net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   10
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 280                         u16 data_len)
 281 {
 282         struct mgmt_rp_read_version rp;
 283
 284         BT_DBG("sock %p", sk);
 285
 286         rp.version = MGMT_VERSION;
 287         rp.revision = cpu_to_le16(MGMT_REVISION);
 288
 289         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 290                                  &rp, sizeof(rp));
 291 }
 292
 293 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 294                          u16 data_len)
 295 {
 296         struct mgmt_rp_read_commands *rp;
 297         u16 num_commands, num_events;
 298         size_t rp_size;
 299         int i, err;
 300
 301         BT_DBG("sock %p", sk);
 302
 303         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 304                 num_commands = ARRAY_SIZE(mgmt_commands);
 305                 num_events = ARRAY_SIZE(mgmt_events);
 306         } else {
 307                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 308                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 309         }
 310
 311         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 312
 313         rp = kmalloc(rp_size, GFP_KERNEL);
 314         if (!rp)
 315                 return -ENOMEM;
 316
 317         rp->num_commands = cpu_to_le16(num_commands);
 318         rp->num_events = cpu_to_le16(num_events);
 319
 320         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_events[i], opcode);
 328         } else {
 329                 __le16 *opcode = rp->opcodes;
 330
 331                 for (i = 0; i < num_commands; i++, opcode++)
 332                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 333
 334                 for (i = 0; i < num_events; i++, opcode++)
 335                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 336         }
 337
 338         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 339                                 rp, rp_size);
 340         kfree(rp);
 341
 342         return err;
 343 }
 344
 345 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 346                            u16 data_len)
 347 {
 348         struct mgmt_rp_read_index_list *rp;
 349         struct hci_dev *d;
 350         size_t rp_len;
 351         u16 count;
 352         int err;
 353
 354         BT_DBG("sock %p", sk);
 355
 356         read_lock(&hci_dev_list_lock);
 357
 358         count = 0;
 359         list_for_each_entry(d, &hci_dev_list, list) {
 360                 if (d->dev_type == HCI_BREDR &&
 361                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 362                         count++;
 363         }
 364
 365         rp_len = sizeof(*rp) + (2 * count);
 366         rp = kmalloc(rp_len, GFP_ATOMIC);
 367         if (!rp) {
 368                 read_unlock(&hci_dev_list_lock);
 369                 return -ENOMEM;
 370         }
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 375                     hci_dev_test_flag(d, HCI_CONFIG) ||
 376                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 377                         continue;
 378
 379                 /* Devices marked as raw-only are neither configured
 380                  * nor unconfigured controllers.
 381                  */
 382                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 383                         continue;
 384
 385                 if (d->dev_type == HCI_BREDR &&
 386                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 387                         rp->index[count++] = cpu_to_le16(d->id);
 388                         BT_DBG("Added hci%u", d->id);
 389                 }
 390         }
 391
 392         rp->num_controllers = cpu_to_le16(count);
 393         rp_len = sizeof(*rp) + (2 * count);
 394
 395         read_unlock(&hci_dev_list_lock);
 396
 397         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 398                                 0, rp, rp_len);
 399
 400         kfree(rp);
 401
 402         return err;
 403 }
 404
 405 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 406                                   void *data, u16 data_len)
 407 {
 408         struct mgmt_rp_read_unconf_index_list *rp;
 409         struct hci_dev *d;
 410         size_t rp_len;
 411         u16 count;
 412         int err;
 413
 414         BT_DBG("sock %p", sk);
 415
 416         read_lock(&hci_dev_list_lock);
 417
 418         count = 0;
 419         list_for_each_entry(d, &hci_dev_list, list) {
 420                 if (d->dev_type == HCI_BREDR &&
 421                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 422                         count++;
 423         }
 424
 425         rp_len = sizeof(*rp) + (2 * count);
 426         rp = kmalloc(rp_len, GFP_ATOMIC);
 427         if (!rp) {
 428                 read_unlock(&hci_dev_list_lock);
 429                 return -ENOMEM;
 430         }
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 435                     hci_dev_test_flag(d, HCI_CONFIG) ||
 436                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 437                         continue;
 438
 439                 /* Devices marked as raw-only are neither configured
 440                  * nor unconfigured controllers.
 441                  */
 442                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 443                         continue;
 444
 445                 if (d->dev_type == HCI_BREDR &&
 446                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 447                         rp->index[count++] = cpu_to_le16(d->id);
 448                         BT_DBG("Added hci%u", d->id);
 449                 }
 450         }
 451
 452         rp->num_controllers = cpu_to_le16(count);
 453         rp_len = sizeof(*rp) + (2 * count);
 454
 455         read_unlock(&hci_dev_list_lock);
 456
 457         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 458                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 459
 460         kfree(rp);
 461
 462         return err;
 463 }
 464
 465 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 466                                void *data, u16 data_len)
 467 {
 468         struct mgmt_rp_read_ext_index_list *rp;
 469         struct hci_dev *d;
 470         size_t rp_len;
 471         u16 count;
 472         int err;
 473
 474         BT_DBG("sock %p", sk);
 475
 476         read_lock(&hci_dev_list_lock);
 477
 478         count = 0;
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 481                         count++;
 482         }
 483
 484         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 485         rp = kmalloc(rp_len, GFP_ATOMIC);
 486         if (!rp) {
 487                 read_unlock(&hci_dev_list_lock);
 488                 return -ENOMEM;
 489         }
 490
 491         count = 0;
 492         list_for_each_entry(d, &hci_dev_list, list) {
 493                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 494                     hci_dev_test_flag(d, HCI_CONFIG) ||
 495                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 496                         continue;
 497
 498                 /* Devices marked as raw-only are neither configured
 499                  * nor unconfigured controllers.
 500                  */
 501                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 502                         continue;
 503
 504                 if (d->dev_type == HCI_BREDR) {
 505                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 506                                 rp->entry[count].type = 0x01;
 507                         else
 508                                 rp->entry[count].type = 0x00;
 509                 } else if (d->dev_type == HCI_AMP) {
 510                         rp->entry[count].type = 0x02;
 511                 } else {
 512                         continue;
 513                 }
 514
 515                 rp->entry[count].bus = d->bus;
 516                 rp->entry[count++].index = cpu_to_le16(d->id);
 517                 BT_DBG("Added hci%u", d->id);
 518         }
 519
 520         rp->num_controllers = cpu_to_le16(count);
 521         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 522
 523         read_unlock(&hci_dev_list_lock);
 524
 525         /* If this command is called at least once, then all the
 526          * default index and unconfigured index events are disabled
 527          * and from now on only extended index events are used.
 528          */
 529         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 530         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 531         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 532
 533         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 534                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 535
 536         kfree(rp);
 537
 538         return err;
 539 }
 540
 541 static bool is_configured(struct hci_dev *hdev)
 542 {
 543         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 544             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 545                 return false;
 546
 547         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 548             !bacmp(&hdev->public_addr, BDADDR_ANY))
 549                 return false;
 550
 551         return true;
 552 }
 553
 554 static __le32 get_missing_options(struct hci_dev *hdev)
 555 {
 556         u32 options = 0;
 557
 558         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 559             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 560                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 561
 562         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 563             !bacmp(&hdev->public_addr, BDADDR_ANY))
 564                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 565
 566         return cpu_to_le32(options);
 567 }
 568
 569 static int new_options(struct hci_dev *hdev, struct sock *skip)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 574                                   sizeof(options), skip);
 575 }
 576
 577 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 578 {
 579         __le32 options = get_missing_options(hdev);
 580
 581         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 582                                  sizeof(options));
 583 }
 584
 585 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 586                             void *data, u16 data_len)
 587 {
 588         struct mgmt_rp_read_config_info rp;
 589         u32 options = 0;
 590
 591         BT_DBG("sock %p %s", sk, hdev->name);
 592
 593         hci_dev_lock(hdev);
 594
 595         memset(&rp, 0, sizeof(rp));
 596         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 597
 598         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 599                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 600
 601         if (hdev->set_bdaddr)
 602                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 603
 604         rp.supported_options = cpu_to_le32(options);
 605         rp.missing_options = get_missing_options(hdev);
 606
 607         hci_dev_unlock(hdev);
 608
 609         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 610                                  &rp, sizeof(rp));
 611 }
 612
 613 static u32 get_supported_settings(struct hci_dev *hdev)
 614 {
 615         u32 settings = 0;
 616
 617         settings |= MGMT_SETTING_POWERED;
 618         settings |= MGMT_SETTING_BONDABLE;
 619         settings |= MGMT_SETTING_DEBUG_KEYS;
 620         settings |= MGMT_SETTING_CONNECTABLE;
 621         settings |= MGMT_SETTING_DISCOVERABLE;
 622
 623         if (lmp_bredr_capable(hdev)) {
 624                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 625                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 626                 settings |= MGMT_SETTING_BREDR;
 627                 settings |= MGMT_SETTING_LINK_SECURITY;
 628
 629                 if (lmp_ssp_capable(hdev)) {
 630                         settings |= MGMT_SETTING_SSP;
 631                         settings |= MGMT_SETTING_HS;
 632                 }
 633
 634                 if (lmp_sc_capable(hdev))
 635                         settings |= MGMT_SETTING_SECURE_CONN;
 636         }
 637
 638         if (lmp_le_capable(hdev)) {
 639                 settings |= MGMT_SETTING_LE;
 640                 settings |= MGMT_SETTING_ADVERTISING;
 641                 settings |= MGMT_SETTING_SECURE_CONN;
 642                 settings |= MGMT_SETTING_PRIVACY;
 643                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 644         }
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 647             hdev->set_bdaddr)
 648                 settings |= MGMT_SETTING_CONFIGURATION;
 649
 650         return settings;
 651 }
 652
 653 static u32 get_current_settings(struct hci_dev *hdev)
 654 {
 655         u32 settings = 0;
 656
 657         if (hdev_is_powered(hdev))
 658                 settings |= MGMT_SETTING_POWERED;
 659
 660         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 661                 settings |= MGMT_SETTING_CONNECTABLE;
 662
 663         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 664                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 665
 666         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 667                 settings |= MGMT_SETTING_DISCOVERABLE;
 668
 669         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 670                 settings |= MGMT_SETTING_BONDABLE;
 671
 672         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 673                 settings |= MGMT_SETTING_BREDR;
 674
 675         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 676                 settings |= MGMT_SETTING_LE;
 677
 678         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 679                 settings |= MGMT_SETTING_LINK_SECURITY;
 680
 681         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 682                 settings |= MGMT_SETTING_SSP;
 683
 684         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 685                 settings |= MGMT_SETTING_HS;
 686
 687         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 688                 settings |= MGMT_SETTING_ADVERTISING;
 689
 690         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 691                 settings |= MGMT_SETTING_SECURE_CONN;
 692
 693         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 694                 settings |= MGMT_SETTING_DEBUG_KEYS;
 695
 696         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 697                 settings |= MGMT_SETTING_PRIVACY;
 698
 699         /* The current setting for static address has two purposes. The
 700          * first is to indicate if the static address will be used and
 701          * the second is to indicate if it is actually set.
 702          *
 703          * This means if the static address is not configured, this flag
 704          * will never be set. If the address is configured, then if the
 705          * address is actually used decides if the flag is set or not.
 706          *
 707          * For single mode LE only controllers and dual-mode controllers
 708          * with BR/EDR disabled, the existence of the static address will
 709          * be evaluated.
 710          */
 711         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 712             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 713             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 714                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 715                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 716         }
 717
 718         return settings;
 719 }
 720
 721 #define PNP_INFO_SVCLASS_ID             0x1200
 722
 723 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 724 {
 725         u8 *ptr = data, *uuids_start = NULL;
 726         struct bt_uuid *uuid;
 727
 728         if (len < 4)
 729                 return ptr;
 730
 731         list_for_each_entry(uuid, &hdev->uuids, list) {
 732                 u16 uuid16;
 733
 734                 if (uuid->size != 16)
 735                         continue;
 736
 737                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 738                 if (uuid16 < 0x1100)
 739                         continue;
 740
 741                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 742                         continue;
 743
 744                 if (!uuids_start) {
 745                         uuids_start = ptr;
 746                         uuids_start[0] = 1;
 747                         uuids_start[1] = EIR_UUID16_ALL;
 748                         ptr += 2;
 749                 }
 750
 751                 /* Stop if not enough space to put next UUID */
 752                 if ((ptr - data) + sizeof(u16) > len) {
 753                         uuids_start[1] = EIR_UUID16_SOME;
 754                         break;
 755                 }
 756
 757                 *ptr++ = (uuid16 & 0x00ff);
 758                 *ptr++ = (uuid16 & 0xff00) >> 8;
 759                 uuids_start[0] += sizeof(uuid16);
 760         }
 761
 762         return ptr;
 763 }
 764
 765 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 766 {
 767         u8 *ptr = data, *uuids_start = NULL;
 768         struct bt_uuid *uuid;
 769
 770         if (len < 6)
 771                 return ptr;
 772
 773         list_for_each_entry(uuid, &hdev->uuids, list) {
 774                 if (uuid->size != 32)
 775                         continue;
 776
 777                 if (!uuids_start) {
 778                         uuids_start = ptr;
 779                         uuids_start[0] = 1;
 780                         uuids_start[1] = EIR_UUID32_ALL;
 781                         ptr += 2;
 782                 }
 783
 784                 /* Stop if not enough space to put next UUID */
 785                 if ((ptr - data) + sizeof(u32) > len) {
 786                         uuids_start[1] = EIR_UUID32_SOME;
 787                         break;
 788                 }
 789
 790                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 791                 ptr += sizeof(u32);
 792                 uuids_start[0] += sizeof(u32);
 793         }
 794
 795         return ptr;
 796 }
 797
 798 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 799 {
 800         u8 *ptr = data, *uuids_start = NULL;
 801         struct bt_uuid *uuid;
 802
 803         if (len < 18)
 804                 return ptr;
 805
 806         list_for_each_entry(uuid, &hdev->uuids, list) {
 807                 if (uuid->size != 128)
 808                         continue;
 809
 810                 if (!uuids_start) {
 811                         uuids_start = ptr;
 812                         uuids_start[0] = 1;
 813                         uuids_start[1] = EIR_UUID128_ALL;
 814                         ptr += 2;
 815                 }
 816
 817                 /* Stop if not enough space to put next UUID */
 818                 if ((ptr - data) + 16 > len) {
 819                         uuids_start[1] = EIR_UUID128_SOME;
 820                         break;
 821                 }
 822
 823                 memcpy(ptr, uuid->uuid, 16);
 824                 ptr += 16;
 825                 uuids_start[0] += 16;
 826         }
 827
 828         return ptr;
 829 }
 830
 831 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 832 {
 833         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 834 }
 835
 836 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 837                                                   struct hci_dev *hdev,
 838                                                   const void *data)
 839 {
 840         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 841 }
 842
 843 static u8 get_current_adv_instance(struct hci_dev *hdev)
 844 {
 845         /* The "Set Advertising" setting supersedes the "Add Advertising"
 846          * setting. Here we set the advertising data based on which
 847          * setting was set. When neither apply, default to the global settings,
 848          * represented by instance "0".
 849          */
 850         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 851             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 852                 return hdev->cur_adv_instance;
 853
 854         return 0x00;
 855 }
 856
 857 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 858 {
 859         u8 ad_len = 0;
 860         size_t name_len;
 861
 862         name_len = strlen(hdev->dev_name);
 863         if (name_len > 0) {
 864                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 865
 866                 if (name_len > max_len) {
 867                         name_len = max_len;
 868                         ptr[1] = EIR_NAME_SHORT;
 869                 } else
 870                         ptr[1] = EIR_NAME_COMPLETE;
 871
 872                 ptr[0] = name_len + 1;
 873
 874                 memcpy(ptr + 2, hdev->dev_name, name_len);
 875
 876                 ad_len += (name_len + 2);
 877                 ptr += (name_len + 2);
 878         }
 879
 880         return ad_len;
 881 }
 882
 883 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
 884                                         u8 *ptr)
 885 {
 886         struct adv_info *adv_instance;
 887
 888         adv_instance = hci_find_adv_instance(hdev, instance);
 889         if (!adv_instance)
 890                 return 0;
 891
 892         /* TODO: Set the appropriate entries based on advertising instance flags
 893          * here once flags other than 0 are supported.
 894          */
 895         memcpy(ptr, adv_instance->scan_rsp_data,
 896                adv_instance->scan_rsp_len);
 897
 898         return adv_instance->scan_rsp_len;
 899 }
 900
 901 static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         struct hci_cp_le_set_scan_rsp_data cp;
 905         u8 len;
 906
 907         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 908                 return;
 909
 910         memset(&cp, 0, sizeof(cp));
 911
 912         if (instance)
 913                 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
 914         else
 915                 len = create_default_scan_rsp_data(hdev, cp.data);
 916
 917         if (hdev->scan_rsp_data_len == len &&
 918             !memcmp(cp.data, hdev->scan_rsp_data, len))
 919                 return;
 920
 921         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 922         hdev->scan_rsp_data_len = len;
 923
 924         cp.length = len;
 925
 926         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 927 }
 928
 929 static void update_scan_rsp_data(struct hci_request *req)
 930 {
 931         update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
 932 }
 933
 934 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 935 {
 936         struct mgmt_pending_cmd *cmd;
 937
 938         /* If there's a pending mgmt command the flags will not yet have
 939          * their final values, so check for this first.
 940          */
 941         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 942         if (cmd) {
 943                 struct mgmt_mode *cp = cmd->param;
 944                 if (cp->val == 0x01)
 945                         return LE_AD_GENERAL;
 946                 else if (cp->val == 0x02)
 947                         return LE_AD_LIMITED;
 948         } else {
 949                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 950                         return LE_AD_LIMITED;
 951                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 952                         return LE_AD_GENERAL;
 953         }
 954
 955         return 0;
 956 }
 957
 958 static bool get_connectable(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flag will not yet have
 963          * it's final value, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968
 969                 return cp->val;
 970         }
 971
 972         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 973 }
 974
 975 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
 976 {
 977         u32 flags;
 978         struct adv_info *adv_instance;
 979
 980         if (instance == 0x00) {
 981                 /* Instance 0 always manages the "Tx Power" and "Flags"
 982                  * fields
 983                  */
 984                 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
 985
 986                 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
 987                  * corresponds to the "connectable" instance flag.
 988                  */
 989                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
 990                         flags |= MGMT_ADV_FLAG_CONNECTABLE;
 991
 992                 return flags;
 993         }
 994
 995         adv_instance = hci_find_adv_instance(hdev, instance);
 996
 997         /* Return 0 when we got an invalid instance identifier. */
 998         if (!adv_instance)
 999                 return 0;
1000
1001         return adv_instance->flags;
1002 }
1003
1004 static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
1005 {
1006         u8 instance = get_current_adv_instance(hdev);
1007         struct adv_info *adv_instance;
1008
1009         /* Ignore instance 0 */
1010         if (instance == 0x00)
1011                 return 0;
1012
1013         adv_instance = hci_find_adv_instance(hdev, instance);
1014         if (!adv_instance)
1015                 return 0;
1016
1017         /* TODO: Take into account the "appearance" and "local-name" flags here.
1018          * These are currently being ignored as they are not supported.
1019          */
1020         return adv_instance->scan_rsp_len;
1021 }
1022
1023 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1024 {
1025         struct adv_info *adv_instance = NULL;
1026         u8 ad_len = 0, flags = 0;
1027         u32 instance_flags;
1028
1029         /* Return 0 when the current instance identifier is invalid. */
1030         if (instance) {
1031                 adv_instance = hci_find_adv_instance(hdev, instance);
1032                 if (!adv_instance)
1033                         return 0;
1034         }
1035
1036         instance_flags = get_adv_instance_flags(hdev, instance);
1037
1038         /* The Add Advertising command allows userspace to set both the general
1039          * and limited discoverable flags.
1040          */
1041         if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1042                 flags |= LE_AD_GENERAL;
1043
1044         if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1045                 flags |= LE_AD_LIMITED;
1046
1047         if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1048                 /* If a discovery flag wasn't provided, simply use the global
1049                  * settings.
1050                  */
1051                 if (!flags)
1052                         flags |= get_adv_discov_flags(hdev);
1053
1054                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                         flags |= LE_AD_NO_BREDR;
1056
1057                 /* If flags would still be empty, then there is no need to
1058                  * include the "Flags" AD field".
1059                  */
1060                 if (flags) {
1061                         ptr[0] = 0x02;
1062                         ptr[1] = EIR_FLAGS;
1063                         ptr[2] = flags;
1064
1065                         ad_len += 3;
1066                         ptr += 3;
1067                 }
1068         }
1069
1070         if (adv_instance) {
1071                 memcpy(ptr, adv_instance->adv_data,
1072                        adv_instance->adv_data_len);
1073                 ad_len += adv_instance->adv_data_len;
1074                 ptr += adv_instance->adv_data_len;
1075         }
1076
1077         /* Provide Tx Power only if we can provide a valid value for it */
1078         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1079             (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1080                 ptr[0] = 0x02;
1081                 ptr[1] = EIR_TX_POWER;
1082                 ptr[2] = (u8)hdev->adv_tx_power;
1083
1084                 ad_len += 3;
1085                 ptr += 3;
1086         }
1087
1088         return ad_len;
1089 }
1090
1091 static void update_inst_adv_data(struct hci_request *req, u8 instance)
1092 {
1093         struct hci_dev *hdev = req->hdev;
1094         struct hci_cp_le_set_adv_data cp;
1095         u8 len;
1096
1097         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1098                 return;
1099
1100         memset(&cp, 0, sizeof(cp));
1101
1102         len = create_instance_adv_data(hdev, instance, cp.data);
1103
1104         /* There's nothing to do if the data hasn't changed */
1105         if (hdev->adv_data_len == len &&
1106             memcmp(cp.data, hdev->adv_data, len) == 0)
1107                 return;
1108
1109         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1110         hdev->adv_data_len = len;
1111
1112         cp.length = len;
1113
1114         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1115 }
1116
1117 static void update_adv_data(struct hci_request *req)
1118 {
1119         update_inst_adv_data(req, get_current_adv_instance(req->hdev));
1120 }
1121
1122 int mgmt_update_adv_data(struct hci_dev *hdev)
1123 {
1124         struct hci_request req;
1125
1126         hci_req_init(&req, hdev);
1127         update_adv_data(&req);
1128
1129         return hci_req_run(&req, NULL);
1130 }
1131
1132 static void create_eir(struct hci_dev *hdev, u8 *data)
1133 {
1134         u8 *ptr = data;
1135         size_t name_len;
1136
1137         name_len = strlen(hdev->dev_name);
1138
1139         if (name_len > 0) {
1140                 /* EIR Data type */
1141                 if (name_len > 48) {
1142                         name_len = 48;
1143                         ptr[1] = EIR_NAME_SHORT;
1144                 } else
1145                         ptr[1] = EIR_NAME_COMPLETE;
1146
1147                 /* EIR Data length */
1148                 ptr[0] = name_len + 1;
1149
1150                 memcpy(ptr + 2, hdev->dev_name, name_len);
1151
1152                 ptr += (name_len + 2);
1153         }
1154
1155         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1156                 ptr[0] = 2;
1157                 ptr[1] = EIR_TX_POWER;
1158                 ptr[2] = (u8) hdev->inq_tx_power;
1159
1160                 ptr += 3;
1161         }
1162
1163         if (hdev->devid_source > 0) {
1164                 ptr[0] = 9;
1165                 ptr[1] = EIR_DEVICE_ID;
1166
1167                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1168                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1169                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1170                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1171
1172                 ptr += 10;
1173         }
1174
1175         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1176         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1177         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1178 }
1179
1180 static void update_eir(struct hci_request *req)
1181 {
1182         struct hci_dev *hdev = req->hdev;
1183         struct hci_cp_write_eir cp;
1184
1185         if (!hdev_is_powered(hdev))
1186                 return;
1187
1188         if (!lmp_ext_inq_capable(hdev))
1189                 return;
1190
1191         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1192                 return;
1193
1194         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1195                 return;
1196
1197         memset(&cp, 0, sizeof(cp));
1198
1199         create_eir(hdev, cp.data);
1200
1201         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1202                 return;
1203
1204         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1205
1206         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1207 }
1208
1209 static u8 get_service_classes(struct hci_dev *hdev)
1210 {
1211         struct bt_uuid *uuid;
1212         u8 val = 0;
1213
1214         list_for_each_entry(uuid, &hdev->uuids, list)
1215                 val |= uuid->svc_hint;
1216
1217         return val;
1218 }
1219
1220 static void update_class(struct hci_request *req)
1221 {
1222         struct hci_dev *hdev = req->hdev;
1223         u8 cod[3];
1224
1225         BT_DBG("%s", hdev->name);
1226
1227         if (!hdev_is_powered(hdev))
1228                 return;
1229
1230         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1231                 return;
1232
1233         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1234                 return;
1235
1236         cod[0] = hdev->minor_class;
1237         cod[1] = hdev->major_class;
1238         cod[2] = get_service_classes(hdev);
1239
1240         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1241                 cod[1] |= 0x20;
1242
1243         if (memcmp(cod, hdev->dev_class, 3) == 0)
1244                 return;
1245
1246         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1247 }
1248
1249 static void disable_advertising(struct hci_request *req)
1250 {
1251         u8 enable = 0x00;
1252
1253         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1254 }
1255
1256 static void enable_advertising(struct hci_request *req)
1257 {
1258         struct hci_dev *hdev = req->hdev;
1259         struct hci_cp_le_set_adv_param cp;
1260         u8 own_addr_type, enable = 0x01;
1261         bool connectable;
1262         u8 instance;
1263         u32 flags;
1264
1265         if (hci_conn_num(hdev, LE_LINK) > 0)
1266                 return;
1267
1268         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1269                 disable_advertising(req);
1270
1271         /* Clear the HCI_LE_ADV bit temporarily so that the
1272          * hci_update_random_address knows that it's safe to go ahead
1273          * and write a new random address. The flag will be set back on
1274          * as soon as the SET_ADV_ENABLE HCI command completes.
1275          */
1276         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1277
1278         instance = get_current_adv_instance(hdev);
1279         flags = get_adv_instance_flags(hdev, instance);
1280
1281         /* If the "connectable" instance flag was not set, then choose between
1282          * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1283          */
1284         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1285                       get_connectable(hdev);
1286
1287         /* Set require_privacy to true only when non-connectable
1288          * advertising is used. In that case it is fine to use a
1289          * non-resolvable private address.
1290          */
1291         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1292                 return;
1293
1294         memset(&cp, 0, sizeof(cp));
1295         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1296         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1297
1298         if (connectable)
1299                 cp.type = LE_ADV_IND;
1300         else if (get_cur_adv_instance_scan_rsp_len(hdev))
1301                 cp.type = LE_ADV_SCAN_IND;
1302         else
1303                 cp.type = LE_ADV_NONCONN_IND;
1304
1305         cp.own_address_type = own_addr_type;
1306         cp.channel_map = hdev->le_adv_channel_map;
1307
1308         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1309
1310         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1311 }
1312
1313 static void service_cache_off(struct work_struct *work)
1314 {
1315         struct hci_dev *hdev = container_of(work, struct hci_dev,
1316                                             service_cache.work);
1317         struct hci_request req;
1318
1319         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1320                 return;
1321
1322         hci_req_init(&req, hdev);
1323
1324         hci_dev_lock(hdev);
1325
1326         update_eir(&req);
1327         update_class(&req);
1328
1329         hci_dev_unlock(hdev);
1330
1331         hci_req_run(&req, NULL);
1332 }
1333
1334 static void rpa_expired(struct work_struct *work)
1335 {
1336         struct hci_dev *hdev = container_of(work, struct hci_dev,
1337                                             rpa_expired.work);
1338         struct hci_request req;
1339
1340         BT_DBG("");
1341
1342         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1343
1344         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1345                 return;
1346
1347         /* The generation of a new RPA and programming it into the
1348          * controller happens in the enable_advertising() function.
