net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 223         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 225         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 226         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 227         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 228         MGMT_STATUS_FAILED,             /* Slot Violation */
 229         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 230         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 231         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 232         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 233         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 234         MGMT_STATUS_BUSY,               /* Controller Busy */
 235         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 236         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 237         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 238         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 239         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 240 };
 241
 242 static u8 mgmt_status(u8 hci_status)
 243 {
 244         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245                 return mgmt_status_table[hci_status];
 246
 247         return MGMT_STATUS_FAILED;
 248 }
 249
 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251                             u16 len, int flag)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, NULL);
 255 }
 256
 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, int flag, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                flag, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 void mgmt_fill_version_info(void *ver)
 280 {
 281         struct mgmt_rp_read_version *rp = ver;
 282
 283         rp->version = MGMT_VERSION;
 284         rp->revision = cpu_to_le16(MGMT_REVISION);
 285 }
 286
 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288                         u16 data_len)
 289 {
 290         struct mgmt_rp_read_version rp;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         mgmt_fill_version_info(&rp);
 295
 296         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297                                  &rp, sizeof(rp));
 298 }
 299
 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301                          u16 data_len)
 302 {
 303         struct mgmt_rp_read_commands *rp;
 304         u16 num_commands, num_events;
 305         size_t rp_size;
 306         int i, err;
 307
 308         BT_DBG("sock %p", sk);
 309
 310         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311                 num_commands = ARRAY_SIZE(mgmt_commands);
 312                 num_events = ARRAY_SIZE(mgmt_events);
 313         } else {
 314                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316         }
 317
 318         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320         rp = kmalloc(rp_size, GFP_KERNEL);
 321         if (!rp)
 322                 return -ENOMEM;
 323
 324         rp->num_commands = cpu_to_le16(num_commands);
 325         rp->num_events = cpu_to_le16(num_events);
 326
 327         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328                 __le16 *opcode = rp->opcodes;
 329
 330                 for (i = 0; i < num_commands; i++, opcode++)
 331                         put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333                 for (i = 0; i < num_events; i++, opcode++)
 334                         put_unaligned_le16(mgmt_events[i], opcode);
 335         } else {
 336                 __le16 *opcode = rp->opcodes;
 337
 338                 for (i = 0; i < num_commands; i++, opcode++)
 339                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341                 for (i = 0; i < num_events; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343         }
 344
 345         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346                                 rp, rp_size);
 347         kfree(rp);
 348
 349         return err;
 350 }
 351
 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353                            u16 data_len)
 354 {
 355         struct mgmt_rp_read_index_list *rp;
 356         struct hci_dev *d;
 357         size_t rp_len;
 358         u16 count;
 359         int err;
 360
 361         BT_DBG("sock %p", sk);
 362
 363         read_lock(&hci_dev_list_lock);
 364
 365         count = 0;
 366         list_for_each_entry(d, &hci_dev_list, list) {
 367                 if (d->dev_type == HCI_PRIMARY &&
 368                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369                         count++;
 370         }
 371
 372         rp_len = sizeof(*rp) + (2 * count);
 373         rp = kmalloc(rp_len, GFP_ATOMIC);
 374         if (!rp) {
 375                 read_unlock(&hci_dev_list_lock);
 376                 return -ENOMEM;
 377         }
 378
 379         count = 0;
 380         list_for_each_entry(d, &hci_dev_list, list) {
 381                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 382                     hci_dev_test_flag(d, HCI_CONFIG) ||
 383                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384                         continue;
 385
 386                 /* Devices marked as raw-only are neither configured
 387                  * nor unconfigured controllers.
 388                  */
 389                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390                         continue;
 391
 392                 if (d->dev_type == HCI_PRIMARY &&
 393                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394                         rp->index[count++] = cpu_to_le16(d->id);
 395                         BT_DBG("Added hci%u", d->id);
 396                 }
 397         }
 398
 399         rp->num_controllers = cpu_to_le16(count);
 400         rp_len = sizeof(*rp) + (2 * count);
 401
 402         read_unlock(&hci_dev_list_lock);
 403
 404         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405                                 0, rp, rp_len);
 406
 407         kfree(rp);
 408
 409         return err;
 410 }
 411
 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413                                   void *data, u16 data_len)
 414 {
 415         struct mgmt_rp_read_unconf_index_list *rp;
 416         struct hci_dev *d;
 417         size_t rp_len;
 418         u16 count;
 419         int err;
 420
 421         BT_DBG("sock %p", sk);
 422
 423         read_lock(&hci_dev_list_lock);
 424
 425         count = 0;
 426         list_for_each_entry(d, &hci_dev_list, list) {
 427                 if (d->dev_type == HCI_PRIMARY &&
 428                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429                         count++;
 430         }
 431
 432         rp_len = sizeof(*rp) + (2 * count);
 433         rp = kmalloc(rp_len, GFP_ATOMIC);
 434         if (!rp) {
 435                 read_unlock(&hci_dev_list_lock);
 436                 return -ENOMEM;
 437         }
 438
 439         count = 0;
 440         list_for_each_entry(d, &hci_dev_list, list) {
 441                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 442                     hci_dev_test_flag(d, HCI_CONFIG) ||
 443                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444                         continue;
 445
 446                 /* Devices marked as raw-only are neither configured
 447                  * nor unconfigured controllers.
 448                  */
 449                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450                         continue;
 451
 452                 if (d->dev_type == HCI_PRIMARY &&
 453                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454                         rp->index[count++] = cpu_to_le16(d->id);
 455                         BT_DBG("Added hci%u", d->id);
 456                 }
 457         }
 458
 459         rp->num_controllers = cpu_to_le16(count);
 460         rp_len = sizeof(*rp) + (2 * count);
 461
 462         read_unlock(&hci_dev_list_lock);
 463
 464         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467         kfree(rp);
 468
 469         return err;
 470 }
 471
 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473                                void *data, u16 data_len)
 474 {
 475         struct mgmt_rp_read_ext_index_list *rp;
 476         struct hci_dev *d;
 477         u16 count;
 478         int err;
 479
 480         BT_DBG("sock %p", sk);
 481
 482         read_lock(&hci_dev_list_lock);
 483
 484         count = 0;
 485         list_for_each_entry(d, &hci_dev_list, list) {
 486                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 487                         count++;
 488         }
 489
 490         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 491         if (!rp) {
 492                 read_unlock(&hci_dev_list_lock);
 493                 return -ENOMEM;
 494         }
 495
 496         count = 0;
 497         list_for_each_entry(d, &hci_dev_list, list) {
 498                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 499                     hci_dev_test_flag(d, HCI_CONFIG) ||
 500                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 501                         continue;
 502
 503                 /* Devices marked as raw-only are neither configured
 504                  * nor unconfigured controllers.
 505                  */
 506                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 507                         continue;
 508
 509                 if (d->dev_type == HCI_PRIMARY) {
 510                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511                                 rp->entry[count].type = 0x01;
 512                         else
 513                                 rp->entry[count].type = 0x00;
 514                 } else if (d->dev_type == HCI_AMP) {
 515                         rp->entry[count].type = 0x02;
 516                 } else {
 517                         continue;
 518                 }
 519
 520                 rp->entry[count].bus = d->bus;
 521                 rp->entry[count++].index = cpu_to_le16(d->id);
 522                 BT_DBG("Added hci%u", d->id);
 523         }
 524
 525         rp->num_controllers = cpu_to_le16(count);
 526
 527         read_unlock(&hci_dev_list_lock);
 528
 529         /* If this command is called at least once, then all the
 530          * default index and unconfigured index events are disabled
 531          * and from now on only extended index events are used.
 532          */
 533         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 534         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 535         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 536
 537         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 538                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 539                                 struct_size(rp, entry, count));
 540
 541         kfree(rp);
 542
 543         return err;
 544 }
 545
 546 static bool is_configured(struct hci_dev *hdev)
 547 {
 548         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 549             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 550                 return false;
 551
 552         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 553              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 554             !bacmp(&hdev->public_addr, BDADDR_ANY))
 555                 return false;
 556
 557         return true;
 558 }
 559
 560 static __le32 get_missing_options(struct hci_dev *hdev)
 561 {
 562         u32 options = 0;
 563
 564         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 565             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 566                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 567
 568         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 569              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 570             !bacmp(&hdev->public_addr, BDADDR_ANY))
 571                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573         return cpu_to_le32(options);
 574 }
 575
 576 static int new_options(struct hci_dev *hdev, struct sock *skip)
 577 {
 578         __le32 options = get_missing_options(hdev);
 579
 580         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582 }
 583
 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585 {
 586         __le32 options = get_missing_options(hdev);
 587
 588         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589                                  sizeof(options));
 590 }
 591
 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593                             void *data, u16 data_len)
 594 {
 595         struct mgmt_rp_read_config_info rp;
 596         u32 options = 0;
 597
 598         BT_DBG("sock %p %s", sk, hdev->name);
 599
 600         hci_dev_lock(hdev);
 601
 602         memset(&rp, 0, sizeof(rp));
 603         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if (hdev->set_bdaddr)
 609                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611         rp.supported_options = cpu_to_le32(options);
 612         rp.missing_options = get_missing_options(hdev);
 613
 614         hci_dev_unlock(hdev);
 615
 616         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617                                  &rp, sizeof(rp));
 618 }
 619
 620 static u32 get_supported_phys(struct hci_dev *hdev)
 621 {
 622         u32 supported_phys = 0;
 623
 624         if (lmp_bredr_capable(hdev)) {
 625                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 626
 627                 if (hdev->features[0][0] & LMP_3SLOT)
 628                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_5SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 632
 633                 if (lmp_edr_2m_capable(hdev)) {
 634                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 635
 636                         if (lmp_edr_3slot_capable(hdev))
 637                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 638
 639                         if (lmp_edr_5slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 641
 642                         if (lmp_edr_3m_capable(hdev)) {
 643                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 644
 645                                 if (lmp_edr_3slot_capable(hdev))
 646                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 647
 648                                 if (lmp_edr_5slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 650                         }
 651                 }
 652         }
 653
 654         if (lmp_le_capable(hdev)) {
 655                 supported_phys |= MGMT_PHY_LE_1M_TX;
 656                 supported_phys |= MGMT_PHY_LE_1M_RX;
 657
 658                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 659                         supported_phys |= MGMT_PHY_LE_2M_TX;
 660                         supported_phys |= MGMT_PHY_LE_2M_RX;
 661                 }
 662
 663                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 664                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 665                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 666                 }
 667         }
 668
 669         return supported_phys;
 670 }
 671
 672 static u32 get_selected_phys(struct hci_dev *hdev)
 673 {
 674         u32 selected_phys = 0;
 675
 676         if (lmp_bredr_capable(hdev)) {
 677                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 678
 679                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 680                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 683                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 684
 685                 if (lmp_edr_2m_capable(hdev)) {
 686                         if (!(hdev->pkt_type & HCI_2DH1))
 687                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 688
 689                         if (lmp_edr_3slot_capable(hdev) &&
 690                             !(hdev->pkt_type & HCI_2DH3))
 691                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 692
 693                         if (lmp_edr_5slot_capable(hdev) &&
 694                             !(hdev->pkt_type & HCI_2DH5))
 695                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 696
 697                         if (lmp_edr_3m_capable(hdev)) {
 698                                 if (!(hdev->pkt_type & HCI_3DH1))
 699                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 700
 701                                 if (lmp_edr_3slot_capable(hdev) &&
 702                                     !(hdev->pkt_type & HCI_3DH3))
 703                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 704
 705                                 if (lmp_edr_5slot_capable(hdev) &&
 706                                     !(hdev->pkt_type & HCI_3DH5))
 707                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 708                         }
 709                 }
 710         }
 711
 712         if (lmp_le_capable(hdev)) {
 713                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 714                         selected_phys |= MGMT_PHY_LE_1M_TX;
 715
 716                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_RX;
 718
 719                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 720                         selected_phys |= MGMT_PHY_LE_2M_TX;
 721
 722                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_RX;
 724
 725                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 726                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 727
 728                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 730         }
 731
 732         return selected_phys;
 733 }
 734
 735 static u32 get_configurable_phys(struct hci_dev *hdev)
 736 {
 737         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 738                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 739 }
 740
 741 static u32 get_supported_settings(struct hci_dev *hdev)
 742 {
 743         u32 settings = 0;
 744
 745         settings |= MGMT_SETTING_POWERED;
 746         settings |= MGMT_SETTING_BONDABLE;
 747         settings |= MGMT_SETTING_DEBUG_KEYS;
 748         settings |= MGMT_SETTING_CONNECTABLE;
 749         settings |= MGMT_SETTING_DISCOVERABLE;
 750
 751         if (lmp_bredr_capable(hdev)) {
 752                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 753                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 754                 settings |= MGMT_SETTING_BREDR;
 755                 settings |= MGMT_SETTING_LINK_SECURITY;
 756
 757                 if (lmp_ssp_capable(hdev)) {
 758                         settings |= MGMT_SETTING_SSP;
 759                         settings |= MGMT_SETTING_HS;
 760                 }
 761
 762                 if (lmp_sc_capable(hdev))
 763                         settings |= MGMT_SETTING_SECURE_CONN;
 764         }
 765
 766         if (lmp_le_capable(hdev)) {
 767                 settings |= MGMT_SETTING_LE;
 768                 settings |= MGMT_SETTING_ADVERTISING;
 769                 settings |= MGMT_SETTING_SECURE_CONN;
 770                 settings |= MGMT_SETTING_PRIVACY;
 771                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 772         }
 773
 774         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 775             hdev->set_bdaddr)
 776                 settings |= MGMT_SETTING_CONFIGURATION;
 777
 778         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 779
 780         return settings;
 781 }
 782
 783 static u32 get_current_settings(struct hci_dev *hdev)
 784 {
 785         u32 settings = 0;
 786
 787         if (hdev_is_powered(hdev))
 788                 settings |= MGMT_SETTING_POWERED;
 789
 790         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 791                 settings |= MGMT_SETTING_CONNECTABLE;
 792
 793         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 794                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 795
 796         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 797                 settings |= MGMT_SETTING_DISCOVERABLE;
 798
 799         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 800                 settings |= MGMT_SETTING_BONDABLE;
 801
 802         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 803                 settings |= MGMT_SETTING_BREDR;
 804
 805         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 806                 settings |= MGMT_SETTING_LE;
 807
 808         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 809                 settings |= MGMT_SETTING_LINK_SECURITY;
 810
 811         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 812                 settings |= MGMT_SETTING_SSP;
 813
 814         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 815                 settings |= MGMT_SETTING_HS;
 816
 817         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 818                 settings |= MGMT_SETTING_ADVERTISING;
 819
 820         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 821                 settings |= MGMT_SETTING_SECURE_CONN;
 822
 823         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 824                 settings |= MGMT_SETTING_DEBUG_KEYS;
 825
 826         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 827                 settings |= MGMT_SETTING_PRIVACY;
 828
 829         /* The current setting for static address has two purposes. The
 830          * first is to indicate if the static address will be used and
 831          * the second is to indicate if it is actually set.
 832          *
 833          * This means if the static address is not configured, this flag
 834          * will never be set. If the address is configured, then if the
 835          * address is actually used decides if the flag is set or not.
 836          *
 837          * For single mode LE only controllers and dual-mode controllers
 838          * with BR/EDR disabled, the existence of the static address will
 839          * be evaluated.
 840          */
 841         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 842             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 843             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 844                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 845                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 846         }
 847
 848         return settings;
 849 }
 850
 851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 852 {
 853         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 854 }
 855
 856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 857                                                   struct hci_dev *hdev,
 858                                                   const void *data)
 859 {
 860         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 861 }
 862
 863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 864 {
 865         struct mgmt_pending_cmd *cmd;
 866
 867         /* If there's a pending mgmt command the flags will not yet have
 868          * their final values, so check for this first.
 869          */
 870         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 871         if (cmd) {
 872                 struct mgmt_mode *cp = cmd->param;
 873                 if (cp->val == 0x01)
 874                         return LE_AD_GENERAL;
 875                 else if (cp->val == 0x02)
 876                         return LE_AD_LIMITED;
 877         } else {
 878                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 879                         return LE_AD_LIMITED;
 880                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 881                         return LE_AD_GENERAL;
 882         }
 883
 884         return 0;
 885 }
 886
 887 bool mgmt_get_connectable(struct hci_dev *hdev)
 888 {
 889         struct mgmt_pending_cmd *cmd;
 890
 891         /* If there's a pending mgmt command the flag will not yet have
 892          * it's final value, so check for this first.
 893          */
 894         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 895         if (cmd) {
 896                 struct mgmt_mode *cp = cmd->param;
 897
 898                 return cp->val;
 899         }
 900
 901         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 902 }
 903
 904 static void service_cache_off(struct work_struct *work)
 905 {
 906         struct hci_dev *hdev = container_of(work, struct hci_dev,
 907                                             service_cache.work);
 908         struct hci_request req;
 909
 910         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 911                 return;
 912
 913         hci_req_init(&req, hdev);
 914
 915         hci_dev_lock(hdev);
 916
 917         __hci_req_update_eir(&req);
 918         __hci_req_update_class(&req);
 919
 920         hci_dev_unlock(hdev);
 921
 922         hci_req_run(&req, NULL);
 923 }
 924
 925 static void rpa_expired(struct work_struct *work)
 926 {
 927         struct hci_dev *hdev = container_of(work, struct hci_dev,
 928                                             rpa_expired.work);
 929         struct hci_request req;
 930
 931         BT_DBG("");
 932
 933         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 934
 935         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 936                 return;
 937
 938         /* The generation of a new RPA and programming it into the
 939          * controller happens in the hci_req_enable_advertising()
 940          * function.
 941          */
 942         hci_req_init(&req, hdev);
 943         if (ext_adv_capable(hdev))
 944                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 945         else
 946                 __hci_req_enable_advertising(&req);
 947         hci_req_run(&req, NULL);
 948 }
 949
 950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 951 {
 952         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 953                 return;
 954
 955         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 956         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 957
 958         /* Non-mgmt controlled devices get this bit set
 959          * implicitly so that pairing works for them, however
 960          * for mgmt we require user-space to explicitly enable
 961          * it
 962          */
 963         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 964 }
 965
 966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 967                                 void *data, u16 data_len)
 968 {
 969         struct mgmt_rp_read_info rp;
 970
 971         BT_DBG("sock %p %s", sk, hdev->name);
 972
 973         hci_dev_lock(hdev);
 974
 975         memset(&rp, 0, sizeof(rp));
 976
 977         bacpy(&rp.bdaddr, &hdev->bdaddr);
 978
 979         rp.version = hdev->hci_ver;
 980         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 981
 982         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 983         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 984
 985         memcpy(rp.dev_class, hdev->dev_class, 3);
 986
 987         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 988         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 989
 990         hci_dev_unlock(hdev);
 991
 992         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 993                                  sizeof(rp));
 994 }
 995
 996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 997 {
 998         u16 eir_len = 0;
 999         size_t name_len;
1000
1001         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003                                           hdev->dev_class, 3);
1004
1005         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007                                           hdev->appearance);
1008
1009         name_len = strlen(hdev->dev_name);
1010         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011                                   hdev->dev_name, name_len);
1012
1013         name_len = strlen(hdev->short_name);
1014         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015                                   hdev->short_name, name_len);
1016
1017         return eir_len;
1018 }
1019
1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021                                     void *data, u16 data_len)
1022 {
1023         char buf[512];
1024         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025         u16 eir_len;
1026
1027         BT_DBG("sock %p %s", sk, hdev->name);
1028
1029         memset(&buf, 0, sizeof(buf));
1030
1031         hci_dev_lock(hdev);
1032
1033         bacpy(&rp->bdaddr, &hdev->bdaddr);
1034
1035         rp->version = hdev->hci_ver;
1036         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037
1038         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040
1041
1042         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043         rp->eir_len = cpu_to_le16(eir_len);
1044
1045         hci_dev_unlock(hdev);
1046
1047         /* If this command is called at least once, then the events
1048          * for class of device and local name changes are disabled
1049          * and only the new extended controller information event
1050          * is used.
1051          */
1052         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055
1056         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057                                  sizeof(*rp) + eir_len);
1058 }
1059
1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061 {
1062         char buf[512];
1063         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064         u16 eir_len;
1065
1066         memset(buf, 0, sizeof(buf));
1067
1068         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069         ev->eir_len = cpu_to_le16(eir_len);
1070
1071         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072                                   sizeof(*ev) + eir_len,
1073                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1074 }
1075
1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077 {
1078         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1079
1080         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081                                  sizeof(settings));
1082 }
1083
1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085 {
1086         BT_DBG("%s status 0x%02x", hdev->name, status);
1087
1088         if (hci_conn_count(hdev) == 0) {
1089                 cancel_delayed_work(&hdev->power_off);
1090                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091         }
1092 }
1093
1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095 {
1096         struct mgmt_ev_advertising_added ev;
1097
1098         ev.instance = instance;
1099
1100         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101 }
1102
1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104                               u8 instance)
1105 {
1106         struct mgmt_ev_advertising_removed ev;
1107
1108         ev.instance = instance;
1109
1110         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111 }
1112
1113 static void cancel_adv_timeout(struct hci_dev *hdev)
1114 {
1115         if (hdev->adv_instance_timeout) {
1116                 hdev->adv_instance_timeout = 0;
1117                 cancel_delayed_work(&hdev->adv_instance_expire);
1118         }
1119 }
1120
1121 static int clean_up_hci_state(struct hci_dev *hdev)
1122 {
1123         struct hci_request req;
1124         struct hci_conn *conn;
1125         bool discov_stopped;
1126         int err;
1127
1128         hci_req_init(&req, hdev);
1129
1130         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131             test_bit(HCI_PSCAN, &hdev->flags)) {
1132                 u8 scan = 0x00;
1133                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134         }
1135
1136         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137
1138         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139                 __hci_req_disable_advertising(&req);
1140
1141         discov_stopped = hci_req_stop_discovery(&req);
1142
1143         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144                 /* 0x15 == Terminated due to Power Off */
1145                 __hci_abort_conn(&req, conn, 0x15);
1146         }
1147
1148         err = hci_req_run(&req, clean_up_hci_complete);
1149         if (!err && discov_stopped)
1150                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151
1152         return err;
1153 }
1154
1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156                        u16 len)
1157 {
1158         struct mgmt_mode *cp = data;
1159         struct mgmt_pending_cmd *cmd;
1160         int err;
1161
1162         BT_DBG("request for %s", hdev->name);
1163
1164         if (cp->val != 0x00 && cp->val != 0x01)
1165                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166                                        MGMT_STATUS_INVALID_PARAMS);
1167
1168         hci_dev_lock(hdev);
1169
1170         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172                                       MGMT_STATUS_BUSY);
1173                 goto failed;
1174         }
1175
1176         if (!!cp->val == hdev_is_powered(hdev)) {
1177                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178                 goto failed;
1179         }
1180
1181         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182         if (!cmd) {
1183                 err = -ENOMEM;
1184                 goto failed;
1185         }
1186
1187         if (cp->val) {
1188                 queue_work(hdev->req_workqueue, &hdev->power_on);
1189                 err = 0;
1190         } else {
1191                 /* Disconnect connections, stop scans, etc */
1192                 err = clean_up_hci_state(hdev);
1193                 if (!err)
1194                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195                                            HCI_POWER_OFF_TIMEOUT);
1196
1197                 /* ENODATA means there were no HCI commands queued */
1198                 if (err == -ENODATA) {
1199                         cancel_delayed_work(&hdev->power_off);
1200                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201                         err = 0;
1202                 }
1203         }
1204
1205 failed:
1206         hci_dev_unlock(hdev);
1207         return err;
1208 }
1209
1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1213
1214         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217
1218 int mgmt_new_settings(struct hci_dev *hdev)
1219 {
1220         return new_settings(hdev, NULL);
1221 }
1222
1223 struct cmd_lookup {
1224         struct sock *sk;
1225         struct hci_dev *hdev;
1226         u8 mgmt_status;
1227 };
1228
1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230 {
1231         struct cmd_lookup *match = data;
1232
1233         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234
1235         list_del(&cmd->list);
1236
1237         if (match->sk == NULL) {
1238                 match->sk = cmd->sk;
1239                 sock_hold(match->sk);
1240         }
1241
1242         mgmt_pending_free(cmd);
1243 }
1244
1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246 {
1247         u8 *status = data;
1248
1249         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250         mgmt_pending_remove(cmd);
1251 }
1252
1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254 {
1255         if (cmd->cmd_complete) {
1256                 u8 *status = data;
1257
1258                 cmd->cmd_complete(cmd, *status);
1259                 mgmt_pending_remove(cmd);
1260
1261                 return;
1262         }
1263
1264         cmd_status_rsp(cmd, data);
1265 }
1266
1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268 {
1269         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270                                  cmd->param, cmd->param_len);
1271 }
1272
1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274 {
1275         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276                                  cmd->param, sizeof(struct mgmt_addr_info));
1277 }
1278
1279 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280 {
1281         if (!lmp_bredr_capable(hdev))
1282                 return MGMT_STATUS_NOT_SUPPORTED;
1283         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284                 return MGMT_STATUS_REJECTED;
1285         else
1286                 return MGMT_STATUS_SUCCESS;
1287 }
1288
1289 static u8 mgmt_le_support(struct hci_dev *hdev)
1290 {
1291         if (!lmp_le_capable(hdev))
1292                 return MGMT_STATUS_NOT_SUPPORTED;
1293         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294                 return MGMT_STATUS_REJECTED;
1295         else
1296                 return MGMT_STATUS_SUCCESS;
1297 }
1298
1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300 {
1301         struct mgmt_pending_cmd *cmd;
1302
1303         BT_DBG("status 0x%02x", status);
1304
1305         hci_dev_lock(hdev);
1306
1307         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308         if (!cmd)
1309                 goto unlock;
1310
1311         if (status) {
1312                 u8 mgmt_err = mgmt_status(status);
1313                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315                 goto remove_cmd;
1316         }
1317
1318         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319             hdev->discov_timeout > 0) {
1320                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322         }
1323
1324         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325         new_settings(hdev, cmd->sk);
1326
1327 remove_cmd:
1328         mgmt_pending_remove(cmd);
1329
1330 unlock:
1331         hci_dev_unlock(hdev);
1332 }
1333
1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335                             u16 len)
1336 {
1337         struct mgmt_cp_set_discoverable *cp = data;
1338         struct mgmt_pending_cmd *cmd;
1339         u16 timeout;
1340         int err;
1341
1342         BT_DBG("request for %s", hdev->name);
1343
1344         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347                                        MGMT_STATUS_REJECTED);
1348
1349         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351                                        MGMT_STATUS_INVALID_PARAMS);
1352
1353         timeout = __le16_to_cpu(cp->timeout);
1354
1355         /* Disabling discoverable requires that no timeout is set,
1356          * and enabling limited discoverable requires a timeout.
