7445                         return false;
7446         }
7447
7448         return true;
7449 }
7450
7451 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7452                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7453                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7454 {
7455         char buf[512];
7456         struct mgmt_ev_device_found *ev = (void *)buf;
7457         size_t ev_size;
7458
7459         /* Don't send events for a non-kernel initiated discovery. With
7460          * LE one exception is if we have pend_le_reports > 0 in which
7461          * case we're doing passive scanning and want these events.
7462          */
7463         if (!hci_discovery_active(hdev)) {
7464                 if (link_type == ACL_LINK)
7465                         return;
7466                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7467                         return;
7468         }
7469
7470         if (hdev->discovery.result_filtering) {
7471                 /* We are using service discovery */
7472                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7473                                      scan_rsp_len))
7474                         return;
7475         }
7476
7477         if (hdev->discovery.limited) {
7478                 /* Check for limited discoverable bit */
7479                 if (dev_class) {
7480                         if (!(dev_class[1] & 0x20))
7481                                 return;
7482                 } else {
7483                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7484                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7485                                 return;
7486                 }
7487         }
7488
7489         /* Make sure that the buffer is big enough. The 5 extra bytes
7490          * are for the potential CoD field.
7491          */
7492         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7493                 return;
7494
7495         memset(buf, 0, sizeof(buf));
7496
7497         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7498          * RSSI value was reported as 0 when not available. This behavior
7499          * is kept when using device discovery. This is required for full
7500          * backwards compatibility with the API.
7501          *
7502          * However when using service discovery, the value 127 will be
7503          * returned when the RSSI is not available.
7504          */
7505         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7506             link_type == ACL_LINK)
7507                 rssi = 0;
7508
7509         bacpy(&ev->addr.bdaddr, bdaddr);
7510         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7511         ev->rssi = rssi;
7512         ev->flags = cpu_to_le32(flags);
7513
7514         if (eir_len > 0)
7515                 /* Copy EIR or advertising data into event */
7516                 memcpy(ev->eir, eir, eir_len);
7517
7518         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7519                                        NULL))
7520                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7521                                           dev_class, 3);
7522
7523         if (scan_rsp_len > 0)
7524                 /* Append scan response data to event */
7525                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7526
7527         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7528         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7529
7530         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7531 }
7532
7533 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7534                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7535 {
7536         struct mgmt_ev_device_found *ev;
7537         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7538         u16 eir_len;
7539
7540         ev = (struct mgmt_ev_device_found *) buf;
7541
7542         memset(buf, 0, sizeof(buf));
7543
7544         bacpy(&ev->addr.bdaddr, bdaddr);
7545         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7546         ev->rssi = rssi;
7547
7548         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7549                                   name_len);
7550
7551         ev->eir_len = cpu_to_le16(eir_len);
7552
7553         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7554 }
7555
7556 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7557 {
7558         struct mgmt_ev_discovering ev;
7559
7560         BT_DBG("%s discovering %u", hdev->name, discovering);
7561
7562         memset(&ev, 0, sizeof(ev));
7563         ev.type = hdev->discovery.type;
7564         ev.discovering = discovering;
7565
7566         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7567 }
7568
7569 static struct hci_mgmt_chan chan = {
7570         .channel        = HCI_CHANNEL_CONTROL,
7571         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7572         .handlers       = mgmt_handlers,
7573         .hdev_init      = mgmt_init_hdev,
7574 };
7575
7576 int mgmt_init(void)
7577 {
7578         return hci_mgmt_chan_register(&chan);
7579 }
7580
7581 void mgmt_exit(void)
7582 {
7583         hci_mgmt_chan_unregister(&chan);
7584 }