1349          */
1350         hci_req_init(&req, hdev);
1351         enable_advertising(&req);
1352         hci_req_run(&req, NULL);
1353 }
1354
1355 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1356 {
1357         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1358                 return;
1359
1360         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1361         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1362
1363         /* Non-mgmt controlled devices get this bit set
1364          * implicitly so that pairing works for them, however
1365          * for mgmt we require user-space to explicitly enable
1366          * it
1367          */
1368         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1369 }
1370
1371 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1372                                 void *data, u16 data_len)
1373 {
1374         struct mgmt_rp_read_info rp;
1375
1376         BT_DBG("sock %p %s", sk, hdev->name);
1377
1378         hci_dev_lock(hdev);
1379
1380         memset(&rp, 0, sizeof(rp));
1381
1382         bacpy(&rp.bdaddr, &hdev->bdaddr);
1383
1384         rp.version = hdev->hci_ver;
1385         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1386
1387         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1388         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1389
1390         memcpy(rp.dev_class, hdev->dev_class, 3);
1391
1392         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1393         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1394
1395         hci_dev_unlock(hdev);
1396
1397         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1398                                  sizeof(rp));
1399 }
1400
1401 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1402 {
1403         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1404
1405         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1406                                  sizeof(settings));
1407 }
1408
1409 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1410 {
1411         BT_DBG("%s status 0x%02x", hdev->name, status);
1412
1413         if (hci_conn_count(hdev) == 0) {
1414                 cancel_delayed_work(&hdev->power_off);
1415                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1416         }
1417 }
1418
1419 static bool hci_stop_discovery(struct hci_request *req)
1420 {
1421         struct hci_dev *hdev = req->hdev;
1422         struct hci_cp_remote_name_req_cancel cp;
1423         struct inquiry_entry *e;
1424
1425         switch (hdev->discovery.state) {
1426         case DISCOVERY_FINDING:
1427                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1428                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1429
1430                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1431                         cancel_delayed_work(&hdev->le_scan_disable);
1432                         hci_req_add_le_scan_disable(req);
1433                 }
1434
1435                 return true;
1436
1437         case DISCOVERY_RESOLVING:
1438                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1439                                                      NAME_PENDING);
1440                 if (!e)
1441                         break;
1442
1443                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1444                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1445                             &cp);
1446
1447                 return true;
1448
1449         default:
1450                 /* Passive scanning */
1451                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1452                         hci_req_add_le_scan_disable(req);
1453                         return true;
1454                 }
1455
1456                 break;
1457         }
1458
1459         return false;
1460 }
1461
1462 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1463                               u8 instance)
1464 {
1465         struct mgmt_ev_advertising_added ev;
1466
1467         ev.instance = instance;
1468
1469         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1470 }
1471
1472 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1473                                 u8 instance)
1474 {
1475         struct mgmt_ev_advertising_removed ev;
1476
1477         ev.instance = instance;
1478
1479         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1480 }
1481
1482 static int schedule_adv_instance(struct hci_request *req, u8 instance,
1483                                  bool force) {
1484         struct hci_dev *hdev = req->hdev;
1485         struct adv_info *adv_instance = NULL;
1486         u16 timeout;
1487
1488         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1489             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1490                 return -EPERM;
1491
1492         if (hdev->adv_instance_timeout)
1493                 return -EBUSY;
1494
1495         adv_instance = hci_find_adv_instance(hdev, instance);
1496         if (!adv_instance)
1497                 return -ENOENT;
1498
1499         /* A zero timeout means unlimited advertising. As long as there is
1500          * only one instance, duration should be ignored. We still set a timeout
1501          * in case further instances are being added later on.
1502          *
1503          * If the remaining lifetime of the instance is more than the duration
1504          * then the timeout corresponds to the duration, otherwise it will be
1505          * reduced to the remaining instance lifetime.
1506          */
1507         if (adv_instance->timeout == 0 ||
1508             adv_instance->duration <= adv_instance->remaining_time)
1509                 timeout = adv_instance->duration;
1510         else
1511                 timeout = adv_instance->remaining_time;
1512
1513         /* The remaining time is being reduced unless the instance is being
1514          * advertised without time limit.
1515          */
1516         if (adv_instance->timeout)
1517                 adv_instance->remaining_time =
1518                                 adv_instance->remaining_time - timeout;
1519
1520         hdev->adv_instance_timeout = timeout;
1521         queue_delayed_work(hdev->workqueue,
1522                            &hdev->adv_instance_expire,
1523                            msecs_to_jiffies(timeout * 1000));
1524
1525         /* If we're just re-scheduling the same instance again then do not
1526          * execute any HCI commands. This happens when a single instance is
1527          * being advertised.
1528          */
1529         if (!force && hdev->cur_adv_instance == instance &&
1530             hci_dev_test_flag(hdev, HCI_LE_ADV))
1531                 return 0;
1532
1533         hdev->cur_adv_instance = instance;
1534         update_adv_data(req);
1535         update_scan_rsp_data(req);
1536         enable_advertising(req);
1537
1538         return 0;
1539 }
1540
1541 static void cancel_adv_timeout(struct hci_dev *hdev)
1542 {
1543         if (hdev->adv_instance_timeout) {
1544                 hdev->adv_instance_timeout = 0;
1545                 cancel_delayed_work(&hdev->adv_instance_expire);
1546         }
1547 }
1548
1549 /* For a single instance:
1550  * - force == true: The instance will be removed even when its remaining
1551  *   lifetime is not zero.
1552  * - force == false: the instance will be deactivated but kept stored unless
1553  *   the remaining lifetime is zero.
1554  *
1555  * For instance == 0x00:
1556  * - force == true: All instances will be removed regardless of their timeout
1557  *   setting.
1558  * - force == false: Only instances that have a timeout will be removed.
1559  */
1560 static void clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1561                                u8 instance, bool force)
1562 {
1563         struct adv_info *adv_instance, *n, *next_instance = NULL;
1564         int err;
1565         u8 rem_inst;
1566
1567         /* Cancel any timeout concerning the removed instance(s). */
1568         if (!instance || hdev->cur_adv_instance == instance)
1569                 cancel_adv_timeout(hdev);
1570
1571         /* Get the next instance to advertise BEFORE we remove
1572          * the current one. This can be the same instance again
1573          * if there is only one instance.
1574          */
1575         if (instance && hdev->cur_adv_instance == instance)
1576                 next_instance = hci_get_next_instance(hdev, instance);
1577
1578         if (instance == 0x00) {
1579                 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1580                                          list) {
1581                         if (!(force || adv_instance->timeout))
1582                                 continue;
1583
1584                         rem_inst = adv_instance->instance;
1585                         err = hci_remove_adv_instance(hdev, rem_inst);
1586                         if (!err)
1587                                 advertising_removed(NULL, hdev, rem_inst);
1588                 }
1589                 hdev->cur_adv_instance = 0x00;
1590         } else {
1591                 adv_instance = hci_find_adv_instance(hdev, instance);
1592
1593                 if (force || (adv_instance && adv_instance->timeout &&
1594                               !adv_instance->remaining_time)) {
1595                         /* Don't advertise a removed instance. */
1596                         if (next_instance &&
1597                             next_instance->instance == instance)
1598                                 next_instance = NULL;
1599
1600                         err = hci_remove_adv_instance(hdev, instance);
1601                         if (!err)
1602                                 advertising_removed(NULL, hdev, instance);
1603                 }
1604         }
1605
1606         if (list_empty(&hdev->adv_instances)) {
1607                 hdev->cur_adv_instance = 0x00;
1608                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1609         }
1610
1611         if (!req || !hdev_is_powered(hdev) ||
1612             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1613                 return;
1614
1615         if (next_instance)
1616                 schedule_adv_instance(req, next_instance->instance, false);
1617 }
1618
1619 static int clean_up_hci_state(struct hci_dev *hdev)
1620 {
1621         struct hci_request req;
1622         struct hci_conn *conn;
1623         bool discov_stopped;
1624         int err;
1625
1626         hci_req_init(&req, hdev);
1627
1628         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1629             test_bit(HCI_PSCAN, &hdev->flags)) {
1630                 u8 scan = 0x00;
1631                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1632         }
1633
1634         clear_adv_instance(hdev, NULL, 0x00, false);
1635
1636         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1637                 disable_advertising(&req);
1638
1639         discov_stopped = hci_stop_discovery(&req);
1640
1641         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1642                 struct hci_cp_disconnect dc;
1643                 struct hci_cp_reject_conn_req rej;
1644
1645                 switch (conn->state) {
1646                 case BT_CONNECTED:
1647                 case BT_CONFIG:
1648                         dc.handle = cpu_to_le16(conn->handle);
1649                         dc.reason = 0x15; /* Terminated due to Power Off */
1650                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1651                         break;
1652                 case BT_CONNECT:
1653                         if (conn->type == LE_LINK)
1654                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1655                                             0, NULL);
1656                         else if (conn->type == ACL_LINK)
1657                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1658                                             6, &conn->dst);
1659                         break;
1660                 case BT_CONNECT2:
1661                         bacpy(&rej.bdaddr, &conn->dst);
1662                         rej.reason = 0x15; /* Terminated due to Power Off */
1663                         if (conn->type == ACL_LINK)
1664                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1665                                             sizeof(rej), &rej);
1666                         else if (conn->type == SCO_LINK)
1667                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1668                                             sizeof(rej), &rej);
1669                         break;
1670                 }
1671         }
1672
1673         err = hci_req_run(&req, clean_up_hci_complete);
1674         if (!err && discov_stopped)
1675                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1676
1677         return err;
1678 }
1679
1680 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1681                        u16 len)
1682 {
1683         struct mgmt_mode *cp = data;
1684         struct mgmt_pending_cmd *cmd;
1685         int err;
1686
1687         BT_DBG("request for %s", hdev->name);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1696                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1697                                       MGMT_STATUS_BUSY);
1698                 goto failed;
1699         }
1700
1701         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1702                 cancel_delayed_work(&hdev->power_off);
1703
1704                 if (cp->val) {
1705                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1706                                          data, len);
1707                         err = mgmt_powered(hdev, 1);
1708                         goto failed;
1709                 }
1710         }
1711
1712         if (!!cp->val == hdev_is_powered(hdev)) {
1713                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1714                 goto failed;
1715         }
1716
1717         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1718         if (!cmd) {
1719                 err = -ENOMEM;
1720                 goto failed;
1721         }
1722
1723         if (cp->val) {
1724                 queue_work(hdev->req_workqueue, &hdev->power_on);
1725                 err = 0;
1726         } else {
1727                 /* Disconnect connections, stop scans, etc */
1728                 err = clean_up_hci_state(hdev);
1729                 if (!err)
1730                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1731                                            HCI_POWER_OFF_TIMEOUT);
1732
1733                 /* ENODATA means there were no HCI commands queued */
1734                 if (err == -ENODATA) {
1735                         cancel_delayed_work(&hdev->power_off);
1736                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1737                         err = 0;
1738                 }
1739         }
1740
1741 failed:
1742         hci_dev_unlock(hdev);
1743         return err;
1744 }
1745
1746 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1747 {
1748         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1749
1750         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1751                                   sizeof(ev), skip);
1752 }
1753
1754 int mgmt_new_settings(struct hci_dev *hdev)
1755 {
1756         return new_settings(hdev, NULL);
1757 }
1758
1759 struct cmd_lookup {
1760         struct sock *sk;
1761         struct hci_dev *hdev;
1762         u8 mgmt_status;
1763 };
1764
1765 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1766 {
1767         struct cmd_lookup *match = data;
1768
1769         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1770
1771         list_del(&cmd->list);
1772
1773         if (match->sk == NULL) {
1774                 match->sk = cmd->sk;
1775                 sock_hold(match->sk);
1776         }
1777
1778         mgmt_pending_free(cmd);
1779 }
1780
1781 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1782 {
1783         u8 *status = data;
1784
1785         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1786         mgmt_pending_remove(cmd);
1787 }
1788
1789 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1790 {
1791         if (cmd->cmd_complete) {
1792                 u8 *status = data;
1793
1794                 cmd->cmd_complete(cmd, *status);
1795                 mgmt_pending_remove(cmd);
1796
1797                 return;
1798         }
1799
1800         cmd_status_rsp(cmd, data);
1801 }
1802
1803 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1804 {
1805         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1806                                  cmd->param, cmd->param_len);
1807 }
1808
1809 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1810 {
1811         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1812                                  cmd->param, sizeof(struct mgmt_addr_info));
1813 }
1814
1815 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1816 {
1817         if (!lmp_bredr_capable(hdev))
1818                 return MGMT_STATUS_NOT_SUPPORTED;
1819         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1820                 return MGMT_STATUS_REJECTED;
1821         else
1822                 return MGMT_STATUS_SUCCESS;
1823 }
1824
1825 static u8 mgmt_le_support(struct hci_dev *hdev)
1826 {
1827         if (!lmp_le_capable(hdev))
1828                 return MGMT_STATUS_NOT_SUPPORTED;
1829         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1830                 return MGMT_STATUS_REJECTED;
1831         else
1832                 return MGMT_STATUS_SUCCESS;
1833 }
1834
1835 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1836                                       u16 opcode)
1837 {
1838         struct mgmt_pending_cmd *cmd;
1839         struct mgmt_mode *cp;
1840         struct hci_request req;
1841         bool changed;
1842
1843         BT_DBG("status 0x%02x", status);
1844
1845         hci_dev_lock(hdev);
1846
1847         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1848         if (!cmd)
1849                 goto unlock;
1850
1851         if (status) {
1852                 u8 mgmt_err = mgmt_status(status);
1853                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1854                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1855                 goto remove_cmd;
1856         }
1857
1858         cp = cmd->param;
1859         if (cp->val) {
1860                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1861
1862                 if (hdev->discov_timeout > 0) {
1863                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1864                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1865                                            to);
1866                 }
1867         } else {
1868                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1869         }
1870
1871         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1872
1873         if (changed)
1874                 new_settings(hdev, cmd->sk);
1875
1876         /* When the discoverable mode gets changed, make sure
1877          * that class of device has the limited discoverable
1878          * bit correctly set. Also update page scan based on whitelist
1879          * entries.
1880          */
1881         hci_req_init(&req, hdev);
1882         __hci_update_page_scan(&req);
1883         update_class(&req);
1884         hci_req_run(&req, NULL);
1885
1886 remove_cmd:
1887         mgmt_pending_remove(cmd);
1888
1889 unlock:
1890         hci_dev_unlock(hdev);
1891 }
1892
1893 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1894                             u16 len)
1895 {
1896         struct mgmt_cp_set_discoverable *cp = data;
1897         struct mgmt_pending_cmd *cmd;
1898         struct hci_request req;
1899         u16 timeout;
1900         u8 scan;
1901         int err;
1902
1903         BT_DBG("request for %s", hdev->name);
1904
1905         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1906             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1907                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1908                                        MGMT_STATUS_REJECTED);
1909
1910         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1911                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1912                                        MGMT_STATUS_INVALID_PARAMS);
1913
1914         timeout = __le16_to_cpu(cp->timeout);
1915
1916         /* Disabling discoverable requires that no timeout is set,
1917          * and enabling limited discoverable requires a timeout.
1918          */
1919         if ((cp->val == 0x00 && timeout > 0) ||
1920             (cp->val == 0x02 && timeout == 0))
1921                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1922                                        MGMT_STATUS_INVALID_PARAMS);
1923
1924         hci_dev_lock(hdev);
1925
1926         if (!hdev_is_powered(hdev) && timeout > 0) {
1927                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1928                                       MGMT_STATUS_NOT_POWERED);
1929                 goto failed;
1930         }
1931
1932         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1933             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1934                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1935                                       MGMT_STATUS_BUSY);
1936                 goto failed;
1937         }
1938
1939         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1940                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1941                                       MGMT_STATUS_REJECTED);
1942                 goto failed;
1943         }
1944
1945         if (!hdev_is_powered(hdev)) {
1946                 bool changed = false;
1947
1948                 /* Setting limited discoverable when powered off is
1949                  * not a valid operation since it requires a timeout
1950                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1951                  */
1952                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1953                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1954                         changed = true;
1955                 }
1956
1957                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1958                 if (err < 0)
1959                         goto failed;
1960
1961                 if (changed)
1962                         err = new_settings(hdev, sk);
1963
1964                 goto failed;
1965         }
1966
1967         /* If the current mode is the same, then just update the timeout
1968          * value with the new value. And if only the timeout gets updated,
1969          * then no need for any HCI transactions.
1970          */
1971         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1972             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1973                                                    HCI_LIMITED_DISCOVERABLE)) {
1974                 cancel_delayed_work(&hdev->discov_off);
1975                 hdev->discov_timeout = timeout;
1976
1977                 if (cp->val && hdev->discov_timeout > 0) {
1978                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1979                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1980                                            to);
1981                 }
1982
1983                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1984                 goto failed;
1985         }
1986
1987         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1988         if (!cmd) {
1989                 err = -ENOMEM;
1990                 goto failed;
1991         }
1992
1993         /* Cancel any potential discoverable timeout that might be
1994          * still active and store new timeout value. The arming of
1995          * the timeout happens in the complete handler.
1996          */
1997         cancel_delayed_work(&hdev->discov_off);
1998         hdev->discov_timeout = timeout;
1999
2000         /* Limited discoverable mode */
2001         if (cp->val == 0x02)
2002                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2003         else
2004                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2005
2006         hci_req_init(&req, hdev);
2007
2008         /* The procedure for LE-only controllers is much simpler - just
2009          * update the advertising data.
2010          */
2011         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2012                 goto update_ad;
2013
2014         scan = SCAN_PAGE;
2015
2016         if (cp->val) {
2017                 struct hci_cp_write_current_iac_lap hci_cp;
2018
2019                 if (cp->val == 0x02) {
2020                         /* Limited discoverable mode */
2021                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
2022                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
2023                         hci_cp.iac_lap[1] = 0x8b;
2024                         hci_cp.iac_lap[2] = 0x9e;
2025                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
2026                         hci_cp.iac_lap[4] = 0x8b;
2027                         hci_cp.iac_lap[5] = 0x9e;
2028                 } else {
2029                         /* General discoverable mode */
2030                         hci_cp.num_iac = 1;
2031                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
2032                         hci_cp.iac_lap[1] = 0x8b;
2033                         hci_cp.iac_lap[2] = 0x9e;
2034                 }
2035
2036                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2037                             (hci_cp.num_iac * 3) + 1, &hci_cp);
2038
2039                 scan |= SCAN_INQUIRY;
2040         } else {
2041                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2042         }
2043
2044         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
2045
2046 update_ad:
2047         update_adv_data(&req);
2048
2049         err = hci_req_run(&req, set_discoverable_complete);
2050         if (err < 0)
2051                 mgmt_pending_remove(cmd);
2052
2053 failed:
2054         hci_dev_unlock(hdev);
2055         return err;
2056 }
2057
2058 static void write_fast_connectable(struct hci_request *req, bool enable)
2059 {
2060         struct hci_dev *hdev = req->hdev;
2061         struct hci_cp_write_page_scan_activity acp;
2062         u8 type;
2063
2064         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2065                 return;
2066
2067         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2068                 return;
2069
2070         if (enable) {
2071                 type = PAGE_SCAN_TYPE_INTERLACED;
2072
2073                 /* 160 msec page scan interval */
2074                 acp.interval = cpu_to_le16(0x0100);
2075         } else {
2076                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2077
2078                 /* default 1.28 sec page scan */
2079                 acp.interval = cpu_to_le16(0x0800);
2080         }
2081
2082         acp.window = cpu_to_le16(0x0012);
2083
2084         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2085             __cpu_to_le16(hdev->page_scan_window) != acp.window)
2086                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2087                             sizeof(acp), &acp);
2088
2089         if (hdev->page_scan_type != type)
2090                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2091 }
2092
2093 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2094                                      u16 opcode)
2095 {
2096         struct mgmt_pending_cmd *cmd;
2097         struct mgmt_mode *cp;
2098         bool conn_changed, discov_changed;
2099
2100         BT_DBG("status 0x%02x", status);
2101
2102         hci_dev_lock(hdev);
2103
2104         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2105         if (!cmd)
2106                 goto unlock;
2107
2108         if (status) {
2109                 u8 mgmt_err = mgmt_status(status);
2110                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
2111                 goto remove_cmd;
2112         }
2113
2114         cp = cmd->param;
2115         if (cp->val) {
2116                 conn_changed = !hci_dev_test_and_set_flag(hdev,
2117                                                           HCI_CONNECTABLE);
2118                 discov_changed = false;
2119         } else {
2120                 conn_changed = hci_dev_test_and_clear_flag(hdev,
2121                                                            HCI_CONNECTABLE);
2122                 discov_changed = hci_dev_test_and_clear_flag(hdev,
2123                                                              HCI_DISCOVERABLE);
2124         }
2125
2126         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2127
2128         if (conn_changed || discov_changed) {
2129                 new_settings(hdev, cmd->sk);
2130                 hci_update_page_scan(hdev);
2131                 if (discov_changed)
2132                         mgmt_update_adv_data(hdev);
2133                 hci_update_background_scan(hdev);
2134         }
2135
2136 remove_cmd:
2137         mgmt_pending_remove(cmd);
2138
2139 unlock:
2140         hci_dev_unlock(hdev);
2141 }
2142
2143 static int set_connectable_update_settings(struct hci_dev *hdev,
2144                                            struct sock *sk, u8 val)
2145 {
2146         bool changed = false;
2147         int err;
2148
2149         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
2150                 changed = true;
2151
2152         if (val) {
2153                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
2154         } else {
2155                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2156                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2157         }
2158
2159         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2160         if (err < 0)
2161                 return err;
2162
2163         if (changed) {
2164                 hci_update_page_scan(hdev);
2165                 hci_update_background_scan(hdev);
2166                 return new_settings(hdev, sk);
2167         }
2168
2169         return 0;
2170 }
2171
2172 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2173                            u16 len)
2174 {
2175         struct mgmt_mode *cp = data;
2176         struct mgmt_pending_cmd *cmd;
2177         struct hci_request req;
2178         u8 scan;
2179         int err;
2180
2181         BT_DBG("request for %s", hdev->name);
2182
2183         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2184             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2185                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2186                                        MGMT_STATUS_REJECTED);
2187
2188         if (cp->val != 0x00 && cp->val != 0x01)
2189                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2190                                        MGMT_STATUS_INVALID_PARAMS);
2191
2192         hci_dev_lock(hdev);
2193
2194         if (!hdev_is_powered(hdev)) {
2195                 err = set_connectable_update_settings(hdev, sk, cp->val);
2196                 goto failed;
2197         }
2198
2199         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2200             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2202                                       MGMT_STATUS_BUSY);
2203                 goto failed;
2204         }
2205
2206         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2207         if (!cmd) {
2208                 err = -ENOMEM;
2209                 goto failed;
2210         }
2211
2212         hci_req_init(&req, hdev);
2213
2214         /* If BR/EDR is not enabled and we disable advertising as a
2215          * by-product of disabling connectable, we need to update the
2216          * advertising flags.
2217          */
2218         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2219                 if (!cp->val) {
2220                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2221                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2222                 }
2223                 update_adv_data(&req);
2224         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2225                 if (cp->val) {
2226                         scan = SCAN_PAGE;
2227                 } else {
2228                         /* If we don't have any whitelist entries just
2229                          * disable all scanning. If there are entries
2230                          * and we had both page and inquiry scanning
2231                          * enabled then fall back to only page scanning.
2232                          * Otherwise no changes are needed.
2233                          */
2234                         if (list_empty(&hdev->whitelist))
2235                                 scan = SCAN_DISABLED;
2236                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2237                                 scan = SCAN_PAGE;
2238                         else
2239                                 goto no_scan_update;
2240
2241                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2242                             hdev->discov_timeout > 0)
2243                                 cancel_delayed_work(&hdev->discov_off);
2244                 }
2245
2246                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2247         }
2248
2249 no_scan_update:
2250         /* Update the advertising parameters if necessary */
2251         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2252             hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
2253                 enable_advertising(&req);
2254
2255         err = hci_req_run(&req, set_connectable_complete);
2256         if (err < 0) {
2257                 mgmt_pending_remove(cmd);
2258                 if (err == -ENODATA)
2259                         err = set_connectable_update_settings(hdev, sk,
2260                                                               cp->val);
2261                 goto failed;
2262         }
2263
2264 failed:
2265         hci_dev_unlock(hdev);
2266         return err;
2267 }
2268
2269 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2270                         u16 len)
2271 {
2272         struct mgmt_mode *cp = data;
2273         bool changed;
2274         int err;
2275
2276         BT_DBG("request for %s", hdev->name);
2277
2278         if (cp->val != 0x00 && cp->val != 0x01)
2279                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2280                                        MGMT_STATUS_INVALID_PARAMS);
2281
2282         hci_dev_lock(hdev);
2283
2284         if (cp->val)
2285                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2286         else
2287                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2288
2289         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2290         if (err < 0)
2291                 goto unlock;
2292
2293         if (changed)
2294                 err = new_settings(hdev, sk);
2295
2296 unlock:
2297         hci_dev_unlock(hdev);
2298         return err;
2299 }
2300
2301 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2302                              u16 len)
2303 {
2304         struct mgmt_mode *cp = data;
2305         struct mgmt_pending_cmd *cmd;
2306         u8 val, status;
2307         int err;
2308
2309         BT_DBG("request for %s", hdev->name);
2310
2311         status = mgmt_bredr_support(hdev);
2312         if (status)
2313                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2314                                        status);
2315
2316         if (cp->val != 0x00 && cp->val != 0x01)
2317                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2318                                        MGMT_STATUS_INVALID_PARAMS);
2319
2320         hci_dev_lock(hdev);
2321
2322         if (!hdev_is_powered(hdev)) {
2323                 bool changed = false;
2324
2325                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2326                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2327                         changed = true;
2328                 }
2329
2330                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2331                 if (err < 0)
2332                         goto failed;
2333
2334                 if (changed)
2335                         err = new_settings(hdev, sk);
2336
2337                 goto failed;
2338         }
2339
2340         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2341                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2342                                       MGMT_STATUS_BUSY);
2343                 goto failed;
2344         }
2345
2346         val = !!cp->val;
2347
2348         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2349                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2350                 goto failed;
2351         }
2352
2353         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2354         if (!cmd) {
2355                 err = -ENOMEM;
2356                 goto failed;
2357         }
2358
2359         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2360         if (err < 0) {
2361                 mgmt_pending_remove(cmd);
2362                 goto failed;
2363         }
2364
2365 failed:
2366         hci_dev_unlock(hdev);
2367         return err;
2368 }
2369
2370 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2371 {
2372         struct mgmt_mode *cp = data;
2373         struct mgmt_pending_cmd *cmd;
2374         u8 status;
2375         int err;
2376
2377         BT_DBG("request for %s", hdev->name);
2378
2379         status = mgmt_bredr_support(hdev);
2380         if (status)
2381                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2382
2383         if (!lmp_ssp_capable(hdev))
2384                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2385                                        MGMT_STATUS_NOT_SUPPORTED);
2386
2387         if (cp->val != 0x00 && cp->val != 0x01)
2388                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2389                                        MGMT_STATUS_INVALID_PARAMS);
2390
2391         hci_dev_lock(hdev);
2392
2393         if (!hdev_is_powered(hdev)) {
2394                 bool changed;
2395
2396                 if (cp->val) {
2397                         changed = !hci_dev_test_and_set_flag(hdev,
2398                                                              HCI_SSP_ENABLED);
2399                 } else {
2400                         changed = hci_dev_test_and_clear_flag(hdev,
2401                                                               HCI_SSP_ENABLED);
2402                         if (!changed)
2403                                 changed = hci_dev_test_and_clear_flag(hdev,
2404                                                                       HCI_HS_ENABLED);
2405                         else
2406                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2407                 }
2408
2409                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2410                 if (err < 0)
2411                         goto failed;
2412
2413                 if (changed)
2414                         err = new_settings(hdev, sk);
2415
2416                 goto failed;
2417         }
2418
2419         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2420                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2421                                       MGMT_STATUS_BUSY);
2422                 goto failed;
2423         }
2424
2425         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2426                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2427                 goto failed;
2428         }
2429
2430         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2431         if (!cmd) {
2432                 err = -ENOMEM;
2433                 goto failed;
2434         }
2435
2436         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2437                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2438                              sizeof(cp->val), &cp->val);
2439
2440         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2441         if (err < 0) {
2442                 mgmt_pending_remove(cmd);
2443                 goto failed;
2444         }
2445
2446 failed:
2447         hci_dev_unlock(hdev);
2448         return err;
2449 }
2450
2451 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2452 {
2453         struct mgmt_mode *cp = data;
2454         bool changed;
2455         u8 status;
2456         int err;
2457
2458         BT_DBG("request for %s", hdev->name);
2459
2460         status = mgmt_bredr_support(hdev);
2461         if (status)
2462                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2463
2464         if (!lmp_ssp_capable(hdev))
2465                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2466                                        MGMT_STATUS_NOT_SUPPORTED);
2467
2468         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2469                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2470                                        MGMT_STATUS_REJECTED);
2471
2472         if (cp->val != 0x00 && cp->val != 0x01)
2473                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2474                                        MGMT_STATUS_INVALID_PARAMS);
2475
2476         hci_dev_lock(hdev);
2477
2478         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2479                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2480                                       MGMT_STATUS_BUSY);
2481                 goto unlock;
2482         }
2483
2484         if (cp->val) {
2485                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2486         } else {
2487                 if (hdev_is_powered(hdev)) {
2488                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2489                                               MGMT_STATUS_REJECTED);
2490                         goto unlock;
2491                 }
2492
2493                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2494         }
2495
2496         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2497         if (err < 0)
2498                 goto unlock;
2499
2500         if (changed)
2501                 err = new_settings(hdev, sk);
2502
2503 unlock:
2504         hci_dev_unlock(hdev);
2505         return err;
2506 }
2507
2508 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2509 {
2510         struct cmd_lookup match = { NULL, hdev };
2511
2512         hci_dev_lock(hdev);
2513
2514         if (status) {
2515                 u8 mgmt_err = mgmt_status(status);
2516
2517                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2518                                      &mgmt_err);
2519                 goto unlock;
2520         }
2521
2522         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2523
2524         new_settings(hdev, match.sk);
2525
2526         if (match.sk)
2527                 sock_put(match.sk);
2528
2529         /* Make sure the controller has a good default for
2530          * advertising data. Restrict the update to when LE
2531          * has actually been enabled. During power on, the
2532          * update in powered_update_hci will take care of it.