1357          */
1358         if ((cp->val == 0x00 && timeout > 0) ||
1359             (cp->val == 0x02 && timeout == 0))
1360                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361                                        MGMT_STATUS_INVALID_PARAMS);
1362
1363         hci_dev_lock(hdev);
1364
1365         if (!hdev_is_powered(hdev) && timeout > 0) {
1366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367                                       MGMT_STATUS_NOT_POWERED);
1368                 goto failed;
1369         }
1370
1371         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374                                       MGMT_STATUS_BUSY);
1375                 goto failed;
1376         }
1377
1378         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380                                       MGMT_STATUS_REJECTED);
1381                 goto failed;
1382         }
1383
1384         if (!hdev_is_powered(hdev)) {
1385                 bool changed = false;
1386
1387                 /* Setting limited discoverable when powered off is
1388                  * not a valid operation since it requires a timeout
1389                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1390                  */
1391                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393                         changed = true;
1394                 }
1395
1396                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397                 if (err < 0)
1398                         goto failed;
1399
1400                 if (changed)
1401                         err = new_settings(hdev, sk);
1402
1403                 goto failed;
1404         }
1405
1406         /* If the current mode is the same, then just update the timeout
1407          * value with the new value. And if only the timeout gets updated,
1408          * then no need for any HCI transactions.
1409          */
1410         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412                                                    HCI_LIMITED_DISCOVERABLE)) {
1413                 cancel_delayed_work(&hdev->discov_off);
1414                 hdev->discov_timeout = timeout;
1415
1416                 if (cp->val && hdev->discov_timeout > 0) {
1417                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418                         queue_delayed_work(hdev->req_workqueue,
1419                                            &hdev->discov_off, to);
1420                 }
1421
1422                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423                 goto failed;
1424         }
1425
1426         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427         if (!cmd) {
1428                 err = -ENOMEM;
1429                 goto failed;
1430         }
1431
1432         /* Cancel any potential discoverable timeout that might be
1433          * still active and store new timeout value. The arming of
1434          * the timeout happens in the complete handler.
1435          */
1436         cancel_delayed_work(&hdev->discov_off);
1437         hdev->discov_timeout = timeout;
1438
1439         if (cp->val)
1440                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441         else
1442                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443
1444         /* Limited discoverable mode */
1445         if (cp->val == 0x02)
1446                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447         else
1448                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449
1450         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451         err = 0;
1452
1453 failed:
1454         hci_dev_unlock(hdev);
1455         return err;
1456 }
1457
1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459 {
1460         struct mgmt_pending_cmd *cmd;
1461
1462         BT_DBG("status 0x%02x", status);
1463
1464         hci_dev_lock(hdev);
1465
1466         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467         if (!cmd)
1468                 goto unlock;
1469
1470         if (status) {
1471                 u8 mgmt_err = mgmt_status(status);
1472                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473                 goto remove_cmd;
1474         }
1475
1476         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477         new_settings(hdev, cmd->sk);
1478
1479 remove_cmd:
1480         mgmt_pending_remove(cmd);
1481
1482 unlock:
1483         hci_dev_unlock(hdev);
1484 }
1485
1486 static int set_connectable_update_settings(struct hci_dev *hdev,
1487                                            struct sock *sk, u8 val)
1488 {
1489         bool changed = false;
1490         int err;
1491
1492         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493                 changed = true;
1494
1495         if (val) {
1496                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497         } else {
1498                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500         }
1501
1502         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503         if (err < 0)
1504                 return err;
1505
1506         if (changed) {
1507                 hci_req_update_scan(hdev);
1508                 hci_update_background_scan(hdev);
1509                 return new_settings(hdev, sk);
1510         }
1511
1512         return 0;
1513 }
1514
1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516                            u16 len)
1517 {
1518         struct mgmt_mode *cp = data;
1519         struct mgmt_pending_cmd *cmd;
1520         int err;
1521
1522         BT_DBG("request for %s", hdev->name);
1523
1524         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527                                        MGMT_STATUS_REJECTED);
1528
1529         if (cp->val != 0x00 && cp->val != 0x01)
1530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531                                        MGMT_STATUS_INVALID_PARAMS);
1532
1533         hci_dev_lock(hdev);
1534
1535         if (!hdev_is_powered(hdev)) {
1536                 err = set_connectable_update_settings(hdev, sk, cp->val);
1537                 goto failed;
1538         }
1539
1540         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543                                       MGMT_STATUS_BUSY);
1544                 goto failed;
1545         }
1546
1547         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548         if (!cmd) {
1549                 err = -ENOMEM;
1550                 goto failed;
1551         }
1552
1553         if (cp->val) {
1554                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555         } else {
1556                 if (hdev->discov_timeout > 0)
1557                         cancel_delayed_work(&hdev->discov_off);
1558
1559                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562         }
1563
1564         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565         err = 0;
1566
1567 failed:
1568         hci_dev_unlock(hdev);
1569         return err;
1570 }
1571
1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573                         u16 len)
1574 {
1575         struct mgmt_mode *cp = data;
1576         bool changed;
1577         int err;
1578
1579         BT_DBG("request for %s", hdev->name);
1580
1581         if (cp->val != 0x00 && cp->val != 0x01)
1582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583                                        MGMT_STATUS_INVALID_PARAMS);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (cp->val)
1588                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589         else
1590                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591
1592         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593         if (err < 0)
1594                 goto unlock;
1595
1596         if (changed) {
1597                 /* In limited privacy mode the change of bondable mode
1598                  * may affect the local advertising address.
1599                  */
1600                 if (hdev_is_powered(hdev) &&
1601                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604                         queue_work(hdev->req_workqueue,
1605                                    &hdev->discoverable_update);
1606
1607                 err = new_settings(hdev, sk);
1608         }
1609
1610 unlock:
1611         hci_dev_unlock(hdev);
1612         return err;
1613 }
1614
1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616                              u16 len)
1617 {
1618         struct mgmt_mode *cp = data;
1619         struct mgmt_pending_cmd *cmd;
1620         u8 val, status;
1621         int err;
1622
1623         BT_DBG("request for %s", hdev->name);
1624
1625         status = mgmt_bredr_support(hdev);
1626         if (status)
1627                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628                                        status);
1629
1630         if (cp->val != 0x00 && cp->val != 0x01)
1631                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632                                        MGMT_STATUS_INVALID_PARAMS);
1633
1634         hci_dev_lock(hdev);
1635
1636         if (!hdev_is_powered(hdev)) {
1637                 bool changed = false;
1638
1639                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641                         changed = true;
1642                 }
1643
1644                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645                 if (err < 0)
1646                         goto failed;
1647
1648                 if (changed)
1649                         err = new_settings(hdev, sk);
1650
1651                 goto failed;
1652         }
1653
1654         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656                                       MGMT_STATUS_BUSY);
1657                 goto failed;
1658         }
1659
1660         val = !!cp->val;
1661
1662         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664                 goto failed;
1665         }
1666
1667         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668         if (!cmd) {
1669                 err = -ENOMEM;
1670                 goto failed;
1671         }
1672
1673         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674         if (err < 0) {
1675                 mgmt_pending_remove(cmd);
1676                 goto failed;
1677         }
1678
1679 failed:
1680         hci_dev_unlock(hdev);
1681         return err;
1682 }
1683
1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685 {
1686         struct mgmt_mode *cp = data;
1687         struct mgmt_pending_cmd *cmd;
1688         u8 status;
1689         int err;
1690
1691         BT_DBG("request for %s", hdev->name);
1692
1693         status = mgmt_bredr_support(hdev);
1694         if (status)
1695                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696
1697         if (!lmp_ssp_capable(hdev))
1698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699                                        MGMT_STATUS_NOT_SUPPORTED);
1700
1701         if (cp->val != 0x00 && cp->val != 0x01)
1702                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703                                        MGMT_STATUS_INVALID_PARAMS);
1704
1705         hci_dev_lock(hdev);
1706
1707         if (!hdev_is_powered(hdev)) {
1708                 bool changed;
1709
1710                 if (cp->val) {
1711                         changed = !hci_dev_test_and_set_flag(hdev,
1712                                                              HCI_SSP_ENABLED);
1713                 } else {
1714                         changed = hci_dev_test_and_clear_flag(hdev,
1715                                                               HCI_SSP_ENABLED);
1716                         if (!changed)
1717                                 changed = hci_dev_test_and_clear_flag(hdev,
1718                                                                       HCI_HS_ENABLED);
1719                         else
1720                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721                 }
1722
1723                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724                 if (err < 0)
1725                         goto failed;
1726
1727                 if (changed)
1728                         err = new_settings(hdev, sk);
1729
1730                 goto failed;
1731         }
1732
1733         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735                                       MGMT_STATUS_BUSY);
1736                 goto failed;
1737         }
1738
1739         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741                 goto failed;
1742         }
1743
1744         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745         if (!cmd) {
1746                 err = -ENOMEM;
1747                 goto failed;
1748         }
1749
1750         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752                              sizeof(cp->val), &cp->val);
1753
1754         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755         if (err < 0) {
1756                 mgmt_pending_remove(cmd);
1757                 goto failed;
1758         }
1759
1760 failed:
1761         hci_dev_unlock(hdev);
1762         return err;
1763 }
1764
1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767         struct mgmt_mode *cp = data;
1768         bool changed;
1769         u8 status;
1770         int err;
1771
1772         BT_DBG("request for %s", hdev->name);
1773
1774         status = mgmt_bredr_support(hdev);
1775         if (status)
1776                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777
1778         if (!lmp_ssp_capable(hdev))
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780                                        MGMT_STATUS_NOT_SUPPORTED);
1781
1782         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784                                        MGMT_STATUS_REJECTED);
1785
1786         if (cp->val != 0x00 && cp->val != 0x01)
1787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788                                        MGMT_STATUS_INVALID_PARAMS);
1789
1790         hci_dev_lock(hdev);
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794                                       MGMT_STATUS_BUSY);
1795                 goto unlock;
1796         }
1797
1798         if (cp->val) {
1799                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800         } else {
1801                 if (hdev_is_powered(hdev)) {
1802                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803                                               MGMT_STATUS_REJECTED);
1804                         goto unlock;
1805                 }
1806
1807                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808         }
1809
1810         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811         if (err < 0)
1812                 goto unlock;
1813
1814         if (changed)
1815                 err = new_settings(hdev, sk);
1816
1817 unlock:
1818         hci_dev_unlock(hdev);
1819         return err;
1820 }
1821
1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823 {
1824         struct cmd_lookup match = { NULL, hdev };
1825
1826         hci_dev_lock(hdev);
1827
1828         if (status) {
1829                 u8 mgmt_err = mgmt_status(status);
1830
1831                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832                                      &mgmt_err);
1833                 goto unlock;
1834         }
1835
1836         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837
1838         new_settings(hdev, match.sk);
1839
1840         if (match.sk)
1841                 sock_put(match.sk);
1842
1843         /* Make sure the controller has a good default for
1844          * advertising data. Restrict the update to when LE
1845          * has actually been enabled. During power on, the
1846          * update in powered_update_hci will take care of it.
1847          */
1848         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849                 struct hci_request req;
1850                 hci_req_init(&req, hdev);
1851                 if (ext_adv_capable(hdev)) {
1852                         int err;
1853
1854                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855                         if (!err)
1856                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1857                 } else {
1858                         __hci_req_update_adv_data(&req, 0x00);
1859                         __hci_req_update_scan_rsp_data(&req, 0x00);
1860                 }
1861                 hci_req_run(&req, NULL);
1862                 hci_update_background_scan(hdev);
1863         }
1864
1865 unlock:
1866         hci_dev_unlock(hdev);
1867 }
1868
1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870 {
1871         struct mgmt_mode *cp = data;
1872         struct hci_cp_write_le_host_supported hci_cp;
1873         struct mgmt_pending_cmd *cmd;
1874         struct hci_request req;
1875         int err;
1876         u8 val, enabled;
1877
1878         BT_DBG("request for %s", hdev->name);
1879
1880         if (!lmp_le_capable(hdev))
1881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882                                        MGMT_STATUS_NOT_SUPPORTED);
1883
1884         if (cp->val != 0x00 && cp->val != 0x01)
1885                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886                                        MGMT_STATUS_INVALID_PARAMS);
1887
1888         /* Bluetooth single mode LE only controllers or dual-mode
1889          * controllers configured as LE only devices, do not allow
1890          * switching LE off. These have either LE enabled explicitly
1891          * or BR/EDR has been previously switched off.
1892          *
1893          * When trying to enable an already enabled LE, then gracefully
1894          * send a positive response. Trying to disable it however will
1895          * result into rejection.
1896          */
1897         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898                 if (cp->val == 0x01)
1899                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900
1901                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902                                        MGMT_STATUS_REJECTED);
1903         }
1904
1905         hci_dev_lock(hdev);
1906
1907         val = !!cp->val;
1908         enabled = lmp_host_le_capable(hdev);
1909
1910         if (!val)
1911                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912
1913         if (!hdev_is_powered(hdev) || val == enabled) {
1914                 bool changed = false;
1915
1916                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918                         changed = true;
1919                 }
1920
1921                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923                         changed = true;
1924                 }
1925
1926                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927                 if (err < 0)
1928                         goto unlock;
1929
1930                 if (changed)
1931                         err = new_settings(hdev, sk);
1932
1933                 goto unlock;
1934         }
1935
1936         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939                                       MGMT_STATUS_BUSY);
1940                 goto unlock;
1941         }
1942
1943         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944         if (!cmd) {
1945                 err = -ENOMEM;
1946                 goto unlock;
1947         }
1948
1949         hci_req_init(&req, hdev);
1950
1951         memset(&hci_cp, 0, sizeof(hci_cp));
1952
1953         if (val) {
1954                 hci_cp.le = val;
1955                 hci_cp.simul = 0x00;
1956         } else {
1957                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958                         __hci_req_disable_advertising(&req);
1959
1960                 if (ext_adv_capable(hdev))
1961                         __hci_req_clear_ext_adv_sets(&req);
1962         }
1963
1964         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965                     &hci_cp);
1966
1967         err = hci_req_run(&req, le_enable_complete);
1968         if (err < 0)
1969                 mgmt_pending_remove(cmd);
1970
1971 unlock:
1972         hci_dev_unlock(hdev);
1973         return err;
1974 }
1975
1976 /* This is a helper function to test for pending mgmt commands that can
1977  * cause CoD or EIR HCI commands. We can only allow one such pending
1978  * mgmt command at a time since otherwise we cannot easily track what
1979  * the current values are, will be, and based on that calculate if a new
1980  * HCI command needs to be sent and if yes with what value.
1981  */
1982 static bool pending_eir_or_class(struct hci_dev *hdev)
1983 {
1984         struct mgmt_pending_cmd *cmd;
1985
1986         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987                 switch (cmd->opcode) {
1988                 case MGMT_OP_ADD_UUID:
1989                 case MGMT_OP_REMOVE_UUID:
1990                 case MGMT_OP_SET_DEV_CLASS:
1991                 case MGMT_OP_SET_POWERED:
1992                         return true;
1993                 }
1994         }
1995
1996         return false;
1997 }
1998
1999 static const u8 bluetooth_base_uuid[] = {
2000                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002 };
2003
2004 static u8 get_uuid_size(const u8 *uuid)
2005 {
2006         u32 val;
2007
2008         if (memcmp(uuid, bluetooth_base_uuid, 12))
2009                 return 128;
2010
2011         val = get_unaligned_le32(&uuid[12]);
2012         if (val > 0xffff)
2013                 return 32;
2014
2015         return 16;
2016 }
2017
2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019 {
2020         struct mgmt_pending_cmd *cmd;
2021
2022         hci_dev_lock(hdev);
2023
2024         cmd = pending_find(mgmt_op, hdev);
2025         if (!cmd)
2026                 goto unlock;
2027
2028         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029                           mgmt_status(status), hdev->dev_class, 3);
2030
2031         mgmt_pending_remove(cmd);
2032
2033 unlock:
2034         hci_dev_unlock(hdev);
2035 }
2036
2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038 {
2039         BT_DBG("status 0x%02x", status);
2040
2041         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042 }
2043
2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045 {
2046         struct mgmt_cp_add_uuid *cp = data;
2047         struct mgmt_pending_cmd *cmd;
2048         struct hci_request req;
2049         struct bt_uuid *uuid;
2050         int err;
2051
2052         BT_DBG("request for %s", hdev->name);
2053
2054         hci_dev_lock(hdev);
2055
2056         if (pending_eir_or_class(hdev)) {
2057                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058                                       MGMT_STATUS_BUSY);
2059                 goto failed;
2060         }
2061
2062         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063         if (!uuid) {
2064                 err = -ENOMEM;
2065                 goto failed;
2066         }
2067
2068         memcpy(uuid->uuid, cp->uuid, 16);
2069         uuid->svc_hint = cp->svc_hint;
2070         uuid->size = get_uuid_size(cp->uuid);
2071
2072         list_add_tail(&uuid->list, &hdev->uuids);
2073
2074         hci_req_init(&req, hdev);
2075
2076         __hci_req_update_class(&req);
2077         __hci_req_update_eir(&req);
2078
2079         err = hci_req_run(&req, add_uuid_complete);
2080         if (err < 0) {
2081                 if (err != -ENODATA)
2082                         goto failed;
2083
2084                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085                                         hdev->dev_class, 3);
2086                 goto failed;
2087         }
2088
2089         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090         if (!cmd) {
2091                 err = -ENOMEM;
2092                 goto failed;
2093         }
2094
2095         err = 0;
2096
2097 failed:
2098         hci_dev_unlock(hdev);
2099         return err;
2100 }
2101
2102 static bool enable_service_cache(struct hci_dev *hdev)
2103 {
2104         if (!hdev_is_powered(hdev))
2105                 return false;
2106
2107         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109                                    CACHE_TIMEOUT);
2110                 return true;
2111         }
2112
2113         return false;
2114 }
2115
2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117 {
2118         BT_DBG("status 0x%02x", status);
2119
2120         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121 }
2122
2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124                        u16 len)
2125 {
2126         struct mgmt_cp_remove_uuid *cp = data;
2127         struct mgmt_pending_cmd *cmd;
2128         struct bt_uuid *match, *tmp;
2129         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130         struct hci_request req;
2131         int err, found;
2132
2133         BT_DBG("request for %s", hdev->name);
2134
2135         hci_dev_lock(hdev);
2136
2137         if (pending_eir_or_class(hdev)) {
2138                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139                                       MGMT_STATUS_BUSY);
2140                 goto unlock;
2141         }
2142
2143         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144                 hci_uuids_clear(hdev);
2145
2146                 if (enable_service_cache(hdev)) {
2147                         err = mgmt_cmd_complete(sk, hdev->id,
2148                                                 MGMT_OP_REMOVE_UUID,
2149                                                 0, hdev->dev_class, 3);
2150                         goto unlock;
2151                 }
2152
2153                 goto update_class;
2154         }
2155
2156         found = 0;
2157
2158         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160                         continue;
2161
2162                 list_del(&match->list);
2163                 kfree(match);
2164                 found++;
2165         }
2166
2167         if (found == 0) {
2168                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169                                       MGMT_STATUS_INVALID_PARAMS);
2170                 goto unlock;
2171         }
2172
2173 update_class:
2174         hci_req_init(&req, hdev);
2175
2176         __hci_req_update_class(&req);
2177         __hci_req_update_eir(&req);
2178
2179         err = hci_req_run(&req, remove_uuid_complete);
2180         if (err < 0) {
2181                 if (err != -ENODATA)
2182                         goto unlock;
2183
2184                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185                                         hdev->dev_class, 3);
2186                 goto unlock;
2187         }
2188
2189         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190         if (!cmd) {
2191                 err = -ENOMEM;
2192                 goto unlock;
2193         }
2194
2195         err = 0;
2196
2197 unlock:
2198         hci_dev_unlock(hdev);
2199         return err;
2200 }
2201
2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203 {
2204         BT_DBG("status 0x%02x", status);
2205
2206         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207 }
2208
2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210                          u16 len)
2211 {
2212         struct mgmt_cp_set_dev_class *cp = data;
2213         struct mgmt_pending_cmd *cmd;
2214         struct hci_request req;
2215         int err;
2216
2217         BT_DBG("request for %s", hdev->name);
2218
2219         if (!lmp_bredr_capable(hdev))
2220                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221                                        MGMT_STATUS_NOT_SUPPORTED);
2222
2223         hci_dev_lock(hdev);
2224
2225         if (pending_eir_or_class(hdev)) {
2226                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227                                       MGMT_STATUS_BUSY);
2228                 goto unlock;
2229         }
2230
2231         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233                                       MGMT_STATUS_INVALID_PARAMS);
2234                 goto unlock;
2235         }
2236
2237         hdev->major_class = cp->major;
2238         hdev->minor_class = cp->minor;
2239
2240         if (!hdev_is_powered(hdev)) {
2241                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242                                         hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         hci_req_init(&req, hdev);
2247
2248         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249                 hci_dev_unlock(hdev);
2250                 cancel_delayed_work_sync(&hdev->service_cache);
2251                 hci_dev_lock(hdev);
2252                 __hci_req_update_eir(&req);
2253         }
2254
2255         __hci_req_update_class(&req);
2256
2257         err = hci_req_run(&req, set_class_complete);
2258         if (err < 0) {
2259                 if (err != -ENODATA)
2260                         goto unlock;
2261
2262                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263                                         hdev->dev_class, 3);
2264                 goto unlock;
2265         }
2266
2267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268         if (!cmd) {
2269                 err = -ENOMEM;
2270                 goto unlock;
2271         }
2272
2273         err = 0;
2274
2275 unlock:
2276         hci_dev_unlock(hdev);
2277         return err;
2278 }
2279
2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281                           u16 len)
2282 {
2283         struct mgmt_cp_load_link_keys *cp = data;
2284         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285                                    sizeof(struct mgmt_link_key_info));
2286         u16 key_count, expected_len;
2287         bool changed;
2288         int i;
2289
2290         BT_DBG("request for %s", hdev->name);
2291
2292         if (!lmp_bredr_capable(hdev))
2293                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294                                        MGMT_STATUS_NOT_SUPPORTED);
2295
2296         key_count = __le16_to_cpu(cp->key_count);
2297         if (key_count > max_key_count) {
2298                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299                            key_count);
2300                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301                                        MGMT_STATUS_INVALID_PARAMS);
2302         }
2303
2304         expected_len = struct_size(cp, keys, key_count);
2305         if (expected_len != len) {
2306                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2307                            expected_len, len);
2308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309                                        MGMT_STATUS_INVALID_PARAMS);
2310         }
2311
2312         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2313                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2314                                        MGMT_STATUS_INVALID_PARAMS);
2315
2316         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2317                key_count);
2318
2319         for (i = 0; i < key_count; i++) {
2320                 struct mgmt_link_key_info *key = &cp->keys[i];
2321
2322                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2323                         return mgmt_cmd_status(sk, hdev->id,
2324                                                MGMT_OP_LOAD_LINK_KEYS,
2325                                                MGMT_STATUS_INVALID_PARAMS);
2326         }
2327
2328         hci_dev_lock(hdev);
2329
2330         hci_link_keys_clear(hdev);
2331
2332         if (cp->debug_keys)
2333                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2334         else
2335                 changed = hci_dev_test_and_clear_flag(hdev,
2336                                                       HCI_KEEP_DEBUG_KEYS);
2337
2338         if (changed)
2339                 new_settings(hdev, NULL);
2340
2341         for (i = 0; i < key_count; i++) {
2342                 struct mgmt_link_key_info *key = &cp->keys[i];
2343
2344                 /* Always ignore debug keys and require a new pairing if
2345                  * the user wants to use them.
2346                  */
2347                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2348                         continue;
2349
2350                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2351                                  key->type, key->pin_len, NULL);
2352         }
2353
2354         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2355
2356         hci_dev_unlock(hdev);
2357
2358         return 0;
2359 }
2360
2361 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2362                            u8 addr_type, struct sock *skip_sk)
2363 {
2364         struct mgmt_ev_device_unpaired ev;
2365
2366         bacpy(&ev.addr.bdaddr, bdaddr);
2367         ev.addr.type = addr_type;
2368
2369         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2370                           skip_sk);
2371 }
2372
2373 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2374                          u16 len)
2375 {
2376         struct mgmt_cp_unpair_device *cp = data;
2377         struct mgmt_rp_unpair_device rp;
2378         struct hci_conn_params *params;
2379         struct mgmt_pending_cmd *cmd;
2380         struct hci_conn *conn;
2381         u8 addr_type;
2382         int err;
2383
2384         memset(&rp, 0, sizeof(rp));
2385         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2386         rp.addr.type = cp->addr.type;
2387
2388         if (!bdaddr_type_is_valid(cp->addr.type))
2389                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2390                                          MGMT_STATUS_INVALID_PARAMS,
2391                                          &rp, sizeof(rp));
2392
2393         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2394                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2395                                          MGMT_STATUS_INVALID_PARAMS,
2396                                          &rp, sizeof(rp));
2397
2398         hci_dev_lock(hdev);
2399
2400         if (!hdev_is_powered(hdev)) {
2401                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2402                                         MGMT_STATUS_NOT_POWERED, &rp,
2403                                         sizeof(rp));
2404                 goto unlock;
2405         }
2406
2407         if (cp->addr.type == BDADDR_BREDR) {
2408                 /* If disconnection is requested, then look up the
2409                  * connection. If the remote device is connected, it
2410                  * will be later used to terminate the link.
2411                  *
2412                  * Setting it to NULL explicitly will cause no
2413                  * termination of the link.
2414                  */
2415                 if (cp->disconnect)
2416                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2417                                                        &cp->addr.bdaddr);
2418                 else
2419                         conn = NULL;
2420
2421                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2422                 if (err < 0) {
2423                         err = mgmt_cmd_complete(sk, hdev->id,
2424                                                 MGMT_OP_UNPAIR_DEVICE,
2425                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2426                                                 sizeof(rp));
2427                         goto unlock;
2428                 }
2429
2430                 goto done;
2431         }
2432
2433         /* LE address type */
2434         addr_type = le_addr_type(cp->addr.type);
2435
2436         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2437         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2438         if (err < 0) {
2439                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2440                                         MGMT_STATUS_NOT_PAIRED, &rp,
2441                                         sizeof(rp));
2442                 goto unlock;
2443         }
2444
2445         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2446         if (!conn) {
2447                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2448                 goto done;
2449         }
2450
2451
2452         /* Defer clearing up the connection parameters until closing to
2453          * give a chance of keeping them if a repairing happens.
2454          */
2455         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2456
2457         /* Disable auto-connection parameters if present */
2458         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2459         if (params) {
2460                 if (params->explicit_connect)
2461                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2462                 else
2463                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2464         }
2465
2466         /* If disconnection is not requested, then clear the connection
2467          * variable so that the link is not terminated.
2468          */
2469         if (!cp->disconnect)
2470                 conn = NULL;
2471
2472 done:
2473         /* If the connection variable is set, then termination of the
2474          * link is requested.
2475          */
2476         if (!conn) {
2477                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2478                                         &rp, sizeof(rp));
2479                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2480                 goto unlock;
2481         }
2482
2483         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2484                                sizeof(*cp));
2485         if (!cmd) {
2486                 err = -ENOMEM;
2487                 goto unlock;
2488         }
2489
2490         cmd->cmd_complete = addr_cmd_complete;
2491
2492         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2493         if (err < 0)
2494                 mgmt_pending_remove(cmd);
2495
2496 unlock:
2497         hci_dev_unlock(hdev);
2498         return err;
2499 }
2500
2501 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2502                       u16 len)
2503 {
2504         struct mgmt_cp_disconnect *cp = data;
2505         struct mgmt_rp_disconnect rp;
2506         struct mgmt_pending_cmd *cmd;
2507         struct hci_conn *conn;
2508         int err;
2509
2510         BT_DBG("");
2511
2512         memset(&rp, 0, sizeof(rp));
2513         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2514         rp.addr.type = cp->addr.type;
2515
2516         if (!bdaddr_type_is_valid(cp->addr.type))
2517                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2518                                          MGMT_STATUS_INVALID_PARAMS,
2519                                          &rp, sizeof(rp));
2520
2521         hci_dev_lock(hdev);
2522
2523         if (!test_bit(HCI_UP, &hdev->flags)) {
2524                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2525                                         MGMT_STATUS_NOT_POWERED, &rp,
2526                                         sizeof(rp));
2527                 goto failed;
2528         }
2529
2530         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2531                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2532                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2533                 goto failed;
2534         }
2535
2536         if (cp->addr.type == BDADDR_BREDR)
2537                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2538                                                &cp->addr.bdaddr);
2539         else
2540                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2541                                                le_addr_type(cp->addr.type));
2542
2543         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2544                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2545                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2546                                         sizeof(rp));
2547                 goto failed;
2548         }
2549
2550         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2551         if (!cmd) {
2552                 err = -ENOMEM;
2553                 goto failed;
2554         }
2555
2556         cmd->cmd_complete = generic_cmd_complete;
2557
2558         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2559         if (err < 0)
2560                 mgmt_pending_remove(cmd);
2561
2562 failed:
2563         hci_dev_unlock(hdev);
2564         return err;
2565 }
2566
2567 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2568 {
2569         switch (link_type) {
2570         case LE_LINK:
2571                 switch (addr_type) {
2572                 case ADDR_LE_DEV_PUBLIC:
2573                         return BDADDR_LE_PUBLIC;
2574
2575                 default:
2576                         /* Fallback to LE Random address type */
2577                         return BDADDR_LE_RANDOM;
2578                 }
2579
2580         default:
2581                 /* Fallback to BR/EDR type */
2582                 return BDADDR_BREDR;
2583         }
2584 }
2585
2586 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2587                            u16 data_len)
2588 {
2589         struct mgmt_rp_get_connections *rp;
2590         struct hci_conn *c;
2591         int err;
2592         u16 i;
2593
2594         BT_DBG("");
2595
2596         hci_dev_lock(hdev);
2597
2598         if (!hdev_is_powered(hdev)) {
2599                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2600                                       MGMT_STATUS_NOT_POWERED);
2601                 goto unlock;
2602         }
2603
2604         i = 0;
2605         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2606                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2607                         i++;
2608         }
2609
2610         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2611         if (!rp) {
2612                 err = -ENOMEM;
2613                 goto unlock;
2614         }
2615
2616         i = 0;
2617         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2618                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2619                         continue;
2620                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2621                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2622                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2623                         continue;
2624                 i++;
2625         }
2626
2627         rp->conn_count = cpu_to_le16(i);
2628
2629         /* Recalculate length in case of filtered SCO connections, etc */
2630         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2631                                 struct_size(rp, addr, i));
2632
2633         kfree(rp);
2634
2635 unlock:
2636         hci_dev_unlock(hdev);
2637         return err;
2638 }
2639
2640 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2641                                    struct mgmt_cp_pin_code_neg_reply *cp)
2642 {
2643         struct mgmt_pending_cmd *cmd;
2644         int err;
2645
2646         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2647                                sizeof(*cp));
2648         if (!cmd)
2649                 return -ENOMEM;
2650
2651         cmd->cmd_complete = addr_cmd_complete;
2652
2653         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2654                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2655         if (err < 0)
2656                 mgmt_pending_remove(cmd);
2657
2658         return err;
2659 }
2660
2661 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2662                           u16 len)
2663 {
2664         struct hci_conn *conn;
2665         struct mgmt_cp_pin_code_reply *cp = data;
2666         struct hci_cp_pin_code_reply reply;
2667         struct mgmt_pending_cmd *cmd;
2668         int err;
2669
2670         BT_DBG("");
2671
2672         hci_dev_lock(hdev);
2673
2674         if (!hdev_is_powered(hdev)) {
2675                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2676                                       MGMT_STATUS_NOT_POWERED);
2677                 goto failed;
2678         }
2679
2680         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2681         if (!conn) {
2682                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2683                                       MGMT_STATUS_NOT_CONNECTED);
2684                 goto failed;
2685         }
2686
2687         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2688                 struct mgmt_cp_pin_code_neg_reply ncp;
2689
2690                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2691
2692                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2693
2694                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2695                 if (err >= 0)
2696                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2697                                               MGMT_STATUS_INVALID_PARAMS);
2698
2699                 goto failed;
2700         }
2701
2702         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2703         if (!cmd) {
2704                 err = -ENOMEM;
2705                 goto failed;
2706         }
2707
2708         cmd->cmd_complete = addr_cmd_complete;
2709
2710         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2711         reply.pin_len = cp->pin_len;
2712         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2713
2714         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2715         if (err < 0)
2716                 mgmt_pending_remove(cmd);
2717
2718 failed:
2719         hci_dev_unlock(hdev);
2720         return err;
2721 }
2722
2723 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2724                              u16 len)
2725 {
2726         struct mgmt_cp_set_io_capability *cp = data;
2727
2728         BT_DBG("");
2729
2730         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2731                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2732                                        MGMT_STATUS_INVALID_PARAMS);
2733
2734         hci_dev_lock(hdev);
2735
2736         hdev->io_capability = cp->io_capability;
2737
2738         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2739                hdev->io_capability);
2740
2741         hci_dev_unlock(hdev);
2742
2743         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2744                                  NULL, 0);
2745 }
2746
2747 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2748 {
2749         struct hci_dev *hdev = conn->hdev;
2750         struct mgmt_pending_cmd *cmd;
2751
2752         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2753                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2754                         continue;
2755
2756                 if (cmd->user_data != conn)
2757                         continue;
2758
2759                 return cmd;
2760         }
2761
2762         return NULL;
2763 }
2764
2765 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2766 {
2767         struct mgmt_rp_pair_device rp;
2768         struct hci_conn *conn = cmd->user_data;
2769         int err;
2770
2771         bacpy(&rp.addr.bdaddr, &conn->dst);
2772         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2773
2774         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2775                                 status, &rp, sizeof(rp));
2776
2777         /* So we don't get further callbacks for this connection */
2778         conn->connect_cfm_cb = NULL;
2779         conn->security_cfm_cb = NULL;
2780         conn->disconn_cfm_cb = NULL;
2781
2782         hci_conn_drop(conn);
2783
2784         /* The device is paired so there is no need to remove
2785          * its connection parameters anymore.
2786          */
2787         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2788
2789         hci_conn_put(conn);
2790
2791         return err;
2792 }
2793
2794 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2795 {
2796         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2797         struct mgmt_pending_cmd *cmd;
2798
2799         cmd = find_pairing(conn);
2800         if (cmd) {
2801                 cmd->cmd_complete(cmd, status);
2802                 mgmt_pending_remove(cmd);
2803         }
2804 }
2805
2806 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2807 {
2808         struct mgmt_pending_cmd *cmd;
2809
2810         BT_DBG("status %u", status);
2811
2812         cmd = find_pairing(conn);
2813         if (!cmd) {
2814                 BT_DBG("Unable to find a pending command");
2815                 return;
2816         }
2817
2818         cmd->cmd_complete(cmd, mgmt_status(status));
2819         mgmt_pending_remove(cmd);
2820 }
2821
2822 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2823 {
2824         struct mgmt_pending_cmd *cmd;
2825
2826         BT_DBG("status %u", status);
2827
2828         if (!status)
2829                 return;
2830
2831         cmd = find_pairing(conn);
2832         if (!cmd) {
2833                 BT_DBG("Unable to find a pending command");
2834                 return;
2835         }
2836
2837         cmd->cmd_complete(cmd, mgmt_status(status));
2838         mgmt_pending_remove(cmd);
2839 }
2840
2841 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2842                        u16 len)
2843 {
2844         struct mgmt_cp_pair_device *cp = data;
2845         struct mgmt_rp_pair_device rp;
2846         struct mgmt_pending_cmd *cmd;
2847         u8 sec_level, auth_type;
2848         struct hci_conn *conn;
2849         int err;
2850
2851         BT_DBG("");
2852
2853         memset(&rp, 0, sizeof(rp));
2854         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2855         rp.addr.type = cp->addr.type;
2856
2857         if (!bdaddr_type_is_valid(cp->addr.type))
2858                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2859                                          MGMT_STATUS_INVALID_PARAMS,
2860                                          &rp, sizeof(rp));
2861
2862         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2863                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2864                                          MGMT_STATUS_INVALID_PARAMS,
2865                                          &rp, sizeof(rp));
2866
2867         hci_dev_lock(hdev);
2868
2869         if (!hdev_is_powered(hdev)) {
2870                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2871                                         MGMT_STATUS_NOT_POWERED, &rp,
2872                                         sizeof(rp));
2873                 goto unlock;
2874         }
2875
2876         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2877                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2878                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2879                                         sizeof(rp));
2880                 goto unlock;
2881         }
2882
2883         sec_level = BT_SECURITY_MEDIUM;
2884         auth_type = HCI_AT_DEDICATED_BONDING;
2885
2886         if (cp->addr.type == BDADDR_BREDR) {
2887                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2888                                        auth_type);
2889         } else {
2890                 u8 addr_type = le_addr_type(cp->addr.type);
2891                 struct hci_conn_params *p;
2892
2893                 /* When pairing a new device, it is expected to remember
2894                  * this device for future connections. Adding the connection
2895                  * parameter information ahead of time allows tracking
2896                  * of the slave preferred values and will speed up any
2897                  * further connection establishment.
2898                  *
2899                  * If connection parameters already exist, then they
2900                  * will be kept and this function does nothing.
2901                  */
2902                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2903
2904                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2905                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2906
2907                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2908                                            addr_type, sec_level,
2909                                            HCI_LE_CONN_TIMEOUT);
2910         }
2911
2912         if (IS_ERR(conn)) {
2913                 int status;
2914
2915                 if (PTR_ERR(conn) == -EBUSY)
2916                         status = MGMT_STATUS_BUSY;
2917                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2918                         status = MGMT_STATUS_NOT_SUPPORTED;
2919                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2920                         status = MGMT_STATUS_REJECTED;
2921                 else
2922                         status = MGMT_STATUS_CONNECT_FAILED;
2923
2924                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2925                                         status, &rp, sizeof(rp));
2926                 goto unlock;
2927         }
2928
2929         if (conn->connect_cfm_cb) {
2930                 hci_conn_drop(conn);
2931                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2932                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2933                 goto unlock;
2934         }
2935
2936         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2937         if (!cmd) {
2938                 err = -ENOMEM;
2939                 hci_conn_drop(conn);
2940                 goto unlock;
2941         }
2942
2943         cmd->cmd_complete = pairing_complete;
2944
2945         /* For LE, just connecting isn't a proof that the pairing finished */
2946         if (cp->addr.type == BDADDR_BREDR) {
2947                 conn->connect_cfm_cb = pairing_complete_cb;
2948                 conn->security_cfm_cb = pairing_complete_cb;
2949                 conn->disconn_cfm_cb = pairing_complete_cb;
2950         } else {
2951                 conn->connect_cfm_cb = le_pairing_complete_cb;
2952                 conn->security_cfm_cb = le_pairing_complete_cb;
2953                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2954         }
2955
2956         conn->io_capability = cp->io_cap;
2957         cmd->user_data = hci_conn_get(conn);
2958
2959         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2960             hci_conn_security(conn, sec_level, auth_type, true)) {
2961                 cmd->cmd_complete(cmd, 0);
2962                 mgmt_pending_remove(cmd);
2963         }
2964
2965         err = 0;
2966
2967 unlock:
2968         hci_dev_unlock(hdev);
2969         return err;
2970 }
2971
2972 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2973                               u16 len)
2974 {
2975         struct mgmt_addr_info *addr = data;
2976         struct mgmt_pending_cmd *cmd;
2977         struct hci_conn *conn;
2978         int err;
2979
2980         BT_DBG("");
2981
2982         hci_dev_lock(hdev);
2983
2984         if (!hdev_is_powered(hdev)) {
2985                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2986                                       MGMT_STATUS_NOT_POWERED);
2987                 goto unlock;
2988         }
2989
2990         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2991         if (!cmd) {
2992                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2993                                       MGMT_STATUS_INVALID_PARAMS);
2994                 goto unlock;
2995         }
2996
2997         conn = cmd->user_data;
2998
2999         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001                                       MGMT_STATUS_INVALID_PARAMS);
3002                 goto unlock;
3003         }
3004
3005         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3006         mgmt_pending_remove(cmd);
3007
3008         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3009                                 addr, sizeof(*addr));
3010 unlock:
3011         hci_dev_unlock(hdev);
3012         return err;
3013 }
3014
3015 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3016                              struct mgmt_addr_info *addr, u16 mgmt_op,
3017                              u16 hci_op, __le32 passkey)
3018 {
3019         struct mgmt_pending_cmd *cmd;
3020         struct hci_conn *conn;
3021         int err;
3022
3023         hci_dev_lock(hdev);
3024
3025         if (!hdev_is_powered(hdev)) {
3026                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3027                                         MGMT_STATUS_NOT_POWERED, addr,
3028                                         sizeof(*addr));
3029                 goto done;
3030         }
3031
3032         if (addr->type == BDADDR_BREDR)
3033                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3034         else
3035                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3036                                                le_addr_type(addr->type));
3037
3038         if (!conn) {
3039                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3040                                         MGMT_STATUS_NOT_CONNECTED, addr,
3041                                         sizeof(*addr));
3042                 goto done;
3043         }
3044
3045         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3046                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3047                 if (!err)
3048                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3049                                                 MGMT_STATUS_SUCCESS, addr,
3050                                                 sizeof(*addr));
3051                 else
3052                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3053                                                 MGMT_STATUS_FAILED, addr,
3054                                                 sizeof(*addr));
3055
3056                 goto done;
3057         }
3058
3059         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3060         if (!cmd) {
3061                 err = -ENOMEM;
3062                 goto done;
3063         }
3064
3065         cmd->cmd_complete = addr_cmd_complete;
3066
3067         /* Continue with pairing via HCI */
3068         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3069                 struct hci_cp_user_passkey_reply cp;
3070
3071                 bacpy(&cp.bdaddr, &addr->bdaddr);
3072                 cp.passkey = passkey;
3073                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3074         } else
3075                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3076                                    &addr->bdaddr);
3077
3078         if (err < 0)
3079                 mgmt_pending_remove(cmd);
3080
3081 done:
3082         hci_dev_unlock(hdev);
3083         return err;
3084 }
3085
3086 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3087                               void *data, u16 len)
3088 {
3089         struct mgmt_cp_pin_code_neg_reply *cp = data;
3090
3091         BT_DBG("");
3092
3093         return user_pairing_resp(sk, hdev, &cp->addr,
3094                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3095                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3096 }
3097
3098 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3099                               u16 len)
3100 {
3101         struct mgmt_cp_user_confirm_reply *cp = data;
3102
3103         BT_DBG("");
3104
3105         if (len != sizeof(*cp))
3106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3107                                        MGMT_STATUS_INVALID_PARAMS);
3108
3109         return user_pairing_resp(sk, hdev, &cp->addr,
3110                                  MGMT_OP_USER_CONFIRM_REPLY,
3111                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3112 }
3113
3114 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3115                                   void *data, u16 len)
3116 {
3117         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3118
3119         BT_DBG("");
3120
3121         return user_pairing_resp(sk, hdev, &cp->addr,
3122                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3123                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3124 }
3125
3126 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3127                               u16 len)
3128 {
3129         struct mgmt_cp_user_passkey_reply *cp = data;
3130
3131         BT_DBG("");
3132
3133         return user_pairing_resp(sk, hdev, &cp->addr,
3134                                  MGMT_OP_USER_PASSKEY_REPLY,
3135                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3136 }
3137
3138 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3139                                   void *data, u16 len)
3140 {
3141         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3142
3143         BT_DBG("");
3144
3145         return user_pairing_resp(sk, hdev, &cp->addr,
3146                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3147                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3148 }
3149
3150 static void adv_expire(struct hci_dev *hdev, u32 flags)
3151 {
3152         struct adv_info *adv_instance;
3153         struct hci_request req;
3154         int err;
3155
3156         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3157         if (!adv_instance)
3158                 return;
3159
3160         /* stop if current instance doesn't need to be changed */
3161         if (!(adv_instance->flags & flags))
3162                 return;
3163
3164         cancel_adv_timeout(hdev);
3165
3166         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3167         if (!adv_instance)
3168                 return;
3169
3170         hci_req_init(&req, hdev);
3171         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3172                                               true);
3173         if (err)
3174                 return;
3175
3176         hci_req_run(&req, NULL);
3177 }
3178
3179 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3180 {
3181         struct mgmt_cp_set_local_name *cp;
3182         struct mgmt_pending_cmd *cmd;
3183
3184         BT_DBG("status 0x%02x", status);
3185
3186         hci_dev_lock(hdev);
3187
3188         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3189         if (!cmd)
3190                 goto unlock;
3191
3192         cp = cmd->param;
3193
3194         if (status) {
3195                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3196                                 mgmt_status(status));
3197         } else {
3198                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3199                                   cp, sizeof(*cp));
3200
3201                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3202                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3203         }
3204
3205         mgmt_pending_remove(cmd);
3206
3207 unlock:
3208         hci_dev_unlock(hdev);
3209 }
3210
3211 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3212                           u16 len)
3213 {
3214         struct mgmt_cp_set_local_name *cp = data;
3215         struct mgmt_pending_cmd *cmd;
3216         struct hci_request req;
3217         int err;
3218
3219         BT_DBG("");
3220
3221         hci_dev_lock(hdev);
3222
3223         /* If the old values are the same as the new ones just return a
3224          * direct command complete event.
3225          */
3226         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3227             !memcmp(hdev->short_name, cp->short_name,
3228                     sizeof(hdev->short_name))) {
3229                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3230                                         data, len);
3231                 goto failed;
3232         }
3233
3234         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3235
3236         if (!hdev_is_powered(hdev)) {
3237                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3238
3239                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3240                                         data, len);
3241                 if (err < 0)
3242                         goto failed;
3243
3244                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3245                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3246                 ext_info_changed(hdev, sk);
3247
3248                 goto failed;
3249         }
3250
3251         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3252         if (!cmd) {
3253                 err = -ENOMEM;
3254                 goto failed;
3255         }
3256
3257         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3258
3259         hci_req_init(&req, hdev);
3260
3261         if (lmp_bredr_capable(hdev)) {
3262                 __hci_req_update_name(&req);
3263                 __hci_req_update_eir(&req);
3264         }
3265
3266         /* The name is stored in the scan response data and so
3267          * no need to udpate the advertising data here.