2533          */
2534         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2535                 struct hci_request req;
2536
2537                 hci_req_init(&req, hdev);
2538                 update_adv_data(&req);
2539                 update_scan_rsp_data(&req);
2540                 __hci_update_background_scan(&req);
2541                 hci_req_run(&req, NULL);
2542         }
2543
2544 unlock:
2545         hci_dev_unlock(hdev);
2546 }
2547
2548 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2549 {
2550         struct mgmt_mode *cp = data;
2551         struct hci_cp_write_le_host_supported hci_cp;
2552         struct mgmt_pending_cmd *cmd;
2553         struct hci_request req;
2554         int err;
2555         u8 val, enabled;
2556
2557         BT_DBG("request for %s", hdev->name);
2558
2559         if (!lmp_le_capable(hdev))
2560                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2561                                        MGMT_STATUS_NOT_SUPPORTED);
2562
2563         if (cp->val != 0x00 && cp->val != 0x01)
2564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2565                                        MGMT_STATUS_INVALID_PARAMS);
2566
2567         /* Bluetooth single mode LE only controllers or dual-mode
2568          * controllers configured as LE only devices, do not allow
2569          * switching LE off. These have either LE enabled explicitly
2570          * or BR/EDR has been previously switched off.
2571          *
2572          * When trying to enable an already enabled LE, then gracefully
2573          * send a positive response. Trying to disable it however will
2574          * result into rejection.
2575          */
2576         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2577                 if (cp->val == 0x01)
2578                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2579
2580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2581                                        MGMT_STATUS_REJECTED);
2582         }
2583
2584         hci_dev_lock(hdev);
2585
2586         val = !!cp->val;
2587         enabled = lmp_host_le_capable(hdev);
2588
2589         if (!val)
2590                 clear_adv_instance(hdev, NULL, 0x00, true);
2591
2592         if (!hdev_is_powered(hdev) || val == enabled) {
2593                 bool changed = false;
2594
2595                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2596                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2597                         changed = true;
2598                 }
2599
2600                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2601                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2602                         changed = true;
2603                 }
2604
2605                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2606                 if (err < 0)
2607                         goto unlock;
2608
2609                 if (changed)
2610                         err = new_settings(hdev, sk);
2611
2612                 goto unlock;
2613         }
2614
2615         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2616             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2617                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2618                                       MGMT_STATUS_BUSY);
2619                 goto unlock;
2620         }
2621
2622         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2623         if (!cmd) {
2624                 err = -ENOMEM;
2625                 goto unlock;
2626         }
2627
2628         hci_req_init(&req, hdev);
2629
2630         memset(&hci_cp, 0, sizeof(hci_cp));
2631
2632         if (val) {
2633                 hci_cp.le = val;
2634                 hci_cp.simul = 0x00;
2635         } else {
2636                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2637                         disable_advertising(&req);
2638         }
2639
2640         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2641                     &hci_cp);
2642
2643         err = hci_req_run(&req, le_enable_complete);
2644         if (err < 0)
2645                 mgmt_pending_remove(cmd);
2646
2647 unlock:
2648         hci_dev_unlock(hdev);
2649         return err;
2650 }
2651
2652 /* This is a helper function to test for pending mgmt commands that can
2653  * cause CoD or EIR HCI commands. We can only allow one such pending
2654  * mgmt command at a time since otherwise we cannot easily track what
2655  * the current values are, will be, and based on that calculate if a new
2656  * HCI command needs to be sent and if yes with what value.
2657  */
2658 static bool pending_eir_or_class(struct hci_dev *hdev)
2659 {
2660         struct mgmt_pending_cmd *cmd;
2661
2662         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2663                 switch (cmd->opcode) {
2664                 case MGMT_OP_ADD_UUID:
2665                 case MGMT_OP_REMOVE_UUID:
2666                 case MGMT_OP_SET_DEV_CLASS:
2667                 case MGMT_OP_SET_POWERED:
2668                         return true;
2669                 }
2670         }
2671
2672         return false;
2673 }
2674
2675 static const u8 bluetooth_base_uuid[] = {
2676                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2677                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2678 };
2679
2680 static u8 get_uuid_size(const u8 *uuid)
2681 {
2682         u32 val;
2683
2684         if (memcmp(uuid, bluetooth_base_uuid, 12))
2685                 return 128;
2686
2687         val = get_unaligned_le32(&uuid[12]);
2688         if (val > 0xffff)
2689                 return 32;
2690
2691         return 16;
2692 }
2693
2694 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2695 {
2696         struct mgmt_pending_cmd *cmd;
2697
2698         hci_dev_lock(hdev);
2699
2700         cmd = pending_find(mgmt_op, hdev);
2701         if (!cmd)
2702                 goto unlock;
2703
2704         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2705                           mgmt_status(status), hdev->dev_class, 3);
2706
2707         mgmt_pending_remove(cmd);
2708
2709 unlock:
2710         hci_dev_unlock(hdev);
2711 }
2712
2713 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2714 {
2715         BT_DBG("status 0x%02x", status);
2716
2717         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2718 }
2719
2720 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2721 {
2722         struct mgmt_cp_add_uuid *cp = data;
2723         struct mgmt_pending_cmd *cmd;
2724         struct hci_request req;
2725         struct bt_uuid *uuid;
2726         int err;
2727
2728         BT_DBG("request for %s", hdev->name);
2729
2730         hci_dev_lock(hdev);
2731
2732         if (pending_eir_or_class(hdev)) {
2733                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2734                                       MGMT_STATUS_BUSY);
2735                 goto failed;
2736         }
2737
2738         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2739         if (!uuid) {
2740                 err = -ENOMEM;
2741                 goto failed;
2742         }
2743
2744         memcpy(uuid->uuid, cp->uuid, 16);
2745         uuid->svc_hint = cp->svc_hint;
2746         uuid->size = get_uuid_size(cp->uuid);
2747
2748         list_add_tail(&uuid->list, &hdev->uuids);
2749
2750         hci_req_init(&req, hdev);
2751
2752         update_class(&req);
2753         update_eir(&req);
2754
2755         err = hci_req_run(&req, add_uuid_complete);
2756         if (err < 0) {
2757                 if (err != -ENODATA)
2758                         goto failed;
2759
2760                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2761                                         hdev->dev_class, 3);
2762                 goto failed;
2763         }
2764
2765         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2766         if (!cmd) {
2767                 err = -ENOMEM;
2768                 goto failed;
2769         }
2770
2771         err = 0;
2772
2773 failed:
2774         hci_dev_unlock(hdev);
2775         return err;
2776 }
2777
2778 static bool enable_service_cache(struct hci_dev *hdev)
2779 {
2780         if (!hdev_is_powered(hdev))
2781                 return false;
2782
2783         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2784                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2785                                    CACHE_TIMEOUT);
2786                 return true;
2787         }
2788
2789         return false;
2790 }
2791
2792 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2793 {
2794         BT_DBG("status 0x%02x", status);
2795
2796         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2797 }
2798
2799 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2800                        u16 len)
2801 {
2802         struct mgmt_cp_remove_uuid *cp = data;
2803         struct mgmt_pending_cmd *cmd;
2804         struct bt_uuid *match, *tmp;
2805         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2806         struct hci_request req;
2807         int err, found;
2808
2809         BT_DBG("request for %s", hdev->name);
2810
2811         hci_dev_lock(hdev);
2812
2813         if (pending_eir_or_class(hdev)) {
2814                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2815                                       MGMT_STATUS_BUSY);
2816                 goto unlock;
2817         }
2818
2819         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2820                 hci_uuids_clear(hdev);
2821
2822                 if (enable_service_cache(hdev)) {
2823                         err = mgmt_cmd_complete(sk, hdev->id,
2824                                                 MGMT_OP_REMOVE_UUID,
2825                                                 0, hdev->dev_class, 3);
2826                         goto unlock;
2827                 }
2828
2829                 goto update_class;
2830         }
2831
2832         found = 0;
2833
2834         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2835                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2836                         continue;
2837
2838                 list_del(&match->list);
2839                 kfree(match);
2840                 found++;
2841         }
2842
2843         if (found == 0) {
2844                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2845                                       MGMT_STATUS_INVALID_PARAMS);
2846                 goto unlock;
2847         }
2848
2849 update_class:
2850         hci_req_init(&req, hdev);
2851
2852         update_class(&req);
2853         update_eir(&req);
2854
2855         err = hci_req_run(&req, remove_uuid_complete);
2856         if (err < 0) {
2857                 if (err != -ENODATA)
2858                         goto unlock;
2859
2860                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2861                                         hdev->dev_class, 3);
2862                 goto unlock;
2863         }
2864
2865         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2866         if (!cmd) {
2867                 err = -ENOMEM;
2868                 goto unlock;
2869         }
2870
2871         err = 0;
2872
2873 unlock:
2874         hci_dev_unlock(hdev);
2875         return err;
2876 }
2877
2878 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2879 {
2880         BT_DBG("status 0x%02x", status);
2881
2882         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2883 }
2884
2885 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2886                          u16 len)
2887 {
2888         struct mgmt_cp_set_dev_class *cp = data;
2889         struct mgmt_pending_cmd *cmd;
2890         struct hci_request req;
2891         int err;
2892
2893         BT_DBG("request for %s", hdev->name);
2894
2895         if (!lmp_bredr_capable(hdev))
2896                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2897                                        MGMT_STATUS_NOT_SUPPORTED);
2898
2899         hci_dev_lock(hdev);
2900
2901         if (pending_eir_or_class(hdev)) {
2902                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2903                                       MGMT_STATUS_BUSY);
2904                 goto unlock;
2905         }
2906
2907         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2908                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2909                                       MGMT_STATUS_INVALID_PARAMS);
2910                 goto unlock;
2911         }
2912
2913         hdev->major_class = cp->major;
2914         hdev->minor_class = cp->minor;
2915
2916         if (!hdev_is_powered(hdev)) {
2917                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2918                                         hdev->dev_class, 3);
2919                 goto unlock;
2920         }
2921
2922         hci_req_init(&req, hdev);
2923
2924         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2925                 hci_dev_unlock(hdev);
2926                 cancel_delayed_work_sync(&hdev->service_cache);
2927                 hci_dev_lock(hdev);
2928                 update_eir(&req);
2929         }
2930
2931         update_class(&req);
2932
2933         err = hci_req_run(&req, set_class_complete);
2934         if (err < 0) {
2935                 if (err != -ENODATA)
2936                         goto unlock;
2937
2938                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2939                                         hdev->dev_class, 3);
2940                 goto unlock;
2941         }
2942
2943         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2944         if (!cmd) {
2945                 err = -ENOMEM;
2946                 goto unlock;
2947         }
2948
2949         err = 0;
2950
2951 unlock:
2952         hci_dev_unlock(hdev);
2953         return err;
2954 }
2955
2956 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2957                           u16 len)
2958 {
2959         struct mgmt_cp_load_link_keys *cp = data;
2960         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2961                                    sizeof(struct mgmt_link_key_info));
2962         u16 key_count, expected_len;
2963         bool changed;
2964         int i;
2965
2966         BT_DBG("request for %s", hdev->name);
2967
2968         if (!lmp_bredr_capable(hdev))
2969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2970                                        MGMT_STATUS_NOT_SUPPORTED);
2971
2972         key_count = __le16_to_cpu(cp->key_count);
2973         if (key_count > max_key_count) {
2974                 BT_ERR("load_link_keys: too big key_count value %u",
2975                        key_count);
2976                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2977                                        MGMT_STATUS_INVALID_PARAMS);
2978         }
2979
2980         expected_len = sizeof(*cp) + key_count *
2981                                         sizeof(struct mgmt_link_key_info);
2982         if (expected_len != len) {
2983                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2984                        expected_len, len);
2985                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2986                                        MGMT_STATUS_INVALID_PARAMS);
2987         }
2988
2989         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2990                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2991                                        MGMT_STATUS_INVALID_PARAMS);
2992
2993         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2994                key_count);
2995
2996         for (i = 0; i < key_count; i++) {
2997                 struct mgmt_link_key_info *key = &cp->keys[i];
2998
2999                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
3000                         return mgmt_cmd_status(sk, hdev->id,
3001                                                MGMT_OP_LOAD_LINK_KEYS,
3002                                                MGMT_STATUS_INVALID_PARAMS);
3003         }
3004
3005         hci_dev_lock(hdev);
3006
3007         hci_link_keys_clear(hdev);
3008
3009         if (cp->debug_keys)
3010                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
3011         else
3012                 changed = hci_dev_test_and_clear_flag(hdev,
3013                                                       HCI_KEEP_DEBUG_KEYS);
3014
3015         if (changed)
3016                 new_settings(hdev, NULL);
3017
3018         for (i = 0; i < key_count; i++) {
3019                 struct mgmt_link_key_info *key = &cp->keys[i];
3020
3021                 /* Always ignore debug keys and require a new pairing if
3022                  * the user wants to use them.
3023                  */
3024                 if (key->type == HCI_LK_DEBUG_COMBINATION)
3025                         continue;
3026
3027                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3028                                  key->type, key->pin_len, NULL);
3029         }
3030
3031         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
3032
3033         hci_dev_unlock(hdev);
3034
3035         return 0;
3036 }
3037
3038 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
3039                            u8 addr_type, struct sock *skip_sk)
3040 {
3041         struct mgmt_ev_device_unpaired ev;
3042
3043         bacpy(&ev.addr.bdaddr, bdaddr);
3044         ev.addr.type = addr_type;
3045
3046         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
3047                           skip_sk);
3048 }
3049
3050 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3051                          u16 len)
3052 {
3053         struct mgmt_cp_unpair_device *cp = data;
3054         struct mgmt_rp_unpair_device rp;
3055         struct hci_conn_params *params;
3056         struct hci_cp_disconnect dc;
3057         struct mgmt_pending_cmd *cmd;
3058         struct hci_conn *conn;
3059         u8 addr_type;
3060         int err;
3061
3062         memset(&rp, 0, sizeof(rp));
3063         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3064         rp.addr.type = cp->addr.type;
3065
3066         if (!bdaddr_type_is_valid(cp->addr.type))
3067                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3068                                          MGMT_STATUS_INVALID_PARAMS,
3069                                          &rp, sizeof(rp));
3070
3071         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3072                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3073                                          MGMT_STATUS_INVALID_PARAMS,
3074                                          &rp, sizeof(rp));
3075
3076         hci_dev_lock(hdev);
3077
3078         if (!hdev_is_powered(hdev)) {
3079                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3080                                         MGMT_STATUS_NOT_POWERED, &rp,
3081                                         sizeof(rp));
3082                 goto unlock;
3083         }
3084
3085         if (cp->addr.type == BDADDR_BREDR) {
3086                 /* If disconnection is requested, then look up the
3087                  * connection. If the remote device is connected, it
3088                  * will be later used to terminate the link.
3089                  *
3090                  * Setting it to NULL explicitly will cause no
3091                  * termination of the link.
3092                  */
3093                 if (cp->disconnect)
3094                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3095                                                        &cp->addr.bdaddr);
3096                 else
3097                         conn = NULL;
3098
3099                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3100                 if (err < 0) {
3101                         err = mgmt_cmd_complete(sk, hdev->id,
3102                                                 MGMT_OP_UNPAIR_DEVICE,
3103                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3104                                                 sizeof(rp));
3105                         goto unlock;
3106                 }
3107
3108                 goto done;
3109         }
3110
3111         /* LE address type */
3112         addr_type = le_addr_type(cp->addr.type);
3113
3114         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
3115
3116         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
3117         if (err < 0) {
3118                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3119                                         MGMT_STATUS_NOT_PAIRED, &rp,
3120                                         sizeof(rp));
3121                 goto unlock;
3122         }
3123
3124         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3125         if (!conn) {
3126                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3127                 goto done;
3128         }
3129
3130         /* Abort any ongoing SMP pairing */
3131         smp_cancel_pairing(conn);
3132
3133         /* Defer clearing up the connection parameters until closing to
3134          * give a chance of keeping them if a repairing happens.
3135          */
3136         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3137
3138         /* Disable auto-connection parameters if present */
3139         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3140         if (params) {
3141                 if (params->explicit_connect)
3142                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3143                 else
3144                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3145         }
3146
3147         /* If disconnection is not requested, then clear the connection
3148          * variable so that the link is not terminated.
3149          */
3150         if (!cp->disconnect)
3151                 conn = NULL;
3152
3153 done:
3154         /* If the connection variable is set, then termination of the
3155          * link is requested.
3156          */
3157         if (!conn) {
3158                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3159                                         &rp, sizeof(rp));
3160                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3161                 goto unlock;
3162         }
3163
3164         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3165                                sizeof(*cp));
3166         if (!cmd) {
3167                 err = -ENOMEM;
3168                 goto unlock;
3169         }
3170
3171         cmd->cmd_complete = addr_cmd_complete;
3172
3173         dc.handle = cpu_to_le16(conn->handle);
3174         dc.reason = 0x13; /* Remote User Terminated Connection */
3175         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3176         if (err < 0)
3177                 mgmt_pending_remove(cmd);
3178
3179 unlock:
3180         hci_dev_unlock(hdev);
3181         return err;
3182 }
3183
3184 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3185                       u16 len)
3186 {
3187         struct mgmt_cp_disconnect *cp = data;
3188         struct mgmt_rp_disconnect rp;
3189         struct mgmt_pending_cmd *cmd;
3190         struct hci_conn *conn;
3191         int err;
3192
3193         BT_DBG("");
3194
3195         memset(&rp, 0, sizeof(rp));
3196         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3197         rp.addr.type = cp->addr.type;
3198
3199         if (!bdaddr_type_is_valid(cp->addr.type))
3200                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3201                                          MGMT_STATUS_INVALID_PARAMS,
3202                                          &rp, sizeof(rp));
3203
3204         hci_dev_lock(hdev);
3205
3206         if (!test_bit(HCI_UP, &hdev->flags)) {
3207                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3208                                         MGMT_STATUS_NOT_POWERED, &rp,
3209                                         sizeof(rp));
3210                 goto failed;
3211         }
3212
3213         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3214                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3215                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3216                 goto failed;
3217         }
3218
3219         if (cp->addr.type == BDADDR_BREDR)
3220                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3221                                                &cp->addr.bdaddr);
3222         else
3223                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3224                                                le_addr_type(cp->addr.type));
3225
3226         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3227                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3228                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3229                                         sizeof(rp));
3230                 goto failed;
3231         }
3232
3233         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3234         if (!cmd) {
3235                 err = -ENOMEM;
3236                 goto failed;
3237         }
3238
3239         cmd->cmd_complete = generic_cmd_complete;
3240
3241         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3242         if (err < 0)
3243                 mgmt_pending_remove(cmd);
3244
3245 failed:
3246         hci_dev_unlock(hdev);
3247         return err;
3248 }
3249
3250 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3251 {
3252         switch (link_type) {
3253         case LE_LINK:
3254                 switch (addr_type) {
3255                 case ADDR_LE_DEV_PUBLIC:
3256                         return BDADDR_LE_PUBLIC;
3257
3258                 default:
3259                         /* Fallback to LE Random address type */
3260                         return BDADDR_LE_RANDOM;
3261                 }
3262
3263         default:
3264                 /* Fallback to BR/EDR type */
3265                 return BDADDR_BREDR;
3266         }
3267 }
3268
3269 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3270                            u16 data_len)
3271 {
3272         struct mgmt_rp_get_connections *rp;
3273         struct hci_conn *c;
3274         size_t rp_len;
3275         int err;
3276         u16 i;
3277
3278         BT_DBG("");
3279
3280         hci_dev_lock(hdev);
3281
3282         if (!hdev_is_powered(hdev)) {
3283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3284                                       MGMT_STATUS_NOT_POWERED);
3285                 goto unlock;
3286         }
3287
3288         i = 0;
3289         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3290                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3291                         i++;
3292         }
3293
3294         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3295         rp = kmalloc(rp_len, GFP_KERNEL);
3296         if (!rp) {
3297                 err = -ENOMEM;
3298                 goto unlock;
3299         }
3300
3301         i = 0;
3302         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3303                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3304                         continue;
3305                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3306                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3307                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3308                         continue;
3309                 i++;
3310         }
3311
3312         rp->conn_count = cpu_to_le16(i);
3313
3314         /* Recalculate length in case of filtered SCO connections, etc */
3315         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3316
3317         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3318                                 rp_len);
3319
3320         kfree(rp);
3321
3322 unlock:
3323         hci_dev_unlock(hdev);
3324         return err;
3325 }
3326
3327 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3328                                    struct mgmt_cp_pin_code_neg_reply *cp)
3329 {
3330         struct mgmt_pending_cmd *cmd;
3331         int err;
3332
3333         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3334                                sizeof(*cp));
3335         if (!cmd)
3336                 return -ENOMEM;
3337
3338         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3339                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3340         if (err < 0)
3341                 mgmt_pending_remove(cmd);
3342
3343         return err;
3344 }
3345
3346 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3347                           u16 len)
3348 {
3349         struct hci_conn *conn;
3350         struct mgmt_cp_pin_code_reply *cp = data;
3351         struct hci_cp_pin_code_reply reply;
3352         struct mgmt_pending_cmd *cmd;
3353         int err;
3354
3355         BT_DBG("");
3356
3357         hci_dev_lock(hdev);
3358
3359         if (!hdev_is_powered(hdev)) {
3360                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3361                                       MGMT_STATUS_NOT_POWERED);
3362                 goto failed;
3363         }
3364
3365         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3366         if (!conn) {
3367                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3368                                       MGMT_STATUS_NOT_CONNECTED);
3369                 goto failed;
3370         }
3371
3372         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3373                 struct mgmt_cp_pin_code_neg_reply ncp;
3374
3375                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3376
3377                 BT_ERR("PIN code is not 16 bytes long");
3378
3379                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3380                 if (err >= 0)
3381                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3382                                               MGMT_STATUS_INVALID_PARAMS);
3383
3384                 goto failed;
3385         }
3386
3387         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3388         if (!cmd) {
3389                 err = -ENOMEM;
3390                 goto failed;
3391         }
3392
3393         cmd->cmd_complete = addr_cmd_complete;
3394
3395         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3396         reply.pin_len = cp->pin_len;
3397         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3398
3399         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3400         if (err < 0)
3401                 mgmt_pending_remove(cmd);
3402
3403 failed:
3404         hci_dev_unlock(hdev);
3405         return err;
3406 }
3407
3408 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3409                              u16 len)
3410 {
3411         struct mgmt_cp_set_io_capability *cp = data;
3412
3413         BT_DBG("");
3414
3415         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3416                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3417                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3418
3419         hci_dev_lock(hdev);
3420
3421         hdev->io_capability = cp->io_capability;
3422
3423         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3424                hdev->io_capability);
3425
3426         hci_dev_unlock(hdev);
3427
3428         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3429                                  NULL, 0);
3430 }
3431
3432 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3433 {
3434         struct hci_dev *hdev = conn->hdev;
3435         struct mgmt_pending_cmd *cmd;
3436
3437         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3438                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3439                         continue;
3440
3441                 if (cmd->user_data != conn)
3442                         continue;
3443
3444                 return cmd;
3445         }
3446
3447         return NULL;
3448 }
3449
3450 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3451 {
3452         struct mgmt_rp_pair_device rp;
3453         struct hci_conn *conn = cmd->user_data;
3454         int err;
3455
3456         bacpy(&rp.addr.bdaddr, &conn->dst);
3457         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3458
3459         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3460                                 status, &rp, sizeof(rp));
3461
3462         /* So we don't get further callbacks for this connection */
3463         conn->connect_cfm_cb = NULL;
3464         conn->security_cfm_cb = NULL;
3465         conn->disconn_cfm_cb = NULL;
3466
3467         hci_conn_drop(conn);
3468
3469         /* The device is paired so there is no need to remove
3470          * its connection parameters anymore.