3268          */
3269         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3270                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3271
3272         err = hci_req_run(&req, set_name_complete);
3273         if (err < 0)
3274                 mgmt_pending_remove(cmd);
3275
3276 failed:
3277         hci_dev_unlock(hdev);
3278         return err;
3279 }
3280
3281 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3282                           u16 len)
3283 {
3284         struct mgmt_cp_set_appearance *cp = data;
3285         u16 apperance;
3286         int err;
3287
3288         BT_DBG("");
3289
3290         if (!lmp_le_capable(hdev))
3291                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3292                                        MGMT_STATUS_NOT_SUPPORTED);
3293
3294         apperance = le16_to_cpu(cp->appearance);
3295
3296         hci_dev_lock(hdev);
3297
3298         if (hdev->appearance != apperance) {
3299                 hdev->appearance = apperance;
3300
3301                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3302                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3303
3304                 ext_info_changed(hdev, sk);
3305         }
3306
3307         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3308                                 0);
3309
3310         hci_dev_unlock(hdev);
3311
3312         return err;
3313 }
3314
3315 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3316                                  void *data, u16 len)
3317 {
3318         struct mgmt_rp_get_phy_confguration rp;
3319
3320         BT_DBG("sock %p %s", sk, hdev->name);
3321
3322         hci_dev_lock(hdev);
3323
3324         memset(&rp, 0, sizeof(rp));
3325
3326         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3327         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3328         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3329
3330         hci_dev_unlock(hdev);
3331
3332         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3333                                  &rp, sizeof(rp));
3334 }
3335
3336 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3337 {
3338         struct mgmt_ev_phy_configuration_changed ev;
3339
3340         memset(&ev, 0, sizeof(ev));
3341
3342         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3343
3344         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3345                           sizeof(ev), skip);
3346 }
3347
3348 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3349                                      u16 opcode, struct sk_buff *skb)
3350 {
3351         struct mgmt_pending_cmd *cmd;
3352
3353         BT_DBG("status 0x%02x", status);
3354
3355         hci_dev_lock(hdev);
3356
3357         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3358         if (!cmd)
3359                 goto unlock;
3360
3361         if (status) {
3362                 mgmt_cmd_status(cmd->sk, hdev->id,
3363                                 MGMT_OP_SET_PHY_CONFIGURATION,
3364                                 mgmt_status(status));
3365         } else {
3366                 mgmt_cmd_complete(cmd->sk, hdev->id,
3367                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3368                                   NULL, 0);
3369
3370                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3371         }
3372
3373         mgmt_pending_remove(cmd);
3374
3375 unlock:
3376         hci_dev_unlock(hdev);
3377 }
3378
3379 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3380                                  void *data, u16 len)
3381 {
3382         struct mgmt_cp_set_phy_confguration *cp = data;
3383         struct hci_cp_le_set_default_phy cp_phy;
3384         struct mgmt_pending_cmd *cmd;
3385         struct hci_request req;
3386         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3387         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3388         bool changed = false;
3389         int err;
3390
3391         BT_DBG("sock %p %s", sk, hdev->name);
3392
3393         configurable_phys = get_configurable_phys(hdev);
3394         supported_phys = get_supported_phys(hdev);
3395         selected_phys = __le32_to_cpu(cp->selected_phys);
3396
3397         if (selected_phys & ~supported_phys)
3398                 return mgmt_cmd_status(sk, hdev->id,
3399                                        MGMT_OP_SET_PHY_CONFIGURATION,
3400                                        MGMT_STATUS_INVALID_PARAMS);
3401
3402         unconfigure_phys = supported_phys & ~configurable_phys;
3403
3404         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3405                 return mgmt_cmd_status(sk, hdev->id,
3406                                        MGMT_OP_SET_PHY_CONFIGURATION,
3407                                        MGMT_STATUS_INVALID_PARAMS);
3408
3409         if (selected_phys == get_selected_phys(hdev))
3410                 return mgmt_cmd_complete(sk, hdev->id,
3411                                          MGMT_OP_SET_PHY_CONFIGURATION,
3412                                          0, NULL, 0);
3413
3414         hci_dev_lock(hdev);
3415
3416         if (!hdev_is_powered(hdev)) {
3417                 err = mgmt_cmd_status(sk, hdev->id,
3418                                       MGMT_OP_SET_PHY_CONFIGURATION,
3419                                       MGMT_STATUS_REJECTED);
3420                 goto unlock;
3421         }
3422
3423         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3424                 err = mgmt_cmd_status(sk, hdev->id,
3425                                       MGMT_OP_SET_PHY_CONFIGURATION,
3426                                       MGMT_STATUS_BUSY);
3427                 goto unlock;
3428         }
3429
3430         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3431                 pkt_type |= (HCI_DH3 | HCI_DM3);
3432         else
3433                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3434
3435         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3436                 pkt_type |= (HCI_DH5 | HCI_DM5);
3437         else
3438                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3439
3440         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3441                 pkt_type &= ~HCI_2DH1;
3442         else
3443                 pkt_type |= HCI_2DH1;
3444
3445         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3446                 pkt_type &= ~HCI_2DH3;
3447         else
3448                 pkt_type |= HCI_2DH3;
3449
3450         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3451                 pkt_type &= ~HCI_2DH5;
3452         else
3453                 pkt_type |= HCI_2DH5;
3454
3455         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3456                 pkt_type &= ~HCI_3DH1;
3457         else
3458                 pkt_type |= HCI_3DH1;
3459
3460         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3461                 pkt_type &= ~HCI_3DH3;
3462         else
3463                 pkt_type |= HCI_3DH3;
3464
3465         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3466                 pkt_type &= ~HCI_3DH5;
3467         else
3468                 pkt_type |= HCI_3DH5;
3469
3470         if (pkt_type != hdev->pkt_type) {
3471                 hdev->pkt_type = pkt_type;
3472                 changed = true;
3473         }
3474
3475         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3476             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3477                 if (changed)
3478                         mgmt_phy_configuration_changed(hdev, sk);
3479
3480                 err = mgmt_cmd_complete(sk, hdev->id,
3481                                         MGMT_OP_SET_PHY_CONFIGURATION,
3482                                         0, NULL, 0);
3483
3484                 goto unlock;
3485         }
3486
3487         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3488                                len);
3489         if (!cmd) {
3490                 err = -ENOMEM;
3491                 goto unlock;
3492         }
3493
3494         hci_req_init(&req, hdev);
3495
3496         memset(&cp_phy, 0, sizeof(cp_phy));
3497
3498         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3499                 cp_phy.all_phys |= 0x01;
3500
3501         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3502                 cp_phy.all_phys |= 0x02;
3503
3504         if (selected_phys & MGMT_PHY_LE_1M_TX)
3505                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3506
3507         if (selected_phys & MGMT_PHY_LE_2M_TX)
3508                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3509
3510         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3511                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3512
3513         if (selected_phys & MGMT_PHY_LE_1M_RX)
3514                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3515
3516         if (selected_phys & MGMT_PHY_LE_2M_RX)
3517                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3518
3519         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3520                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3521
3522         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3523
3524         err = hci_req_run_skb(&req, set_default_phy_complete);
3525         if (err < 0)
3526                 mgmt_pending_remove(cmd);
3527
3528 unlock:
3529         hci_dev_unlock(hdev);
3530
3531         return err;
3532 }
3533
3534 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3535                                          u16 opcode, struct sk_buff *skb)
3536 {
3537         struct mgmt_rp_read_local_oob_data mgmt_rp;
3538         size_t rp_size = sizeof(mgmt_rp);
3539         struct mgmt_pending_cmd *cmd;
3540
3541         BT_DBG("%s status %u", hdev->name, status);
3542
3543         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3544         if (!cmd)
3545                 return;
3546
3547         if (status || !skb) {
3548                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3549                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3550                 goto remove;
3551         }
3552
3553         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3554
3555         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3556                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3557
3558                 if (skb->len < sizeof(*rp)) {
3559                         mgmt_cmd_status(cmd->sk, hdev->id,
3560                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3561                                         MGMT_STATUS_FAILED);
3562                         goto remove;
3563                 }
3564
3565                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3566                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3567
3568                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3569         } else {
3570                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3571
3572                 if (skb->len < sizeof(*rp)) {
3573                         mgmt_cmd_status(cmd->sk, hdev->id,
3574                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3575                                         MGMT_STATUS_FAILED);
3576                         goto remove;
3577                 }
3578
3579                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3580                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3581
3582                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3583                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3584         }
3585
3586         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3587                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3588
3589 remove:
3590         mgmt_pending_remove(cmd);
3591 }
3592
3593 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3594                                void *data, u16 data_len)
3595 {
3596         struct mgmt_pending_cmd *cmd;
3597         struct hci_request req;
3598         int err;
3599
3600         BT_DBG("%s", hdev->name);
3601
3602         hci_dev_lock(hdev);
3603
3604         if (!hdev_is_powered(hdev)) {
3605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3606                                       MGMT_STATUS_NOT_POWERED);
3607                 goto unlock;
3608         }
3609
3610         if (!lmp_ssp_capable(hdev)) {
3611                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3612                                       MGMT_STATUS_NOT_SUPPORTED);
3613                 goto unlock;
3614         }
3615
3616         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3617                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3618                                       MGMT_STATUS_BUSY);
3619                 goto unlock;
3620         }
3621
3622         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3623         if (!cmd) {
3624                 err = -ENOMEM;
3625                 goto unlock;
3626         }
3627
3628         hci_req_init(&req, hdev);
3629
3630         if (bredr_sc_enabled(hdev))
3631                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3632         else
3633                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3634
3635         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3636         if (err < 0)
3637                 mgmt_pending_remove(cmd);
3638
3639 unlock:
3640         hci_dev_unlock(hdev);
3641         return err;
3642 }
3643
3644 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3645                                void *data, u16 len)
3646 {
3647         struct mgmt_addr_info *addr = data;
3648         int err;
3649
3650         BT_DBG("%s ", hdev->name);
3651
3652         if (!bdaddr_type_is_valid(addr->type))
3653                 return mgmt_cmd_complete(sk, hdev->id,
3654                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3655                                          MGMT_STATUS_INVALID_PARAMS,
3656                                          addr, sizeof(*addr));
3657
3658         hci_dev_lock(hdev);
3659
3660         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3661                 struct mgmt_cp_add_remote_oob_data *cp = data;
3662                 u8 status;
3663
3664                 if (cp->addr.type != BDADDR_BREDR) {
3665                         err = mgmt_cmd_complete(sk, hdev->id,
3666                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3667                                                 MGMT_STATUS_INVALID_PARAMS,
3668                                                 &cp->addr, sizeof(cp->addr));
3669                         goto unlock;
3670                 }
3671
3672                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3673                                               cp->addr.type, cp->hash,
3674                                               cp->rand, NULL, NULL);
3675                 if (err < 0)
3676                         status = MGMT_STATUS_FAILED;
3677                 else
3678                         status = MGMT_STATUS_SUCCESS;
3679
3680                 err = mgmt_cmd_complete(sk, hdev->id,
3681                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3682                                         &cp->addr, sizeof(cp->addr));
3683         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3684                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3685                 u8 *rand192, *hash192, *rand256, *hash256;
3686                 u8 status;
3687
3688                 if (bdaddr_type_is_le(cp->addr.type)) {
3689                         /* Enforce zero-valued 192-bit parameters as
3690                          * long as legacy SMP OOB isn't implemented.
3691                          */
3692                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3693                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3694                                 err = mgmt_cmd_complete(sk, hdev->id,
3695                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3696                                                         MGMT_STATUS_INVALID_PARAMS,
3697                                                         addr, sizeof(*addr));
3698                                 goto unlock;
3699                         }
3700
3701                         rand192 = NULL;
3702                         hash192 = NULL;
3703                 } else {
3704                         /* In case one of the P-192 values is set to zero,
3705                          * then just disable OOB data for P-192.
3706                          */
3707                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3708                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3709                                 rand192 = NULL;
3710                                 hash192 = NULL;
3711                         } else {
3712                                 rand192 = cp->rand192;
3713                                 hash192 = cp->hash192;
3714                         }
3715                 }
3716
3717                 /* In case one of the P-256 values is set to zero, then just
3718                  * disable OOB data for P-256.
3719                  */
3720                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3721                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3722                         rand256 = NULL;
3723                         hash256 = NULL;
3724                 } else {
3725                         rand256 = cp->rand256;
3726                         hash256 = cp->hash256;
3727                 }
3728
3729                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3730                                               cp->addr.type, hash192, rand192,
3731                                               hash256, rand256);
3732                 if (err < 0)
3733                         status = MGMT_STATUS_FAILED;
3734                 else
3735                         status = MGMT_STATUS_SUCCESS;
3736
3737                 err = mgmt_cmd_complete(sk, hdev->id,
3738                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3739                                         status, &cp->addr, sizeof(cp->addr));
3740         } else {
3741                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3742                            len);
3743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3744                                       MGMT_STATUS_INVALID_PARAMS);
3745         }
3746
3747 unlock:
3748         hci_dev_unlock(hdev);
3749         return err;
3750 }
3751
3752 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3753                                   void *data, u16 len)
3754 {
3755         struct mgmt_cp_remove_remote_oob_data *cp = data;
3756         u8 status;
3757         int err;
3758
3759         BT_DBG("%s", hdev->name);
3760
3761         if (cp->addr.type != BDADDR_BREDR)
3762                 return mgmt_cmd_complete(sk, hdev->id,
3763                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3764                                          MGMT_STATUS_INVALID_PARAMS,
3765                                          &cp->addr, sizeof(cp->addr));
3766
3767         hci_dev_lock(hdev);
3768
3769         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3770                 hci_remote_oob_data_clear(hdev);
3771                 status = MGMT_STATUS_SUCCESS;
3772                 goto done;
3773         }
3774
3775         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3776         if (err < 0)
3777                 status = MGMT_STATUS_INVALID_PARAMS;
3778         else
3779                 status = MGMT_STATUS_SUCCESS;
3780
3781 done:
3782         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3783                                 status, &cp->addr, sizeof(cp->addr));
3784
3785         hci_dev_unlock(hdev);
3786         return err;
3787 }
3788
3789 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3790 {
3791         struct mgmt_pending_cmd *cmd;
3792
3793         BT_DBG("status %d", status);
3794
3795         hci_dev_lock(hdev);
3796
3797         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3798         if (!cmd)
3799                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3800
3801         if (!cmd)
3802                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3803
3804         if (cmd) {
3805                 cmd->cmd_complete(cmd, mgmt_status(status));
3806                 mgmt_pending_remove(cmd);
3807         }
3808
3809         hci_dev_unlock(hdev);
3810 }
3811
3812 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3813                                     uint8_t *mgmt_status)
3814 {
3815         switch (type) {
3816         case DISCOV_TYPE_LE:
3817                 *mgmt_status = mgmt_le_support(hdev);
3818                 if (*mgmt_status)
3819                         return false;
3820                 break;
3821         case DISCOV_TYPE_INTERLEAVED:
3822                 *mgmt_status = mgmt_le_support(hdev);
3823                 if (*mgmt_status)
3824                         return false;
3825                 /* Intentional fall-through */
3826         case DISCOV_TYPE_BREDR:
3827                 *mgmt_status = mgmt_bredr_support(hdev);
3828                 if (*mgmt_status)
3829                         return false;
3830                 break;
3831         default:
3832                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3833                 return false;
3834         }
3835
3836         return true;
3837 }
3838
3839 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3840                                     u16 op, void *data, u16 len)
3841 {
3842         struct mgmt_cp_start_discovery *cp = data;
3843         struct mgmt_pending_cmd *cmd;
3844         u8 status;
3845         int err;
3846
3847         BT_DBG("%s", hdev->name);
3848
3849         hci_dev_lock(hdev);
3850
3851         if (!hdev_is_powered(hdev)) {
3852                 err = mgmt_cmd_complete(sk, hdev->id, op,
3853                                         MGMT_STATUS_NOT_POWERED,
3854                                         &cp->type, sizeof(cp->type));
3855                 goto failed;
3856         }
3857
3858         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3859             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3860                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3861                                         &cp->type, sizeof(cp->type));
3862                 goto failed;
3863         }
3864
3865         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3866                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3867                                         &cp->type, sizeof(cp->type));
3868                 goto failed;
3869         }
3870
3871         /* Clear the discovery filter first to free any previously
3872          * allocated memory for the UUID list.
3873          */
3874         hci_discovery_filter_clear(hdev);
3875
3876         hdev->discovery.type = cp->type;
3877         hdev->discovery.report_invalid_rssi = false;
3878         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3879                 hdev->discovery.limited = true;
3880         else
3881                 hdev->discovery.limited = false;
3882
3883         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3884         if (!cmd) {
3885                 err = -ENOMEM;
3886                 goto failed;
3887         }
3888
3889         cmd->cmd_complete = generic_cmd_complete;
3890
3891         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3892         queue_work(hdev->req_workqueue, &hdev->discov_update);
3893         err = 0;
3894
3895 failed:
3896         hci_dev_unlock(hdev);
3897         return err;
3898 }
3899
3900 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3901                            void *data, u16 len)
3902 {
3903         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3904                                         data, len);
3905 }
3906
3907 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3908                                    void *data, u16 len)
3909 {
3910         return start_discovery_internal(sk, hdev,
3911                                         MGMT_OP_START_LIMITED_DISCOVERY,
3912                                         data, len);
3913 }
3914
3915 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3916                                           u8 status)
3917 {
3918         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3919                                  cmd->param, 1);
3920 }
3921
3922 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3923                                    void *data, u16 len)
3924 {
3925         struct mgmt_cp_start_service_discovery *cp = data;
3926         struct mgmt_pending_cmd *cmd;
3927         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3928         u16 uuid_count, expected_len;
3929         u8 status;
3930         int err;
3931
3932         BT_DBG("%s", hdev->name);
3933
3934         hci_dev_lock(hdev);
3935
3936         if (!hdev_is_powered(hdev)) {
3937                 err = mgmt_cmd_complete(sk, hdev->id,
3938                                         MGMT_OP_START_SERVICE_DISCOVERY,
3939                                         MGMT_STATUS_NOT_POWERED,
3940                                         &cp->type, sizeof(cp->type));
3941                 goto failed;
3942         }
3943
3944         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3945             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3946                 err = mgmt_cmd_complete(sk, hdev->id,
3947                                         MGMT_OP_START_SERVICE_DISCOVERY,
3948                                         MGMT_STATUS_BUSY, &cp->type,
3949                                         sizeof(cp->type));
3950                 goto failed;
3951         }
3952
3953         uuid_count = __le16_to_cpu(cp->uuid_count);
3954         if (uuid_count > max_uuid_count) {
3955                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3956                            uuid_count);
3957                 err = mgmt_cmd_complete(sk, hdev->id,
3958                                         MGMT_OP_START_SERVICE_DISCOVERY,
3959                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3960                                         sizeof(cp->type));
3961                 goto failed;
3962         }
3963
3964         expected_len = sizeof(*cp) + uuid_count * 16;
3965         if (expected_len != len) {
3966                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3967                            expected_len, len);
3968                 err = mgmt_cmd_complete(sk, hdev->id,
3969                                         MGMT_OP_START_SERVICE_DISCOVERY,
3970                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3971                                         sizeof(cp->type));
3972                 goto failed;
3973         }
3974
3975         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3976                 err = mgmt_cmd_complete(sk, hdev->id,
3977                                         MGMT_OP_START_SERVICE_DISCOVERY,
3978                                         status, &cp->type, sizeof(cp->type));
3979                 goto failed;
3980         }
3981
3982         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3983                                hdev, data, len);
3984         if (!cmd) {
3985                 err = -ENOMEM;
3986                 goto failed;
3987         }
3988
3989         cmd->cmd_complete = service_discovery_cmd_complete;
3990
3991         /* Clear the discovery filter first to free any previously
3992          * allocated memory for the UUID list.
3993          */
3994         hci_discovery_filter_clear(hdev);
3995
3996         hdev->discovery.result_filtering = true;
3997         hdev->discovery.type = cp->type;
3998         hdev->discovery.rssi = cp->rssi;
3999         hdev->discovery.uuid_count = uuid_count;
4000
4001         if (uuid_count > 0) {
4002                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4003                                                 GFP_KERNEL);
4004                 if (!hdev->discovery.uuids) {
4005                         err = mgmt_cmd_complete(sk, hdev->id,
4006                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4007                                                 MGMT_STATUS_FAILED,
4008                                                 &cp->type, sizeof(cp->type));
4009                         mgmt_pending_remove(cmd);
4010                         goto failed;
4011                 }
4012         }
4013
4014         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4015         queue_work(hdev->req_workqueue, &hdev->discov_update);
4016         err = 0;
4017
4018 failed:
4019         hci_dev_unlock(hdev);
4020         return err;
4021 }
4022
4023 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4024 {
4025         struct mgmt_pending_cmd *cmd;
4026
4027         BT_DBG("status %d", status);
4028
4029         hci_dev_lock(hdev);
4030
4031         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4032         if (cmd) {
4033                 cmd->cmd_complete(cmd, mgmt_status(status));
4034                 mgmt_pending_remove(cmd);
4035         }
4036
4037         hci_dev_unlock(hdev);
4038 }
4039
4040 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4041                           u16 len)
4042 {
4043         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4044         struct mgmt_pending_cmd *cmd;
4045         int err;
4046
4047         BT_DBG("%s", hdev->name);
4048
4049         hci_dev_lock(hdev);
4050
4051         if (!hci_discovery_active(hdev)) {
4052                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4053                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4054                                         sizeof(mgmt_cp->type));
4055                 goto unlock;
4056         }
4057
4058         if (hdev->discovery.type != mgmt_cp->type) {
4059                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4060                                         MGMT_STATUS_INVALID_PARAMS,
4061                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4062                 goto unlock;
4063         }
4064
4065         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4066         if (!cmd) {
4067                 err = -ENOMEM;
4068                 goto unlock;
4069         }
4070
4071         cmd->cmd_complete = generic_cmd_complete;
4072
4073         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4074         queue_work(hdev->req_workqueue, &hdev->discov_update);
4075         err = 0;
4076
4077 unlock:
4078         hci_dev_unlock(hdev);
4079         return err;
4080 }
4081
4082 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4083                         u16 len)
4084 {
4085         struct mgmt_cp_confirm_name *cp = data;
4086         struct inquiry_entry *e;
4087         int err;
4088
4089         BT_DBG("%s", hdev->name);
4090
4091         hci_dev_lock(hdev);
4092
4093         if (!hci_discovery_active(hdev)) {
4094                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4095                                         MGMT_STATUS_FAILED, &cp->addr,
4096                                         sizeof(cp->addr));
4097                 goto failed;
4098         }
4099
4100         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4101         if (!e) {
4102                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4104                                         sizeof(cp->addr));
4105                 goto failed;
4106         }
4107
4108         if (cp->name_known) {
4109                 e->name_state = NAME_KNOWN;
4110                 list_del(&e->list);
4111         } else {
4112                 e->name_state = NAME_NEEDED;
4113                 hci_inquiry_cache_update_resolve(hdev, e);
4114         }
4115
4116         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4117                                 &cp->addr, sizeof(cp->addr));
4118
4119 failed:
4120         hci_dev_unlock(hdev);
4121         return err;
4122 }
4123
4124 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4125                         u16 len)
4126 {
4127         struct mgmt_cp_block_device *cp = data;
4128         u8 status;
4129         int err;
4130
4131         BT_DBG("%s", hdev->name);
4132
4133         if (!bdaddr_type_is_valid(cp->addr.type))
4134                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4135                                          MGMT_STATUS_INVALID_PARAMS,
4136                                          &cp->addr, sizeof(cp->addr));
4137
4138         hci_dev_lock(hdev);
4139
4140         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4141                                   cp->addr.type);
4142         if (err < 0) {
4143                 status = MGMT_STATUS_FAILED;
4144                 goto done;
4145         }
4146
4147         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4148                    sk);
4149         status = MGMT_STATUS_SUCCESS;
4150
4151 done:
4152         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4153                                 &cp->addr, sizeof(cp->addr));
4154
4155         hci_dev_unlock(hdev);
4156
4157         return err;
4158 }
4159
4160 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4161                           u16 len)
4162 {
4163         struct mgmt_cp_unblock_device *cp = data;
4164         u8 status;
4165         int err;
4166
4167         BT_DBG("%s", hdev->name);
4168
4169         if (!bdaddr_type_is_valid(cp->addr.type))
4170                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4171                                          MGMT_STATUS_INVALID_PARAMS,
4172                                          &cp->addr, sizeof(cp->addr));
4173
4174         hci_dev_lock(hdev);
4175
4176         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4177                                   cp->addr.type);
4178         if (err < 0) {
4179                 status = MGMT_STATUS_INVALID_PARAMS;
4180                 goto done;
4181         }
4182
4183         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4184                    sk);
4185         status = MGMT_STATUS_SUCCESS;
4186
4187 done:
4188         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4189                                 &cp->addr, sizeof(cp->addr));
4190
4191         hci_dev_unlock(hdev);
4192
4193         return err;
4194 }
4195
4196 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4197                          u16 len)
4198 {
4199         struct mgmt_cp_set_device_id *cp = data;
4200         struct hci_request req;
4201         int err;
4202         __u16 source;
4203
4204         BT_DBG("%s", hdev->name);
4205
4206         source = __le16_to_cpu(cp->source);
4207
4208         if (source > 0x0002)
4209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4210                                        MGMT_STATUS_INVALID_PARAMS);
4211
4212         hci_dev_lock(hdev);
4213
4214         hdev->devid_source = source;
4215         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4216         hdev->devid_product = __le16_to_cpu(cp->product);
4217         hdev->devid_version = __le16_to_cpu(cp->version);
4218
4219         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4220                                 NULL, 0);
4221
4222         hci_req_init(&req, hdev);
4223         __hci_req_update_eir(&req);
4224         hci_req_run(&req, NULL);
4225
4226         hci_dev_unlock(hdev);
4227
4228         return err;
4229 }
4230
4231 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4232                                         u16 opcode)
4233 {
4234         BT_DBG("status %d", status);
4235 }
4236
4237 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4238                                      u16 opcode)
4239 {
4240         struct cmd_lookup match = { NULL, hdev };
4241         struct hci_request req;
4242         u8 instance;
4243         struct adv_info *adv_instance;
4244         int err;
4245
4246         hci_dev_lock(hdev);
4247
4248         if (status) {
4249                 u8 mgmt_err = mgmt_status(status);
4250
4251                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4252                                      cmd_status_rsp, &mgmt_err);
4253                 goto unlock;
4254         }
4255
4256         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4257                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4258         else
4259                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4260
4261         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4262                              &match);
4263
4264         new_settings(hdev, match.sk);
4265
4266         if (match.sk)
4267                 sock_put(match.sk);
4268
4269         /* If "Set Advertising" was just disabled and instance advertising was
4270          * set up earlier, then re-enable multi-instance advertising.
4271          */
4272         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4273             list_empty(&hdev->adv_instances))
4274                 goto unlock;
4275
4276         instance = hdev->cur_adv_instance;
4277         if (!instance) {
4278                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4279                                                         struct adv_info, list);
4280                 if (!adv_instance)
4281                         goto unlock;
4282
4283                 instance = adv_instance->instance;
4284         }
4285
4286         hci_req_init(&req, hdev);
4287
4288         err = __hci_req_schedule_adv_instance(&req, instance, true);
4289
4290         if (!err)
4291                 err = hci_req_run(&req, enable_advertising_instance);
4292
4293         if (err)
4294                 bt_dev_err(hdev, "failed to re-configure advertising");
4295
4296 unlock:
4297         hci_dev_unlock(hdev);
4298 }
4299
4300 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4301                            u16 len)
4302 {
4303         struct mgmt_mode *cp = data;
4304         struct mgmt_pending_cmd *cmd;
4305         struct hci_request req;
4306         u8 val, status;
4307         int err;
4308
4309         BT_DBG("request for %s", hdev->name);
4310
4311         status = mgmt_le_support(hdev);
4312         if (status)
4313                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4314                                        status);
4315
4316         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4317                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4318                                        MGMT_STATUS_INVALID_PARAMS);
4319
4320         hci_dev_lock(hdev);
4321
4322         val = !!cp->val;
4323
4324         /* The following conditions are ones which mean that we should
4325          * not do any HCI communication but directly send a mgmt
4326          * response to user space (after toggling the flag if
4327          * necessary).
4328          */
4329         if (!hdev_is_powered(hdev) ||
4330             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4331              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4332             hci_conn_num(hdev, LE_LINK) > 0 ||
4333             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4334              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4335                 bool changed;
4336
4337                 if (cp->val) {
4338                         hdev->cur_adv_instance = 0x00;
4339                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4340                         if (cp->val == 0x02)
4341                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4342                         else
4343                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4344                 } else {
4345                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4346                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347                 }
4348
4349                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4350                 if (err < 0)
4351                         goto unlock;
4352
4353                 if (changed)
4354                         err = new_settings(hdev, sk);
4355
4356                 goto unlock;
4357         }
4358
4359         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4360             pending_find(MGMT_OP_SET_LE, hdev)) {
4361                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4362                                       MGMT_STATUS_BUSY);
4363                 goto unlock;
4364         }
4365
4366         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4367         if (!cmd) {
4368                 err = -ENOMEM;
4369                 goto unlock;
4370         }
4371
4372         hci_req_init(&req, hdev);
4373
4374         if (cp->val == 0x02)
4375                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4376         else
4377                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4378
4379         cancel_adv_timeout(hdev);
4380
4381         if (val) {
4382                 /* Switch to instance "0" for the Set Advertising setting.
4383                  * We cannot use update_[adv|scan_rsp]_data() here as the
4384                  * HCI_ADVERTISING flag is not yet set.
4385                  */
4386                 hdev->cur_adv_instance = 0x00;
4387
4388                 if (ext_adv_capable(hdev)) {
4389                         __hci_req_start_ext_adv(&req, 0x00);
4390                 } else {
4391                         __hci_req_update_adv_data(&req, 0x00);
4392                         __hci_req_update_scan_rsp_data(&req, 0x00);
4393                         __hci_req_enable_advertising(&req);
4394                 }
4395         } else {
4396                 __hci_req_disable_advertising(&req);
4397         }
4398
4399         err = hci_req_run(&req, set_advertising_complete);
4400         if (err < 0)
4401                 mgmt_pending_remove(cmd);
4402
4403 unlock:
4404         hci_dev_unlock(hdev);
4405         return err;
4406 }
4407
4408 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4409                               void *data, u16 len)
4410 {
4411         struct mgmt_cp_set_static_address *cp = data;
4412         int err;
4413
4414         BT_DBG("%s", hdev->name);
4415
4416         if (!lmp_le_capable(hdev))
4417                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4418                                        MGMT_STATUS_NOT_SUPPORTED);
4419
4420         if (hdev_is_powered(hdev))
4421                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4422                                        MGMT_STATUS_REJECTED);
4423
4424         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4425                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4426                         return mgmt_cmd_status(sk, hdev->id,
4427                                                MGMT_OP_SET_STATIC_ADDRESS,
4428                                                MGMT_STATUS_INVALID_PARAMS);
4429
4430                 /* Two most significant bits shall be set */
4431                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4432                         return mgmt_cmd_status(sk, hdev->id,
4433                                                MGMT_OP_SET_STATIC_ADDRESS,
4434                                                MGMT_STATUS_INVALID_PARAMS);
4435         }
4436
4437         hci_dev_lock(hdev);
4438
4439         bacpy(&hdev->static_addr, &cp->bdaddr);
4440
4441         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4442         if (err < 0)
4443                 goto unlock;
4444
4445         err = new_settings(hdev, sk);
4446
4447 unlock:
4448         hci_dev_unlock(hdev);
4449         return err;
4450 }
4451
4452 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4453                            void *data, u16 len)
4454 {
4455         struct mgmt_cp_set_scan_params *cp = data;
4456         __u16 interval, window;
4457         int err;
4458
4459         BT_DBG("%s", hdev->name);
4460
4461         if (!lmp_le_capable(hdev))
4462                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4463                                        MGMT_STATUS_NOT_SUPPORTED);
4464
4465         interval = __le16_to_cpu(cp->interval);
4466
4467         if (interval < 0x0004 || interval > 0x4000)
4468                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4469                                        MGMT_STATUS_INVALID_PARAMS);
4470
4471         window = __le16_to_cpu(cp->window);
4472
4473         if (window < 0x0004 || window > 0x4000)
4474                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4475                                        MGMT_STATUS_INVALID_PARAMS);
4476
4477         if (window > interval)
4478                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4479                                        MGMT_STATUS_INVALID_PARAMS);
4480
4481         hci_dev_lock(hdev);
4482
4483         hdev->le_scan_interval = interval;
4484         hdev->le_scan_window = window;
4485
4486         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4487                                 NULL, 0);
4488
4489         /* If background scan is running, restart it so new parameters are
4490          * loaded.
4491          */
4492         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4493             hdev->discovery.state == DISCOVERY_STOPPED) {
4494                 struct hci_request req;
4495
4496                 hci_req_init(&req, hdev);
4497
4498                 hci_req_add_le_scan_disable(&req);
4499                 hci_req_add_le_passive_scan(&req);
4500
4501                 hci_req_run(&req, NULL);
4502         }
4503
4504         hci_dev_unlock(hdev);
4505
4506         return err;
4507 }
4508
4509 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4510                                       u16 opcode)
4511 {
4512         struct mgmt_pending_cmd *cmd;
4513
4514         BT_DBG("status 0x%02x", status);
4515
4516         hci_dev_lock(hdev);
4517
4518         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4519         if (!cmd)
4520                 goto unlock;
4521
4522         if (status) {
4523                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4524                                 mgmt_status(status));
4525         } else {
4526                 struct mgmt_mode *cp = cmd->param;
4527
4528                 if (cp->val)
4529                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4530                 else
4531                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4532
4533                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4534                 new_settings(hdev, cmd->sk);
4535         }
4536
4537         mgmt_pending_remove(cmd);
4538
4539 unlock:
4540         hci_dev_unlock(hdev);
4541 }
4542
4543 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4544                                 void *data, u16 len)
4545 {
4546         struct mgmt_mode *cp = data;
4547         struct mgmt_pending_cmd *cmd;
4548         struct hci_request req;
4549         int err;
4550
4551         BT_DBG("%s", hdev->name);
4552
4553         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4554             hdev->hci_ver < BLUETOOTH_VER_1_2)
4555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4556                                        MGMT_STATUS_NOT_SUPPORTED);
4557
4558         if (cp->val != 0x00 && cp->val != 0x01)
4559                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560                                        MGMT_STATUS_INVALID_PARAMS);
4561
4562         hci_dev_lock(hdev);
4563
4564         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4566                                       MGMT_STATUS_BUSY);
4567                 goto unlock;
4568         }
4569
4570         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4571                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4572                                         hdev);
4573                 goto unlock;
4574         }
4575
4576         if (!hdev_is_powered(hdev)) {
4577                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4578                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4579                                         hdev);
4580                 new_settings(hdev, sk);
4581                 goto unlock;
4582         }
4583
4584         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4585                                data, len);
4586         if (!cmd) {
4587                 err = -ENOMEM;
4588                 goto unlock;
4589         }
4590
4591         hci_req_init(&req, hdev);
4592
4593         __hci_req_write_fast_connectable(&req, cp->val);
4594
4595         err = hci_req_run(&req, fast_connectable_complete);
4596         if (err < 0) {
4597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4598                                       MGMT_STATUS_FAILED);
4599                 mgmt_pending_remove(cmd);
4600         }
4601
4602 unlock:
4603         hci_dev_unlock(hdev);
4604
4605         return err;
4606 }
4607
4608 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4609 {
4610         struct mgmt_pending_cmd *cmd;
4611
4612         BT_DBG("status 0x%02x", status);
4613
4614         hci_dev_lock(hdev);
4615
4616         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4617         if (!cmd)
4618                 goto unlock;
4619
4620         if (status) {
4621                 u8 mgmt_err = mgmt_status(status);
4622
4623                 /* We need to restore the flag if related HCI commands
4624                  * failed.
4625                  */
4626                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4627
4628                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4629         } else {
4630                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4631                 new_settings(hdev, cmd->sk);
4632         }
4633
4634         mgmt_pending_remove(cmd);
4635
4636 unlock:
4637         hci_dev_unlock(hdev);
4638 }
4639
4640 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4641 {
4642         struct mgmt_mode *cp = data;
4643         struct mgmt_pending_cmd *cmd;
4644         struct hci_request req;
4645         int err;
4646
4647         BT_DBG("request for %s", hdev->name);
4648
4649         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4650                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4651                                        MGMT_STATUS_NOT_SUPPORTED);
4652
4653         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4654                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4655                                        MGMT_STATUS_REJECTED);
4656
4657         if (cp->val != 0x00 && cp->val != 0x01)
4658                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659                                        MGMT_STATUS_INVALID_PARAMS);
4660
4661         hci_dev_lock(hdev);
4662
4663         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4664                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4665                 goto unlock;
4666         }
4667
4668         if (!hdev_is_powered(hdev)) {
4669                 if (!cp->val) {
4670                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4671                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4672                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4673                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4674                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4675                 }
4676
4677                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4678
4679                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4680                 if (err < 0)
4681                         goto unlock;
4682
4683                 err = new_settings(hdev, sk);
4684                 goto unlock;
4685         }
4686
4687         /* Reject disabling when powered on */
4688         if (!cp->val) {
4689                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4690                                       MGMT_STATUS_REJECTED);
4691                 goto unlock;
4692         } else {
4693                 /* When configuring a dual-mode controller to operate
4694                  * with LE only and using a static address, then switching
4695                  * BR/EDR back on is not allowed.
4696                  *
4697                  * Dual-mode controllers shall operate with the public
4698                  * address as its identity address for BR/EDR and LE. So
4699                  * reject the attempt to create an invalid configuration.
4700                  *
4701                  * The same restrictions applies when secure connections
4702                  * has been enabled. For BR/EDR this is a controller feature
4703                  * while for LE it is a host stack feature. This means that
4704                  * switching BR/EDR back on when secure connections has been
4705                  * enabled is not a supported transaction.
4706                  */
4707                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4708                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4709                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4710                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4711                                               MGMT_STATUS_REJECTED);
4712                         goto unlock;
4713                 }
4714         }
4715
4716         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4717                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4718                                       MGMT_STATUS_BUSY);
4719                 goto unlock;
4720         }
4721
4722         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4723         if (!cmd) {
4724                 err = -ENOMEM;
4725                 goto unlock;
4726         }
4727
4728         /* We need to flip the bit already here so that
4729          * hci_req_update_adv_data generates the correct flags.
4730          */
4731         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4732
4733         hci_req_init(&req, hdev);
4734
4735         __hci_req_write_fast_connectable(&req, false);
4736         __hci_req_update_scan(&req);
4737
4738         /* Since only the advertising data flags will change, there
4739          * is no need to update the scan response data.
4740          */
4741         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4742
4743         err = hci_req_run(&req, set_bredr_complete);
4744         if (err < 0)
4745                 mgmt_pending_remove(cmd);
4746
4747 unlock:
4748         hci_dev_unlock(hdev);
4749         return err;
4750 }
4751
4752 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4753 {
4754         struct mgmt_pending_cmd *cmd;
4755         struct mgmt_mode *cp;
4756
4757         BT_DBG("%s status %u", hdev->name, status);
4758
4759         hci_dev_lock(hdev);
4760
4761         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4762         if (!cmd)
4763                 goto unlock;
4764
4765         if (status) {
4766                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4767                                 mgmt_status(status));
4768                 goto remove;
4769         }
4770
4771         cp = cmd->param;
4772
4773         switch (cp->val) {
4774         case 0x00:
4775                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4776                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4777                 break;
4778         case 0x01:
4779                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4780                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4781                 break;
4782         case 0x02:
4783                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4784                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4785                 break;
4786         }
4787
4788         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4789         new_settings(hdev, cmd->sk);
4790
4791 remove:
4792         mgmt_pending_remove(cmd);
4793 unlock:
4794         hci_dev_unlock(hdev);
4795 }
4796
4797 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4798                            void *data, u16 len)
4799 {
4800         struct mgmt_mode *cp = data;
4801         struct mgmt_pending_cmd *cmd;
4802         struct hci_request req;
4803         u8 val;
4804         int err;
4805
4806         BT_DBG("request for %s", hdev->name);
4807
4808         if (!lmp_sc_capable(hdev) &&
4809             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4810                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4811                                        MGMT_STATUS_NOT_SUPPORTED);
4812
4813         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4814             lmp_sc_capable(hdev) &&
4815             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4816                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4817                                        MGMT_STATUS_REJECTED);
4818
4819         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4821                                   MGMT_STATUS_INVALID_PARAMS);
4822
4823         hci_dev_lock(hdev);
4824
4825         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4826             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4827                 bool changed;
4828
4829                 if (cp->val) {
4830                         changed = !hci_dev_test_and_set_flag(hdev,
4831                                                              HCI_SC_ENABLED);
4832                         if (cp->val == 0x02)
4833                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4834                         else
4835                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4836                 } else {
4837                         changed = hci_dev_test_and_clear_flag(hdev,
4838                                                               HCI_SC_ENABLED);
4839                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4840                 }
4841
4842                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4843                 if (err < 0)
4844                         goto failed;
4845
4846                 if (changed)
4847                         err = new_settings(hdev, sk);
4848
4849                 goto failed;
4850         }
4851
4852         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4853                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4854                                       MGMT_STATUS_BUSY);
4855                 goto failed;
4856         }
4857
4858         val = !!cp->val;
4859
4860         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4861             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4862                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4863                 goto failed;
4864         }
4865
4866         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4867         if (!cmd) {
4868                 err = -ENOMEM;
4869                 goto failed;
4870         }
4871
4872         hci_req_init(&req, hdev);
4873         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4874         err = hci_req_run(&req, sc_enable_complete);
4875         if (err < 0) {
4876                 mgmt_pending_remove(cmd);
4877                 goto failed;
4878         }
4879
4880 failed:
4881         hci_dev_unlock(hdev);
4882         return err;
4883 }
4884
4885 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4886                           void *data, u16 len)
4887 {
4888         struct mgmt_mode *cp = data;
4889         bool changed, use_changed;
4890         int err;
4891
4892         BT_DBG("request for %s", hdev->name);
4893
4894         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4895                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4896                                        MGMT_STATUS_INVALID_PARAMS);
4897
4898         hci_dev_lock(hdev);
4899
4900         if (cp->val)
4901                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4902         else
4903                 changed = hci_dev_test_and_clear_flag(hdev,
4904                                                       HCI_KEEP_DEBUG_KEYS);
4905
4906         if (cp->val == 0x02)
4907                 use_changed = !hci_dev_test_and_set_flag(hdev,
4908                                                          HCI_USE_DEBUG_KEYS);
4909         else
4910                 use_changed = hci_dev_test_and_clear_flag(hdev,
4911                                                           HCI_USE_DEBUG_KEYS);
4912
4913         if (hdev_is_powered(hdev) && use_changed &&
4914             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4915                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4916                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4917                              sizeof(mode), &mode);
4918         }
4919
4920         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4921         if (err < 0)
4922                 goto unlock;
4923
4924         if (changed)
4925                 err = new_settings(hdev, sk);
4926
4927 unlock:
4928         hci_dev_unlock(hdev);
4929         return err;
4930 }
4931
4932 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4933                        u16 len)
4934 {
4935         struct mgmt_cp_set_privacy *cp = cp_data;
4936         bool changed;
4937         int err;
4938
4939         BT_DBG("request for %s", hdev->name);
4940
4941         if (!lmp_le_capable(hdev))
4942                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4943                                        MGMT_STATUS_NOT_SUPPORTED);
4944
4945         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4946                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4947                                        MGMT_STATUS_INVALID_PARAMS);
4948
4949         if (hdev_is_powered(hdev))
4950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951                                        MGMT_STATUS_REJECTED);
4952
4953         hci_dev_lock(hdev);
4954
4955         /* If user space supports this command it is also expected to
4956          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4957          */
4958         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4959
4960         if (cp->privacy) {
4961                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4962                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4963                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4964                 hci_adv_instances_set_rpa_expired(hdev, true);
4965                 if (cp->privacy == 0x02)
4966                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4967                 else
4968                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4969         } else {
4970                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4971                 memset(hdev->irk, 0, sizeof(hdev->irk));
4972                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4973                 hci_adv_instances_set_rpa_expired(hdev, false);
4974                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4975         }
4976
4977         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4978         if (err < 0)
4979                 goto unlock;
4980
4981         if (changed)
4982                 err = new_settings(hdev, sk);
4983
4984 unlock:
4985         hci_dev_unlock(hdev);
4986         return err;
4987 }
4988
4989 static bool irk_is_valid(struct mgmt_irk_info *irk)
4990 {
4991         switch (irk->addr.type) {
4992         case BDADDR_LE_PUBLIC:
4993                 return true;
4994
4995         case BDADDR_LE_RANDOM:
4996                 /* Two most significant bits shall be set */
4997                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4998                         return false;
4999                 return true;
5000         }
5001
5002         return false;
5003 }
5004
5005 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5006                      u16 len)
5007 {
5008         struct mgmt_cp_load_irks *cp = cp_data;
5009         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5010                                    sizeof(struct mgmt_irk_info));
5011         u16 irk_count, expected_len;
5012         int i, err;
5013
5014         BT_DBG("request for %s", hdev->name);
5015
5016         if (!lmp_le_capable(hdev))
5017                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5018                                        MGMT_STATUS_NOT_SUPPORTED);
5019
5020         irk_count = __le16_to_cpu(cp->irk_count);
5021         if (irk_count > max_irk_count) {
5022                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5023                            irk_count);
5024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5025                                        MGMT_STATUS_INVALID_PARAMS);
5026         }
5027
5028         expected_len = struct_size(cp, irks, irk_count);
5029         if (expected_len != len) {
5030                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5031                            expected_len, len);
5032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033                                        MGMT_STATUS_INVALID_PARAMS);
5034         }
5035
5036         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5037
5038         for (i = 0; i < irk_count; i++) {
5039                 struct mgmt_irk_info *key = &cp->irks[i];
5040
5041                 if (!irk_is_valid(key))
5042                         return mgmt_cmd_status(sk, hdev->id,
5043                                                MGMT_OP_LOAD_IRKS,
5044                                                MGMT_STATUS_INVALID_PARAMS);
5045         }
5046
5047         hci_dev_lock(hdev);
5048
5049         hci_smp_irks_clear(hdev);
5050
5051         for (i = 0; i < irk_count; i++) {
5052                 struct mgmt_irk_info *irk = &cp->irks[i];
5053
5054                 hci_add_irk(hdev, &irk->addr.bdaddr,
5055                             le_addr_type(irk->addr.type), irk->val,
5056                             BDADDR_ANY);
5057         }
5058
5059         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5060
5061         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5062
5063         hci_dev_unlock(hdev);
5064
5065         return err;
5066 }
5067
5068 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5069 {
5070         if (key->master != 0x00 && key->master != 0x01)
5071                 return false;
5072
5073         switch (key->addr.type) {
5074         case BDADDR_LE_PUBLIC:
5075                 return true;
5076
5077         case BDADDR_LE_RANDOM:
5078                 /* Two most significant bits shall be set */
5079                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5080                         return false;
5081                 return true;
5082         }
5083
5084         return false;
5085 }
5086
5087 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5088                                void *cp_data, u16 len)
5089 {
5090         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5091         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5092                                    sizeof(struct mgmt_ltk_info));
5093         u16 key_count, expected_len;
5094         int i, err;
5095
5096         BT_DBG("request for %s", hdev->name);
5097
5098         if (!lmp_le_capable(hdev))
5099                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5100                                        MGMT_STATUS_NOT_SUPPORTED);
5101
5102         key_count = __le16_to_cpu(cp->key_count);
5103         if (key_count > max_key_count) {
5104                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5105                            key_count);
5106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5107                                        MGMT_STATUS_INVALID_PARAMS);
5108         }
5109
5110         expected_len = struct_size(cp, keys, key_count);
5111         if (expected_len != len) {
5112                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5113                            expected_len, len);
5114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115                                        MGMT_STATUS_INVALID_PARAMS);
5116         }
5117
5118         BT_DBG("%s key_count %u", hdev->name, key_count);
5119
5120         for (i = 0; i < key_count; i++) {
5121                 struct mgmt_ltk_info *key = &cp->keys[i];
5122
5123                 if (!ltk_is_valid(key))
5124                         return mgmt_cmd_status(sk, hdev->id,
5125                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5126                                                MGMT_STATUS_INVALID_PARAMS);
5127         }
5128
5129         hci_dev_lock(hdev);
5130
5131         hci_smp_ltks_clear(hdev);
5132
5133         for (i = 0; i < key_count; i++) {
5134                 struct mgmt_ltk_info *key = &cp->keys[i];
5135                 u8 type, authenticated;
5136
5137                 switch (key->type) {
5138                 case MGMT_LTK_UNAUTHENTICATED:
5139                         authenticated = 0x00;
5140                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5141                         break;
5142                 case MGMT_LTK_AUTHENTICATED:
5143                         authenticated = 0x01;
5144                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5145                         break;
5146                 case MGMT_LTK_P256_UNAUTH:
5147                         authenticated = 0x00;
5148                         type = SMP_LTK_P256;
5149                         break;
5150                 case MGMT_LTK_P256_AUTH:
5151                         authenticated = 0x01;
5152                         type = SMP_LTK_P256;
5153                         break;
5154                 case MGMT_LTK_P256_DEBUG:
5155                         authenticated = 0x00;
5156                         type = SMP_LTK_P256_DEBUG;
5157                         /* fall through */
5158                 default:
5159                         continue;
5160                 }
5161
5162                 hci_add_ltk(hdev, &key->addr.bdaddr,
5163                             le_addr_type(key->addr.type), type, authenticated,
5164                             key->val, key->enc_size, key->ediv, key->rand);
5165         }
5166
5167         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5168                            NULL, 0);
5169
5170         hci_dev_unlock(hdev);
5171
5172         return err;
5173 }
5174
5175 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5176 {
5177         struct hci_conn *conn = cmd->user_data;
5178         struct mgmt_rp_get_conn_info rp;
5179         int err;
5180
5181         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5182
5183         if (status == MGMT_STATUS_SUCCESS) {
5184                 rp.rssi = conn->rssi;
5185                 rp.tx_power = conn->tx_power;
5186                 rp.max_tx_power = conn->max_tx_power;
5187         } else {
5188                 rp.rssi = HCI_RSSI_INVALID;
5189                 rp.tx_power = HCI_TX_POWER_INVALID;
5190                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5191         }
5192
5193         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5194                                 status, &rp, sizeof(rp));
5195
5196         hci_conn_drop(conn);
5197         hci_conn_put(conn);
5198
5199         return err;
5200 }
5201
5202 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5203                                        u16 opcode)
5204 {
5205         struct hci_cp_read_rssi *cp;
5206         struct mgmt_pending_cmd *cmd;
5207         struct hci_conn *conn;
5208         u16 handle;
5209         u8 status;
5210
5211         BT_DBG("status 0x%02x", hci_status);
5212
5213         hci_dev_lock(hdev);
5214
5215         /* Commands sent in request are either Read RSSI or Read Transmit Power
5216          * Level so we check which one was last sent to retrieve connection
5217          * handle.  Both commands have handle as first parameter so it's safe to
5218          * cast data on the same command struct.