3471          */
3472         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3473
3474         hci_conn_put(conn);
3475
3476         return err;
3477 }
3478
3479 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3480 {
3481         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3482         struct mgmt_pending_cmd *cmd;
3483
3484         cmd = find_pairing(conn);
3485         if (cmd) {
3486                 cmd->cmd_complete(cmd, status);
3487                 mgmt_pending_remove(cmd);
3488         }
3489 }
3490
3491 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3492 {
3493         struct mgmt_pending_cmd *cmd;
3494
3495         BT_DBG("status %u", status);
3496
3497         cmd = find_pairing(conn);
3498         if (!cmd) {
3499                 BT_DBG("Unable to find a pending command");
3500                 return;
3501         }
3502
3503         cmd->cmd_complete(cmd, mgmt_status(status));
3504         mgmt_pending_remove(cmd);
3505 }
3506
3507 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3508 {
3509         struct mgmt_pending_cmd *cmd;
3510
3511         BT_DBG("status %u", status);
3512
3513         if (!status)
3514                 return;
3515
3516         cmd = find_pairing(conn);
3517         if (!cmd) {
3518                 BT_DBG("Unable to find a pending command");
3519                 return;
3520         }
3521
3522         cmd->cmd_complete(cmd, mgmt_status(status));
3523         mgmt_pending_remove(cmd);
3524 }
3525
3526 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3527                        u16 len)
3528 {
3529         struct mgmt_cp_pair_device *cp = data;
3530         struct mgmt_rp_pair_device rp;
3531         struct mgmt_pending_cmd *cmd;
3532         u8 sec_level, auth_type;
3533         struct hci_conn *conn;
3534         int err;
3535
3536         BT_DBG("");
3537
3538         memset(&rp, 0, sizeof(rp));
3539         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3540         rp.addr.type = cp->addr.type;
3541
3542         if (!bdaddr_type_is_valid(cp->addr.type))
3543                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3544                                          MGMT_STATUS_INVALID_PARAMS,
3545                                          &rp, sizeof(rp));
3546
3547         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3548                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3549                                          MGMT_STATUS_INVALID_PARAMS,
3550                                          &rp, sizeof(rp));
3551
3552         hci_dev_lock(hdev);
3553
3554         if (!hdev_is_powered(hdev)) {
3555                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3556                                         MGMT_STATUS_NOT_POWERED, &rp,
3557                                         sizeof(rp));
3558                 goto unlock;
3559         }
3560
3561         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3562                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3563                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3564                                         sizeof(rp));
3565                 goto unlock;
3566         }
3567
3568         sec_level = BT_SECURITY_MEDIUM;
3569         auth_type = HCI_AT_DEDICATED_BONDING;
3570
3571         if (cp->addr.type == BDADDR_BREDR) {
3572                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3573                                        auth_type);
3574         } else {
3575                 u8 addr_type = le_addr_type(cp->addr.type);
3576                 struct hci_conn_params *p;
3577
3578                 /* When pairing a new device, it is expected to remember
3579                  * this device for future connections. Adding the connection
3580                  * parameter information ahead of time allows tracking
3581                  * of the slave preferred values and will speed up any
3582                  * further connection establishment.
3583                  *
3584                  * If connection parameters already exist, then they
3585                  * will be kept and this function does nothing.
3586                  */
3587                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3588
3589                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3590                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3591
3592                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
3593                                            addr_type, sec_level,
3594                                            HCI_LE_CONN_TIMEOUT,
3595                                            HCI_ROLE_MASTER);
3596         }
3597
3598         if (IS_ERR(conn)) {
3599                 int status;
3600
3601                 if (PTR_ERR(conn) == -EBUSY)
3602                         status = MGMT_STATUS_BUSY;
3603                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3604                         status = MGMT_STATUS_NOT_SUPPORTED;
3605                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3606                         status = MGMT_STATUS_REJECTED;
3607                 else
3608                         status = MGMT_STATUS_CONNECT_FAILED;
3609
3610                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3611                                         status, &rp, sizeof(rp));
3612                 goto unlock;
3613         }
3614
3615         if (conn->connect_cfm_cb) {
3616                 hci_conn_drop(conn);
3617                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3618                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3619                 goto unlock;
3620         }
3621
3622         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3623         if (!cmd) {
3624                 err = -ENOMEM;
3625                 hci_conn_drop(conn);
3626                 goto unlock;
3627         }
3628
3629         cmd->cmd_complete = pairing_complete;
3630
3631         /* For LE, just connecting isn't a proof that the pairing finished */
3632         if (cp->addr.type == BDADDR_BREDR) {
3633                 conn->connect_cfm_cb = pairing_complete_cb;
3634                 conn->security_cfm_cb = pairing_complete_cb;
3635                 conn->disconn_cfm_cb = pairing_complete_cb;
3636         } else {
3637                 conn->connect_cfm_cb = le_pairing_complete_cb;
3638                 conn->security_cfm_cb = le_pairing_complete_cb;
3639                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3640         }
3641
3642         conn->io_capability = cp->io_cap;
3643         cmd->user_data = hci_conn_get(conn);
3644
3645         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3646             hci_conn_security(conn, sec_level, auth_type, true)) {
3647                 cmd->cmd_complete(cmd, 0);
3648                 mgmt_pending_remove(cmd);
3649         }
3650
3651         err = 0;
3652
3653 unlock:
3654         hci_dev_unlock(hdev);
3655         return err;
3656 }
3657
3658 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3659                               u16 len)
3660 {
3661         struct mgmt_addr_info *addr = data;
3662         struct mgmt_pending_cmd *cmd;
3663         struct hci_conn *conn;
3664         int err;
3665
3666         BT_DBG("");
3667
3668         hci_dev_lock(hdev);
3669
3670         if (!hdev_is_powered(hdev)) {
3671                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3672                                       MGMT_STATUS_NOT_POWERED);
3673                 goto unlock;
3674         }
3675
3676         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3677         if (!cmd) {
3678                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3679                                       MGMT_STATUS_INVALID_PARAMS);
3680                 goto unlock;
3681         }
3682
3683         conn = cmd->user_data;
3684
3685         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3686                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3687                                       MGMT_STATUS_INVALID_PARAMS);
3688                 goto unlock;
3689         }
3690
3691         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3692         mgmt_pending_remove(cmd);
3693
3694         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3695                                 addr, sizeof(*addr));
3696 unlock:
3697         hci_dev_unlock(hdev);
3698         return err;
3699 }
3700
3701 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3702                              struct mgmt_addr_info *addr, u16 mgmt_op,
3703                              u16 hci_op, __le32 passkey)
3704 {
3705         struct mgmt_pending_cmd *cmd;
3706         struct hci_conn *conn;
3707         int err;
3708
3709         hci_dev_lock(hdev);
3710
3711         if (!hdev_is_powered(hdev)) {
3712                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3713                                         MGMT_STATUS_NOT_POWERED, addr,
3714                                         sizeof(*addr));
3715                 goto done;
3716         }
3717
3718         if (addr->type == BDADDR_BREDR)
3719                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3720         else
3721                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3722                                                le_addr_type(addr->type));
3723
3724         if (!conn) {
3725                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3726                                         MGMT_STATUS_NOT_CONNECTED, addr,
3727                                         sizeof(*addr));
3728                 goto done;
3729         }
3730
3731         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3732                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3733                 if (!err)
3734                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3735                                                 MGMT_STATUS_SUCCESS, addr,
3736                                                 sizeof(*addr));
3737                 else
3738                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3739                                                 MGMT_STATUS_FAILED, addr,
3740                                                 sizeof(*addr));
3741
3742                 goto done;
3743         }
3744
3745         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3746         if (!cmd) {
3747                 err = -ENOMEM;
3748                 goto done;
3749         }
3750
3751         cmd->cmd_complete = addr_cmd_complete;
3752
3753         /* Continue with pairing via HCI */
3754         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3755                 struct hci_cp_user_passkey_reply cp;
3756
3757                 bacpy(&cp.bdaddr, &addr->bdaddr);
3758                 cp.passkey = passkey;
3759                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3760         } else
3761                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3762                                    &addr->bdaddr);
3763
3764         if (err < 0)
3765                 mgmt_pending_remove(cmd);
3766
3767 done:
3768         hci_dev_unlock(hdev);
3769         return err;
3770 }
3771
3772 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3773                               void *data, u16 len)
3774 {
3775         struct mgmt_cp_pin_code_neg_reply *cp = data;
3776
3777         BT_DBG("");
3778
3779         return user_pairing_resp(sk, hdev, &cp->addr,
3780                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3781                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3782 }
3783
3784 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3785                               u16 len)
3786 {
3787         struct mgmt_cp_user_confirm_reply *cp = data;
3788
3789         BT_DBG("");
3790
3791         if (len != sizeof(*cp))
3792                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3793                                        MGMT_STATUS_INVALID_PARAMS);
3794
3795         return user_pairing_resp(sk, hdev, &cp->addr,
3796                                  MGMT_OP_USER_CONFIRM_REPLY,
3797                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3798 }
3799
3800 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3801                                   void *data, u16 len)
3802 {
3803         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3804
3805         BT_DBG("");
3806
3807         return user_pairing_resp(sk, hdev, &cp->addr,
3808                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3809                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3810 }
3811
3812 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3813                               u16 len)
3814 {
3815         struct mgmt_cp_user_passkey_reply *cp = data;
3816
3817         BT_DBG("");
3818
3819         return user_pairing_resp(sk, hdev, &cp->addr,
3820                                  MGMT_OP_USER_PASSKEY_REPLY,
3821                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3822 }
3823
3824 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3825                                   void *data, u16 len)
3826 {
3827         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3828
3829         BT_DBG("");
3830
3831         return user_pairing_resp(sk, hdev, &cp->addr,
3832                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3833                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3834 }
3835
3836 static void update_name(struct hci_request *req)
3837 {
3838         struct hci_dev *hdev = req->hdev;
3839         struct hci_cp_write_local_name cp;
3840
3841         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3842
3843         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3844 }
3845
3846 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3847 {
3848         struct mgmt_cp_set_local_name *cp;
3849         struct mgmt_pending_cmd *cmd;
3850
3851         BT_DBG("status 0x%02x", status);
3852
3853         hci_dev_lock(hdev);
3854
3855         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3856         if (!cmd)
3857                 goto unlock;
3858
3859         cp = cmd->param;
3860
3861         if (status)
3862                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3863                                 mgmt_status(status));
3864         else
3865                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3866                                   cp, sizeof(*cp));
3867
3868         mgmt_pending_remove(cmd);
3869
3870 unlock:
3871         hci_dev_unlock(hdev);
3872 }
3873
3874 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3875                           u16 len)
3876 {
3877         struct mgmt_cp_set_local_name *cp = data;
3878         struct mgmt_pending_cmd *cmd;
3879         struct hci_request req;
3880         int err;
3881
3882         BT_DBG("");
3883
3884         hci_dev_lock(hdev);
3885
3886         /* If the old values are the same as the new ones just return a
3887          * direct command complete event.
3888          */
3889         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3890             !memcmp(hdev->short_name, cp->short_name,
3891                     sizeof(hdev->short_name))) {
3892                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3893                                         data, len);
3894                 goto failed;
3895         }
3896
3897         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3898
3899         if (!hdev_is_powered(hdev)) {
3900                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3901
3902                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3903                                         data, len);
3904                 if (err < 0)
3905                         goto failed;
3906
3907                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3908                                          data, len, sk);
3909
3910                 goto failed;
3911         }
3912
3913         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3914         if (!cmd) {
3915                 err = -ENOMEM;
3916                 goto failed;
3917         }
3918
3919         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3920
3921         hci_req_init(&req, hdev);
3922
3923         if (lmp_bredr_capable(hdev)) {
3924                 update_name(&req);
3925                 update_eir(&req);
3926         }
3927
3928         /* The name is stored in the scan response data and so
3929          * no need to udpate the advertising data here.
3930          */
3931         if (lmp_le_capable(hdev))
3932                 update_scan_rsp_data(&req);
3933
3934         err = hci_req_run(&req, set_name_complete);
3935         if (err < 0)
3936                 mgmt_pending_remove(cmd);
3937
3938 failed:
3939         hci_dev_unlock(hdev);
3940         return err;
3941 }
3942
3943 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3944                                          u16 opcode, struct sk_buff *skb)
3945 {
3946         struct mgmt_rp_read_local_oob_data mgmt_rp;
3947         size_t rp_size = sizeof(mgmt_rp);
3948         struct mgmt_pending_cmd *cmd;
3949
3950         BT_DBG("%s status %u", hdev->name, status);
3951
3952         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3953         if (!cmd)
3954                 return;
3955
3956         if (status || !skb) {
3957                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3958                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3959                 goto remove;
3960         }
3961
3962         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3963
3964         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3965                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3966
3967                 if (skb->len < sizeof(*rp)) {
3968                         mgmt_cmd_status(cmd->sk, hdev->id,
3969                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3970                                         MGMT_STATUS_FAILED);
3971                         goto remove;
3972                 }
3973
3974                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3975                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3976
3977                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3978         } else {
3979                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3980
3981                 if (skb->len < sizeof(*rp)) {
3982                         mgmt_cmd_status(cmd->sk, hdev->id,
3983                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3984                                         MGMT_STATUS_FAILED);
3985                         goto remove;
3986                 }
3987
3988                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3989                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3990
3991                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3992                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3993         }
3994
3995         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3996                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3997
3998 remove:
3999         mgmt_pending_remove(cmd);
4000 }
4001
4002 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4003                                void *data, u16 data_len)
4004 {
4005         struct mgmt_pending_cmd *cmd;
4006         struct hci_request req;
4007         int err;
4008
4009         BT_DBG("%s", hdev->name);
4010
4011         hci_dev_lock(hdev);
4012
4013         if (!hdev_is_powered(hdev)) {
4014                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4015                                       MGMT_STATUS_NOT_POWERED);
4016                 goto unlock;
4017         }
4018
4019         if (!lmp_ssp_capable(hdev)) {
4020                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4021                                       MGMT_STATUS_NOT_SUPPORTED);
4022                 goto unlock;
4023         }
4024
4025         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4026                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4027                                       MGMT_STATUS_BUSY);
4028                 goto unlock;
4029         }
4030
4031         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4032         if (!cmd) {
4033                 err = -ENOMEM;
4034                 goto unlock;
4035         }
4036
4037         hci_req_init(&req, hdev);
4038
4039         if (bredr_sc_enabled(hdev))
4040                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4041         else
4042                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4043
4044         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4045         if (err < 0)
4046                 mgmt_pending_remove(cmd);
4047
4048 unlock:
4049         hci_dev_unlock(hdev);
4050         return err;
4051 }
4052
4053 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4054                                void *data, u16 len)
4055 {
4056         struct mgmt_addr_info *addr = data;
4057         int err;
4058
4059         BT_DBG("%s ", hdev->name);
4060
4061         if (!bdaddr_type_is_valid(addr->type))
4062                 return mgmt_cmd_complete(sk, hdev->id,
4063                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4064                                          MGMT_STATUS_INVALID_PARAMS,
4065                                          addr, sizeof(*addr));
4066
4067         hci_dev_lock(hdev);
4068
4069         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4070                 struct mgmt_cp_add_remote_oob_data *cp = data;
4071                 u8 status;
4072
4073                 if (cp->addr.type != BDADDR_BREDR) {
4074                         err = mgmt_cmd_complete(sk, hdev->id,
4075                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4076                                                 MGMT_STATUS_INVALID_PARAMS,
4077                                                 &cp->addr, sizeof(cp->addr));
4078                         goto unlock;
4079                 }
4080
4081                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4082                                               cp->addr.type, cp->hash,
4083                                               cp->rand, NULL, NULL);
4084                 if (err < 0)
4085                         status = MGMT_STATUS_FAILED;
4086                 else
4087                         status = MGMT_STATUS_SUCCESS;
4088
4089                 err = mgmt_cmd_complete(sk, hdev->id,
4090                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4091                                         &cp->addr, sizeof(cp->addr));
4092         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4093                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4094                 u8 *rand192, *hash192, *rand256, *hash256;
4095                 u8 status;
4096
4097                 if (bdaddr_type_is_le(cp->addr.type)) {
4098                         /* Enforce zero-valued 192-bit parameters as
4099                          * long as legacy SMP OOB isn't implemented.
4100                          */
4101                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4102                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4103                                 err = mgmt_cmd_complete(sk, hdev->id,
4104                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4105                                                         MGMT_STATUS_INVALID_PARAMS,
4106                                                         addr, sizeof(*addr));
4107                                 goto unlock;
4108                         }
4109
4110                         rand192 = NULL;
4111                         hash192 = NULL;
4112                 } else {
4113                         /* In case one of the P-192 values is set to zero,
4114                          * then just disable OOB data for P-192.
4115                          */
4116                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4117                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4118                                 rand192 = NULL;
4119                                 hash192 = NULL;
4120                         } else {
4121                                 rand192 = cp->rand192;
4122                                 hash192 = cp->hash192;
4123                         }
4124                 }
4125
4126                 /* In case one of the P-256 values is set to zero, then just
4127                  * disable OOB data for P-256.
4128                  */
4129                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4130                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4131                         rand256 = NULL;
4132                         hash256 = NULL;
4133                 } else {
4134                         rand256 = cp->rand256;
4135                         hash256 = cp->hash256;
4136                 }
4137
4138                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4139                                               cp->addr.type, hash192, rand192,
4140                                               hash256, rand256);
4141                 if (err < 0)
4142                         status = MGMT_STATUS_FAILED;
4143                 else
4144                         status = MGMT_STATUS_SUCCESS;
4145
4146                 err = mgmt_cmd_complete(sk, hdev->id,
4147                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4148                                         status, &cp->addr, sizeof(cp->addr));
4149         } else {
4150                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
4151                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4152                                       MGMT_STATUS_INVALID_PARAMS);
4153         }
4154
4155 unlock:
4156         hci_dev_unlock(hdev);
4157         return err;
4158 }
4159
4160 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4161                                   void *data, u16 len)
4162 {
4163         struct mgmt_cp_remove_remote_oob_data *cp = data;
4164         u8 status;
4165         int err;
4166
4167         BT_DBG("%s", hdev->name);
4168
4169         if (cp->addr.type != BDADDR_BREDR)
4170                 return mgmt_cmd_complete(sk, hdev->id,
4171                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4172                                          MGMT_STATUS_INVALID_PARAMS,
4173                                          &cp->addr, sizeof(cp->addr));
4174
4175         hci_dev_lock(hdev);
4176
4177         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4178                 hci_remote_oob_data_clear(hdev);
4179                 status = MGMT_STATUS_SUCCESS;
4180                 goto done;
4181         }
4182
4183         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4184         if (err < 0)
4185                 status = MGMT_STATUS_INVALID_PARAMS;
4186         else
4187                 status = MGMT_STATUS_SUCCESS;
4188
4189 done:
4190         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4191                                 status, &cp->addr, sizeof(cp->addr));
4192
4193         hci_dev_unlock(hdev);
4194         return err;
4195 }
4196
4197 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
4198 {
4199         struct hci_dev *hdev = req->hdev;
4200         struct hci_cp_inquiry cp;
4201         /* General inquiry access code (GIAC) */
4202         u8 lap[3] = { 0x33, 0x8b, 0x9e };
4203
4204         *status = mgmt_bredr_support(hdev);
4205         if (*status)
4206                 return false;
4207
4208         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4209                 *status = MGMT_STATUS_BUSY;
4210                 return false;
4211         }
4212
4213         hci_inquiry_cache_flush(hdev);
4214
4215         memset(&cp, 0, sizeof(cp));
4216         memcpy(&cp.lap, lap, sizeof(cp.lap));
4217         cp.length = DISCOV_BREDR_INQUIRY_LEN;
4218
4219         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4220
4221         return true;
4222 }
4223
4224 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4225 {
4226         struct hci_dev *hdev = req->hdev;
4227         struct hci_cp_le_set_scan_param param_cp;
4228         struct hci_cp_le_set_scan_enable enable_cp;
4229         u8 own_addr_type;
4230         int err;
4231
4232         *status = mgmt_le_support(hdev);
4233         if (*status)
4234                 return false;
4235
4236         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4237                 /* Don't let discovery abort an outgoing connection attempt
4238                  * that's using directed advertising.
4239                  */
4240                 if (hci_lookup_le_connect(hdev)) {
4241                         *status = MGMT_STATUS_REJECTED;
4242                         return false;
4243                 }
4244
4245                 cancel_adv_timeout(hdev);
4246                 disable_advertising(req);
4247         }
4248
4249         /* If controller is scanning, it means the background scanning is
4250          * running. Thus, we should temporarily stop it in order to set the
4251          * discovery scanning parameters.
4252          */
4253         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4254                 hci_req_add_le_scan_disable(req);
4255
4256         /* All active scans will be done with either a resolvable private
4257          * address (when privacy feature has been enabled) or non-resolvable
4258          * private address.
4259          */
4260         err = hci_update_random_address(req, true, &own_addr_type);
4261         if (err < 0) {
4262                 *status = MGMT_STATUS_FAILED;
4263                 return false;
4264         }
4265
4266         memset(&param_cp, 0, sizeof(param_cp));
4267         param_cp.type = LE_SCAN_ACTIVE;
4268         param_cp.interval = cpu_to_le16(interval);
4269         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4270         param_cp.own_address_type = own_addr_type;
4271
4272         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4273                     &param_cp);
4274
4275         memset(&enable_cp, 0, sizeof(enable_cp));
4276         enable_cp.enable = LE_SCAN_ENABLE;
4277         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4278
4279         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4280                     &enable_cp);
4281
4282         return true;
4283 }
4284
4285 static bool trigger_discovery(struct hci_request *req, u8 *status)
4286 {
4287         struct hci_dev *hdev = req->hdev;
4288
4289         switch (hdev->discovery.type) {
4290         case DISCOV_TYPE_BREDR:
4291                 if (!trigger_bredr_inquiry(req, status))
4292                         return false;
4293                 break;
4294
4295         case DISCOV_TYPE_INTERLEAVED:
4296                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4297                              &hdev->quirks)) {
4298                         /* During simultaneous discovery, we double LE scan
4299                          * interval. We must leave some time for the controller
4300                          * to do BR/EDR inquiry.
4301                          */
4302                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4303                                              status))
4304                                 return false;
4305
4306                         if (!trigger_bredr_inquiry(req, status))
4307                                 return false;
4308
4309                         return true;
4310                 }
4311
4312                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4313                         *status = MGMT_STATUS_NOT_SUPPORTED;
4314                         return false;
4315                 }
4316                 /* fall through */
4317
4318         case DISCOV_TYPE_LE:
4319                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4320                         return false;
4321                 break;
4322
4323         default:
4324                 *status = MGMT_STATUS_INVALID_PARAMS;
4325                 return false;
4326         }
4327
4328         return true;
4329 }
4330
4331 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4332                                      u16 opcode)
4333 {
4334         struct mgmt_pending_cmd *cmd;
4335         unsigned long timeout;
4336
4337         BT_DBG("status %d", status);
4338
4339         hci_dev_lock(hdev);
4340
4341         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4342         if (!cmd)
4343                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4344
4345         if (cmd) {
4346                 cmd->cmd_complete(cmd, mgmt_status(status));
4347                 mgmt_pending_remove(cmd);
4348         }
4349
4350         if (status) {
4351                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4352                 goto unlock;
4353         }
4354
4355         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4356
4357         /* If the scan involves LE scan, pick proper timeout to schedule
4358          * hdev->le_scan_disable that will stop it.
4359          */
4360         switch (hdev->discovery.type) {
4361         case DISCOV_TYPE_LE:
4362                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4363                 break;
4364         case DISCOV_TYPE_INTERLEAVED:
4365                  /* When running simultaneous discovery, the LE scanning time
4366                  * should occupy the whole discovery time sine BR/EDR inquiry
4367                  * and LE scanning are scheduled by the controller.
4368                  *
4369                  * For interleaving discovery in comparison, BR/EDR inquiry
4370                  * and LE scanning are done sequentially with separate
4371                  * timeouts.
4372                  */
4373                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4374                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4375                 else
4376                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4377                 break;
4378         case DISCOV_TYPE_BREDR:
4379                 timeout = 0;
4380                 break;
4381         default:
4382                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4383                 timeout = 0;
4384                 break;
4385         }
4386
4387         if (timeout) {
4388                 /* When service discovery is used and the controller has
4389                  * a strict duplicate filter, it is important to remember
4390                  * the start and duration of the scan. This is required
4391                  * for restarting scanning during the discovery phase.
4392                  */
4393                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4394                              &hdev->quirks) &&
4395                     hdev->discovery.result_filtering) {
4396                         hdev->discovery.scan_start = jiffies;
4397                         hdev->discovery.scan_duration = timeout;
4398                 }
4399
4400                 queue_delayed_work(hdev->workqueue,
4401                                    &hdev->le_scan_disable, timeout);
4402         }
4403
4404 unlock:
4405         hci_dev_unlock(hdev);
4406 }
4407
4408 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4409                            void *data, u16 len)
4410 {
4411         struct mgmt_cp_start_discovery *cp = data;
4412         struct mgmt_pending_cmd *cmd;
4413         struct hci_request req;
4414         u8 status;
4415         int err;
4416
4417         BT_DBG("%s", hdev->name);
4418
4419         hci_dev_lock(hdev);
4420
4421         if (!hdev_is_powered(hdev)) {
4422                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4423                                         MGMT_STATUS_NOT_POWERED,
4424                                         &cp->type, sizeof(cp->type));
4425                 goto failed;
4426         }
4427
4428         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4429             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4430                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4431                                         MGMT_STATUS_BUSY, &cp->type,
4432                                         sizeof(cp->type));
4433                 goto failed;
4434         }
4435
4436         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4437         if (!cmd) {
4438                 err = -ENOMEM;
4439                 goto failed;
4440         }
4441
4442         cmd->cmd_complete = generic_cmd_complete;
4443
4444         /* Clear the discovery filter first to free any previously
4445          * allocated memory for the UUID list.
4446          */
4447         hci_discovery_filter_clear(hdev);
4448
4449         hdev->discovery.type = cp->type;
4450         hdev->discovery.report_invalid_rssi = false;
4451
4452         hci_req_init(&req, hdev);
4453
4454         if (!trigger_discovery(&req, &status)) {
4455                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4456                                         status, &cp->type, sizeof(cp->type));
4457                 mgmt_pending_remove(cmd);
4458                 goto failed;
4459         }
4460
4461         err = hci_req_run(&req, start_discovery_complete);
4462         if (err < 0) {
4463                 mgmt_pending_remove(cmd);
4464                 goto failed;
4465         }
4466
4467         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4468
4469 failed:
4470         hci_dev_unlock(hdev);
4471         return err;
4472 }
4473
4474 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4475                                           u8 status)
4476 {
4477         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4478                                  cmd->param, 1);
4479 }
4480
4481 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4482                                    void *data, u16 len)
4483 {
4484         struct mgmt_cp_start_service_discovery *cp = data;
4485         struct mgmt_pending_cmd *cmd;
4486         struct hci_request req;
4487         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4488         u16 uuid_count, expected_len;
4489         u8 status;
4490         int err;
4491
4492         BT_DBG("%s", hdev->name);
4493
4494         hci_dev_lock(hdev);
4495
4496         if (!hdev_is_powered(hdev)) {
4497                 err = mgmt_cmd_complete(sk, hdev->id,
4498                                         MGMT_OP_START_SERVICE_DISCOVERY,
4499                                         MGMT_STATUS_NOT_POWERED,
4500                                         &cp->type, sizeof(cp->type));
4501                 goto failed;
4502         }
4503
4504         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4505             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4506                 err = mgmt_cmd_complete(sk, hdev->id,
4507                                         MGMT_OP_START_SERVICE_DISCOVERY,
4508                                         MGMT_STATUS_BUSY, &cp->type,
4509                                         sizeof(cp->type));
4510                 goto failed;
4511         }
4512
4513         uuid_count = __le16_to_cpu(cp->uuid_count);
4514         if (uuid_count > max_uuid_count) {
4515                 BT_ERR("service_discovery: too big uuid_count value %u",
4516                        uuid_count);
4517                 err = mgmt_cmd_complete(sk, hdev->id,
4518                                         MGMT_OP_START_SERVICE_DISCOVERY,
4519                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4520                                         sizeof(cp->type));
4521                 goto failed;
4522         }
4523
4524         expected_len = sizeof(*cp) + uuid_count * 16;
4525         if (expected_len != len) {
4526                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4527                        expected_len, len);
4528                 err = mgmt_cmd_complete(sk, hdev->id,
4529                                         MGMT_OP_START_SERVICE_DISCOVERY,
4530                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4531                                         sizeof(cp->type));
4532                 goto failed;
4533         }
4534
4535         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4536                                hdev, data, len);
4537         if (!cmd) {
4538                 err = -ENOMEM;
4539                 goto failed;
4540         }
4541
4542         cmd->cmd_complete = service_discovery_cmd_complete;
4543
4544         /* Clear the discovery filter first to free any previously
4545          * allocated memory for the UUID list.