5219          *
5220          * First command sent is always Read RSSI and we fail only if it fails.
5221          * In other case we simply override error to indicate success as we
5222          * already remembered if TX power value is actually valid.
5223          */
5224         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5225         if (!cp) {
5226                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5227                 status = MGMT_STATUS_SUCCESS;
5228         } else {
5229                 status = mgmt_status(hci_status);
5230         }
5231
5232         if (!cp) {
5233                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5234                 goto unlock;
5235         }
5236
5237         handle = __le16_to_cpu(cp->handle);
5238         conn = hci_conn_hash_lookup_handle(hdev, handle);
5239         if (!conn) {
5240                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5241                            handle);
5242                 goto unlock;
5243         }
5244
5245         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5246         if (!cmd)
5247                 goto unlock;
5248
5249         cmd->cmd_complete(cmd, status);
5250         mgmt_pending_remove(cmd);
5251
5252 unlock:
5253         hci_dev_unlock(hdev);
5254 }
5255
5256 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5257                          u16 len)
5258 {
5259         struct mgmt_cp_get_conn_info *cp = data;
5260         struct mgmt_rp_get_conn_info rp;
5261         struct hci_conn *conn;
5262         unsigned long conn_info_age;
5263         int err = 0;
5264
5265         BT_DBG("%s", hdev->name);
5266
5267         memset(&rp, 0, sizeof(rp));
5268         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5269         rp.addr.type = cp->addr.type;
5270
5271         if (!bdaddr_type_is_valid(cp->addr.type))
5272                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5273                                          MGMT_STATUS_INVALID_PARAMS,
5274                                          &rp, sizeof(rp));
5275
5276         hci_dev_lock(hdev);
5277
5278         if (!hdev_is_powered(hdev)) {
5279                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5280                                         MGMT_STATUS_NOT_POWERED, &rp,
5281                                         sizeof(rp));
5282                 goto unlock;
5283         }
5284
5285         if (cp->addr.type == BDADDR_BREDR)
5286                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5287                                                &cp->addr.bdaddr);
5288         else
5289                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5290
5291         if (!conn || conn->state != BT_CONNECTED) {
5292                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5293                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5294                                         sizeof(rp));
5295                 goto unlock;
5296         }
5297
5298         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5299                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5300                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5301                 goto unlock;
5302         }
5303
5304         /* To avoid client trying to guess when to poll again for information we
5305          * calculate conn info age as random value between min/max set in hdev.
5306          */
5307         conn_info_age = hdev->conn_info_min_age +
5308                         prandom_u32_max(hdev->conn_info_max_age -
5309                                         hdev->conn_info_min_age);
5310
5311         /* Query controller to refresh cached values if they are too old or were
5312          * never read.
5313          */
5314         if (time_after(jiffies, conn->conn_info_timestamp +
5315                        msecs_to_jiffies(conn_info_age)) ||
5316             !conn->conn_info_timestamp) {
5317                 struct hci_request req;
5318                 struct hci_cp_read_tx_power req_txp_cp;
5319                 struct hci_cp_read_rssi req_rssi_cp;
5320                 struct mgmt_pending_cmd *cmd;
5321
5322                 hci_req_init(&req, hdev);
5323                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5324                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5325                             &req_rssi_cp);
5326
5327                 /* For LE links TX power does not change thus we don't need to
5328                  * query for it once value is known.
5329                  */
5330                 if (!bdaddr_type_is_le(cp->addr.type) ||
5331                     conn->tx_power == HCI_TX_POWER_INVALID) {
5332                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5333                         req_txp_cp.type = 0x00;
5334                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5335                                     sizeof(req_txp_cp), &req_txp_cp);
5336                 }
5337
5338                 /* Max TX power needs to be read only once per connection */
5339                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5340                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5341                         req_txp_cp.type = 0x01;
5342                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5343                                     sizeof(req_txp_cp), &req_txp_cp);
5344                 }
5345
5346                 err = hci_req_run(&req, conn_info_refresh_complete);
5347                 if (err < 0)
5348                         goto unlock;
5349
5350                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5351                                        data, len);
5352                 if (!cmd) {
5353                         err = -ENOMEM;
5354                         goto unlock;
5355                 }
5356
5357                 hci_conn_hold(conn);
5358                 cmd->user_data = hci_conn_get(conn);
5359                 cmd->cmd_complete = conn_info_cmd_complete;
5360
5361                 conn->conn_info_timestamp = jiffies;
5362         } else {
5363                 /* Cache is valid, just reply with values cached in hci_conn */
5364                 rp.rssi = conn->rssi;
5365                 rp.tx_power = conn->tx_power;
5366                 rp.max_tx_power = conn->max_tx_power;
5367
5368                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5369                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5370         }
5371
5372 unlock:
5373         hci_dev_unlock(hdev);
5374         return err;
5375 }
5376
5377 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5378 {
5379         struct hci_conn *conn = cmd->user_data;
5380         struct mgmt_rp_get_clock_info rp;
5381         struct hci_dev *hdev;
5382         int err;
5383
5384         memset(&rp, 0, sizeof(rp));
5385         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5386
5387         if (status)
5388                 goto complete;
5389
5390         hdev = hci_dev_get(cmd->index);
5391         if (hdev) {
5392                 rp.local_clock = cpu_to_le32(hdev->clock);
5393                 hci_dev_put(hdev);
5394         }
5395
5396         if (conn) {
5397                 rp.piconet_clock = cpu_to_le32(conn->clock);
5398                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5399         }
5400
5401 complete:
5402         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5403                                 sizeof(rp));
5404
5405         if (conn) {
5406                 hci_conn_drop(conn);
5407                 hci_conn_put(conn);
5408         }
5409
5410         return err;
5411 }
5412
5413 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5414 {
5415         struct hci_cp_read_clock *hci_cp;
5416         struct mgmt_pending_cmd *cmd;
5417         struct hci_conn *conn;
5418
5419         BT_DBG("%s status %u", hdev->name, status);
5420
5421         hci_dev_lock(hdev);
5422
5423         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5424         if (!hci_cp)
5425                 goto unlock;
5426
5427         if (hci_cp->which) {
5428                 u16 handle = __le16_to_cpu(hci_cp->handle);
5429                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5430         } else {
5431                 conn = NULL;
5432         }
5433
5434         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5435         if (!cmd)
5436                 goto unlock;
5437
5438         cmd->cmd_complete(cmd, mgmt_status(status));
5439         mgmt_pending_remove(cmd);
5440
5441 unlock:
5442         hci_dev_unlock(hdev);
5443 }
5444
5445 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5446                          u16 len)
5447 {
5448         struct mgmt_cp_get_clock_info *cp = data;
5449         struct mgmt_rp_get_clock_info rp;
5450         struct hci_cp_read_clock hci_cp;
5451         struct mgmt_pending_cmd *cmd;
5452         struct hci_request req;
5453         struct hci_conn *conn;
5454         int err;
5455
5456         BT_DBG("%s", hdev->name);
5457
5458         memset(&rp, 0, sizeof(rp));
5459         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5460         rp.addr.type = cp->addr.type;
5461
5462         if (cp->addr.type != BDADDR_BREDR)
5463                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5464                                          MGMT_STATUS_INVALID_PARAMS,
5465                                          &rp, sizeof(rp));
5466
5467         hci_dev_lock(hdev);
5468
5469         if (!hdev_is_powered(hdev)) {
5470                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5471                                         MGMT_STATUS_NOT_POWERED, &rp,
5472                                         sizeof(rp));
5473                 goto unlock;
5474         }
5475
5476         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5477                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5478                                                &cp->addr.bdaddr);
5479                 if (!conn || conn->state != BT_CONNECTED) {
5480                         err = mgmt_cmd_complete(sk, hdev->id,
5481                                                 MGMT_OP_GET_CLOCK_INFO,
5482                                                 MGMT_STATUS_NOT_CONNECTED,
5483                                                 &rp, sizeof(rp));
5484                         goto unlock;
5485                 }
5486         } else {
5487                 conn = NULL;
5488         }
5489
5490         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5491         if (!cmd) {
5492                 err = -ENOMEM;
5493                 goto unlock;
5494         }
5495
5496         cmd->cmd_complete = clock_info_cmd_complete;
5497
5498         hci_req_init(&req, hdev);
5499
5500         memset(&hci_cp, 0, sizeof(hci_cp));
5501         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5502
5503         if (conn) {
5504                 hci_conn_hold(conn);
5505                 cmd->user_data = hci_conn_get(conn);
5506
5507                 hci_cp.handle = cpu_to_le16(conn->handle);
5508                 hci_cp.which = 0x01; /* Piconet clock */
5509                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5510         }
5511
5512         err = hci_req_run(&req, get_clock_info_complete);
5513         if (err < 0)
5514                 mgmt_pending_remove(cmd);
5515
5516 unlock:
5517         hci_dev_unlock(hdev);
5518         return err;
5519 }
5520
5521 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5522 {
5523         struct hci_conn *conn;
5524
5525         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5526         if (!conn)
5527                 return false;
5528
5529         if (conn->dst_type != type)
5530                 return false;
5531
5532         if (conn->state != BT_CONNECTED)
5533                 return false;
5534
5535         return true;
5536 }
5537
5538 /* This function requires the caller holds hdev->lock */
5539 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5540                                u8 addr_type, u8 auto_connect)
5541 {
5542         struct hci_conn_params *params;
5543
5544         params = hci_conn_params_add(hdev, addr, addr_type);
5545         if (!params)
5546                 return -EIO;
5547
5548         if (params->auto_connect == auto_connect)
5549                 return 0;
5550
5551         list_del_init(&params->action);
5552
5553         switch (auto_connect) {
5554         case HCI_AUTO_CONN_DISABLED:
5555         case HCI_AUTO_CONN_LINK_LOSS:
5556                 /* If auto connect is being disabled when we're trying to
5557                  * connect to device, keep connecting.
5558                  */
5559                 if (params->explicit_connect)
5560                         list_add(&params->action, &hdev->pend_le_conns);
5561                 break;
5562         case HCI_AUTO_CONN_REPORT:
5563                 if (params->explicit_connect)
5564                         list_add(&params->action, &hdev->pend_le_conns);
5565                 else
5566                         list_add(&params->action, &hdev->pend_le_reports);
5567                 break;
5568         case HCI_AUTO_CONN_DIRECT:
5569         case HCI_AUTO_CONN_ALWAYS:
5570                 if (!is_connected(hdev, addr, addr_type))
5571                         list_add(&params->action, &hdev->pend_le_conns);
5572                 break;
5573         }
5574
5575         params->auto_connect = auto_connect;
5576
5577         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5578                auto_connect);
5579
5580         return 0;
5581 }
5582
5583 static void device_added(struct sock *sk, struct hci_dev *hdev,
5584                          bdaddr_t *bdaddr, u8 type, u8 action)
5585 {
5586         struct mgmt_ev_device_added ev;
5587
5588         bacpy(&ev.addr.bdaddr, bdaddr);
5589         ev.addr.type = type;
5590         ev.action = action;
5591
5592         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5593 }
5594
5595 static int add_device(struct sock *sk, struct hci_dev *hdev,
5596                       void *data, u16 len)
5597 {
5598         struct mgmt_cp_add_device *cp = data;
5599         u8 auto_conn, addr_type;
5600         int err;
5601
5602         BT_DBG("%s", hdev->name);
5603
5604         if (!bdaddr_type_is_valid(cp->addr.type) ||
5605             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5606                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5607                                          MGMT_STATUS_INVALID_PARAMS,
5608                                          &cp->addr, sizeof(cp->addr));
5609
5610         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5611                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5612                                          MGMT_STATUS_INVALID_PARAMS,
5613                                          &cp->addr, sizeof(cp->addr));
5614
5615         hci_dev_lock(hdev);
5616
5617         if (cp->addr.type == BDADDR_BREDR) {
5618                 /* Only incoming connections action is supported for now */
5619                 if (cp->action != 0x01) {
5620                         err = mgmt_cmd_complete(sk, hdev->id,
5621                                                 MGMT_OP_ADD_DEVICE,
5622                                                 MGMT_STATUS_INVALID_PARAMS,
5623                                                 &cp->addr, sizeof(cp->addr));
5624                         goto unlock;
5625                 }
5626
5627                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5628                                           cp->addr.type);
5629                 if (err)
5630                         goto unlock;
5631
5632                 hci_req_update_scan(hdev);
5633
5634                 goto added;
5635         }
5636
5637         addr_type = le_addr_type(cp->addr.type);
5638
5639         if (cp->action == 0x02)
5640                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5641         else if (cp->action == 0x01)
5642                 auto_conn = HCI_AUTO_CONN_DIRECT;
5643         else
5644                 auto_conn = HCI_AUTO_CONN_REPORT;
5645
5646         /* Kernel internally uses conn_params with resolvable private
5647          * address, but Add Device allows only identity addresses.
5648          * Make sure it is enforced before calling
5649          * hci_conn_params_lookup.
5650          */
5651         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5652                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5653                                         MGMT_STATUS_INVALID_PARAMS,
5654                                         &cp->addr, sizeof(cp->addr));
5655                 goto unlock;
5656         }
5657
5658         /* If the connection parameters don't exist for this device,
5659          * they will be created and configured with defaults.
5660          */
5661         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5662                                 auto_conn) < 0) {
5663                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5664                                         MGMT_STATUS_FAILED, &cp->addr,
5665                                         sizeof(cp->addr));
5666                 goto unlock;
5667         }
5668
5669         hci_update_background_scan(hdev);
5670
5671 added:
5672         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5673
5674         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5675                                 MGMT_STATUS_SUCCESS, &cp->addr,
5676                                 sizeof(cp->addr));
5677
5678 unlock:
5679         hci_dev_unlock(hdev);
5680         return err;
5681 }
5682
5683 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5684                            bdaddr_t *bdaddr, u8 type)
5685 {
5686         struct mgmt_ev_device_removed ev;
5687
5688         bacpy(&ev.addr.bdaddr, bdaddr);
5689         ev.addr.type = type;
5690
5691         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5692 }
5693
5694 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5695                          void *data, u16 len)
5696 {
5697         struct mgmt_cp_remove_device *cp = data;
5698         int err;
5699
5700         BT_DBG("%s", hdev->name);
5701
5702         hci_dev_lock(hdev);
5703
5704         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5705                 struct hci_conn_params *params;
5706                 u8 addr_type;
5707
5708                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5709                         err = mgmt_cmd_complete(sk, hdev->id,
5710                                                 MGMT_OP_REMOVE_DEVICE,
5711                                                 MGMT_STATUS_INVALID_PARAMS,
5712                                                 &cp->addr, sizeof(cp->addr));
5713                         goto unlock;
5714                 }
5715
5716                 if (cp->addr.type == BDADDR_BREDR) {
5717                         err = hci_bdaddr_list_del(&hdev->whitelist,
5718                                                   &cp->addr.bdaddr,
5719                                                   cp->addr.type);
5720                         if (err) {
5721                                 err = mgmt_cmd_complete(sk, hdev->id,
5722                                                         MGMT_OP_REMOVE_DEVICE,
5723                                                         MGMT_STATUS_INVALID_PARAMS,
5724                                                         &cp->addr,
5725                                                         sizeof(cp->addr));
5726                                 goto unlock;
5727                         }
5728
5729                         hci_req_update_scan(hdev);
5730
5731                         device_removed(sk, hdev, &cp->addr.bdaddr,
5732                                        cp->addr.type);
5733                         goto complete;
5734                 }
5735
5736                 addr_type = le_addr_type(cp->addr.type);
5737
5738                 /* Kernel internally uses conn_params with resolvable private
5739                  * address, but Remove Device allows only identity addresses.
5740                  * Make sure it is enforced before calling
5741                  * hci_conn_params_lookup.
5742                  */
5743                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5744                         err = mgmt_cmd_complete(sk, hdev->id,
5745                                                 MGMT_OP_REMOVE_DEVICE,
5746                                                 MGMT_STATUS_INVALID_PARAMS,
5747                                                 &cp->addr, sizeof(cp->addr));
5748                         goto unlock;
5749                 }
5750
5751                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5752                                                 addr_type);
5753                 if (!params) {
5754                         err = mgmt_cmd_complete(sk, hdev->id,
5755                                                 MGMT_OP_REMOVE_DEVICE,
5756                                                 MGMT_STATUS_INVALID_PARAMS,
5757                                                 &cp->addr, sizeof(cp->addr));
5758                         goto unlock;
5759                 }
5760
5761                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5762                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5763                         err = mgmt_cmd_complete(sk, hdev->id,
5764                                                 MGMT_OP_REMOVE_DEVICE,
5765                                                 MGMT_STATUS_INVALID_PARAMS,
5766                                                 &cp->addr, sizeof(cp->addr));
5767                         goto unlock;
5768                 }
5769
5770                 list_del(&params->action);
5771                 list_del(&params->list);
5772                 kfree(params);
5773                 hci_update_background_scan(hdev);
5774
5775                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5776         } else {
5777                 struct hci_conn_params *p, *tmp;
5778                 struct bdaddr_list *b, *btmp;
5779
5780                 if (cp->addr.type) {
5781                         err = mgmt_cmd_complete(sk, hdev->id,
5782                                                 MGMT_OP_REMOVE_DEVICE,
5783                                                 MGMT_STATUS_INVALID_PARAMS,
5784                                                 &cp->addr, sizeof(cp->addr));
5785                         goto unlock;
5786                 }
5787
5788                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5789                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5790                         list_del(&b->list);
5791                         kfree(b);
5792                 }
5793
5794                 hci_req_update_scan(hdev);
5795
5796                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5797                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5798                                 continue;
5799                         device_removed(sk, hdev, &p->addr, p->addr_type);
5800                         if (p->explicit_connect) {
5801                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5802                                 continue;
5803                         }
5804                         list_del(&p->action);
5805                         list_del(&p->list);
5806                         kfree(p);
5807                 }
5808
5809                 BT_DBG("All LE connection parameters were removed");
5810
5811                 hci_update_background_scan(hdev);
5812         }
5813
5814 complete:
5815         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5816                                 MGMT_STATUS_SUCCESS, &cp->addr,
5817                                 sizeof(cp->addr));
5818 unlock:
5819         hci_dev_unlock(hdev);
5820         return err;
5821 }
5822
5823 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5824                            u16 len)
5825 {
5826         struct mgmt_cp_load_conn_param *cp = data;
5827         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5828                                      sizeof(struct mgmt_conn_param));
5829         u16 param_count, expected_len;
5830         int i;
5831
5832         if (!lmp_le_capable(hdev))
5833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5834                                        MGMT_STATUS_NOT_SUPPORTED);
5835
5836         param_count = __le16_to_cpu(cp->param_count);
5837         if (param_count > max_param_count) {
5838                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5839                            param_count);
5840                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5841                                        MGMT_STATUS_INVALID_PARAMS);
5842         }
5843
5844         expected_len = struct_size(cp, params, param_count);
5845         if (expected_len != len) {
5846                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5847                            expected_len, len);
5848                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5849                                        MGMT_STATUS_INVALID_PARAMS);
5850         }
5851
5852         BT_DBG("%s param_count %u", hdev->name, param_count);
5853
5854         hci_dev_lock(hdev);
5855
5856         hci_conn_params_clear_disabled(hdev);
5857
5858         for (i = 0; i < param_count; i++) {
5859                 struct mgmt_conn_param *param = &cp->params[i];
5860                 struct hci_conn_params *hci_param;
5861                 u16 min, max, latency, timeout;
5862                 u8 addr_type;
5863
5864                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5865                        param->addr.type);
5866
5867                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5868                         addr_type = ADDR_LE_DEV_PUBLIC;
5869                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5870                         addr_type = ADDR_LE_DEV_RANDOM;
5871                 } else {
5872                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5873                         continue;
5874                 }
5875
5876                 min = le16_to_cpu(param->min_interval);
5877                 max = le16_to_cpu(param->max_interval);
5878                 latency = le16_to_cpu(param->latency);
5879                 timeout = le16_to_cpu(param->timeout);
5880
5881                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5882                        min, max, latency, timeout);
5883
5884                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5885                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5886                         continue;
5887                 }
5888
5889                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5890                                                 addr_type);
5891                 if (!hci_param) {
5892                         bt_dev_err(hdev, "failed to add connection parameters");
5893                         continue;
5894                 }
5895
5896                 hci_param->conn_min_interval = min;
5897                 hci_param->conn_max_interval = max;
5898                 hci_param->conn_latency = latency;
5899                 hci_param->supervision_timeout = timeout;
5900         }
5901
5902         hci_dev_unlock(hdev);
5903
5904         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5905                                  NULL, 0);
5906 }
5907
5908 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5909                                void *data, u16 len)
5910 {
5911         struct mgmt_cp_set_external_config *cp = data;
5912         bool changed;
5913         int err;
5914
5915         BT_DBG("%s", hdev->name);
5916
5917         if (hdev_is_powered(hdev))
5918                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5919                                        MGMT_STATUS_REJECTED);
5920
5921         if (cp->config != 0x00 && cp->config != 0x01)
5922                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5923                                          MGMT_STATUS_INVALID_PARAMS);
5924
5925         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5927                                        MGMT_STATUS_NOT_SUPPORTED);
5928
5929         hci_dev_lock(hdev);
5930
5931         if (cp->config)
5932                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5933         else
5934                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5935
5936         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5937         if (err < 0)
5938                 goto unlock;
5939
5940         if (!changed)
5941                 goto unlock;
5942
5943         err = new_options(hdev, sk);
5944
5945         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5946                 mgmt_index_removed(hdev);
5947
5948                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5949                         hci_dev_set_flag(hdev, HCI_CONFIG);
5950                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5951
5952                         queue_work(hdev->req_workqueue, &hdev->power_on);
5953                 } else {
5954                         set_bit(HCI_RAW, &hdev->flags);
5955                         mgmt_index_added(hdev);
5956                 }
5957         }
5958
5959 unlock:
5960         hci_dev_unlock(hdev);
5961         return err;
5962 }
5963
5964 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5965                               void *data, u16 len)
5966 {
5967         struct mgmt_cp_set_public_address *cp = data;
5968         bool changed;
5969         int err;
5970
5971         BT_DBG("%s", hdev->name);
5972
5973         if (hdev_is_powered(hdev))
5974                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5975                                        MGMT_STATUS_REJECTED);
5976
5977         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5979                                        MGMT_STATUS_INVALID_PARAMS);
5980
5981         if (!hdev->set_bdaddr)
5982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5983                                        MGMT_STATUS_NOT_SUPPORTED);
5984
5985         hci_dev_lock(hdev);
5986
5987         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5988         bacpy(&hdev->public_addr, &cp->bdaddr);
5989
5990         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5991         if (err < 0)
5992                 goto unlock;
5993
5994         if (!changed)
5995                 goto unlock;
5996
5997         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5998                 err = new_options(hdev, sk);
5999
6000         if (is_configured(hdev)) {
6001                 mgmt_index_removed(hdev);
6002
6003                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6004
6005                 hci_dev_set_flag(hdev, HCI_CONFIG);
6006                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6007
6008                 queue_work(hdev->req_workqueue, &hdev->power_on);
6009         }
6010
6011 unlock:
6012         hci_dev_unlock(hdev);
6013         return err;
6014 }
6015
6016 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6017                                              u16 opcode, struct sk_buff *skb)
6018 {
6019         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6020         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6021         u8 *h192, *r192, *h256, *r256;
6022         struct mgmt_pending_cmd *cmd;
6023         u16 eir_len;
6024         int err;
6025
6026         BT_DBG("%s status %u", hdev->name, status);
6027
6028         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6029         if (!cmd)
6030                 return;
6031
6032         mgmt_cp = cmd->param;
6033
6034         if (status) {
6035                 status = mgmt_status(status);
6036                 eir_len = 0;
6037
6038                 h192 = NULL;
6039                 r192 = NULL;
6040                 h256 = NULL;
6041                 r256 = NULL;
6042         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6043                 struct hci_rp_read_local_oob_data *rp;
6044
6045                 if (skb->len != sizeof(*rp)) {
6046                         status = MGMT_STATUS_FAILED;
6047                         eir_len = 0;
6048                 } else {
6049                         status = MGMT_STATUS_SUCCESS;
6050                         rp = (void *)skb->data;
6051
6052                         eir_len = 5 + 18 + 18;
6053                         h192 = rp->hash;
6054                         r192 = rp->rand;
6055                         h256 = NULL;
6056                         r256 = NULL;
6057                 }
6058         } else {
6059                 struct hci_rp_read_local_oob_ext_data *rp;
6060
6061                 if (skb->len != sizeof(*rp)) {
6062                         status = MGMT_STATUS_FAILED;
6063                         eir_len = 0;
6064                 } else {
6065                         status = MGMT_STATUS_SUCCESS;
6066                         rp = (void *)skb->data;
6067
6068                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6069                                 eir_len = 5 + 18 + 18;
6070                                 h192 = NULL;
6071                                 r192 = NULL;
6072                         } else {
6073                                 eir_len = 5 + 18 + 18 + 18 + 18;
6074                                 h192 = rp->hash192;
6075                                 r192 = rp->rand192;
6076                         }
6077
6078                         h256 = rp->hash256;
6079                         r256 = rp->rand256;
6080                 }
6081         }
6082
6083         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6084         if (!mgmt_rp)
6085                 goto done;
6086
6087         if (status)
6088                 goto send_rsp;
6089
6090         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6091                                   hdev->dev_class, 3);
6092
6093         if (h192 && r192) {
6094                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6095                                           EIR_SSP_HASH_C192, h192, 16);
6096                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6097                                           EIR_SSP_RAND_R192, r192, 16);
6098         }
6099
6100         if (h256 && r256) {
6101                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6102                                           EIR_SSP_HASH_C256, h256, 16);
6103                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6104                                           EIR_SSP_RAND_R256, r256, 16);
6105         }
6106
6107 send_rsp:
6108         mgmt_rp->type = mgmt_cp->type;
6109         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6110
6111         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6112                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6113                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6114         if (err < 0 || status)
6115                 goto done;
6116
6117         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6118
6119         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6120                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6121                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6122 done:
6123         kfree(mgmt_rp);
6124         mgmt_pending_remove(cmd);
6125 }
6126
6127 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6128                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6129 {
6130         struct mgmt_pending_cmd *cmd;
6131         struct hci_request req;
6132         int err;
6133
6134         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6135                                cp, sizeof(*cp));
6136         if (!cmd)
6137                 return -ENOMEM;
6138
6139         hci_req_init(&req, hdev);
6140
6141         if (bredr_sc_enabled(hdev))
6142                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6143         else
6144                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6145
6146         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6147         if (err < 0) {
6148                 mgmt_pending_remove(cmd);
6149                 return err;
6150         }
6151
6152         return 0;
6153 }
6154
6155 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6156                                    void *data, u16 data_len)
6157 {
6158         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6159         struct mgmt_rp_read_local_oob_ext_data *rp;
6160         size_t rp_len;
6161         u16 eir_len;
6162         u8 status, flags, role, addr[7], hash[16], rand[16];
6163         int err;
6164
6165         BT_DBG("%s", hdev->name);
6166
6167         if (hdev_is_powered(hdev)) {
6168                 switch (cp->type) {
6169                 case BIT(BDADDR_BREDR):
6170                         status = mgmt_bredr_support(hdev);
6171                         if (status)
6172                                 eir_len = 0;
6173                         else
6174                                 eir_len = 5;
6175                         break;
6176                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6177                         status = mgmt_le_support(hdev);
6178                         if (status)
6179                                 eir_len = 0;
6180                         else
6181                                 eir_len = 9 + 3 + 18 + 18 + 3;
6182                         break;
6183                 default:
6184                         status = MGMT_STATUS_INVALID_PARAMS;
6185                         eir_len = 0;
6186                         break;
6187                 }
6188         } else {
6189                 status = MGMT_STATUS_NOT_POWERED;
6190                 eir_len = 0;
6191         }
6192
6193         rp_len = sizeof(*rp) + eir_len;
6194         rp = kmalloc(rp_len, GFP_ATOMIC);
6195         if (!rp)
6196                 return -ENOMEM;
6197
6198         if (status)
6199                 goto complete;
6200
6201         hci_dev_lock(hdev);
6202
6203         eir_len = 0;
6204         switch (cp->type) {
6205         case BIT(BDADDR_BREDR):
6206                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6207                         err = read_local_ssp_oob_req(hdev, sk, cp);
6208                         hci_dev_unlock(hdev);
6209                         if (!err)
6210                                 goto done;
6211
6212                         status = MGMT_STATUS_FAILED;
6213                         goto complete;
6214                 } else {
6215                         eir_len = eir_append_data(rp->eir, eir_len,
6216                                                   EIR_CLASS_OF_DEV,
6217                                                   hdev->dev_class, 3);
6218                 }
6219                 break;
6220         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6221                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6222                     smp_generate_oob(hdev, hash, rand) < 0) {
6223                         hci_dev_unlock(hdev);
6224                         status = MGMT_STATUS_FAILED;
6225                         goto complete;
6226                 }
6227
6228                 /* This should return the active RPA, but since the RPA
6229                  * is only programmed on demand, it is really hard to fill
6230                  * this in at the moment. For now disallow retrieving
6231                  * local out-of-band data when privacy is in use.
6232                  *
6233                  * Returning the identity address will not help here since
6234                  * pairing happens before the identity resolving key is
6235                  * known and thus the connection establishment happens
6236                  * based on the RPA and not the identity address.
6237                  */
6238                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6239                         hci_dev_unlock(hdev);
6240                         status = MGMT_STATUS_REJECTED;
6241                         goto complete;
6242                 }
6243
6244                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6245                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6246                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6247                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6248                         memcpy(addr, &hdev->static_addr, 6);
6249                         addr[6] = 0x01;
6250                 } else {
6251                         memcpy(addr, &hdev->bdaddr, 6);
6252                         addr[6] = 0x00;
6253                 }
6254
6255                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6256                                           addr, sizeof(addr));
6257
6258                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6259                         role = 0x02;
6260                 else
6261                         role = 0x01;
6262
6263                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6264                                           &role, sizeof(role));
6265
6266                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6267                         eir_len = eir_append_data(rp->eir, eir_len,
6268                                                   EIR_LE_SC_CONFIRM,
6269                                                   hash, sizeof(hash));
6270
6271                         eir_len = eir_append_data(rp->eir, eir_len,
6272                                                   EIR_LE_SC_RANDOM,
6273                                                   rand, sizeof(rand));
6274                 }
6275
6276                 flags = mgmt_get_adv_discov_flags(hdev);
6277
6278                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6279                         flags |= LE_AD_NO_BREDR;
6280
6281                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6282                                           &flags, sizeof(flags));
6283                 break;
6284         }
6285
6286         hci_dev_unlock(hdev);
6287
6288         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6289
6290         status = MGMT_STATUS_SUCCESS;
6291
6292 complete:
6293         rp->type = cp->type;
6294         rp->eir_len = cpu_to_le16(eir_len);
6295
6296         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6297                                 status, rp, sizeof(*rp) + eir_len);
6298         if (err < 0 || status)
6299                 goto done;
6300
6301         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6302                                  rp, sizeof(*rp) + eir_len,
6303                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6304
6305 done:
6306         kfree(rp);
6307
6308         return err;
6309 }
6310
6311 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6312 {
6313         u32 flags = 0;
6314
6315         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6316         flags |= MGMT_ADV_FLAG_DISCOV;
6317         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6318         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6319         flags |= MGMT_ADV_FLAG_APPEARANCE;
6320         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6321
6322         /* In extended adv TX_POWER returned from Set Adv Param
6323          * will be always valid.
6324          */
6325         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6326             ext_adv_capable(hdev))
6327                 flags |= MGMT_ADV_FLAG_TX_POWER;
6328
6329         if (ext_adv_capable(hdev)) {
6330                 flags |= MGMT_ADV_FLAG_SEC_1M;
6331
6332                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6333                         flags |= MGMT_ADV_FLAG_SEC_2M;
6334
6335                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6336                         flags |= MGMT_ADV_FLAG_SEC_CODED;
6337         }
6338
6339         return flags;
6340 }
6341
6342 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6343                              void *data, u16 data_len)
6344 {
6345         struct mgmt_rp_read_adv_features *rp;
6346         size_t rp_len;
6347         int err;
6348         struct adv_info *adv_instance;
6349         u32 supported_flags;
6350         u8 *instance;
6351
6352         BT_DBG("%s", hdev->name);
6353
6354         if (!lmp_le_capable(hdev))
6355                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6356                                        MGMT_STATUS_REJECTED);
6357
6358         hci_dev_lock(hdev);
6359
6360         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6361         rp = kmalloc(rp_len, GFP_ATOMIC);
6362         if (!rp) {
6363                 hci_dev_unlock(hdev);
6364                 return -ENOMEM;
6365         }
6366
6367         supported_flags = get_supported_adv_flags(hdev);
6368
6369         rp->supported_flags = cpu_to_le32(supported_flags);
6370         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6371         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6372         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6373         rp->num_instances = hdev->adv_instance_cnt;
6374
6375         instance = rp->instance;
6376         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6377                 *instance = adv_instance->instance;
6378                 instance++;
6379         }
6380
6381         hci_dev_unlock(hdev);
6382
6383         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6384                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6385
6386         kfree(rp);
6387
6388         return err;
6389 }
6390
6391 static u8 calculate_name_len(struct hci_dev *hdev)
6392 {
6393         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6394
6395         return append_local_name(hdev, buf, 0);
6396 }
6397
6398 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6399                            bool is_adv_data)
6400 {
6401         u8 max_len = HCI_MAX_AD_LENGTH;
6402
6403         if (is_adv_data) {
6404                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6405                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6406                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6407                         max_len -= 3;
6408
6409                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6410                         max_len -= 3;
6411         } else {
6412                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6413                         max_len -= calculate_name_len(hdev);
6414
6415                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6416                         max_len -= 4;
6417         }
6418
6419         return max_len;
6420 }
6421
6422 static bool flags_managed(u32 adv_flags)
6423 {
6424         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6425                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6426                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6427 }
6428
6429 static bool tx_power_managed(u32 adv_flags)
6430 {
6431         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6432 }
6433
6434 static bool name_managed(u32 adv_flags)
6435 {
6436         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6437 }
6438
6439 static bool appearance_managed(u32 adv_flags)
6440 {
6441         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6442 }
6443
6444 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6445                               u8 len, bool is_adv_data)
6446 {
6447         int i, cur_len;
6448         u8 max_len;
6449
6450         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6451
6452         if (len > max_len)
6453                 return false;
6454
6455         /* Make sure that the data is correctly formatted. */
6456         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6457                 cur_len = data[i];
6458
6459                 if (data[i + 1] == EIR_FLAGS &&
6460                     (!is_adv_data || flags_managed(adv_flags)))
6461                         return false;
6462
6463                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6464                         return false;
6465
6466                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6467                         return false;
6468
6469                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6470                         return false;
6471
6472                 if (data[i + 1] == EIR_APPEARANCE &&
6473                     appearance_managed(adv_flags))
6474                         return false;
6475
6476                 /* If the current field length would exceed the total data
6477                  * length, then it's invalid.
6478                  */
6479                 if (i + cur_len >= len)
6480                         return false;
6481         }
6482
6483         return true;
6484 }
6485
6486 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6487                                      u16 opcode)
6488 {
6489         struct mgmt_pending_cmd *cmd;
6490         struct mgmt_cp_add_advertising *cp;
6491         struct mgmt_rp_add_advertising rp;
6492         struct adv_info *adv_instance, *n;
6493         u8 instance;
6494
6495         BT_DBG("status %d", status);
6496
6497         hci_dev_lock(hdev);
6498
6499         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6500
6501         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6502                 if (!adv_instance->pending)
6503                         continue;
6504
6505                 if (!status) {
6506                         adv_instance->pending = false;
6507                         continue;
6508                 }
6509
6510                 instance = adv_instance->instance;
6511
6512                 if (hdev->cur_adv_instance == instance)
6513                         cancel_adv_timeout(hdev);
6514
6515                 hci_remove_adv_instance(hdev, instance);
6516                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6517         }
6518
6519         if (!cmd)
6520                 goto unlock;
6521
6522         cp = cmd->param;
6523         rp.instance = cp->instance;
6524
6525         if (status)
6526                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6527                                 mgmt_status(status));
6528         else
6529                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6530                                   mgmt_status(status), &rp, sizeof(rp));
6531
6532         mgmt_pending_remove(cmd);
6533
6534 unlock:
6535         hci_dev_unlock(hdev);
6536 }
6537
6538 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6539                            void *data, u16 data_len)
6540 {
6541         struct mgmt_cp_add_advertising *cp = data;
6542         struct mgmt_rp_add_advertising rp;
6543         u32 flags;
6544         u32 supported_flags, phy_flags;
6545         u8 status;
6546         u16 timeout, duration;
6547         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6548         u8 schedule_instance = 0;
6549         struct adv_info *next_instance;
6550         int err;
6551         struct mgmt_pending_cmd *cmd;
6552         struct hci_request req;
6553
6554         BT_DBG("%s", hdev->name);
6555
6556         status = mgmt_le_support(hdev);
6557         if (status)
6558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6559                                        status);
6560
6561         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6562                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6563                                        MGMT_STATUS_INVALID_PARAMS);
6564
6565         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6567                                        MGMT_STATUS_INVALID_PARAMS);
6568
6569         flags = __le32_to_cpu(cp->flags);
6570         timeout = __le16_to_cpu(cp->timeout);
6571         duration = __le16_to_cpu(cp->duration);
6572
6573         /* The current implementation only supports a subset of the specified
6574          * flags. Also need to check mutual exclusiveness of sec flags.
6575          */
6576         supported_flags = get_supported_adv_flags(hdev);
6577         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6578         if (flags & ~supported_flags ||
6579             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6581                                        MGMT_STATUS_INVALID_PARAMS);
6582
6583         hci_dev_lock(hdev);
6584
6585         if (timeout && !hdev_is_powered(hdev)) {
6586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6587                                       MGMT_STATUS_REJECTED);
6588                 goto unlock;
6589         }
6590
6591         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6592             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6593             pending_find(MGMT_OP_SET_LE, hdev)) {
6594                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6595                                       MGMT_STATUS_BUSY);
6596                 goto unlock;
6597         }
6598
6599         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6600             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6601                                cp->scan_rsp_len, false)) {
6602                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6603                                       MGMT_STATUS_INVALID_PARAMS);
6604                 goto unlock;
6605         }
6606
6607         err = hci_add_adv_instance(hdev, cp->instance, flags,
6608                                    cp->adv_data_len, cp->data,
6609                                    cp->scan_rsp_len,
6610                                    cp->data + cp->adv_data_len,
6611                                    timeout, duration);
6612         if (err < 0) {
6613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6614                                       MGMT_STATUS_FAILED);
6615                 goto unlock;
6616         }
6617
6618         /* Only trigger an advertising added event if a new instance was
6619          * actually added.
6620          */
6621         if (hdev->adv_instance_cnt > prev_instance_cnt)
6622                 mgmt_advertising_added(sk, hdev, cp->instance);
6623
6624         if (hdev->cur_adv_instance == cp->instance) {
6625                 /* If the currently advertised instance is being changed then
6626                  * cancel the current advertising and schedule the next
6627                  * instance. If there is only one instance then the overridden
6628                  * advertising data will be visible right away.
6629                  */
6630                 cancel_adv_timeout(hdev);
6631
6632                 next_instance = hci_get_next_instance(hdev, cp->instance);
6633                 if (next_instance)
6634                         schedule_instance = next_instance->instance;
6635         } else if (!hdev->adv_instance_timeout) {
6636                 /* Immediately advertise the new instance if no other
6637                  * instance is currently being advertised.
6638                  */
6639                 schedule_instance = cp->instance;
6640         }
6641
6642         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6643          * there is no instance to be advertised then we have no HCI
6644          * communication to make. Simply return.
6645          */
6646         if (!hdev_is_powered(hdev) ||
6647             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6648             !schedule_instance) {
6649                 rp.instance = cp->instance;
6650                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6651                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6652                 goto unlock;
6653         }
6654
6655         /* We're good to go, update advertising data, parameters, and start
6656          * advertising.
6657          */
6658         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6659                                data_len);
6660         if (!cmd) {
6661                 err = -ENOMEM;
6662                 goto unlock;
6663         }
6664
6665         hci_req_init(&req, hdev);
6666
6667         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6668
6669         if (!err)
6670                 err = hci_req_run(&req, add_advertising_complete);
6671
6672         if (err < 0)
6673                 mgmt_pending_remove(cmd);
6674
6675 unlock:
6676         hci_dev_unlock(hdev);
6677
6678         return err;
6679 }
6680
6681 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6682                                         u16 opcode)
6683 {
6684         struct mgmt_pending_cmd *cmd;
6685         struct mgmt_cp_remove_advertising *cp;
6686         struct mgmt_rp_remove_advertising rp;
6687
6688         BT_DBG("status %d", status);
6689
6690         hci_dev_lock(hdev);
6691
6692         /* A failure status here only means that we failed to disable
6693          * advertising. Otherwise, the advertising instance has been removed,
6694          * so report success.
6695          */
6696         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6697         if (!cmd)
6698                 goto unlock;
6699
6700         cp = cmd->param;
6701         rp.instance = cp->instance;
6702
6703         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6704                           &rp, sizeof(rp));
6705         mgmt_pending_remove(cmd);
6706
6707 unlock:
6708         hci_dev_unlock(hdev);
6709 }
6710
6711 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6712                               void *data, u16 data_len)
6713 {
6714         struct mgmt_cp_remove_advertising *cp = data;
6715         struct mgmt_rp_remove_advertising rp;
6716         struct mgmt_pending_cmd *cmd;
6717         struct hci_request req;
6718         int err;
6719
6720         BT_DBG("%s", hdev->name);
6721
6722         hci_dev_lock(hdev);
6723
6724         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6725                 err = mgmt_cmd_status(sk, hdev->id,
6726                                       MGMT_OP_REMOVE_ADVERTISING,
6727                                       MGMT_STATUS_INVALID_PARAMS);
6728                 goto unlock;
6729         }
6730
6731         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6732             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6733             pending_find(MGMT_OP_SET_LE, hdev)) {
6734                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6735                                       MGMT_STATUS_BUSY);
6736                 goto unlock;
6737         }
6738
6739         if (list_empty(&hdev->adv_instances)) {
6740                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6741                                       MGMT_STATUS_INVALID_PARAMS);
6742                 goto unlock;
6743         }
6744
6745         hci_req_init(&req, hdev);
6746
6747         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6748
6749         if (list_empty(&hdev->adv_instances))
6750                 __hci_req_disable_advertising(&req);
6751
6752         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6753          * flag is set or the device isn't powered then we have no HCI
6754          * communication to make. Simply return.
6755          */
6756         if (skb_queue_empty(&req.cmd_q) ||
6757             !hdev_is_powered(hdev) ||
6758             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6759                 hci_req_purge(&req);
6760                 rp.instance = cp->instance;
6761                 err = mgmt_cmd_complete(sk, hdev->id,
6762                                         MGMT_OP_REMOVE_ADVERTISING,
6763                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6764                 goto unlock;
6765         }
6766
6767         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6768                                data_len);
6769         if (!cmd) {
6770                 err = -ENOMEM;
6771                 goto unlock;
6772         }
6773
6774         err = hci_req_run(&req, remove_advertising_complete);
6775         if (err < 0)
6776                 mgmt_pending_remove(cmd);
6777
6778 unlock:
6779         hci_dev_unlock(hdev);
6780
6781         return err;
6782 }
6783
6784 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6785                              void *data, u16 data_len)
6786 {
6787         struct mgmt_cp_get_adv_size_info *cp = data;
6788         struct mgmt_rp_get_adv_size_info rp;
6789         u32 flags, supported_flags;
6790         int err;
6791
6792         BT_DBG("%s", hdev->name);
6793
6794         if (!lmp_le_capable(hdev))
6795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6796                                        MGMT_STATUS_REJECTED);
6797
6798         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6799                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6800                                        MGMT_STATUS_INVALID_PARAMS);
6801
6802         flags = __le32_to_cpu(cp->flags);
6803
6804         /* The current implementation only supports a subset of the specified
6805          * flags.
6806          */
6807         supported_flags = get_supported_adv_flags(hdev);
6808         if (flags & ~supported_flags)
6809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6810                                        MGMT_STATUS_INVALID_PARAMS);
6811
6812         rp.instance = cp->instance;
6813         rp.flags = cp->flags;
6814         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6815         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6816
6817         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6818                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6819
6820         return err;
6821 }
6822
6823 static const struct hci_mgmt_handler mgmt_handlers[] = {
6824         { NULL }, /* 0x0000 (no command) */
6825         { read_version,            MGMT_READ_VERSION_SIZE,
6826                                                 HCI_MGMT_NO_HDEV |
6827                                                 HCI_MGMT_UNTRUSTED },
6828         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6829                                                 HCI_MGMT_NO_HDEV |
6830                                                 HCI_MGMT_UNTRUSTED },
6831         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6832                                                 HCI_MGMT_NO_HDEV |
6833                                                 HCI_MGMT_UNTRUSTED },
6834         { read_controller_info,    MGMT_READ_INFO_SIZE,
6835                                                 HCI_MGMT_UNTRUSTED },
6836         { set_powered,             MGMT_SETTING_SIZE },
6837         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6838         { set_connectable,         MGMT_SETTING_SIZE },
6839         { set_fast_connectable,    MGMT_SETTING_SIZE },
6840         { set_bondable,            MGMT_SETTING_SIZE },
6841         { set_link_security,       MGMT_SETTING_SIZE },
6842         { set_ssp,                 MGMT_SETTING_SIZE },
6843         { set_hs,                  MGMT_SETTING_SIZE },
6844         { set_le,                  MGMT_SETTING_SIZE },
6845         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6846         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6847         { add_uuid,                MGMT_ADD_UUID_SIZE },
6848         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6849         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6850                                                 HCI_MGMT_VAR_LEN },
6851         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6852                                                 HCI_MGMT_VAR_LEN },
6853         { disconnect,              MGMT_DISCONNECT_SIZE },
6854         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6855         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6856         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6857         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6858         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6859         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6860         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6861         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6862         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6863         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6864         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6865         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6866         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6867                                                 HCI_MGMT_VAR_LEN },
6868         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6869         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6870         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6871         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6872         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6873         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6874         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6875         { set_advertising,         MGMT_SETTING_SIZE },
6876         { set_bredr,               MGMT_SETTING_SIZE },
6877         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6878         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6879         { set_secure_conn,         MGMT_SETTING_SIZE },
6880         { set_debug_keys,          MGMT_SETTING_SIZE },
6881         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6882         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6883                                                 HCI_MGMT_VAR_LEN },
6884         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6885         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6886         { add_device,              MGMT_ADD_DEVICE_SIZE },
6887         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6888         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6889                                                 HCI_MGMT_VAR_LEN },
6890         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6891                                                 HCI_MGMT_NO_HDEV |
6892                                                 HCI_MGMT_UNTRUSTED },
6893         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6894                                                 HCI_MGMT_UNCONFIGURED |
6895                                                 HCI_MGMT_UNTRUSTED },
6896         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6897                                                 HCI_MGMT_UNCONFIGURED },
6898         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6899                                                 HCI_MGMT_UNCONFIGURED },
6900         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6901                                                 HCI_MGMT_VAR_LEN },
6902         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6903         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6904                                                 HCI_MGMT_NO_HDEV |
6905                                                 HCI_MGMT_UNTRUSTED },
6906         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6907         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6908                                                 HCI_MGMT_VAR_LEN },
6909         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6910         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6911         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6912         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6913                                                 HCI_MGMT_UNTRUSTED },
6914         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6915         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6916         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6917 };
6918
6919 void mgmt_index_added(struct hci_dev *hdev)
6920 {
6921         struct mgmt_ev_ext_index ev;
6922
6923         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6924                 return;
6925
6926         switch (hdev->dev_type) {
6927         case HCI_PRIMARY:
6928                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6929                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6930                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6931                         ev.type = 0x01;
6932                 } else {
6933                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6934                                          HCI_MGMT_INDEX_EVENTS);
6935                         ev.type = 0x00;
6936                 }
6937                 break;
6938         case HCI_AMP:
6939                 ev.type = 0x02;
6940                 break;
6941         default:
6942                 return;
6943         }
6944
6945         ev.bus = hdev->bus;
6946
6947         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6948                          HCI_MGMT_EXT_INDEX_EVENTS);
6949 }
6950
6951 void mgmt_index_removed(struct hci_dev *hdev)
6952 {
6953         struct mgmt_ev_ext_index ev;
6954         u8 status = MGMT_STATUS_INVALID_INDEX;
6955
6956         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6957                 return;
6958
6959         switch (hdev->dev_type) {
6960         case HCI_PRIMARY:
6961                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6962
6963                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6964                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6965                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6966                         ev.type = 0x01;
6967                 } else {
6968                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6969                                          HCI_MGMT_INDEX_EVENTS);
6970                         ev.type = 0x00;
6971                 }
6972                 break;
6973         case HCI_AMP:
6974                 ev.type = 0x02;
6975                 break;
6976         default:
6977                 return;
6978         }
6979
6980         ev.bus = hdev->bus;
6981
6982         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6983                          HCI_MGMT_EXT_INDEX_EVENTS);
6984 }
6985
6986 /* This function requires the caller holds hdev->lock */
6987 static void restart_le_actions(struct hci_dev *hdev)
6988 {
6989         struct hci_conn_params *p;
6990
6991         list_for_each_entry(p, &hdev->le_conn_params, list) {
6992                 /* Needed for AUTO_OFF case where might not "really"
6993                  * have been powered off.