4546          */
4547         hci_discovery_filter_clear(hdev);
4548
4549         hdev->discovery.result_filtering = true;
4550         hdev->discovery.type = cp->type;
4551         hdev->discovery.rssi = cp->rssi;
4552         hdev->discovery.uuid_count = uuid_count;
4553
4554         if (uuid_count > 0) {
4555                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4556                                                 GFP_KERNEL);
4557                 if (!hdev->discovery.uuids) {
4558                         err = mgmt_cmd_complete(sk, hdev->id,
4559                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4560                                                 MGMT_STATUS_FAILED,
4561                                                 &cp->type, sizeof(cp->type));
4562                         mgmt_pending_remove(cmd);
4563                         goto failed;
4564                 }
4565         }
4566
4567         hci_req_init(&req, hdev);
4568
4569         if (!trigger_discovery(&req, &status)) {
4570                 err = mgmt_cmd_complete(sk, hdev->id,
4571                                         MGMT_OP_START_SERVICE_DISCOVERY,
4572                                         status, &cp->type, sizeof(cp->type));
4573                 mgmt_pending_remove(cmd);
4574                 goto failed;
4575         }
4576
4577         err = hci_req_run(&req, start_discovery_complete);
4578         if (err < 0) {
4579                 mgmt_pending_remove(cmd);
4580                 goto failed;
4581         }
4582
4583         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4584
4585 failed:
4586         hci_dev_unlock(hdev);
4587         return err;
4588 }
4589
4590 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4591 {
4592         struct mgmt_pending_cmd *cmd;
4593
4594         BT_DBG("status %d", status);
4595
4596         hci_dev_lock(hdev);
4597
4598         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4599         if (cmd) {
4600                 cmd->cmd_complete(cmd, mgmt_status(status));
4601                 mgmt_pending_remove(cmd);
4602         }
4603
4604         if (!status)
4605                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4606
4607         hci_dev_unlock(hdev);
4608 }
4609
4610 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4611                           u16 len)
4612 {
4613         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4614         struct mgmt_pending_cmd *cmd;
4615         struct hci_request req;
4616         int err;
4617
4618         BT_DBG("%s", hdev->name);
4619
4620         hci_dev_lock(hdev);
4621
4622         if (!hci_discovery_active(hdev)) {
4623                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4624                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4625                                         sizeof(mgmt_cp->type));
4626                 goto unlock;
4627         }
4628
4629         if (hdev->discovery.type != mgmt_cp->type) {
4630                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4631                                         MGMT_STATUS_INVALID_PARAMS,
4632                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4633                 goto unlock;
4634         }
4635
4636         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4637         if (!cmd) {
4638                 err = -ENOMEM;
4639                 goto unlock;
4640         }
4641
4642         cmd->cmd_complete = generic_cmd_complete;
4643
4644         hci_req_init(&req, hdev);
4645
4646         hci_stop_discovery(&req);
4647
4648         err = hci_req_run(&req, stop_discovery_complete);
4649         if (!err) {
4650                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4651                 goto unlock;
4652         }
4653
4654         mgmt_pending_remove(cmd);
4655
4656         /* If no HCI commands were sent we're done */
4657         if (err == -ENODATA) {
4658                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4659                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4660                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4661         }
4662
4663 unlock:
4664         hci_dev_unlock(hdev);
4665         return err;
4666 }
4667
4668 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4669                         u16 len)
4670 {
4671         struct mgmt_cp_confirm_name *cp = data;
4672         struct inquiry_entry *e;
4673         int err;
4674
4675         BT_DBG("%s", hdev->name);
4676
4677         hci_dev_lock(hdev);
4678
4679         if (!hci_discovery_active(hdev)) {
4680                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4681                                         MGMT_STATUS_FAILED, &cp->addr,
4682                                         sizeof(cp->addr));
4683                 goto failed;
4684         }
4685
4686         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4687         if (!e) {
4688                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4689                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4690                                         sizeof(cp->addr));
4691                 goto failed;
4692         }
4693
4694         if (cp->name_known) {
4695                 e->name_state = NAME_KNOWN;
4696                 list_del(&e->list);
4697         } else {
4698                 e->name_state = NAME_NEEDED;
4699                 hci_inquiry_cache_update_resolve(hdev, e);
4700         }
4701
4702         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4703                                 &cp->addr, sizeof(cp->addr));
4704
4705 failed:
4706         hci_dev_unlock(hdev);
4707         return err;
4708 }
4709
4710 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4711                         u16 len)
4712 {
4713         struct mgmt_cp_block_device *cp = data;
4714         u8 status;
4715         int err;
4716
4717         BT_DBG("%s", hdev->name);
4718
4719         if (!bdaddr_type_is_valid(cp->addr.type))
4720                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4721                                          MGMT_STATUS_INVALID_PARAMS,
4722                                          &cp->addr, sizeof(cp->addr));
4723
4724         hci_dev_lock(hdev);
4725
4726         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4727                                   cp->addr.type);
4728         if (err < 0) {
4729                 status = MGMT_STATUS_FAILED;
4730                 goto done;
4731         }
4732
4733         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4734                    sk);
4735         status = MGMT_STATUS_SUCCESS;
4736
4737 done:
4738         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4739                                 &cp->addr, sizeof(cp->addr));
4740
4741         hci_dev_unlock(hdev);
4742
4743         return err;
4744 }
4745
4746 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4747                           u16 len)
4748 {
4749         struct mgmt_cp_unblock_device *cp = data;
4750         u8 status;
4751         int err;
4752
4753         BT_DBG("%s", hdev->name);
4754
4755         if (!bdaddr_type_is_valid(cp->addr.type))
4756                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4757                                          MGMT_STATUS_INVALID_PARAMS,
4758                                          &cp->addr, sizeof(cp->addr));
4759
4760         hci_dev_lock(hdev);
4761
4762         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4763                                   cp->addr.type);
4764         if (err < 0) {
4765                 status = MGMT_STATUS_INVALID_PARAMS;
4766                 goto done;
4767         }
4768
4769         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4770                    sk);
4771         status = MGMT_STATUS_SUCCESS;
4772
4773 done:
4774         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4775                                 &cp->addr, sizeof(cp->addr));
4776
4777         hci_dev_unlock(hdev);
4778
4779         return err;
4780 }
4781
4782 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4783                          u16 len)
4784 {
4785         struct mgmt_cp_set_device_id *cp = data;
4786         struct hci_request req;
4787         int err;
4788         __u16 source;
4789
4790         BT_DBG("%s", hdev->name);
4791
4792         source = __le16_to_cpu(cp->source);
4793
4794         if (source > 0x0002)
4795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4796                                        MGMT_STATUS_INVALID_PARAMS);
4797
4798         hci_dev_lock(hdev);
4799
4800         hdev->devid_source = source;
4801         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4802         hdev->devid_product = __le16_to_cpu(cp->product);
4803         hdev->devid_version = __le16_to_cpu(cp->version);
4804
4805         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4806                                 NULL, 0);
4807
4808         hci_req_init(&req, hdev);
4809         update_eir(&req);
4810         hci_req_run(&req, NULL);
4811
4812         hci_dev_unlock(hdev);
4813
4814         return err;
4815 }
4816
4817 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4818                                         u16 opcode)
4819 {
4820         BT_DBG("status %d", status);
4821 }
4822
4823 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4824                                      u16 opcode)
4825 {
4826         struct cmd_lookup match = { NULL, hdev };
4827         struct hci_request req;
4828         u8 instance;
4829         struct adv_info *adv_instance;
4830         int err;
4831
4832         hci_dev_lock(hdev);
4833
4834         if (status) {
4835                 u8 mgmt_err = mgmt_status(status);
4836
4837                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4838                                      cmd_status_rsp, &mgmt_err);
4839                 goto unlock;
4840         }
4841
4842         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4843                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4844         else
4845                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4846
4847         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4848                              &match);
4849
4850         new_settings(hdev, match.sk);
4851
4852         if (match.sk)
4853                 sock_put(match.sk);
4854
4855         /* If "Set Advertising" was just disabled and instance advertising was
4856          * set up earlier, then re-enable multi-instance advertising.
4857          */
4858         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4859             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4860             list_empty(&hdev->adv_instances))
4861                 goto unlock;
4862
4863         instance = hdev->cur_adv_instance;
4864         if (!instance) {
4865                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4866                                                         struct adv_info, list);
4867                 if (!adv_instance)
4868                         goto unlock;
4869
4870                 instance = adv_instance->instance;
4871         }
4872
4873         hci_req_init(&req, hdev);
4874
4875         err = schedule_adv_instance(&req, instance, true);
4876
4877         if (!err)
4878                 err = hci_req_run(&req, enable_advertising_instance);
4879
4880         if (err)
4881                 BT_ERR("Failed to re-configure advertising");
4882
4883 unlock:
4884         hci_dev_unlock(hdev);
4885 }
4886
4887 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4888                            u16 len)
4889 {
4890         struct mgmt_mode *cp = data;
4891         struct mgmt_pending_cmd *cmd;
4892         struct hci_request req;
4893         u8 val, status;
4894         int err;
4895
4896         BT_DBG("request for %s", hdev->name);
4897
4898         status = mgmt_le_support(hdev);
4899         if (status)
4900                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4901                                        status);
4902
4903         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4905                                        MGMT_STATUS_INVALID_PARAMS);
4906
4907         hci_dev_lock(hdev);
4908
4909         val = !!cp->val;
4910
4911         /* The following conditions are ones which mean that we should
4912          * not do any HCI communication but directly send a mgmt
4913          * response to user space (after toggling the flag if
4914          * necessary).
4915          */
4916         if (!hdev_is_powered(hdev) ||
4917             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4918              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4919             hci_conn_num(hdev, LE_LINK) > 0 ||
4920             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4921              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4922                 bool changed;
4923
4924                 if (cp->val) {
4925                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4926                         if (cp->val == 0x02)
4927                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4928                         else
4929                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4930                 } else {
4931                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4932                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4933                 }
4934
4935                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4936                 if (err < 0)
4937                         goto unlock;
4938
4939                 if (changed)
4940                         err = new_settings(hdev, sk);
4941
4942                 goto unlock;
4943         }
4944
4945         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4946             pending_find(MGMT_OP_SET_LE, hdev)) {
4947                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4948                                       MGMT_STATUS_BUSY);
4949                 goto unlock;
4950         }
4951
4952         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4953         if (!cmd) {
4954                 err = -ENOMEM;
4955                 goto unlock;
4956         }
4957
4958         hci_req_init(&req, hdev);
4959
4960         if (cp->val == 0x02)
4961                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4962         else
4963                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4964
4965         cancel_adv_timeout(hdev);
4966
4967         if (val) {
4968                 /* Switch to instance "0" for the Set Advertising setting.
4969                  * We cannot use update_[adv|scan_rsp]_data() here as the
4970                  * HCI_ADVERTISING flag is not yet set.
4971                  */
4972                 update_inst_adv_data(&req, 0x00);
4973                 update_inst_scan_rsp_data(&req, 0x00);
4974                 enable_advertising(&req);
4975         } else {
4976                 disable_advertising(&req);
4977         }
4978
4979         err = hci_req_run(&req, set_advertising_complete);
4980         if (err < 0)
4981                 mgmt_pending_remove(cmd);
4982
4983 unlock:
4984         hci_dev_unlock(hdev);
4985         return err;
4986 }
4987
4988 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4989                               void *data, u16 len)
4990 {
4991         struct mgmt_cp_set_static_address *cp = data;
4992         int err;
4993
4994         BT_DBG("%s", hdev->name);
4995
4996         if (!lmp_le_capable(hdev))
4997                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4998                                        MGMT_STATUS_NOT_SUPPORTED);
4999
5000         if (hdev_is_powered(hdev))
5001                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5002                                        MGMT_STATUS_REJECTED);
5003
5004         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5005                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5006                         return mgmt_cmd_status(sk, hdev->id,
5007                                                MGMT_OP_SET_STATIC_ADDRESS,
5008                                                MGMT_STATUS_INVALID_PARAMS);
5009
5010                 /* Two most significant bits shall be set */
5011                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5012                         return mgmt_cmd_status(sk, hdev->id,
5013                                                MGMT_OP_SET_STATIC_ADDRESS,
5014                                                MGMT_STATUS_INVALID_PARAMS);
5015         }
5016
5017         hci_dev_lock(hdev);
5018
5019         bacpy(&hdev->static_addr, &cp->bdaddr);
5020
5021         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5022         if (err < 0)
5023                 goto unlock;
5024
5025         err = new_settings(hdev, sk);
5026
5027 unlock:
5028         hci_dev_unlock(hdev);
5029         return err;
5030 }
5031
5032 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5033                            void *data, u16 len)
5034 {
5035         struct mgmt_cp_set_scan_params *cp = data;
5036         __u16 interval, window;
5037         int err;
5038
5039         BT_DBG("%s", hdev->name);
5040
5041         if (!lmp_le_capable(hdev))
5042                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5043                                        MGMT_STATUS_NOT_SUPPORTED);
5044
5045         interval = __le16_to_cpu(cp->interval);
5046
5047         if (interval < 0x0004 || interval > 0x4000)
5048                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5049                                        MGMT_STATUS_INVALID_PARAMS);
5050
5051         window = __le16_to_cpu(cp->window);
5052
5053         if (window < 0x0004 || window > 0x4000)
5054                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5055                                        MGMT_STATUS_INVALID_PARAMS);
5056
5057         if (window > interval)
5058                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5059                                        MGMT_STATUS_INVALID_PARAMS);
5060
5061         hci_dev_lock(hdev);
5062
5063         hdev->le_scan_interval = interval;
5064         hdev->le_scan_window = window;
5065
5066         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5067                                 NULL, 0);
5068
5069         /* If background scan is running, restart it so new parameters are
5070          * loaded.
5071          */
5072         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5073             hdev->discovery.state == DISCOVERY_STOPPED) {
5074                 struct hci_request req;
5075
5076                 hci_req_init(&req, hdev);
5077
5078                 hci_req_add_le_scan_disable(&req);
5079                 hci_req_add_le_passive_scan(&req);
5080
5081                 hci_req_run(&req, NULL);
5082         }
5083
5084         hci_dev_unlock(hdev);
5085
5086         return err;
5087 }
5088
5089 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5090                                       u16 opcode)
5091 {
5092         struct mgmt_pending_cmd *cmd;
5093
5094         BT_DBG("status 0x%02x", status);
5095
5096         hci_dev_lock(hdev);
5097
5098         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5099         if (!cmd)
5100                 goto unlock;
5101
5102         if (status) {
5103                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5104                                 mgmt_status(status));
5105         } else {
5106                 struct mgmt_mode *cp = cmd->param;
5107
5108                 if (cp->val)
5109                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5110                 else
5111                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5112
5113                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5114                 new_settings(hdev, cmd->sk);
5115         }
5116
5117         mgmt_pending_remove(cmd);
5118
5119 unlock:
5120         hci_dev_unlock(hdev);
5121 }
5122
5123 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5124                                 void *data, u16 len)
5125 {
5126         struct mgmt_mode *cp = data;
5127         struct mgmt_pending_cmd *cmd;
5128         struct hci_request req;
5129         int err;
5130
5131         BT_DBG("%s", hdev->name);
5132
5133         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5134             hdev->hci_ver < BLUETOOTH_VER_1_2)
5135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5136                                        MGMT_STATUS_NOT_SUPPORTED);
5137
5138         if (cp->val != 0x00 && cp->val != 0x01)
5139                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5140                                        MGMT_STATUS_INVALID_PARAMS);
5141
5142         hci_dev_lock(hdev);
5143
5144         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5145                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5146                                       MGMT_STATUS_BUSY);
5147                 goto unlock;
5148         }
5149
5150         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5151                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5152                                         hdev);
5153                 goto unlock;
5154         }
5155
5156         if (!hdev_is_powered(hdev)) {
5157                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5158                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5159                                         hdev);
5160                 new_settings(hdev, sk);
5161                 goto unlock;
5162         }
5163
5164         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5165                                data, len);
5166         if (!cmd) {
5167                 err = -ENOMEM;
5168                 goto unlock;
5169         }
5170
5171         hci_req_init(&req, hdev);
5172
5173         write_fast_connectable(&req, cp->val);
5174
5175         err = hci_req_run(&req, fast_connectable_complete);
5176         if (err < 0) {
5177                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5178                                       MGMT_STATUS_FAILED);
5179                 mgmt_pending_remove(cmd);
5180         }
5181
5182 unlock:
5183         hci_dev_unlock(hdev);
5184
5185         return err;
5186 }
5187
5188 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5189 {
5190         struct mgmt_pending_cmd *cmd;
5191
5192         BT_DBG("status 0x%02x", status);
5193
5194         hci_dev_lock(hdev);
5195
5196         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5197         if (!cmd)
5198                 goto unlock;
5199
5200         if (status) {
5201                 u8 mgmt_err = mgmt_status(status);
5202
5203                 /* We need to restore the flag if related HCI commands
5204                  * failed.
5205                  */
5206                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5207
5208                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5209         } else {
5210                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5211                 new_settings(hdev, cmd->sk);
5212         }
5213
5214         mgmt_pending_remove(cmd);
5215
5216 unlock:
5217         hci_dev_unlock(hdev);
5218 }
5219
5220 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5221 {
5222         struct mgmt_mode *cp = data;
5223         struct mgmt_pending_cmd *cmd;
5224         struct hci_request req;
5225         int err;
5226
5227         BT_DBG("request for %s", hdev->name);
5228
5229         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5230                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5231                                        MGMT_STATUS_NOT_SUPPORTED);
5232
5233         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5234                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5235                                        MGMT_STATUS_REJECTED);
5236
5237         if (cp->val != 0x00 && cp->val != 0x01)
5238                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5239                                        MGMT_STATUS_INVALID_PARAMS);
5240
5241         hci_dev_lock(hdev);
5242
5243         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5244                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5245                 goto unlock;
5246         }
5247
5248         if (!hdev_is_powered(hdev)) {
5249                 if (!cp->val) {
5250                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5251                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5252                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5253                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5254                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5255                 }
5256
5257                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5258
5259                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5260                 if (err < 0)
5261                         goto unlock;
5262
5263                 err = new_settings(hdev, sk);
5264                 goto unlock;
5265         }
5266
5267         /* Reject disabling when powered on */
5268         if (!cp->val) {
5269                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5270                                       MGMT_STATUS_REJECTED);
5271                 goto unlock;
5272         } else {
5273                 /* When configuring a dual-mode controller to operate
5274                  * with LE only and using a static address, then switching
5275                  * BR/EDR back on is not allowed.
5276                  *
5277                  * Dual-mode controllers shall operate with the public
5278                  * address as its identity address for BR/EDR and LE. So
5279                  * reject the attempt to create an invalid configuration.
5280                  *
5281                  * The same restrictions applies when secure connections
5282                  * has been enabled. For BR/EDR this is a controller feature
5283                  * while for LE it is a host stack feature. This means that
5284                  * switching BR/EDR back on when secure connections has been
5285                  * enabled is not a supported transaction.
5286                  */
5287                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5288                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5289                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5290                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5291                                               MGMT_STATUS_REJECTED);
5292                         goto unlock;
5293                 }
5294         }
5295
5296         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5297                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5298                                       MGMT_STATUS_BUSY);
5299                 goto unlock;
5300         }
5301
5302         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5303         if (!cmd) {
5304                 err = -ENOMEM;
5305                 goto unlock;
5306         }
5307
5308         /* We need to flip the bit already here so that update_adv_data
5309          * generates the correct flags.
5310          */
5311         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5312
5313         hci_req_init(&req, hdev);
5314
5315         write_fast_connectable(&req, false);
5316         __hci_update_page_scan(&req);
5317
5318         /* Since only the advertising data flags will change, there
5319          * is no need to update the scan response data.
5320          */
5321         update_adv_data(&req);
5322
5323         err = hci_req_run(&req, set_bredr_complete);
5324         if (err < 0)
5325                 mgmt_pending_remove(cmd);
5326
5327 unlock:
5328         hci_dev_unlock(hdev);
5329         return err;
5330 }
5331
5332 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5333 {
5334         struct mgmt_pending_cmd *cmd;
5335         struct mgmt_mode *cp;
5336
5337         BT_DBG("%s status %u", hdev->name, status);
5338
5339         hci_dev_lock(hdev);
5340
5341         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5342         if (!cmd)
5343                 goto unlock;
5344
5345         if (status) {
5346                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5347                                 mgmt_status(status));
5348                 goto remove;
5349         }
5350
5351         cp = cmd->param;
5352
5353         switch (cp->val) {
5354         case 0x00:
5355                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5356                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5357                 break;
5358         case 0x01:
5359                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5360                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5361                 break;
5362         case 0x02:
5363                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5364                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5365                 break;
5366         }
5367
5368         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5369         new_settings(hdev, cmd->sk);
5370
5371 remove:
5372         mgmt_pending_remove(cmd);
5373 unlock:
5374         hci_dev_unlock(hdev);
5375 }
5376
5377 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5378                            void *data, u16 len)
5379 {
5380         struct mgmt_mode *cp = data;
5381         struct mgmt_pending_cmd *cmd;
5382         struct hci_request req;
5383         u8 val;
5384         int err;
5385
5386         BT_DBG("request for %s", hdev->name);
5387
5388         if (!lmp_sc_capable(hdev) &&
5389             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5391                                        MGMT_STATUS_NOT_SUPPORTED);
5392
5393         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5394             lmp_sc_capable(hdev) &&
5395             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5396                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5397                                        MGMT_STATUS_REJECTED);
5398
5399         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5401                                   MGMT_STATUS_INVALID_PARAMS);
5402
5403         hci_dev_lock(hdev);
5404
5405         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5406             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5407                 bool changed;
5408
5409                 if (cp->val) {
5410                         changed = !hci_dev_test_and_set_flag(hdev,
5411                                                              HCI_SC_ENABLED);
5412                         if (cp->val == 0x02)
5413                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5414                         else
5415                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5416                 } else {
5417                         changed = hci_dev_test_and_clear_flag(hdev,
5418                                                               HCI_SC_ENABLED);
5419                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5420                 }
5421
5422                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5423                 if (err < 0)
5424                         goto failed;
5425
5426                 if (changed)
5427                         err = new_settings(hdev, sk);
5428
5429                 goto failed;
5430         }
5431
5432         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5433                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5434                                       MGMT_STATUS_BUSY);
5435                 goto failed;
5436         }
5437
5438         val = !!cp->val;
5439
5440         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5441             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5442                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5443                 goto failed;
5444         }
5445
5446         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5447         if (!cmd) {
5448                 err = -ENOMEM;
5449                 goto failed;
5450         }
5451
5452         hci_req_init(&req, hdev);
5453         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5454         err = hci_req_run(&req, sc_enable_complete);
5455         if (err < 0) {
5456                 mgmt_pending_remove(cmd);
5457                 goto failed;
5458         }
5459
5460 failed:
5461         hci_dev_unlock(hdev);
5462         return err;
5463 }
5464
5465 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5466                           void *data, u16 len)
5467 {
5468         struct mgmt_mode *cp = data;
5469         bool changed, use_changed;
5470         int err;
5471
5472         BT_DBG("request for %s", hdev->name);
5473
5474         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5475                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5476                                        MGMT_STATUS_INVALID_PARAMS);
5477
5478         hci_dev_lock(hdev);
5479
5480         if (cp->val)
5481                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5482         else
5483                 changed = hci_dev_test_and_clear_flag(hdev,
5484                                                       HCI_KEEP_DEBUG_KEYS);
5485
5486         if (cp->val == 0x02)
5487                 use_changed = !hci_dev_test_and_set_flag(hdev,
5488                                                          HCI_USE_DEBUG_KEYS);
5489         else
5490                 use_changed = hci_dev_test_and_clear_flag(hdev,
5491                                                           HCI_USE_DEBUG_KEYS);
5492
5493         if (hdev_is_powered(hdev) && use_changed &&
5494             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5495                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5496                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5497                              sizeof(mode), &mode);
5498         }
5499
5500         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5501         if (err < 0)
5502                 goto unlock;
5503
5504         if (changed)
5505                 err = new_settings(hdev, sk);
5506
5507 unlock:
5508         hci_dev_unlock(hdev);
5509         return err;
5510 }
5511
5512 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5513                        u16 len)
5514 {
5515         struct mgmt_cp_set_privacy *cp = cp_data;
5516         bool changed;
5517         int err;
5518
5519         BT_DBG("request for %s", hdev->name);
5520
5521         if (!lmp_le_capable(hdev))
5522                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5523                                        MGMT_STATUS_NOT_SUPPORTED);
5524
5525         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5527                                        MGMT_STATUS_INVALID_PARAMS);
5528
5529         if (hdev_is_powered(hdev))
5530                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5531                                        MGMT_STATUS_REJECTED);
5532
5533         hci_dev_lock(hdev);
5534
5535         /* If user space supports this command it is also expected to
5536          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5537          */
5538         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5539
5540         if (cp->privacy) {
5541                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5542                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5543                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5544         } else {
5545                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5546                 memset(hdev->irk, 0, sizeof(hdev->irk));
5547                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5548         }
5549
5550         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5551         if (err < 0)
5552                 goto unlock;
5553
5554         if (changed)
5555                 err = new_settings(hdev, sk);
5556
5557 unlock:
5558         hci_dev_unlock(hdev);
5559         return err;
5560 }
5561
5562 static bool irk_is_valid(struct mgmt_irk_info *irk)
5563 {
5564         switch (irk->addr.type) {
5565         case BDADDR_LE_PUBLIC:
5566                 return true;
5567
5568         case BDADDR_LE_RANDOM:
5569                 /* Two most significant bits shall be set */
5570                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5571                         return false;
5572                 return true;
5573         }
5574
5575         return false;
5576 }
5577
5578 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5579                      u16 len)
5580 {
5581         struct mgmt_cp_load_irks *cp = cp_data;
5582         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5583                                    sizeof(struct mgmt_irk_info));
5584         u16 irk_count, expected_len;
5585         int i, err;
5586
5587         BT_DBG("request for %s", hdev->name);
5588
5589         if (!lmp_le_capable(hdev))
5590                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5591                                        MGMT_STATUS_NOT_SUPPORTED);
5592
5593         irk_count = __le16_to_cpu(cp->irk_count);
5594         if (irk_count > max_irk_count) {
5595                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5596                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5597                                        MGMT_STATUS_INVALID_PARAMS);
5598         }
5599
5600         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5601         if (expected_len != len) {
5602                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5603                        expected_len, len);
5604                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5605                                        MGMT_STATUS_INVALID_PARAMS);
5606         }
5607
5608         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5609
5610         for (i = 0; i < irk_count; i++) {
5611                 struct mgmt_irk_info *key = &cp->irks[i];
5612
5613                 if (!irk_is_valid(key))
5614                         return mgmt_cmd_status(sk, hdev->id,
5615                                                MGMT_OP_LOAD_IRKS,
5616                                                MGMT_STATUS_INVALID_PARAMS);
5617         }
5618
5619         hci_dev_lock(hdev);
5620
5621         hci_smp_irks_clear(hdev);
5622
5623         for (i = 0; i < irk_count; i++) {
5624                 struct mgmt_irk_info *irk = &cp->irks[i];
5625
5626                 hci_add_irk(hdev, &irk->addr.bdaddr,
5627                             le_addr_type(irk->addr.type), irk->val,
5628                             BDADDR_ANY);
5629         }
5630
5631         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5632
5633         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5634
5635         hci_dev_unlock(hdev);
5636
5637         return err;
5638 }
5639
5640 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5641 {
5642         if (key->master != 0x00 && key->master != 0x01)
5643                 return false;
5644
5645         switch (key->addr.type) {
5646         case BDADDR_LE_PUBLIC:
5647                 return true;
5648
5649         case BDADDR_LE_RANDOM:
5650                 /* Two most significant bits shall be set */
5651                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5652                         return false;
5653                 return true;
5654         }
5655
5656         return false;
5657 }
5658
5659 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5660                                void *cp_data, u16 len)
5661 {
5662         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5663         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5664                                    sizeof(struct mgmt_ltk_info));
5665         u16 key_count, expected_len;
5666         int i, err;
5667
5668         BT_DBG("request for %s", hdev->name);
5669
5670         if (!lmp_le_capable(hdev))
5671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5672                                        MGMT_STATUS_NOT_SUPPORTED);
5673
5674         key_count = __le16_to_cpu(cp->key_count);
5675         if (key_count > max_key_count) {
5676                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5677                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5678                                        MGMT_STATUS_INVALID_PARAMS);
5679         }
5680
5681         expected_len = sizeof(*cp) + key_count *
5682                                         sizeof(struct mgmt_ltk_info);
5683         if (expected_len != len) {
5684                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5685                        expected_len, len);
5686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5687                                        MGMT_STATUS_INVALID_PARAMS);
5688         }
5689
5690         BT_DBG("%s key_count %u", hdev->name, key_count);
5691
5692         for (i = 0; i < key_count; i++) {
5693                 struct mgmt_ltk_info *key = &cp->keys[i];
5694
5695                 if (!ltk_is_valid(key))
5696                         return mgmt_cmd_status(sk, hdev->id,
5697                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5698                                                MGMT_STATUS_INVALID_PARAMS);
5699         }
5700
5701         hci_dev_lock(hdev);
5702
5703         hci_smp_ltks_clear(hdev);
5704
5705         for (i = 0; i < key_count; i++) {
5706                 struct mgmt_ltk_info *key = &cp->keys[i];
5707                 u8 type, authenticated;
5708
5709                 switch (key->type) {
5710                 case MGMT_LTK_UNAUTHENTICATED:
5711                         authenticated = 0x00;
5712                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5713                         break;
5714                 case MGMT_LTK_AUTHENTICATED:
5715                         authenticated = 0x01;
5716                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5717                         break;
5718                 case MGMT_LTK_P256_UNAUTH:
5719                         authenticated = 0x00;
5720                         type = SMP_LTK_P256;
5721                         break;
5722                 case MGMT_LTK_P256_AUTH:
5723                         authenticated = 0x01;
5724                         type = SMP_LTK_P256;
5725                         break;
5726                 case MGMT_LTK_P256_DEBUG:
5727                         authenticated = 0x00;
5728                         type = SMP_LTK_P256_DEBUG;
5729                 default:
5730                         continue;
5731                 }
5732
5733                 hci_add_ltk(hdev, &key->addr.bdaddr,
5734                             le_addr_type(key->addr.type), type, authenticated,
5735                             key->val, key->enc_size, key->ediv, key->rand);
5736         }
5737
5738         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5739                            NULL, 0);
5740
5741         hci_dev_unlock(hdev);
5742
5743         return err;
5744 }
5745
5746 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5747 {
5748         struct hci_conn *conn = cmd->user_data;
5749         struct mgmt_rp_get_conn_info rp;
5750         int err;
5751
5752         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5753
5754         if (status == MGMT_STATUS_SUCCESS) {
5755                 rp.rssi = conn->rssi;
5756                 rp.tx_power = conn->tx_power;
5757                 rp.max_tx_power = conn->max_tx_power;
5758         } else {
5759                 rp.rssi = HCI_RSSI_INVALID;
5760                 rp.tx_power = HCI_TX_POWER_INVALID;
5761                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5762         }
5763
5764         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5765                                 status, &rp, sizeof(rp));
5766
5767         hci_conn_drop(conn);
5768         hci_conn_put(conn);
5769
5770         return err;
5771 }
5772
5773 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5774                                        u16 opcode)
5775 {
5776         struct hci_cp_read_rssi *cp;
5777         struct mgmt_pending_cmd *cmd;
5778         struct hci_conn *conn;
5779         u16 handle;
5780         u8 status;
5781
5782         BT_DBG("status 0x%02x", hci_status);
5783
5784         hci_dev_lock(hdev);
5785
5786         /* Commands sent in request are either Read RSSI or Read Transmit Power
5787          * Level so we check which one was last sent to retrieve connection
5788          * handle.  Both commands have handle as first parameter so it's safe to
5789          * cast data on the same command struct.