6994                  */
6995                 list_del_init(&p->action);
6996
6997                 switch (p->auto_connect) {
6998                 case HCI_AUTO_CONN_DIRECT:
6999                 case HCI_AUTO_CONN_ALWAYS:
7000                         list_add(&p->action, &hdev->pend_le_conns);
7001                         break;
7002                 case HCI_AUTO_CONN_REPORT:
7003                         list_add(&p->action, &hdev->pend_le_reports);
7004                         break;
7005                 default:
7006                         break;
7007                 }
7008         }
7009 }
7010
7011 void mgmt_power_on(struct hci_dev *hdev, int err)
7012 {
7013         struct cmd_lookup match = { NULL, hdev };
7014
7015         BT_DBG("err %d", err);
7016
7017         hci_dev_lock(hdev);
7018
7019         if (!err) {
7020                 restart_le_actions(hdev);
7021                 hci_update_background_scan(hdev);
7022         }
7023
7024         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7025
7026         new_settings(hdev, match.sk);
7027
7028         if (match.sk)
7029                 sock_put(match.sk);
7030
7031         hci_dev_unlock(hdev);
7032 }
7033
7034 void __mgmt_power_off(struct hci_dev *hdev)
7035 {
7036         struct cmd_lookup match = { NULL, hdev };
7037         u8 status, zero_cod[] = { 0, 0, 0 };
7038
7039         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7040
7041         /* If the power off is because of hdev unregistration let
7042          * use the appropriate INVALID_INDEX status. Otherwise use
7043          * NOT_POWERED. We cover both scenarios here since later in
7044          * mgmt_index_removed() any hci_conn callbacks will have already
7045          * been triggered, potentially causing misleading DISCONNECTED
7046          * status responses.
7047          */
7048         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7049                 status = MGMT_STATUS_INVALID_INDEX;
7050         else
7051                 status = MGMT_STATUS_NOT_POWERED;
7052
7053         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7054
7055         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7056                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7057                                    zero_cod, sizeof(zero_cod),
7058                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7059                 ext_info_changed(hdev, NULL);
7060         }
7061
7062         new_settings(hdev, match.sk);
7063
7064         if (match.sk)
7065                 sock_put(match.sk);
7066 }
7067
7068 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7069 {
7070         struct mgmt_pending_cmd *cmd;
7071         u8 status;
7072
7073         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7074         if (!cmd)
7075                 return;
7076
7077         if (err == -ERFKILL)
7078                 status = MGMT_STATUS_RFKILLED;
7079         else
7080                 status = MGMT_STATUS_FAILED;
7081
7082         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7083
7084         mgmt_pending_remove(cmd);
7085 }
7086
7087 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7088                        bool persistent)
7089 {
7090         struct mgmt_ev_new_link_key ev;
7091
7092         memset(&ev, 0, sizeof(ev));
7093
7094         ev.store_hint = persistent;
7095         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7096         ev.key.addr.type = BDADDR_BREDR;
7097         ev.key.type = key->type;
7098         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7099         ev.key.pin_len = key->pin_len;
7100
7101         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7102 }
7103
7104 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7105 {
7106         switch (ltk->type) {
7107         case SMP_LTK:
7108         case SMP_LTK_SLAVE:
7109                 if (ltk->authenticated)
7110                         return MGMT_LTK_AUTHENTICATED;
7111                 return MGMT_LTK_UNAUTHENTICATED;
7112         case SMP_LTK_P256:
7113                 if (ltk->authenticated)
7114                         return MGMT_LTK_P256_AUTH;
7115                 return MGMT_LTK_P256_UNAUTH;
7116         case SMP_LTK_P256_DEBUG:
7117                 return MGMT_LTK_P256_DEBUG;
7118         }
7119
7120         return MGMT_LTK_UNAUTHENTICATED;
7121 }
7122
7123 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7124 {
7125         struct mgmt_ev_new_long_term_key ev;
7126
7127         memset(&ev, 0, sizeof(ev));
7128
7129         /* Devices using resolvable or non-resolvable random addresses
7130          * without providing an identity resolving key don't require
7131          * to store long term keys. Their addresses will change the
7132          * next time around.
7133          *
7134          * Only when a remote device provides an identity address
7135          * make sure the long term key is stored. If the remote
7136          * identity is known, the long term keys are internally
7137          * mapped to the identity address. So allow static random
7138          * and public addresses here.
7139          */
7140         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7141             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7142                 ev.store_hint = 0x00;
7143         else
7144                 ev.store_hint = persistent;
7145
7146         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7147         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7148         ev.key.type = mgmt_ltk_type(key);
7149         ev.key.enc_size = key->enc_size;
7150         ev.key.ediv = key->ediv;
7151         ev.key.rand = key->rand;
7152
7153         if (key->type == SMP_LTK)
7154                 ev.key.master = 1;
7155
7156         /* Make sure we copy only the significant bytes based on the
7157          * encryption key size, and set the rest of the value to zeroes.
7158          */
7159         memcpy(ev.key.val, key->val, key->enc_size);
7160         memset(ev.key.val + key->enc_size, 0,
7161                sizeof(ev.key.val) - key->enc_size);
7162
7163         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7164 }
7165
7166 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7167 {
7168         struct mgmt_ev_new_irk ev;
7169
7170         memset(&ev, 0, sizeof(ev));
7171
7172         ev.store_hint = persistent;
7173
7174         bacpy(&ev.rpa, &irk->rpa);
7175         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7176         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7177         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7178
7179         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7180 }
7181
7182 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7183                    bool persistent)
7184 {
7185         struct mgmt_ev_new_csrk ev;
7186
7187         memset(&ev, 0, sizeof(ev));
7188
7189         /* Devices using resolvable or non-resolvable random addresses
7190          * without providing an identity resolving key don't require
7191          * to store signature resolving keys. Their addresses will change
7192          * the next time around.
7193          *
7194          * Only when a remote device provides an identity address
7195          * make sure the signature resolving key is stored. So allow
7196          * static random and public addresses here.
7197          */
7198         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7199             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7200                 ev.store_hint = 0x00;
7201         else
7202                 ev.store_hint = persistent;
7203
7204         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7205         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7206         ev.key.type = csrk->type;
7207         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7208
7209         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7210 }
7211
7212 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7213                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7214                          u16 max_interval, u16 latency, u16 timeout)
7215 {
7216         struct mgmt_ev_new_conn_param ev;
7217
7218         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7219                 return;
7220
7221         memset(&ev, 0, sizeof(ev));
7222         bacpy(&ev.addr.bdaddr, bdaddr);
7223         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7224         ev.store_hint = store_hint;
7225         ev.min_interval = cpu_to_le16(min_interval);
7226         ev.max_interval = cpu_to_le16(max_interval);
7227         ev.latency = cpu_to_le16(latency);
7228         ev.timeout = cpu_to_le16(timeout);
7229
7230         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7231 }
7232
7233 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7234                            u32 flags, u8 *name, u8 name_len)
7235 {
7236         char buf[512];
7237         struct mgmt_ev_device_connected *ev = (void *) buf;
7238         u16 eir_len = 0;
7239
7240         bacpy(&ev->addr.bdaddr, &conn->dst);
7241         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7242
7243         ev->flags = __cpu_to_le32(flags);
7244
7245         /* We must ensure that the EIR Data fields are ordered and
7246          * unique. Keep it simple for now and avoid the problem by not
7247          * adding any BR/EDR data to the LE adv.
7248          */
7249         if (conn->le_adv_data_len > 0) {
7250                 memcpy(&ev->eir[eir_len],
7251                        conn->le_adv_data, conn->le_adv_data_len);
7252                 eir_len = conn->le_adv_data_len;
7253         } else {
7254                 if (name_len > 0)
7255                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7256                                                   name, name_len);
7257
7258                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7259                         eir_len = eir_append_data(ev->eir, eir_len,
7260                                                   EIR_CLASS_OF_DEV,
7261                                                   conn->dev_class, 3);
7262         }
7263
7264         ev->eir_len = cpu_to_le16(eir_len);
7265
7266         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7267                     sizeof(*ev) + eir_len, NULL);
7268 }
7269
7270 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7271 {
7272         struct sock **sk = data;
7273
7274         cmd->cmd_complete(cmd, 0);
7275
7276         *sk = cmd->sk;
7277         sock_hold(*sk);
7278
7279         mgmt_pending_remove(cmd);
7280 }
7281
7282 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7283 {
7284         struct hci_dev *hdev = data;
7285         struct mgmt_cp_unpair_device *cp = cmd->param;
7286
7287         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7288
7289         cmd->cmd_complete(cmd, 0);
7290         mgmt_pending_remove(cmd);
7291 }
7292
7293 bool mgmt_powering_down(struct hci_dev *hdev)
7294 {
7295         struct mgmt_pending_cmd *cmd;
7296         struct mgmt_mode *cp;
7297
7298         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7299         if (!cmd)
7300                 return false;
7301
7302         cp = cmd->param;
7303         if (!cp->val)
7304                 return true;
7305
7306         return false;
7307 }
7308
7309 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7310                               u8 link_type, u8 addr_type, u8 reason,
7311                               bool mgmt_connected)
7312 {
7313         struct mgmt_ev_device_disconnected ev;
7314         struct sock *sk = NULL;
7315
7316         /* The connection is still in hci_conn_hash so test for 1
7317          * instead of 0 to know if this is the last one.
7318          */
7319         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7320                 cancel_delayed_work(&hdev->power_off);
7321                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7322         }
7323
7324         if (!mgmt_connected)
7325                 return;
7326
7327         if (link_type != ACL_LINK && link_type != LE_LINK)
7328                 return;
7329
7330         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7331
7332         bacpy(&ev.addr.bdaddr, bdaddr);
7333         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7334         ev.reason = reason;
7335
7336         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7337
7338         if (sk)
7339                 sock_put(sk);
7340
7341         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7342                              hdev);
7343 }
7344
7345 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7346                             u8 link_type, u8 addr_type, u8 status)
7347 {
7348         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7349         struct mgmt_cp_disconnect *cp;
7350         struct mgmt_pending_cmd *cmd;
7351
7352         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7353                              hdev);
7354
7355         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7356         if (!cmd)
7357                 return;
7358
7359         cp = cmd->param;
7360
7361         if (bacmp(bdaddr, &cp->addr.bdaddr))
7362                 return;
7363
7364         if (cp->addr.type != bdaddr_type)
7365                 return;
7366
7367         cmd->cmd_complete(cmd, mgmt_status(status));
7368         mgmt_pending_remove(cmd);
7369 }
7370
7371 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7372                          u8 addr_type, u8 status)
7373 {
7374         struct mgmt_ev_connect_failed ev;
7375
7376         /* The connection is still in hci_conn_hash so test for 1
7377          * instead of 0 to know if this is the last one.
7378          */
7379         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7380                 cancel_delayed_work(&hdev->power_off);
7381                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7382         }
7383
7384         bacpy(&ev.addr.bdaddr, bdaddr);
7385         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7386         ev.status = mgmt_status(status);
7387
7388         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7389 }
7390
7391 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7392 {
7393         struct mgmt_ev_pin_code_request ev;
7394
7395         bacpy(&ev.addr.bdaddr, bdaddr);
7396         ev.addr.type = BDADDR_BREDR;
7397         ev.secure = secure;
7398
7399         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7400 }
7401
7402 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7403                                   u8 status)
7404 {
7405         struct mgmt_pending_cmd *cmd;
7406
7407         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7408         if (!cmd)
7409                 return;
7410
7411         cmd->cmd_complete(cmd, mgmt_status(status));
7412         mgmt_pending_remove(cmd);
7413 }
7414
7415 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7416                                       u8 status)
7417 {
7418         struct mgmt_pending_cmd *cmd;
7419
7420         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7421         if (!cmd)
7422                 return;
7423
7424         cmd->cmd_complete(cmd, mgmt_status(status));
7425         mgmt_pending_remove(cmd);
7426 }
7427
7428 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7429                               u8 link_type, u8 addr_type, u32 value,
7430                               u8 confirm_hint)
7431 {
7432         struct mgmt_ev_user_confirm_request ev;
7433
7434         BT_DBG("%s", hdev->name);
7435
7436         bacpy(&ev.addr.bdaddr, bdaddr);
7437         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7438         ev.confirm_hint = confirm_hint;
7439         ev.value = cpu_to_le32(value);
7440
7441         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7442                           NULL);
7443 }
7444
7445 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7446                               u8 link_type, u8 addr_type)
7447 {
7448         struct mgmt_ev_user_passkey_request ev;
7449
7450         BT_DBG("%s", hdev->name);
7451
7452         bacpy(&ev.addr.bdaddr, bdaddr);
7453         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7454
7455         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7456                           NULL);
7457 }
7458
7459 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7460                                       u8 link_type, u8 addr_type, u8 status,
7461                                       u8 opcode)
7462 {
7463         struct mgmt_pending_cmd *cmd;
7464
7465         cmd = pending_find(opcode, hdev);
7466         if (!cmd)
7467                 return -ENOENT;
7468
7469         cmd->cmd_complete(cmd, mgmt_status(status));
7470         mgmt_pending_remove(cmd);
7471
7472         return 0;
7473 }
7474
7475 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7476                                      u8 link_type, u8 addr_type, u8 status)
7477 {
7478         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7479                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7480 }
7481
7482 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7483                                          u8 link_type, u8 addr_type, u8 status)
7484 {
7485         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7486                                           status,
7487                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7488 }
7489
7490 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7491                                      u8 link_type, u8 addr_type, u8 status)
7492 {
7493         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7494                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7495 }
7496
7497 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7498                                          u8 link_type, u8 addr_type, u8 status)
7499 {
7500         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7501                                           status,
7502                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7503 }
7504
7505 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7506                              u8 link_type, u8 addr_type, u32 passkey,
7507                              u8 entered)
7508 {
7509         struct mgmt_ev_passkey_notify ev;
7510
7511         BT_DBG("%s", hdev->name);
7512
7513         bacpy(&ev.addr.bdaddr, bdaddr);
7514         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7515         ev.passkey = __cpu_to_le32(passkey);
7516         ev.entered = entered;
7517
7518         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7519 }
7520
7521 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7522 {
7523         struct mgmt_ev_auth_failed ev;
7524         struct mgmt_pending_cmd *cmd;
7525         u8 status = mgmt_status(hci_status);
7526
7527         bacpy(&ev.addr.bdaddr, &conn->dst);
7528         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7529         ev.status = status;
7530
7531         cmd = find_pairing(conn);
7532
7533         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7534                     cmd ? cmd->sk : NULL);
7535
7536         if (cmd) {
7537                 cmd->cmd_complete(cmd, status);
7538                 mgmt_pending_remove(cmd);
7539         }
7540 }
7541
7542 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7543 {
7544         struct cmd_lookup match = { NULL, hdev };
7545         bool changed;
7546
7547         if (status) {
7548                 u8 mgmt_err = mgmt_status(status);
7549                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7550                                      cmd_status_rsp, &mgmt_err);
7551                 return;
7552         }
7553
7554         if (test_bit(HCI_AUTH, &hdev->flags))
7555                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7556         else
7557                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7558
7559         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7560                              &match);
7561
7562         if (changed)
7563                 new_settings(hdev, match.sk);
7564
7565         if (match.sk)
7566                 sock_put(match.sk);
7567 }
7568
7569 static void clear_eir(struct hci_request *req)
7570 {
7571         struct hci_dev *hdev = req->hdev;
7572         struct hci_cp_write_eir cp;
7573
7574         if (!lmp_ext_inq_capable(hdev))
7575                 return;
7576
7577         memset(hdev->eir, 0, sizeof(hdev->eir));
7578
7579         memset(&cp, 0, sizeof(cp));
7580
7581         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7582 }
7583
7584 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7585 {
7586         struct cmd_lookup match = { NULL, hdev };
7587         struct hci_request req;
7588         bool changed = false;
7589
7590         if (status) {
7591                 u8 mgmt_err = mgmt_status(status);
7592
7593                 if (enable && hci_dev_test_and_clear_flag(hdev,
7594                                                           HCI_SSP_ENABLED)) {
7595                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7596                         new_settings(hdev, NULL);
7597                 }
7598
7599                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7600                                      &mgmt_err);
7601                 return;
7602         }
7603
7604         if (enable) {
7605                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7606         } else {
7607                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7608                 if (!changed)
7609                         changed = hci_dev_test_and_clear_flag(hdev,
7610                                                               HCI_HS_ENABLED);
7611                 else
7612                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7613         }
7614
7615         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7616
7617         if (changed)
7618                 new_settings(hdev, match.sk);
7619
7620         if (match.sk)
7621                 sock_put(match.sk);
7622
7623         hci_req_init(&req, hdev);
7624
7625         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7626                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7627                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7628                                     sizeof(enable), &enable);
7629                 __hci_req_update_eir(&req);
7630         } else {
7631                 clear_eir(&req);
7632         }
7633
7634         hci_req_run(&req, NULL);
7635 }
7636
7637 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7638 {
7639         struct cmd_lookup *match = data;
7640
7641         if (match->sk == NULL) {
7642                 match->sk = cmd->sk;
7643                 sock_hold(match->sk);
7644         }
7645 }
7646
7647 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7648                                     u8 status)
7649 {
7650         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7651
7652         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7653         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7654         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7655
7656         if (!status) {
7657                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7658                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7659                 ext_info_changed(hdev, NULL);
7660         }
7661
7662         if (match.sk)
7663                 sock_put(match.sk);
7664 }
7665
7666 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7667 {
7668         struct mgmt_cp_set_local_name ev;
7669         struct mgmt_pending_cmd *cmd;
7670
7671         if (status)
7672                 return;
7673
7674         memset(&ev, 0, sizeof(ev));
7675         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7676         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7677
7678         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7679         if (!cmd) {
7680                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7681
7682                 /* If this is a HCI command related to powering on the
7683                  * HCI dev don't send any mgmt signals.
7684                  */
7685                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7686                         return;
7687         }
7688
7689         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7690                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7691         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7692 }
7693
7694 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7695 {
7696         int i;
7697
7698         for (i = 0; i < uuid_count; i++) {
7699                 if (!memcmp(uuid, uuids[i], 16))
7700                         return true;
7701         }
7702
7703         return false;
7704 }
7705
7706 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7707 {
7708         u16 parsed = 0;
7709
7710         while (parsed < eir_len) {
7711                 u8 field_len = eir[0];
7712                 u8 uuid[16];
7713                 int i;
7714
7715                 if (field_len == 0)
7716                         break;
7717
7718                 if (eir_len - parsed < field_len + 1)
7719                         break;
7720
7721                 switch (eir[1]) {
7722                 case EIR_UUID16_ALL:
7723                 case EIR_UUID16_SOME:
7724                         for (i = 0; i + 3 <= field_len; i += 2) {
7725                                 memcpy(uuid, bluetooth_base_uuid, 16);
7726                                 uuid[13] = eir[i + 3];
7727                                 uuid[12] = eir[i + 2];
7728                                 if (has_uuid(uuid, uuid_count, uuids))
7729                                         return true;
7730                         }
7731                         break;
7732                 case EIR_UUID32_ALL:
7733                 case EIR_UUID32_SOME:
7734                         for (i = 0; i + 5 <= field_len; i += 4) {
7735                                 memcpy(uuid, bluetooth_base_uuid, 16);
7736                                 uuid[15] = eir[i + 5];
7737                                 uuid[14] = eir[i + 4];
7738                                 uuid[13] = eir[i + 3];
7739                                 uuid[12] = eir[i + 2];
7740                                 if (has_uuid(uuid, uuid_count, uuids))
7741                                         return true;
7742                         }
7743                         break;
7744                 case EIR_UUID128_ALL:
7745                 case EIR_UUID128_SOME:
7746                         for (i = 0; i + 17 <= field_len; i += 16) {
7747                                 memcpy(uuid, eir + i + 2, 16);
7748                                 if (has_uuid(uuid, uuid_count, uuids))
7749                                         return true;
7750                         }
7751                         break;
7752                 }
7753
7754                 parsed += field_len + 1;
7755                 eir += field_len + 1;
7756         }
7757
7758         return false;
7759 }
7760
7761 static void restart_le_scan(struct hci_dev *hdev)
7762 {
7763         /* If controller is not scanning we are done. */
7764         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7765                 return;
7766
7767         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7768                        hdev->discovery.scan_start +
7769                        hdev->discovery.scan_duration))
7770                 return;
7771
7772         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7773                            DISCOV_LE_RESTART_DELAY);
7774 }
7775
7776 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7777                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7778 {
7779         /* If a RSSI threshold has been specified, and
7780          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7781          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7782          * is set, let it through for further processing, as we might need to
7783          * restart the scan.
7784          *
7785          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7786          * the results are also dropped.
7787          */
7788         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7789             (rssi == HCI_RSSI_INVALID ||
7790             (rssi < hdev->discovery.rssi &&
7791              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7792                 return  false;
7793
7794         if (hdev->discovery.uuid_count != 0) {
7795                 /* If a list of UUIDs is provided in filter, results with no
7796                  * matching UUID should be dropped.
7797                  */
7798                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7799                                    hdev->discovery.uuids) &&
7800                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7801                                    hdev->discovery.uuid_count,
7802                                    hdev->discovery.uuids))
7803                         return false;
7804         }
7805
7806         /* If duplicate filtering does not report RSSI changes, then restart
7807          * scanning to ensure updated result with updated RSSI values.
7808          */
7809         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7810                 restart_le_scan(hdev);
7811
7812                 /* Validate RSSI value against the RSSI threshold once more. */
7813                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7814                     rssi < hdev->discovery.rssi)
7815                         return false;
7816         }
7817
7818         return true;
7819 }
7820
7821 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7822                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7823                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7824 {
7825         char buf[512];
7826         struct mgmt_ev_device_found *ev = (void *)buf;
7827         size_t ev_size;
7828
7829         /* Don't send events for a non-kernel initiated discovery. With
7830          * LE one exception is if we have pend_le_reports > 0 in which
7831          * case we're doing passive scanning and want these events.
7832          */
7833         if (!hci_discovery_active(hdev)) {
7834                 if (link_type == ACL_LINK)
7835                         return;
7836                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7837                         return;
7838         }
7839
7840         if (hdev->discovery.result_filtering) {
7841                 /* We are using service discovery */
7842                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7843                                      scan_rsp_len))
7844                         return;
7845         }
7846
7847         if (hdev->discovery.limited) {
7848                 /* Check for limited discoverable bit */
7849                 if (dev_class) {
7850                         if (!(dev_class[1] & 0x20))
7851                                 return;
7852                 } else {
7853                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7854                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7855                                 return;
7856                 }
7857         }
7858
7859         /* Make sure that the buffer is big enough. The 5 extra bytes
7860          * are for the potential CoD field.
7861          */
7862         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7863                 return;
7864
7865         memset(buf, 0, sizeof(buf));
7866
7867         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7868          * RSSI value was reported as 0 when not available. This behavior
7869          * is kept when using device discovery. This is required for full
7870          * backwards compatibility with the API.
7871          *
7872          * However when using service discovery, the value 127 will be
7873          * returned when the RSSI is not available.
7874          */
7875         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7876             link_type == ACL_LINK)
7877                 rssi = 0;
7878
7879         bacpy(&ev->addr.bdaddr, bdaddr);
7880         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7881         ev->rssi = rssi;
7882         ev->flags = cpu_to_le32(flags);
7883
7884         if (eir_len > 0)
7885                 /* Copy EIR or advertising data into event */
7886                 memcpy(ev->eir, eir, eir_len);
7887
7888         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7889                                        NULL))
7890                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7891                                           dev_class, 3);
7892
7893         if (scan_rsp_len > 0)
7894                 /* Append scan response data to event */
7895                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7896
7897         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7898         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7899
7900         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7901 }
7902
7903 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7904                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7905 {
7906         struct mgmt_ev_device_found *ev;
7907         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7908         u16 eir_len;
7909
7910         ev = (struct mgmt_ev_device_found *) buf;
7911
7912         memset(buf, 0, sizeof(buf));
7913
7914         bacpy(&ev->addr.bdaddr, bdaddr);
7915         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7916         ev->rssi = rssi;
7917
7918         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7919                                   name_len);
7920
7921         ev->eir_len = cpu_to_le16(eir_len);
7922
7923         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7924 }
7925
7926 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7927 {
7928         struct mgmt_ev_discovering ev;
7929
7930         BT_DBG("%s discovering %u", hdev->name, discovering);
7931
7932         memset(&ev, 0, sizeof(ev));
7933         ev.type = hdev->discovery.type;
7934         ev.discovering = discovering;
7935
7936         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7937 }
7938
7939 static struct hci_mgmt_chan chan = {
7940         .channel        = HCI_CHANNEL_CONTROL,
7941         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7942         .handlers       = mgmt_handlers,
7943         .hdev_init      = mgmt_init_hdev,
7944 };
7945
7946 int mgmt_init(void)
7947 {
7948         return hci_mgmt_chan_register(&chan);
7949 }
7950
7951 void mgmt_exit(void)
7952 {
7953         hci_mgmt_chan_unregister(&chan);
7954 }