5790          *
5791          * First command sent is always Read RSSI and we fail only if it fails.
5792          * In other case we simply override error to indicate success as we
5793          * already remembered if TX power value is actually valid.
5794          */
5795         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5796         if (!cp) {
5797                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5798                 status = MGMT_STATUS_SUCCESS;
5799         } else {
5800                 status = mgmt_status(hci_status);
5801         }
5802
5803         if (!cp) {
5804                 BT_ERR("invalid sent_cmd in conn_info response");
5805                 goto unlock;
5806         }
5807
5808         handle = __le16_to_cpu(cp->handle);
5809         conn = hci_conn_hash_lookup_handle(hdev, handle);
5810         if (!conn) {
5811                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5812                 goto unlock;
5813         }
5814
5815         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5816         if (!cmd)
5817                 goto unlock;
5818
5819         cmd->cmd_complete(cmd, status);
5820         mgmt_pending_remove(cmd);
5821
5822 unlock:
5823         hci_dev_unlock(hdev);
5824 }
5825
5826 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5827                          u16 len)
5828 {
5829         struct mgmt_cp_get_conn_info *cp = data;
5830         struct mgmt_rp_get_conn_info rp;
5831         struct hci_conn *conn;
5832         unsigned long conn_info_age;
5833         int err = 0;
5834
5835         BT_DBG("%s", hdev->name);
5836
5837         memset(&rp, 0, sizeof(rp));
5838         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5839         rp.addr.type = cp->addr.type;
5840
5841         if (!bdaddr_type_is_valid(cp->addr.type))
5842                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5843                                          MGMT_STATUS_INVALID_PARAMS,
5844                                          &rp, sizeof(rp));
5845
5846         hci_dev_lock(hdev);
5847
5848         if (!hdev_is_powered(hdev)) {
5849                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5850                                         MGMT_STATUS_NOT_POWERED, &rp,
5851                                         sizeof(rp));
5852                 goto unlock;
5853         }
5854
5855         if (cp->addr.type == BDADDR_BREDR)
5856                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5857                                                &cp->addr.bdaddr);
5858         else
5859                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5860
5861         if (!conn || conn->state != BT_CONNECTED) {
5862                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5863                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5864                                         sizeof(rp));
5865                 goto unlock;
5866         }
5867
5868         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5869                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5870                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5871                 goto unlock;
5872         }
5873
5874         /* To avoid client trying to guess when to poll again for information we
5875          * calculate conn info age as random value between min/max set in hdev.
5876          */
5877         conn_info_age = hdev->conn_info_min_age +
5878                         prandom_u32_max(hdev->conn_info_max_age -
5879                                         hdev->conn_info_min_age);
5880
5881         /* Query controller to refresh cached values if they are too old or were
5882          * never read.
5883          */
5884         if (time_after(jiffies, conn->conn_info_timestamp +
5885                        msecs_to_jiffies(conn_info_age)) ||
5886             !conn->conn_info_timestamp) {
5887                 struct hci_request req;
5888                 struct hci_cp_read_tx_power req_txp_cp;
5889                 struct hci_cp_read_rssi req_rssi_cp;
5890                 struct mgmt_pending_cmd *cmd;
5891
5892                 hci_req_init(&req, hdev);
5893                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5894                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5895                             &req_rssi_cp);
5896
5897                 /* For LE links TX power does not change thus we don't need to
5898                  * query for it once value is known.
5899                  */
5900                 if (!bdaddr_type_is_le(cp->addr.type) ||
5901                     conn->tx_power == HCI_TX_POWER_INVALID) {
5902                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5903                         req_txp_cp.type = 0x00;
5904                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5905                                     sizeof(req_txp_cp), &req_txp_cp);
5906                 }
5907
5908                 /* Max TX power needs to be read only once per connection */
5909                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5910                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5911                         req_txp_cp.type = 0x01;
5912                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5913                                     sizeof(req_txp_cp), &req_txp_cp);
5914                 }
5915
5916                 err = hci_req_run(&req, conn_info_refresh_complete);
5917                 if (err < 0)
5918                         goto unlock;
5919
5920                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5921                                        data, len);
5922                 if (!cmd) {
5923                         err = -ENOMEM;
5924                         goto unlock;
5925                 }
5926
5927                 hci_conn_hold(conn);
5928                 cmd->user_data = hci_conn_get(conn);
5929                 cmd->cmd_complete = conn_info_cmd_complete;
5930
5931                 conn->conn_info_timestamp = jiffies;
5932         } else {
5933                 /* Cache is valid, just reply with values cached in hci_conn */
5934                 rp.rssi = conn->rssi;
5935                 rp.tx_power = conn->tx_power;
5936                 rp.max_tx_power = conn->max_tx_power;
5937
5938                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5939                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5940         }
5941
5942 unlock:
5943         hci_dev_unlock(hdev);
5944         return err;
5945 }
5946
5947 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5948 {
5949         struct hci_conn *conn = cmd->user_data;
5950         struct mgmt_rp_get_clock_info rp;
5951         struct hci_dev *hdev;
5952         int err;
5953
5954         memset(&rp, 0, sizeof(rp));
5955         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5956
5957         if (status)
5958                 goto complete;
5959
5960         hdev = hci_dev_get(cmd->index);
5961         if (hdev) {
5962                 rp.local_clock = cpu_to_le32(hdev->clock);
5963                 hci_dev_put(hdev);
5964         }
5965
5966         if (conn) {
5967                 rp.piconet_clock = cpu_to_le32(conn->clock);
5968                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5969         }
5970
5971 complete:
5972         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5973                                 sizeof(rp));
5974
5975         if (conn) {
5976                 hci_conn_drop(conn);
5977                 hci_conn_put(conn);
5978         }
5979
5980         return err;
5981 }
5982
5983 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5984 {
5985         struct hci_cp_read_clock *hci_cp;
5986         struct mgmt_pending_cmd *cmd;
5987         struct hci_conn *conn;
5988
5989         BT_DBG("%s status %u", hdev->name, status);
5990
5991         hci_dev_lock(hdev);
5992
5993         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5994         if (!hci_cp)
5995                 goto unlock;
5996
5997         if (hci_cp->which) {
5998                 u16 handle = __le16_to_cpu(hci_cp->handle);
5999                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6000         } else {
6001                 conn = NULL;
6002         }
6003
6004         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6005         if (!cmd)
6006                 goto unlock;
6007
6008         cmd->cmd_complete(cmd, mgmt_status(status));
6009         mgmt_pending_remove(cmd);
6010
6011 unlock:
6012         hci_dev_unlock(hdev);
6013 }
6014
6015 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6016                          u16 len)
6017 {
6018         struct mgmt_cp_get_clock_info *cp = data;
6019         struct mgmt_rp_get_clock_info rp;
6020         struct hci_cp_read_clock hci_cp;
6021         struct mgmt_pending_cmd *cmd;
6022         struct hci_request req;
6023         struct hci_conn *conn;
6024         int err;
6025
6026         BT_DBG("%s", hdev->name);
6027
6028         memset(&rp, 0, sizeof(rp));
6029         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6030         rp.addr.type = cp->addr.type;
6031
6032         if (cp->addr.type != BDADDR_BREDR)
6033                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6034                                          MGMT_STATUS_INVALID_PARAMS,
6035                                          &rp, sizeof(rp));
6036
6037         hci_dev_lock(hdev);
6038
6039         if (!hdev_is_powered(hdev)) {
6040                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6041                                         MGMT_STATUS_NOT_POWERED, &rp,
6042                                         sizeof(rp));
6043                 goto unlock;
6044         }
6045
6046         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6047                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6048                                                &cp->addr.bdaddr);
6049                 if (!conn || conn->state != BT_CONNECTED) {
6050                         err = mgmt_cmd_complete(sk, hdev->id,
6051                                                 MGMT_OP_GET_CLOCK_INFO,
6052                                                 MGMT_STATUS_NOT_CONNECTED,
6053                                                 &rp, sizeof(rp));
6054                         goto unlock;
6055                 }
6056         } else {
6057                 conn = NULL;
6058         }
6059
6060         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6061         if (!cmd) {
6062                 err = -ENOMEM;
6063                 goto unlock;
6064         }
6065
6066         cmd->cmd_complete = clock_info_cmd_complete;
6067
6068         hci_req_init(&req, hdev);
6069
6070         memset(&hci_cp, 0, sizeof(hci_cp));
6071         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6072
6073         if (conn) {
6074                 hci_conn_hold(conn);
6075                 cmd->user_data = hci_conn_get(conn);
6076
6077                 hci_cp.handle = cpu_to_le16(conn->handle);
6078                 hci_cp.which = 0x01; /* Piconet clock */
6079                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6080         }
6081
6082         err = hci_req_run(&req, get_clock_info_complete);
6083         if (err < 0)
6084                 mgmt_pending_remove(cmd);
6085
6086 unlock:
6087         hci_dev_unlock(hdev);
6088         return err;
6089 }
6090
6091 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6092 {
6093         struct hci_conn *conn;
6094
6095         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6096         if (!conn)
6097                 return false;
6098
6099         if (conn->dst_type != type)
6100                 return false;
6101
6102         if (conn->state != BT_CONNECTED)
6103                 return false;
6104
6105         return true;
6106 }
6107
6108 /* This function requires the caller holds hdev->lock */
6109 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6110                                u8 addr_type, u8 auto_connect)
6111 {
6112         struct hci_dev *hdev = req->hdev;
6113         struct hci_conn_params *params;
6114
6115         params = hci_conn_params_add(hdev, addr, addr_type);
6116         if (!params)
6117                 return -EIO;
6118
6119         if (params->auto_connect == auto_connect)
6120                 return 0;
6121
6122         list_del_init(&params->action);
6123
6124         switch (auto_connect) {
6125         case HCI_AUTO_CONN_DISABLED:
6126         case HCI_AUTO_CONN_LINK_LOSS:
6127                 /* If auto connect is being disabled when we're trying to
6128                  * connect to device, keep connecting.
6129                  */
6130                 if (params->explicit_connect)
6131                         list_add(&params->action, &hdev->pend_le_conns);
6132
6133                 __hci_update_background_scan(req);
6134                 break;
6135         case HCI_AUTO_CONN_REPORT:
6136                 if (params->explicit_connect)
6137                         list_add(&params->action, &hdev->pend_le_conns);
6138                 else
6139                         list_add(&params->action, &hdev->pend_le_reports);
6140                 __hci_update_background_scan(req);
6141                 break;
6142         case HCI_AUTO_CONN_DIRECT:
6143         case HCI_AUTO_CONN_ALWAYS:
6144                 if (!is_connected(hdev, addr, addr_type)) {
6145                         list_add(&params->action, &hdev->pend_le_conns);
6146                         /* If we are in scan phase of connecting, we were
6147                          * already added to pend_le_conns and scanning.
6148                          */
6149                         if (params->auto_connect != HCI_AUTO_CONN_EXPLICIT)
6150                                 __hci_update_background_scan(req);
6151                 }
6152                 break;
6153         }
6154
6155         params->auto_connect = auto_connect;
6156
6157         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6158                auto_connect);
6159
6160         return 0;
6161 }
6162
6163 static void device_added(struct sock *sk, struct hci_dev *hdev,
6164                          bdaddr_t *bdaddr, u8 type, u8 action)
6165 {
6166         struct mgmt_ev_device_added ev;
6167
6168         bacpy(&ev.addr.bdaddr, bdaddr);
6169         ev.addr.type = type;
6170         ev.action = action;
6171
6172         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6173 }
6174
6175 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6176 {
6177         struct mgmt_pending_cmd *cmd;
6178
6179         BT_DBG("status 0x%02x", status);
6180
6181         hci_dev_lock(hdev);
6182
6183         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
6184         if (!cmd)
6185                 goto unlock;
6186
6187         cmd->cmd_complete(cmd, mgmt_status(status));
6188         mgmt_pending_remove(cmd);
6189
6190 unlock:
6191         hci_dev_unlock(hdev);
6192 }
6193
6194 static int add_device(struct sock *sk, struct hci_dev *hdev,
6195                       void *data, u16 len)
6196 {
6197         struct mgmt_cp_add_device *cp = data;
6198         struct mgmt_pending_cmd *cmd;
6199         struct hci_request req;
6200         u8 auto_conn, addr_type;
6201         int err;
6202
6203         BT_DBG("%s", hdev->name);
6204
6205         if (!bdaddr_type_is_valid(cp->addr.type) ||
6206             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6207                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6208                                          MGMT_STATUS_INVALID_PARAMS,
6209                                          &cp->addr, sizeof(cp->addr));
6210
6211         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6212                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6213                                          MGMT_STATUS_INVALID_PARAMS,
6214                                          &cp->addr, sizeof(cp->addr));
6215
6216         hci_req_init(&req, hdev);
6217
6218         hci_dev_lock(hdev);
6219
6220         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6221         if (!cmd) {
6222                 err = -ENOMEM;
6223                 goto unlock;
6224         }
6225
6226         cmd->cmd_complete = addr_cmd_complete;
6227
6228         if (cp->addr.type == BDADDR_BREDR) {
6229                 /* Only incoming connections action is supported for now */
6230                 if (cp->action != 0x01) {
6231                         err = cmd->cmd_complete(cmd,
6232                                                 MGMT_STATUS_INVALID_PARAMS);
6233                         mgmt_pending_remove(cmd);
6234                         goto unlock;
6235                 }
6236
6237                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6238                                           cp->addr.type);
6239                 if (err)
6240                         goto unlock;
6241
6242                 __hci_update_page_scan(&req);
6243
6244                 goto added;
6245         }
6246
6247         addr_type = le_addr_type(cp->addr.type);
6248
6249         if (cp->action == 0x02)
6250                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6251         else if (cp->action == 0x01)
6252                 auto_conn = HCI_AUTO_CONN_DIRECT;
6253         else
6254                 auto_conn = HCI_AUTO_CONN_REPORT;
6255
6256         /* Kernel internally uses conn_params with resolvable private
6257          * address, but Add Device allows only identity addresses.
6258          * Make sure it is enforced before calling
6259          * hci_conn_params_lookup.
6260          */
6261         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6262                 err = cmd->cmd_complete(cmd, MGMT_STATUS_INVALID_PARAMS);
6263                 mgmt_pending_remove(cmd);
6264                 goto unlock;
6265         }
6266
6267         /* If the connection parameters don't exist for this device,
6268          * they will be created and configured with defaults.
6269          */
6270         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
6271                                 auto_conn) < 0) {
6272                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
6273                 mgmt_pending_remove(cmd);
6274                 goto unlock;
6275         }
6276
6277 added:
6278         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6279
6280         err = hci_req_run(&req, add_device_complete);
6281         if (err < 0) {
6282                 /* ENODATA means no HCI commands were needed (e.g. if
6283                  * the adapter is powered off).
6284                  */
6285                 if (err == -ENODATA)
6286                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6287                 mgmt_pending_remove(cmd);
6288         }
6289
6290 unlock:
6291         hci_dev_unlock(hdev);
6292         return err;
6293 }
6294
6295 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6296                            bdaddr_t *bdaddr, u8 type)
6297 {
6298         struct mgmt_ev_device_removed ev;
6299
6300         bacpy(&ev.addr.bdaddr, bdaddr);
6301         ev.addr.type = type;
6302
6303         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6304 }
6305
6306 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6307 {
6308         struct mgmt_pending_cmd *cmd;
6309
6310         BT_DBG("status 0x%02x", status);
6311
6312         hci_dev_lock(hdev);
6313
6314         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6315         if (!cmd)
6316                 goto unlock;
6317
6318         cmd->cmd_complete(cmd, mgmt_status(status));
6319         mgmt_pending_remove(cmd);
6320
6321 unlock:
6322         hci_dev_unlock(hdev);
6323 }
6324
6325 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6326                          void *data, u16 len)
6327 {
6328         struct mgmt_cp_remove_device *cp = data;
6329         struct mgmt_pending_cmd *cmd;
6330         struct hci_request req;
6331         int err;
6332
6333         BT_DBG("%s", hdev->name);
6334
6335         hci_req_init(&req, hdev);
6336
6337         hci_dev_lock(hdev);
6338
6339         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6340         if (!cmd) {
6341                 err = -ENOMEM;
6342                 goto unlock;
6343         }
6344
6345         cmd->cmd_complete = addr_cmd_complete;
6346
6347         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6348                 struct hci_conn_params *params;
6349                 u8 addr_type;
6350
6351                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6352                         err = cmd->cmd_complete(cmd,
6353                                                 MGMT_STATUS_INVALID_PARAMS);
6354                         mgmt_pending_remove(cmd);
6355                         goto unlock;
6356                 }
6357
6358                 if (cp->addr.type == BDADDR_BREDR) {
6359                         err = hci_bdaddr_list_del(&hdev->whitelist,
6360                                                   &cp->addr.bdaddr,
6361                                                   cp->addr.type);
6362                         if (err) {
6363                                 err = cmd->cmd_complete(cmd,
6364                                                         MGMT_STATUS_INVALID_PARAMS);
6365                                 mgmt_pending_remove(cmd);
6366                                 goto unlock;
6367                         }
6368
6369                         __hci_update_page_scan(&req);
6370
6371                         device_removed(sk, hdev, &cp->addr.bdaddr,
6372                                        cp->addr.type);
6373                         goto complete;
6374                 }
6375
6376                 addr_type = le_addr_type(cp->addr.type);
6377
6378                 /* Kernel internally uses conn_params with resolvable private
6379                  * address, but Remove Device allows only identity addresses.
6380                  * Make sure it is enforced before calling
6381                  * hci_conn_params_lookup.
6382                  */
6383                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6384                         err = cmd->cmd_complete(cmd,
6385                                                 MGMT_STATUS_INVALID_PARAMS);
6386                         mgmt_pending_remove(cmd);
6387                         goto unlock;
6388                 }
6389
6390                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6391                                                 addr_type);
6392                 if (!params) {
6393                         err = cmd->cmd_complete(cmd,
6394                                                 MGMT_STATUS_INVALID_PARAMS);
6395                         mgmt_pending_remove(cmd);
6396                         goto unlock;
6397                 }
6398
6399                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6400                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6401                         err = cmd->cmd_complete(cmd,
6402                                                 MGMT_STATUS_INVALID_PARAMS);
6403                         mgmt_pending_remove(cmd);
6404                         goto unlock;
6405                 }
6406
6407                 list_del(&params->action);
6408                 list_del(&params->list);
6409                 kfree(params);
6410                 __hci_update_background_scan(&req);
6411
6412                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6413         } else {
6414                 struct hci_conn_params *p, *tmp;
6415                 struct bdaddr_list *b, *btmp;
6416
6417                 if (cp->addr.type) {
6418                         err = cmd->cmd_complete(cmd,
6419                                                 MGMT_STATUS_INVALID_PARAMS);
6420                         mgmt_pending_remove(cmd);
6421                         goto unlock;
6422                 }
6423
6424                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6425                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6426                         list_del(&b->list);
6427                         kfree(b);
6428                 }
6429
6430                 __hci_update_page_scan(&req);
6431
6432                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6433                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6434                                 continue;
6435                         device_removed(sk, hdev, &p->addr, p->addr_type);
6436                         if (p->explicit_connect) {
6437                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6438                                 continue;
6439                         }
6440                         list_del(&p->action);
6441                         list_del(&p->list);
6442                         kfree(p);
6443                 }
6444
6445                 BT_DBG("All LE connection parameters were removed");
6446
6447                 __hci_update_background_scan(&req);
6448         }
6449
6450 complete:
6451         err = hci_req_run(&req, remove_device_complete);
6452         if (err < 0) {
6453                 /* ENODATA means no HCI commands were needed (e.g. if
6454                  * the adapter is powered off).
6455                  */
6456                 if (err == -ENODATA)
6457                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6458                 mgmt_pending_remove(cmd);
6459         }
6460
6461 unlock:
6462         hci_dev_unlock(hdev);
6463         return err;
6464 }
6465
6466 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6467                            u16 len)
6468 {
6469         struct mgmt_cp_load_conn_param *cp = data;
6470         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6471                                      sizeof(struct mgmt_conn_param));
6472         u16 param_count, expected_len;
6473         int i;
6474
6475         if (!lmp_le_capable(hdev))
6476                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6477                                        MGMT_STATUS_NOT_SUPPORTED);
6478
6479         param_count = __le16_to_cpu(cp->param_count);
6480         if (param_count > max_param_count) {
6481                 BT_ERR("load_conn_param: too big param_count value %u",
6482                        param_count);
6483                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6484                                        MGMT_STATUS_INVALID_PARAMS);
6485         }
6486
6487         expected_len = sizeof(*cp) + param_count *
6488                                         sizeof(struct mgmt_conn_param);
6489         if (expected_len != len) {
6490                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6491                        expected_len, len);
6492                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6493                                        MGMT_STATUS_INVALID_PARAMS);
6494         }
6495
6496         BT_DBG("%s param_count %u", hdev->name, param_count);
6497
6498         hci_dev_lock(hdev);
6499
6500         hci_conn_params_clear_disabled(hdev);
6501
6502         for (i = 0; i < param_count; i++) {
6503                 struct mgmt_conn_param *param = &cp->params[i];
6504                 struct hci_conn_params *hci_param;
6505                 u16 min, max, latency, timeout;
6506                 u8 addr_type;
6507
6508                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6509                        param->addr.type);
6510
6511                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6512                         addr_type = ADDR_LE_DEV_PUBLIC;
6513                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6514                         addr_type = ADDR_LE_DEV_RANDOM;
6515                 } else {
6516                         BT_ERR("Ignoring invalid connection parameters");
6517                         continue;
6518                 }
6519
6520                 min = le16_to_cpu(param->min_interval);
6521                 max = le16_to_cpu(param->max_interval);
6522                 latency = le16_to_cpu(param->latency);
6523                 timeout = le16_to_cpu(param->timeout);
6524
6525                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6526                        min, max, latency, timeout);
6527
6528                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6529                         BT_ERR("Ignoring invalid connection parameters");
6530                         continue;
6531                 }
6532
6533                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6534                                                 addr_type);
6535                 if (!hci_param) {
6536                         BT_ERR("Failed to add connection parameters");
6537                         continue;
6538                 }
6539
6540                 hci_param->conn_min_interval = min;
6541                 hci_param->conn_max_interval = max;
6542                 hci_param->conn_latency = latency;
6543                 hci_param->supervision_timeout = timeout;
6544         }
6545
6546         hci_dev_unlock(hdev);
6547
6548         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6549                                  NULL, 0);
6550 }
6551
6552 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6553                                void *data, u16 len)
6554 {
6555         struct mgmt_cp_set_external_config *cp = data;
6556         bool changed;
6557         int err;
6558
6559         BT_DBG("%s", hdev->name);
6560
6561         if (hdev_is_powered(hdev))
6562                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6563                                        MGMT_STATUS_REJECTED);
6564
6565         if (cp->config != 0x00 && cp->config != 0x01)
6566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6567                                          MGMT_STATUS_INVALID_PARAMS);
6568
6569         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6571                                        MGMT_STATUS_NOT_SUPPORTED);
6572
6573         hci_dev_lock(hdev);
6574
6575         if (cp->config)
6576                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6577         else
6578                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6579
6580         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6581         if (err < 0)
6582                 goto unlock;
6583
6584         if (!changed)
6585                 goto unlock;
6586
6587         err = new_options(hdev, sk);
6588
6589         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6590                 mgmt_index_removed(hdev);
6591
6592                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6593                         hci_dev_set_flag(hdev, HCI_CONFIG);
6594                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6595
6596                         queue_work(hdev->req_workqueue, &hdev->power_on);
6597                 } else {
6598                         set_bit(HCI_RAW, &hdev->flags);
6599                         mgmt_index_added(hdev);
6600                 }
6601         }
6602
6603 unlock:
6604         hci_dev_unlock(hdev);
6605         return err;
6606 }
6607
6608 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6609                               void *data, u16 len)
6610 {
6611         struct mgmt_cp_set_public_address *cp = data;
6612         bool changed;
6613         int err;
6614
6615         BT_DBG("%s", hdev->name);
6616
6617         if (hdev_is_powered(hdev))
6618                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6619                                        MGMT_STATUS_REJECTED);
6620
6621         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6622                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6623                                        MGMT_STATUS_INVALID_PARAMS);
6624
6625         if (!hdev->set_bdaddr)
6626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6627                                        MGMT_STATUS_NOT_SUPPORTED);
6628
6629         hci_dev_lock(hdev);
6630
6631         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6632         bacpy(&hdev->public_addr, &cp->bdaddr);
6633
6634         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6635         if (err < 0)
6636                 goto unlock;
6637
6638         if (!changed)
6639                 goto unlock;
6640
6641         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6642                 err = new_options(hdev, sk);
6643
6644         if (is_configured(hdev)) {
6645                 mgmt_index_removed(hdev);
6646
6647                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6648
6649                 hci_dev_set_flag(hdev, HCI_CONFIG);
6650                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6651
6652                 queue_work(hdev->req_workqueue, &hdev->power_on);
6653         }
6654
6655 unlock:
6656         hci_dev_unlock(hdev);
6657         return err;
6658 }
6659
6660 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6661                                   u8 data_len)
6662 {
6663         eir[eir_len++] = sizeof(type) + data_len;
6664         eir[eir_len++] = type;
6665         memcpy(&eir[eir_len], data, data_len);
6666         eir_len += data_len;
6667
6668         return eir_len;
6669 }
6670
6671 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6672                                              u16 opcode, struct sk_buff *skb)
6673 {
6674         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6675         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6676         u8 *h192, *r192, *h256, *r256;
6677         struct mgmt_pending_cmd *cmd;
6678         u16 eir_len;
6679         int err;
6680
6681         BT_DBG("%s status %u", hdev->name, status);
6682
6683         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6684         if (!cmd)
6685                 return;
6686
6687         mgmt_cp = cmd->param;
6688
6689         if (status) {
6690                 status = mgmt_status(status);
6691                 eir_len = 0;
6692
6693                 h192 = NULL;
6694                 r192 = NULL;
6695                 h256 = NULL;
6696                 r256 = NULL;
6697         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6698                 struct hci_rp_read_local_oob_data *rp;
6699
6700                 if (skb->len != sizeof(*rp)) {
6701                         status = MGMT_STATUS_FAILED;
6702                         eir_len = 0;
6703                 } else {
6704                         status = MGMT_STATUS_SUCCESS;
6705                         rp = (void *)skb->data;
6706
6707                         eir_len = 5 + 18 + 18;
6708                         h192 = rp->hash;
6709                         r192 = rp->rand;
6710                         h256 = NULL;
6711                         r256 = NULL;
6712                 }
6713         } else {
6714                 struct hci_rp_read_local_oob_ext_data *rp;
6715
6716                 if (skb->len != sizeof(*rp)) {
6717                         status = MGMT_STATUS_FAILED;
6718                         eir_len = 0;
6719                 } else {
6720                         status = MGMT_STATUS_SUCCESS;
6721                         rp = (void *)skb->data;
6722
6723                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6724                                 eir_len = 5 + 18 + 18;
6725                                 h192 = NULL;
6726                                 r192 = NULL;
6727                         } else {
6728                                 eir_len = 5 + 18 + 18 + 18 + 18;
6729                                 h192 = rp->hash192;
6730                                 r192 = rp->rand192;
6731                         }
6732
6733                         h256 = rp->hash256;
6734                         r256 = rp->rand256;
6735                 }
6736         }
6737
6738         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6739         if (!mgmt_rp)
6740                 goto done;
6741
6742         if (status)
6743                 goto send_rsp;
6744
6745         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6746                                   hdev->dev_class, 3);
6747
6748         if (h192 && r192) {
6749                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6750                                           EIR_SSP_HASH_C192, h192, 16);
6751                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6752                                           EIR_SSP_RAND_R192, r192, 16);
6753         }
6754
6755         if (h256 && r256) {
6756                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6757                                           EIR_SSP_HASH_C256, h256, 16);
6758                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6759                                           EIR_SSP_RAND_R256, r256, 16);
6760         }
6761
6762 send_rsp:
6763         mgmt_rp->type = mgmt_cp->type;
6764         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6765
6766         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6767                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6768                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6769         if (err < 0 || status)
6770                 goto done;
6771
6772         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6773
6774         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6775                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6776                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6777 done:
6778         kfree(mgmt_rp);
6779         mgmt_pending_remove(cmd);
6780 }
6781
6782 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6783                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6784 {
6785         struct mgmt_pending_cmd *cmd;
6786         struct hci_request req;
6787         int err;
6788
6789         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6790                                cp, sizeof(*cp));
6791         if (!cmd)
6792                 return -ENOMEM;
6793
6794         hci_req_init(&req, hdev);
6795
6796         if (bredr_sc_enabled(hdev))
6797                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6798         else
6799                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6800
6801         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6802         if (err < 0) {
6803                 mgmt_pending_remove(cmd);
6804                 return err;
6805         }
6806
6807         return 0;
6808 }
6809
6810 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6811                                    void *data, u16 data_len)
6812 {
6813         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6814         struct mgmt_rp_read_local_oob_ext_data *rp;
6815         size_t rp_len;
6816         u16 eir_len;
6817         u8 status, flags, role, addr[7], hash[16], rand[16];
6818         int err;
6819
6820         BT_DBG("%s", hdev->name);
6821
6822         if (hdev_is_powered(hdev)) {
6823                 switch (cp->type) {
6824                 case BIT(BDADDR_BREDR):
6825                         status = mgmt_bredr_support(hdev);
6826                         if (status)
6827                                 eir_len = 0;
6828                         else
6829                                 eir_len = 5;
6830                         break;
6831                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6832                         status = mgmt_le_support(hdev);
6833                         if (status)
6834                                 eir_len = 0;
6835                         else
6836                                 eir_len = 9 + 3 + 18 + 18 + 3;
6837                         break;
6838                 default:
6839                         status = MGMT_STATUS_INVALID_PARAMS;
6840                         eir_len = 0;
6841                         break;
6842                 }
6843         } else {
6844                 status = MGMT_STATUS_NOT_POWERED;
6845                 eir_len = 0;
6846         }
6847
6848         rp_len = sizeof(*rp) + eir_len;
6849         rp = kmalloc(rp_len, GFP_ATOMIC);
6850         if (!rp)
6851                 return -ENOMEM;
6852
6853         if (status)
6854                 goto complete;
6855
6856         hci_dev_lock(hdev);
6857
6858         eir_len = 0;
6859         switch (cp->type) {
6860         case BIT(BDADDR_BREDR):
6861                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6862                         err = read_local_ssp_oob_req(hdev, sk, cp);
6863                         hci_dev_unlock(hdev);
6864                         if (!err)
6865                                 goto done;
6866
6867                         status = MGMT_STATUS_FAILED;
6868                         goto complete;
6869                 } else {
6870                         eir_len = eir_append_data(rp->eir, eir_len,
6871                                                   EIR_CLASS_OF_DEV,
6872                                                   hdev->dev_class, 3);
6873                 }
6874                 break;
6875         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6876                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6877                     smp_generate_oob(hdev, hash, rand) < 0) {
6878                         hci_dev_unlock(hdev);
6879                         status = MGMT_STATUS_FAILED;
6880                         goto complete;
6881                 }
6882
6883                 /* This should return the active RPA, but since the RPA
6884                  * is only programmed on demand, it is really hard to fill
6885                  * this in at the moment. For now disallow retrieving
6886                  * local out-of-band data when privacy is in use.
6887                  *
6888                  * Returning the identity address will not help here since
6889                  * pairing happens before the identity resolving key is
6890                  * known and thus the connection establishment happens
6891                  * based on the RPA and not the identity address.
6892                  */
6893                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6894                         hci_dev_unlock(hdev);
6895                         status = MGMT_STATUS_REJECTED;
6896                         goto complete;
6897                 }
6898
6899                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6900                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6901                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6902                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6903                         memcpy(addr, &hdev->static_addr, 6);
6904                         addr[6] = 0x01;
6905                 } else {
6906                         memcpy(addr, &hdev->bdaddr, 6);
6907                         addr[6] = 0x00;
6908                 }
6909
6910                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6911                                           addr, sizeof(addr));
6912
6913                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6914                         role = 0x02;
6915                 else
6916                         role = 0x01;
6917
6918                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6919                                           &role, sizeof(role));
6920
6921                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6922                         eir_len = eir_append_data(rp->eir, eir_len,
6923                                                   EIR_LE_SC_CONFIRM,
6924                                                   hash, sizeof(hash));
6925
6926                         eir_len = eir_append_data(rp->eir, eir_len,
6927                                                   EIR_LE_SC_RANDOM,
6928                                                   rand, sizeof(rand));
6929                 }
6930
6931                 flags = get_adv_discov_flags(hdev);
6932
6933                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6934                         flags |= LE_AD_NO_BREDR;
6935
6936                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6937                                           &flags, sizeof(flags));
6938                 break;
6939         }
6940
6941         hci_dev_unlock(hdev);
6942
6943         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6944
6945         status = MGMT_STATUS_SUCCESS;
6946
6947 complete:
6948         rp->type = cp->type;
6949         rp->eir_len = cpu_to_le16(eir_len);
6950
6951         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6952                                 status, rp, sizeof(*rp) + eir_len);
6953         if (err < 0 || status)
6954                 goto done;
6955
6956         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6957                                  rp, sizeof(*rp) + eir_len,
6958                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6959
6960 done:
6961         kfree(rp);
6962
6963         return err;
6964 }
6965
6966 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6967 {
6968         u32 flags = 0;
6969
6970         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6971         flags |= MGMT_ADV_FLAG_DISCOV;
6972         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6973         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6974
6975         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6976                 flags |= MGMT_ADV_FLAG_TX_POWER;
6977
6978         return flags;
6979 }
6980
6981 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6982                              void *data, u16 data_len)
6983 {
6984         struct mgmt_rp_read_adv_features *rp;
6985         size_t rp_len;
6986         int err, i;
6987         bool instance;
6988         struct adv_info *adv_instance;
6989         u32 supported_flags;
6990
6991         BT_DBG("%s", hdev->name);
6992
6993         if (!lmp_le_capable(hdev))
6994                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6995                                        MGMT_STATUS_REJECTED);
6996
6997         hci_dev_lock(hdev);
6998
6999         rp_len = sizeof(*rp);
7000
7001         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
7002         if (instance)
7003                 rp_len += hdev->adv_instance_cnt;
7004
7005         rp = kmalloc(rp_len, GFP_ATOMIC);
7006         if (!rp) {
7007                 hci_dev_unlock(hdev);
7008                 return -ENOMEM;
7009         }
7010
7011         supported_flags = get_supported_adv_flags(hdev);
7012
7013         rp->supported_flags = cpu_to_le32(supported_flags);
7014         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7015         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7016         rp->max_instances = HCI_MAX_ADV_INSTANCES;
7017
7018         if (instance) {
7019                 i = 0;
7020                 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7021                         if (i >= hdev->adv_instance_cnt)
7022                                 break;
7023
7024                         rp->instance[i] = adv_instance->instance;
7025                         i++;
7026                 }
7027                 rp->num_instances = hdev->adv_instance_cnt;
7028         } else {
7029                 rp->num_instances = 0;
7030         }
7031
7032         hci_dev_unlock(hdev);
7033
7034         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7035                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7036
7037         kfree(rp);
7038
7039         return err;
7040 }
7041
7042 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7043                               u8 len, bool is_adv_data)
7044 {
7045         u8 max_len = HCI_MAX_AD_LENGTH;
7046         int i, cur_len;
7047         bool flags_managed = false;
7048         bool tx_power_managed = false;
7049         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
7050                            MGMT_ADV_FLAG_MANAGED_FLAGS;
7051
7052         if (is_adv_data && (adv_flags & flags_params)) {
7053                 flags_managed = true;
7054                 max_len -= 3;
7055         }
7056
7057         if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
7058                 tx_power_managed = true;
7059                 max_len -= 3;
7060         }
7061
7062         if (len > max_len)
7063                 return false;
7064
7065         /* Make sure that the data is correctly formatted. */
7066         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7067                 cur_len = data[i];
7068
7069                 if (flags_managed && data[i + 1] == EIR_FLAGS)
7070                         return false;
7071
7072                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
7073                         return false;
7074
7075                 /* If the current field length would exceed the total data
7076                  * length, then it's invalid.
7077                  */
7078                 if (i + cur_len >= len)
7079                         return false;
7080         }
7081
7082         return true;
7083 }
7084
7085 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7086                                      u16 opcode)
7087 {
7088         struct mgmt_pending_cmd *cmd;
7089         struct mgmt_cp_add_advertising *cp;
7090         struct mgmt_rp_add_advertising rp;
7091         struct adv_info *adv_instance, *n;
7092         u8 instance;
7093
7094         BT_DBG("status %d", status);
7095
7096         hci_dev_lock(hdev);
7097
7098         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7099
7100         if (status)
7101                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
7102
7103         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7104                 if (!adv_instance->pending)
7105                         continue;
7106
7107                 if (!status) {
7108                         adv_instance->pending = false;
7109                         continue;
7110                 }
7111
7112                 instance = adv_instance->instance;
7113
7114                 if (hdev->cur_adv_instance == instance)
7115                         cancel_adv_timeout(hdev);
7116
7117                 hci_remove_adv_instance(hdev, instance);
7118                 advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7119         }
7120
7121         if (!cmd)
7122                 goto unlock;
7123
7124         cp = cmd->param;
7125         rp.instance = cp->instance;
7126
7127         if (status)
7128                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7129                                 mgmt_status(status));
7130         else
7131                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7132                                   mgmt_status(status), &rp, sizeof(rp));
7133
7134         mgmt_pending_remove(cmd);
7135
7136 unlock:
7137         hci_dev_unlock(hdev);
7138 }
7139
7140 void mgmt_adv_timeout_expired(struct hci_dev *hdev)
7141 {
7142         u8 instance;
7143         struct hci_request req;
7144
7145         hdev->adv_instance_timeout = 0;
7146
7147         instance = get_current_adv_instance(hdev);
7148         if (instance == 0x00)
7149                 return;
7150
7151         hci_dev_lock(hdev);
7152         hci_req_init(&req, hdev);
7153
7154         clear_adv_instance(hdev, &req, instance, false);
7155
7156         if (list_empty(&hdev->adv_instances))
7157                 disable_advertising(&req);
7158
7159         if (!skb_queue_empty(&req.cmd_q))
7160                 hci_req_run(&req, NULL);
7161
7162         hci_dev_unlock(hdev);
7163 }
7164
7165 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7166                            void *data, u16 data_len)
7167 {
7168         struct mgmt_cp_add_advertising *cp = data;
7169         struct mgmt_rp_add_advertising rp;
7170         u32 flags;
7171         u32 supported_flags;
7172         u8 status;
7173         u16 timeout, duration;
7174         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7175         u8 schedule_instance = 0;
7176         struct adv_info *next_instance;
7177         int err;
7178         struct mgmt_pending_cmd *cmd;
7179         struct hci_request req;
7180
7181         BT_DBG("%s", hdev->name);
7182
7183         status = mgmt_le_support(hdev);
7184         if (status)
7185                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7186                                        status);
7187
7188         flags = __le32_to_cpu(cp->flags);
7189         timeout = __le16_to_cpu(cp->timeout);
7190         duration = __le16_to_cpu(cp->duration);
7191
7192         /* The current implementation only supports a subset of the specified
7193          * flags.
7194          */
7195         supported_flags = get_supported_adv_flags(hdev);
7196         if (flags & ~supported_flags)
7197                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7198                                        MGMT_STATUS_INVALID_PARAMS);
7199
7200         hci_dev_lock(hdev);
7201
7202         if (timeout && !hdev_is_powered(hdev)) {
7203                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7204                                       MGMT_STATUS_REJECTED);
7205                 goto unlock;
7206         }
7207
7208         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7209             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7210             pending_find(MGMT_OP_SET_LE, hdev)) {
7211                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7212                                       MGMT_STATUS_BUSY);
7213                 goto unlock;
7214         }
7215
7216         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7217             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7218                                cp->scan_rsp_len, false)) {
7219                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7220                                       MGMT_STATUS_INVALID_PARAMS);
7221                 goto unlock;
7222         }
7223
7224         err = hci_add_adv_instance(hdev, cp->instance, flags,
7225                                    cp->adv_data_len, cp->data,
7226                                    cp->scan_rsp_len,
7227                                    cp->data + cp->adv_data_len,
7228                                    timeout, duration);
7229         if (err < 0) {
7230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7231                                       MGMT_STATUS_FAILED);
7232                 goto unlock;
7233         }
7234
7235         /* Only trigger an advertising added event if a new instance was
7236          * actually added.
7237          */
7238         if (hdev->adv_instance_cnt > prev_instance_cnt)
7239                 advertising_added(sk, hdev, cp->instance);
7240
7241         hci_dev_set_flag(hdev, HCI_ADVERTISING_INSTANCE);
7242
7243         if (hdev->cur_adv_instance == cp->instance) {
7244                 /* If the currently advertised instance is being changed then
7245                  * cancel the current advertising and schedule the next
7246                  * instance. If there is only one instance then the overridden
7247                  * advertising data will be visible right away.
7248                  */
7249                 cancel_adv_timeout(hdev);
7250
7251                 next_instance = hci_get_next_instance(hdev, cp->instance);
7252                 if (next_instance)
7253                         schedule_instance = next_instance->instance;
7254         } else if (!hdev->adv_instance_timeout) {
7255                 /* Immediately advertise the new instance if no other
7256                  * instance is currently being advertised.
7257                  */
7258                 schedule_instance = cp->instance;
7259         }
7260
7261         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7262          * there is no instance to be advertised then we have no HCI
7263          * communication to make. Simply return.
7264          */
7265         if (!hdev_is_powered(hdev) ||
7266             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7267             !schedule_instance) {
7268                 rp.instance = cp->instance;
7269                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7270                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7271                 goto unlock;
7272         }
7273
7274         /* We're good to go, update advertising data, parameters, and start
7275          * advertising.
7276          */
7277         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7278                                data_len);
7279         if (!cmd) {
7280                 err = -ENOMEM;
7281                 goto unlock;
7282         }
7283
7284         hci_req_init(&req, hdev);
7285
7286         err = schedule_adv_instance(&req, schedule_instance, true);
7287
7288         if (!err)
7289                 err = hci_req_run(&req, add_advertising_complete);
7290
7291         if (err < 0)
7292                 mgmt_pending_remove(cmd);
7293
7294 unlock:
7295         hci_dev_unlock(hdev);
7296
7297         return err;
7298 }
7299
7300 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7301                                         u16 opcode)
7302 {
7303         struct mgmt_pending_cmd *cmd;
7304         struct mgmt_cp_remove_advertising *cp;
7305         struct mgmt_rp_remove_advertising rp;
7306
7307         BT_DBG("status %d", status);
7308
7309         hci_dev_lock(hdev);
7310
7311         /* A failure status here only means that we failed to disable
7312          * advertising. Otherwise, the advertising instance has been removed,
7313          * so report success.
7314          */
7315         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7316         if (!cmd)
7317                 goto unlock;
7318
7319         cp = cmd->param;
7320         rp.instance = cp->instance;
7321
7322         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7323                           &rp, sizeof(rp));
7324         mgmt_pending_remove(cmd);
7325
7326 unlock:
7327         hci_dev_unlock(hdev);
7328 }
7329
7330 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7331                               void *data, u16 data_len)
7332 {
7333         struct mgmt_cp_remove_advertising *cp = data;
7334         struct mgmt_rp_remove_advertising rp;
7335         struct mgmt_pending_cmd *cmd;
7336         struct hci_request req;
7337         int err;
7338
7339         BT_DBG("%s", hdev->name);
7340
7341         hci_dev_lock(hdev);
7342
7343         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
7344                 err = mgmt_cmd_status(sk, hdev->id,
7345                                       MGMT_OP_REMOVE_ADVERTISING,
7346                                       MGMT_STATUS_INVALID_PARAMS);
7347                 goto unlock;
7348         }
7349
7350         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7351             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7352             pending_find(MGMT_OP_SET_LE, hdev)) {
7353                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7354                                       MGMT_STATUS_BUSY);
7355                 goto unlock;
7356         }
7357
7358         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7359                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7360                                       MGMT_STATUS_INVALID_PARAMS);
7361                 goto unlock;
7362         }
7363
7364         hci_req_init(&req, hdev);
7365
7366         clear_adv_instance(hdev, &req, cp->instance, true);
7367
7368         if (list_empty(&hdev->adv_instances))
7369                 disable_advertising(&req);
7370
7371         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7372          * flag is set or the device isn't powered then we have no HCI
7373          * communication to make. Simply return.
7374          */
7375         if (skb_queue_empty(&req.cmd_q) ||
7376             !hdev_is_powered(hdev) ||
7377             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7378                 rp.instance = cp->instance;
7379                 err = mgmt_cmd_complete(sk, hdev->id,
7380                                         MGMT_OP_REMOVE_ADVERTISING,
7381                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7382                 goto unlock;
7383         }
7384
7385         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7386                                data_len);
7387         if (!cmd) {
7388                 err = -ENOMEM;
7389                 goto unlock;
7390         }
7391
7392         err = hci_req_run(&req, remove_advertising_complete);
7393         if (err < 0)
7394                 mgmt_pending_remove(cmd);
7395
7396 unlock:
7397         hci_dev_unlock(hdev);
7398
7399         return err;
7400 }
7401
7402 static const struct hci_mgmt_handler mgmt_handlers[] = {
7403         { NULL }, /* 0x0000 (no command) */
7404         { read_version,            MGMT_READ_VERSION_SIZE,
7405                                                 HCI_MGMT_NO_HDEV |
7406                                                 HCI_MGMT_UNTRUSTED },
7407         { read_commands,           MGMT_READ_COMMANDS_SIZE,
7408                                                 HCI_MGMT_NO_HDEV |
7409                                                 HCI_MGMT_UNTRUSTED },
7410         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
7411                                                 HCI_MGMT_NO_HDEV |
7412                                                 HCI_MGMT_UNTRUSTED },
7413         { read_controller_info,    MGMT_READ_INFO_SIZE,
7414                                                 HCI_MGMT_UNTRUSTED },
7415         { set_powered,             MGMT_SETTING_SIZE },
7416         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
7417         { set_connectable,         MGMT_SETTING_SIZE },
7418         { set_fast_connectable,    MGMT_SETTING_SIZE },
7419         { set_bondable,            MGMT_SETTING_SIZE },
7420         { set_link_security,       MGMT_SETTING_SIZE },
7421         { set_ssp,                 MGMT_SETTING_SIZE },
7422         { set_hs,                  MGMT_SETTING_SIZE },
7423         { set_le,                  MGMT_SETTING_SIZE },
7424         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
7425         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
7426         { add_uuid,                MGMT_ADD_UUID_SIZE },
7427         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
7428         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
7429                                                 HCI_MGMT_VAR_LEN },
7430         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7431                                                 HCI_MGMT_VAR_LEN },
7432         { disconnect,              MGMT_DISCONNECT_SIZE },
7433         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
7434         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
7435         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
7436         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
7437         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
7438         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
7439         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
7440         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
7441         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7442         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
7443         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7444         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
7445         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7446                                                 HCI_MGMT_VAR_LEN },
7447         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7448         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
7449         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
7450         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
7451         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
7452         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
7453         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
7454         { set_advertising,         MGMT_SETTING_SIZE },
7455         { set_bredr,               MGMT_SETTING_SIZE },
7456         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
7457         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
7458         { set_secure_conn,         MGMT_SETTING_SIZE },
7459         { set_debug_keys,          MGMT_SETTING_SIZE },
7460         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
7461         { load_irks,               MGMT_LOAD_IRKS_SIZE,
7462                                                 HCI_MGMT_VAR_LEN },
7463         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
7464         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
7465         { add_device,              MGMT_ADD_DEVICE_SIZE },
7466         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
7467         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
7468                                                 HCI_MGMT_VAR_LEN },
7469         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7470                                                 HCI_MGMT_NO_HDEV |
7471                                                 HCI_MGMT_UNTRUSTED },
7472         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
7473                                                 HCI_MGMT_UNCONFIGURED |
7474                                                 HCI_MGMT_UNTRUSTED },
7475         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
7476                                                 HCI_MGMT_UNCONFIGURED },
7477         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
7478                                                 HCI_MGMT_UNCONFIGURED },
7479         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7480                                                 HCI_MGMT_VAR_LEN },
7481         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7482         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
7483                                                 HCI_MGMT_NO_HDEV |
7484                                                 HCI_MGMT_UNTRUSTED },
7485         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
7486         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
7487                                                 HCI_MGMT_VAR_LEN },
7488         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
7489 };
7490
7491 void mgmt_index_added(struct hci_dev *hdev)
7492 {
7493         struct mgmt_ev_ext_index ev;
7494
7495         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7496                 return;
7497
7498         switch (hdev->dev_type) {
7499         case HCI_BREDR:
7500                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7501                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7502                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7503                         ev.type = 0x01;
7504                 } else {
7505                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7506                                          HCI_MGMT_INDEX_EVENTS);
7507                         ev.type = 0x00;
7508                 }
7509                 break;
7510         case HCI_AMP:
7511                 ev.type = 0x02;
7512                 break;
7513         default:
7514                 return;
7515         }
7516
7517         ev.bus = hdev->bus;
7518
7519         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7520                          HCI_MGMT_EXT_INDEX_EVENTS);
7521 }
7522
7523 void mgmt_index_removed(struct hci_dev *hdev)
7524 {
7525         struct mgmt_ev_ext_index ev;
7526         u8 status = MGMT_STATUS_INVALID_INDEX;
7527
7528         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7529                 return;
7530
7531         switch (hdev->dev_type) {
7532         case HCI_BREDR:
7533                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7534
7535                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7536                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7537                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7538                         ev.type = 0x01;
7539                 } else {
7540                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7541                                          HCI_MGMT_INDEX_EVENTS);
7542                         ev.type = 0x00;
7543                 }
7544                 break;
7545         case HCI_AMP:
7546                 ev.type = 0x02;
7547                 break;
7548         default:
7549                 return;
7550         }
7551
7552         ev.bus = hdev->bus;
7553
7554         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7555                          HCI_MGMT_EXT_INDEX_EVENTS);
7556 }
7557
7558 /* This function requires the caller holds hdev->lock */
7559 static void restart_le_actions(struct hci_request *req)
7560 {
7561         struct hci_dev *hdev = req->hdev;
7562         struct hci_conn_params *p;
7563
7564         list_for_each_entry(p, &hdev->le_conn_params, list) {
7565                 /* Needed for AUTO_OFF case where might not "really"
7566                  * have been powered off.
7567                  */
7568                 list_del_init(&p->action);
7569
7570                 switch (p->auto_connect) {
7571                 case HCI_AUTO_CONN_DIRECT:
7572                 case HCI_AUTO_CONN_ALWAYS:
7573                         list_add(&p->action, &hdev->pend_le_conns);
7574                         break;
7575                 case HCI_AUTO_CONN_REPORT:
7576                         list_add(&p->action, &hdev->pend_le_reports);
7577                         break;
7578                 default:
7579                         break;
7580                 }
7581         }
7582
7583         __hci_update_background_scan(req);
7584 }
7585
7586 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7587 {
7588         struct cmd_lookup match = { NULL, hdev };
7589
7590         BT_DBG("status 0x%02x", status);
7591
7592         if (!status) {
7593                 /* Register the available SMP channels (BR/EDR and LE) only
7594                  * when successfully powering on the controller. This late
7595                  * registration is required so that LE SMP can clearly
7596                  * decide if the public address or static address is used.
7597                  */
7598                 smp_register(hdev);
7599         }
7600
7601         hci_dev_lock(hdev);
7602
7603         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7604
7605         new_settings(hdev, match.sk);
7606
7607         hci_dev_unlock(hdev);
7608
7609         if (match.sk)
7610                 sock_put(match.sk);
7611 }
7612
7613 static int powered_update_hci(struct hci_dev *hdev)
7614 {
7615         struct hci_request req;
7616         struct adv_info *adv_instance;
7617         u8 link_sec;
7618
7619         hci_req_init(&req, hdev);
7620
7621         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7622             !lmp_host_ssp_capable(hdev)) {
7623                 u8 mode = 0x01;
7624
7625                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7626
7627                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7628                         u8 support = 0x01;
7629
7630                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7631                                     sizeof(support), &support);
7632                 }
7633         }
7634
7635         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7636             lmp_bredr_capable(hdev)) {
7637                 struct hci_cp_write_le_host_supported cp;
7638
7639                 cp.le = 0x01;
7640                 cp.simul = 0x00;
7641
7642                 /* Check first if we already have the right
7643                  * host state (host features set)
7644                  */
7645                 if (cp.le != lmp_host_le_capable(hdev) ||
7646                     cp.simul != lmp_host_le_br_capable(hdev))
7647                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7648                                     sizeof(cp), &cp);
7649         }
7650
7651         if (lmp_le_capable(hdev)) {
7652                 /* Make sure the controller has a good default for
7653                  * advertising data. This also applies to the case
7654                  * where BR/EDR was toggled during the AUTO_OFF phase.
7655                  */
7656                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7657                     (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7658                      !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))) {
7659                         update_adv_data(&req);
7660                         update_scan_rsp_data(&req);
7661                 }
7662
7663                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7664                     hdev->cur_adv_instance == 0x00 &&
7665                     !list_empty(&hdev->adv_instances)) {
7666                         adv_instance = list_first_entry(&hdev->adv_instances,
7667                                                         struct adv_info, list);
7668                         hdev->cur_adv_instance = adv_instance->instance;
7669                 }
7670
7671                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7672                         enable_advertising(&req);
7673                 else if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7674                          hdev->cur_adv_instance)
7675                         schedule_adv_instance(&req, hdev->cur_adv_instance,
7676                                               true);
7677
7678                 restart_le_actions(&req);
7679         }
7680
7681         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7682         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7683                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7684                             sizeof(link_sec), &link_sec);
7685
7686         if (lmp_bredr_capable(hdev)) {
7687                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7688                         write_fast_connectable(&req, true);
7689                 else
7690                         write_fast_connectable(&req, false);
7691                 __hci_update_page_scan(&req);
7692                 update_class(&req);
7693                 update_name(&req);
7694                 update_eir(&req);
7695         }
7696
7697         return hci_req_run(&req, powered_complete);
7698 }
7699
7700 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7701 {
7702         struct cmd_lookup match = { NULL, hdev };
7703         u8 status, zero_cod[] = { 0, 0, 0 };
7704         int err;
7705
7706         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7707                 return 0;
7708
7709         if (powered) {
7710                 if (powered_update_hci(hdev) == 0)
7711                         return 0;
7712
7713                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7714                                      &match);
7715                 goto new_settings;
7716         }
7717
7718         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7719
7720         /* If the power off is because of hdev unregistration let
7721          * use the appropriate INVALID_INDEX status. Otherwise use
7722          * NOT_POWERED. We cover both scenarios here since later in
7723          * mgmt_index_removed() any hci_conn callbacks will have already
7724          * been triggered, potentially causing misleading DISCONNECTED
7725          * status responses.
7726          */
7727         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7728                 status = MGMT_STATUS_INVALID_INDEX;
7729         else
7730                 status = MGMT_STATUS_NOT_POWERED;
7731
7732         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7733
7734         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7735                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7736                                    zero_cod, sizeof(zero_cod), NULL);
7737
7738 new_settings:
7739         err = new_settings(hdev, match.sk);
7740
7741         if (match.sk)
7742                 sock_put(match.sk);
7743
7744         return err;
7745 }
7746
7747 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7748 {
7749         struct mgmt_pending_cmd *cmd;
7750         u8 status;
7751
7752         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7753         if (!cmd)
7754                 return;
7755
7756         if (err == -ERFKILL)
7757                 status = MGMT_STATUS_RFKILLED;
7758         else
7759                 status = MGMT_STATUS_FAILED;
7760
7761         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7762
7763         mgmt_pending_remove(cmd);
7764 }
7765
7766 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7767 {
7768         struct hci_request req;
7769
7770         hci_dev_lock(hdev);
7771
7772         /* When discoverable timeout triggers, then just make sure
7773          * the limited discoverable flag is cleared. Even in the case
7774          * of a timeout triggered from general discoverable, it is
7775          * safe to unconditionally clear the flag.
7776          */
7777         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7778         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7779
7780         hci_req_init(&req, hdev);
7781         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7782                 u8 scan = SCAN_PAGE;
7783                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7784                             sizeof(scan), &scan);
7785         }
7786         update_class(&req);
7787
7788         /* Advertising instances don't use the global discoverable setting, so
7789          * only update AD if advertising was enabled using Set Advertising.
7790          */
7791         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7792                 update_adv_data(&req);
7793
7794         hci_req_run(&req, NULL);
7795
7796         hdev->discov_timeout = 0;
7797
7798         new_settings(hdev, NULL);
7799
7800         hci_dev_unlock(hdev);
7801 }
7802
7803 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7804                        bool persistent)
7805 {
7806         struct mgmt_ev_new_link_key ev;
7807
7808         memset(&ev, 0, sizeof(ev));
7809
7810         ev.store_hint = persistent;
7811         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7812         ev.key.addr.type = BDADDR_BREDR;
7813         ev.key.type = key->type;
7814         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7815         ev.key.pin_len = key->pin_len;
7816
7817         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7818 }
7819
7820 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7821 {
7822         switch (ltk->type) {
7823         case SMP_LTK:
7824         case SMP_LTK_SLAVE:
7825                 if (ltk->authenticated)
7826                         return MGMT_LTK_AUTHENTICATED;
7827                 return MGMT_LTK_UNAUTHENTICATED;
7828         case SMP_LTK_P256:
7829                 if (ltk->authenticated)
7830                         return MGMT_LTK_P256_AUTH;
7831                 return MGMT_LTK_P256_UNAUTH;
7832         case SMP_LTK_P256_DEBUG:
7833                 return MGMT_LTK_P256_DEBUG;
7834         }
7835
7836         return MGMT_LTK_UNAUTHENTICATED;
7837 }
7838
7839 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7840 {
7841         struct mgmt_ev_new_long_term_key ev;
7842
7843         memset(&ev, 0, sizeof(ev));
7844
7845         /* Devices using resolvable or non-resolvable random addresses
7846          * without providing an identity resolving key don't require
7847          * to store long term keys. Their addresses will change the
7848          * next time around.
7849          *
7850          * Only when a remote device provides an identity address
7851          * make sure the long term key is stored. If the remote
7852          * identity is known, the long term keys are internally
7853          * mapped to the identity address. So allow static random
7854          * and public addresses here.
7855          */
7856         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7857             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7858                 ev.store_hint = 0x00;
7859         else
7860                 ev.store_hint = persistent;
7861
7862         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7863         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7864         ev.key.type = mgmt_ltk_type(key);
7865         ev.key.enc_size = key->enc_size;
7866         ev.key.ediv = key->ediv;
7867         ev.key.rand = key->rand;
7868
7869         if (key->type == SMP_LTK)
7870                 ev.key.master = 1;
7871
7872         /* Make sure we copy only the significant bytes based on the
7873          * encryption key size, and set the rest of the value to zeroes.
7874          */
7875         memcpy(ev.key.val, key->val, key->enc_size);
7876         memset(ev.key.val + key->enc_size, 0,
7877                sizeof(ev.key.val) - key->enc_size);
7878
7879         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7880 }
7881
7882 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7883 {
7884         struct mgmt_ev_new_irk ev;
7885
7886         memset(&ev, 0, sizeof(ev));
7887
7888         ev.store_hint = persistent;
7889
7890         bacpy(&ev.rpa, &irk->rpa);
7891         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7892         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7893         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7894
7895         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7896 }
7897
7898 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7899                    bool persistent)
7900 {
7901         struct mgmt_ev_new_csrk ev;
7902
7903         memset(&ev, 0, sizeof(ev));
7904
7905         /* Devices using resolvable or non-resolvable random addresses
7906          * without providing an identity resolving key don't require
7907          * to store signature resolving keys. Their addresses will change
7908          * the next time around.
7909          *
7910          * Only when a remote device provides an identity address
7911          * make sure the signature resolving key is stored. So allow
7912          * static random and public addresses here.
7913          */
7914         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7915             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7916                 ev.store_hint = 0x00;
7917         else
7918                 ev.store_hint = persistent;
7919
7920         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7921         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7922         ev.key.type = csrk->type;
7923         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7924
7925         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7926 }
7927
7928 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7929                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7930                          u16 max_interval, u16 latency, u16 timeout)
7931 {
7932         struct mgmt_ev_new_conn_param ev;
7933
7934         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7935                 return;
7936
7937         memset(&ev, 0, sizeof(ev));
7938         bacpy(&ev.addr.bdaddr, bdaddr);
7939         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7940         ev.store_hint = store_hint;
7941         ev.min_interval = cpu_to_le16(min_interval);
7942         ev.max_interval = cpu_to_le16(max_interval);
7943         ev.latency = cpu_to_le16(latency);
7944         ev.timeout = cpu_to_le16(timeout);
7945
7946         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7947 }
7948
7949 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7950                            u32 flags, u8 *name, u8 name_len)
7951 {
7952         char buf[512];
7953         struct mgmt_ev_device_connected *ev = (void *) buf;
7954         u16 eir_len = 0;
7955
7956         bacpy(&ev->addr.bdaddr, &conn->dst);
7957         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7958
7959         ev->flags = __cpu_to_le32(flags);
7960
7961         /* We must ensure that the EIR Data fields are ordered and
7962          * unique. Keep it simple for now and avoid the problem by not
7963          * adding any BR/EDR data to the LE adv.
7964          */
7965         if (conn->le_adv_data_len > 0) {
7966                 memcpy(&ev->eir[eir_len],
7967                        conn->le_adv_data, conn->le_adv_data_len);
7968                 eir_len = conn->le_adv_data_len;
7969         } else {
7970                 if (name_len > 0)
7971                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7972                                                   name, name_len);
7973
7974                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7975                         eir_len = eir_append_data(ev->eir, eir_len,
7976                                                   EIR_CLASS_OF_DEV,
7977                                                   conn->dev_class, 3);
7978         }
7979
7980         ev->eir_len = cpu_to_le16(eir_len);
7981
7982         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7983                     sizeof(*ev) + eir_len, NULL);
7984 }
7985
7986 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7987 {
7988         struct sock **sk = data;
7989
7990         cmd->cmd_complete(cmd, 0);
7991
7992         *sk = cmd->sk;
7993         sock_hold(*sk);
7994
7995         mgmt_pending_remove(cmd);
7996 }
7997
7998 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7999 {
8000         struct hci_dev *hdev = data;
8001         struct mgmt_cp_unpair_device *cp = cmd->param;
8002
8003         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8004
8005         cmd->cmd_complete(cmd, 0);
8006         mgmt_pending_remove(cmd);
8007 }
8008
8009 bool mgmt_powering_down(struct hci_dev *hdev)
8010 {
8011         struct mgmt_pending_cmd *cmd;
8012         struct mgmt_mode *cp;
8013
8014         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8015         if (!cmd)
8016                 return false;
8017
8018         cp = cmd->param;
8019         if (!cp->val)
8020                 return true;
8021
8022         return false;
8023 }
8024
8025 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8026                               u8 link_type, u8 addr_type, u8 reason,
8027                               bool mgmt_connected)
8028 {
8029         struct mgmt_ev_device_disconnected ev;
8030         struct sock *sk = NULL;
8031
8032         /* The connection is still in hci_conn_hash so test for 1
8033          * instead of 0 to know if this is the last one.
8034          */
8035         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8036                 cancel_delayed_work(&hdev->power_off);
8037                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8038         }
8039
8040         if (!mgmt_connected)
8041                 return;
8042
8043         if (link_type != ACL_LINK && link_type != LE_LINK)
8044                 return;
8045
8046         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8047
8048         bacpy(&ev.addr.bdaddr, bdaddr);
8049         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8050         ev.reason = reason;
8051
8052         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8053
8054         if (sk)
8055                 sock_put(sk);
8056
8057         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8058                              hdev);
8059 }
8060
8061 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8062                             u8 link_type, u8 addr_type, u8 status)
8063 {
8064         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8065         struct mgmt_cp_disconnect *cp;
8066         struct mgmt_pending_cmd *cmd;
8067
8068         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8069                              hdev);
8070
8071         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8072         if (!cmd)
8073                 return;
8074
8075         cp = cmd->param;
8076
8077         if (bacmp(bdaddr, &cp->addr.bdaddr))
8078                 return;
8079
8080         if (cp->addr.type != bdaddr_type)
8081                 return;
8082
8083         cmd->cmd_complete(cmd, mgmt_status(status));
8084         mgmt_pending_remove(cmd);
8085 }
8086
8087 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8088                          u8 addr_type, u8 status)
8089 {
8090         struct mgmt_ev_connect_failed ev;
8091
8092         /* The connection is still in hci_conn_hash so test for 1
8093          * instead of 0 to know if this is the last one.
8094          */
8095         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8096                 cancel_delayed_work(&hdev->power_off);
8097                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8098         }
8099
8100         bacpy(&ev.addr.bdaddr, bdaddr);
8101         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8102         ev.status = mgmt_status(status);
8103
8104         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8105 }
8106
8107 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8108 {
8109         struct mgmt_ev_pin_code_request ev;
8110
8111         bacpy(&ev.addr.bdaddr, bdaddr);
8112         ev.addr.type = BDADDR_BREDR;
8113         ev.secure = secure;
8114
8115         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8116 }
8117
8118 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8119                                   u8 status)
8120 {
8121         struct mgmt_pending_cmd *cmd;
8122
8123         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8124         if (!cmd)
8125                 return;
8126
8127         cmd->cmd_complete(cmd, mgmt_status(status));
8128         mgmt_pending_remove(cmd);
8129 }
8130
8131 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8132                                       u8 status)
8133 {
8134         struct mgmt_pending_cmd *cmd;
8135
8136         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8137         if (!cmd)
8138                 return;
8139
8140         cmd->cmd_complete(cmd, mgmt_status(status));
8141         mgmt_pending_remove(cmd);
8142 }
8143
8144 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8145                               u8 link_type, u8 addr_type, u32 value,
8146                               u8 confirm_hint)
8147 {
8148         struct mgmt_ev_user_confirm_request ev;
8149
8150         BT_DBG("%s", hdev->name);
8151
8152         bacpy(&ev.addr.bdaddr, bdaddr);
8153         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8154         ev.confirm_hint = confirm_hint;
8155         ev.value = cpu_to_le32(value);
8156
8157         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8158                           NULL);
8159 }
8160
8161 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8162                               u8 link_type, u8 addr_type)
8163 {
8164         struct mgmt_ev_user_passkey_request ev;
8165
8166         BT_DBG("%s", hdev->name);
8167
8168         bacpy(&ev.addr.bdaddr, bdaddr);
8169         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8170
8171         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8172                           NULL);
8173 }
8174
8175 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8176                                       u8 link_type, u8 addr_type, u8 status,
8177                                       u8 opcode)
8178 {
8179         struct mgmt_pending_cmd *cmd;
8180
8181         cmd = pending_find(opcode, hdev);
8182         if (!cmd)
8183                 return -ENOENT;
8184
8185         cmd->cmd_complete(cmd, mgmt_status(status));
8186         mgmt_pending_remove(cmd);
8187
8188         return 0;
8189 }
8190
8191 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8192                                      u8 link_type, u8 addr_type, u8 status)
8193 {
8194         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8195                                           status, MGMT_OP_USER_CONFIRM_REPLY);
8196 }
8197
8198 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8199                                          u8 link_type, u8 addr_type, u8 status)
8200 {
8201         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8202                                           status,
8203                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
8204 }
8205
8206 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8207                                      u8 link_type, u8 addr_type, u8 status)
8208 {
8209         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8210                                           status, MGMT_OP_USER_PASSKEY_REPLY);
8211 }
8212
8213 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8214                                          u8 link_type, u8 addr_type, u8 status)
8215 {
8216         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8217                                           status,
8218                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
8219 }
8220
8221 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8222                              u8 link_type, u8 addr_type, u32 passkey,
8223                              u8 entered)
8224 {
8225         struct mgmt_ev_passkey_notify ev;
8226
8227         BT_DBG("%s", hdev->name);
8228
8229         bacpy(&ev.addr.bdaddr, bdaddr);
8230         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8231         ev.passkey = __cpu_to_le32(passkey);
8232         ev.entered = entered;
8233
8234         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8235 }
8236
8237 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8238 {
8239         struct mgmt_ev_auth_failed ev;
8240         struct mgmt_pending_cmd *cmd;
8241         u8 status = mgmt_status(hci_status);
8242
8243         bacpy(&ev.addr.bdaddr, &conn->dst);
8244         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8245         ev.status = status;
8246
8247         cmd = find_pairing(conn);
8248
8249         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8250                     cmd ? cmd->sk : NULL);
8251
8252         if (cmd) {
8253                 cmd->cmd_complete(cmd, status);
8254                 mgmt_pending_remove(cmd);
8255         }
8256 }
8257
8258 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
8259 {
8260         struct cmd_lookup match = { NULL, hdev };
8261         bool changed;
8262
8263         if (status) {
8264                 u8 mgmt_err = mgmt_status(status);
8265                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8266                                      cmd_status_rsp, &mgmt_err);
8267                 return;
8268         }
8269
8270         if (test_bit(HCI_AUTH, &hdev->flags))
8271                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
8272         else
8273                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
8274
8275         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8276                              &match);
8277
8278         if (changed)
8279                 new_settings(hdev, match.sk);
8280
8281         if (match.sk)
8282                 sock_put(match.sk);
8283 }
8284
8285 static void clear_eir(struct hci_request *req)
8286 {
8287         struct hci_dev *hdev = req->hdev;
8288         struct hci_cp_write_eir cp;
8289
8290         if (!lmp_ext_inq_capable(hdev))
8291                 return;
8292
8293         memset(hdev->eir, 0, sizeof(hdev->eir));
8294
8295         memset(&cp, 0, sizeof(cp));
8296
8297         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8298 }
8299
8300 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8301 {
8302         struct cmd_lookup match = { NULL, hdev };
8303         struct hci_request req;
8304         bool changed = false;
8305
8306         if (status) {
8307                 u8 mgmt_err = mgmt_status(status);
8308
8309                 if (enable && hci_dev_test_and_clear_flag(hdev,
8310                                                           HCI_SSP_ENABLED)) {
8311                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8312                         new_settings(hdev, NULL);
8313                 }
8314
8315                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8316                                      &mgmt_err);
8317                 return;
8318         }
8319
8320         if (enable) {
8321                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
8322         } else {
8323                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
8324                 if (!changed)
8325                         changed = hci_dev_test_and_clear_flag(hdev,
8326                                                               HCI_HS_ENABLED);
8327                 else
8328                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8329         }
8330
8331         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8332
8333         if (changed)
8334                 new_settings(hdev, match.sk);
8335
8336         if (match.sk)
8337                 sock_put(match.sk);
8338
8339         hci_req_init(&req, hdev);
8340
8341         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8342                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
8343                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8344                                     sizeof(enable), &enable);
8345                 update_eir(&req);
8346         } else {
8347                 clear_eir(&req);
8348         }
8349
8350         hci_req_run(&req, NULL);
8351 }
8352
8353 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
8354 {
8355         struct cmd_lookup *match = data;
8356
8357         if (match->sk == NULL) {
8358                 match->sk = cmd->sk;
8359                 sock_hold(match->sk);
8360         }
8361 }
8362
8363 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8364                                     u8 status)
8365 {
8366         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8367
8368         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8369         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8370         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8371
8372         if (!status)
8373                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8374                                    dev_class, 3, NULL);
8375
8376         if (match.sk)
8377                 sock_put(match.sk);
8378 }
8379
8380 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8381 {
8382         struct mgmt_cp_set_local_name ev;
8383         struct mgmt_pending_cmd *cmd;
8384
8385         if (status)
8386                 return;
8387
8388         memset(&ev, 0, sizeof(ev));
8389         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
8390         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
8391
8392         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
8393         if (!cmd) {
8394                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
8395
8396                 /* If this is a HCI command related to powering on the
8397                  * HCI dev don't send any mgmt signals.
8398                  */
8399                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
8400                         return;
8401         }
8402
8403         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8404                            cmd ? cmd->sk : NULL);
8405 }
8406
8407 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8408 {
8409         int i;
8410
8411         for (i = 0; i < uuid_count; i++) {
8412                 if (!memcmp(uuid, uuids[i], 16))
8413                         return true;
8414         }
8415
8416         return false;
8417 }
8418
8419 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8420 {
8421         u16 parsed = 0;
8422
8423         while (parsed < eir_len) {
8424                 u8 field_len = eir[0];
8425                 u8 uuid[16];
8426                 int i;
8427
8428                 if (field_len == 0)
8429                         break;
8430
8431                 if (eir_len - parsed < field_len + 1)
8432                         break;
8433
8434                 switch (eir[1]) {
8435                 case EIR_UUID16_ALL:
8436                 case EIR_UUID16_SOME:
8437                         for (i = 0; i + 3 <= field_len; i += 2) {
8438                                 memcpy(uuid, bluetooth_base_uuid, 16);
8439                                 uuid[13] = eir[i + 3];
8440                                 uuid[12] = eir[i + 2];
8441                                 if (has_uuid(uuid, uuid_count, uuids))
8442                                         return true;
8443                         }
8444                         break;
8445                 case EIR_UUID32_ALL:
8446                 case EIR_UUID32_SOME:
8447                         for (i = 0; i + 5 <= field_len; i += 4) {
8448                                 memcpy(uuid, bluetooth_base_uuid, 16);
8449                                 uuid[15] = eir[i + 5];
8450                                 uuid[14] = eir[i + 4];
8451                                 uuid[13] = eir[i + 3];
8452                                 uuid[12] = eir[i + 2];
8453                                 if (has_uuid(uuid, uuid_count, uuids))
8454                                         return true;
8455                         }
8456                         break;
8457                 case EIR_UUID128_ALL:
8458                 case EIR_UUID128_SOME:
8459                         for (i = 0; i + 17 <= field_len; i += 16) {
8460                                 memcpy(uuid, eir + i + 2, 16);
8461                                 if (has_uuid(uuid, uuid_count, uuids))
8462                                         return true;
8463                         }
8464                         break;
8465                 }
8466
8467                 parsed += field_len + 1;
8468                 eir += field_len + 1;
8469         }
8470
8471         return false;
8472 }
8473
8474 static void restart_le_scan(struct hci_dev *hdev)
8475 {
8476         /* If controller is not scanning we are done. */
8477         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8478                 return;
8479
8480         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8481                        hdev->discovery.scan_start +
8482                        hdev->discovery.scan_duration))
8483                 return;
8484
8485         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8486                            DISCOV_LE_RESTART_DELAY);
8487 }
8488
8489 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8490                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8491 {
8492         /* If a RSSI threshold has been specified, and
8493          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8494          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8495          * is set, let it through for further processing, as we might need to
8496          * restart the scan.
8497          *
8498          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8499          * the results are also dropped.
8500          */
8501         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8502             (rssi == HCI_RSSI_INVALID ||
8503             (rssi < hdev->discovery.rssi &&
8504              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8505                 return  false;
8506
8507         if (hdev->discovery.uuid_count != 0) {
8508                 /* If a list of UUIDs is provided in filter, results with no
8509                  * matching UUID should be dropped.
8510                  */
8511                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8512                                    hdev->discovery.uuids) &&
8513                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8514                                    hdev->discovery.uuid_count,
8515                                    hdev->discovery.uuids))
8516                         return false;
8517         }
8518
8519         /* If duplicate filtering does not report RSSI changes, then restart
8520          * scanning to ensure updated result with updated RSSI values.
8521          */
8522         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8523                 restart_le_scan(hdev);
8524
8525                 /* Validate RSSI value against the RSSI threshold once more. */
8526                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8527                     rssi < hdev->discovery.rssi)
8528                         return false;
8529         }
8530
8531         return true;
8532 }
8533
8534 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8535                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8536                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8537 {
8538         char buf[512];
8539         struct mgmt_ev_device_found *ev = (void *)buf;
8540         size_t ev_size;
8541
8542         /* Don't send events for a non-kernel initiated discovery. With
8543          * LE one exception is if we have pend_le_reports > 0 in which
8544          * case we're doing passive scanning and want these events.
8545          */
8546         if (!hci_discovery_active(hdev)) {
8547                 if (link_type == ACL_LINK)
8548                         return;
8549                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8550                         return;
8551         }
8552
8553         if (hdev->discovery.result_filtering) {
8554                 /* We are using service discovery */
8555                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8556                                      scan_rsp_len))
8557                         return;
8558         }
8559
8560         /* Make sure that the buffer is big enough. The 5 extra bytes
8561          * are for the potential CoD field.
8562          */
8563         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8564                 return;
8565
8566         memset(buf, 0, sizeof(buf));
8567
8568         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8569          * RSSI value was reported as 0 when not available. This behavior
8570          * is kept when using device discovery. This is required for full
8571          * backwards compatibility with the API.
8572          *
8573          * However when using service discovery, the value 127 will be
8574          * returned when the RSSI is not available.
8575          */
8576         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8577             link_type == ACL_LINK)
8578                 rssi = 0;
8579
8580         bacpy(&ev->addr.bdaddr, bdaddr);
8581         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8582         ev->rssi = rssi;
8583         ev->flags = cpu_to_le32(flags);
8584
8585         if (eir_len > 0)
8586                 /* Copy EIR or advertising data into event */
8587                 memcpy(ev->eir, eir, eir_len);
8588
8589         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8590                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8591                                           dev_class, 3);
8592
8593         if (scan_rsp_len > 0)
8594                 /* Append scan response data to event */
8595                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8596
8597         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8598         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8599
8600         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8601 }
8602
8603 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8604                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8605 {
8606         struct mgmt_ev_device_found *ev;
8607         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8608         u16 eir_len;
8609
8610         ev = (struct mgmt_ev_device_found *) buf;
8611
8612         memset(buf, 0, sizeof(buf));
8613
8614         bacpy(&ev->addr.bdaddr, bdaddr);
8615         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8616         ev->rssi = rssi;
8617
8618         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8619                                   name_len);
8620
8621         ev->eir_len = cpu_to_le16(eir_len);
8622
8623         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8624 }
8625
8626 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8627 {
8628         struct mgmt_ev_discovering ev;
8629
8630         BT_DBG("%s discovering %u", hdev->name, discovering);
8631
8632         memset(&ev, 0, sizeof(ev));
8633         ev.type = hdev->discovery.type;
8634         ev.discovering = discovering;
8635
8636         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8637 }
8638
8639 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8640 {
8641         BT_DBG("%s status %u", hdev->name, status);
8642 }
8643
8644 void mgmt_reenable_advertising(struct hci_dev *hdev)
8645 {
8646         struct hci_request req;
8647         u8 instance;
8648
8649         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8650             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8651                 return;
8652
8653         instance = get_current_adv_instance(hdev);
8654
8655         hci_req_init(&req, hdev);
8656
8657         if (instance) {
8658                 schedule_adv_instance(&req, instance, true);
8659         } else {
8660                 update_adv_data(&req);
8661                 update_scan_rsp_data(&req);
8662                 enable_advertising(&req);
8663         }
8664
8665         hci_req_run(&req, adv_enable_complete);
8666 }
8667
8668 static struct hci_mgmt_chan chan = {
8669         .channel        = HCI_CHANNEL_CONTROL,
8670         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8671         .handlers       = mgmt_handlers,
8672         .hdev_init      = mgmt_init_hdev,
8673 };
8674
8675 int mgmt_init(void)
8676 {
8677         return hci_mgmt_chan_register(&chan);
8678 }
8679
8680 void mgmt_exit(void)
8681 {
8682         hci_mgmt_chan_unregister(&chan);
8683 }