net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42
  43 #define MGMT_VERSION    1
  44 #define MGMT_REVISION   14
  45
  46 static const u16 mgmt_commands[] = {
  47         MGMT_OP_READ_INDEX_LIST,
  48         MGMT_OP_READ_INFO,
  49         MGMT_OP_SET_POWERED,
  50         MGMT_OP_SET_DISCOVERABLE,
  51         MGMT_OP_SET_CONNECTABLE,
  52         MGMT_OP_SET_FAST_CONNECTABLE,
  53         MGMT_OP_SET_BONDABLE,
  54         MGMT_OP_SET_LINK_SECURITY,
  55         MGMT_OP_SET_SSP,
  56         MGMT_OP_SET_HS,
  57         MGMT_OP_SET_LE,
  58         MGMT_OP_SET_DEV_CLASS,
  59         MGMT_OP_SET_LOCAL_NAME,
  60         MGMT_OP_ADD_UUID,
  61         MGMT_OP_REMOVE_UUID,
  62         MGMT_OP_LOAD_LINK_KEYS,
  63         MGMT_OP_LOAD_LONG_TERM_KEYS,
  64         MGMT_OP_DISCONNECT,
  65         MGMT_OP_GET_CONNECTIONS,
  66         MGMT_OP_PIN_CODE_REPLY,
  67         MGMT_OP_PIN_CODE_NEG_REPLY,
  68         MGMT_OP_SET_IO_CAPABILITY,
  69         MGMT_OP_PAIR_DEVICE,
  70         MGMT_OP_CANCEL_PAIR_DEVICE,
  71         MGMT_OP_UNPAIR_DEVICE,
  72         MGMT_OP_USER_CONFIRM_REPLY,
  73         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  74         MGMT_OP_USER_PASSKEY_REPLY,
  75         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  76         MGMT_OP_READ_LOCAL_OOB_DATA,
  77         MGMT_OP_ADD_REMOTE_OOB_DATA,
  78         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  79         MGMT_OP_START_DISCOVERY,
  80         MGMT_OP_STOP_DISCOVERY,
  81         MGMT_OP_CONFIRM_NAME,
  82         MGMT_OP_BLOCK_DEVICE,
  83         MGMT_OP_UNBLOCK_DEVICE,
  84         MGMT_OP_SET_DEVICE_ID,
  85         MGMT_OP_SET_ADVERTISING,
  86         MGMT_OP_SET_BREDR,
  87         MGMT_OP_SET_STATIC_ADDRESS,
  88         MGMT_OP_SET_SCAN_PARAMS,
  89         MGMT_OP_SET_SECURE_CONN,
  90         MGMT_OP_SET_DEBUG_KEYS,
  91         MGMT_OP_SET_PRIVACY,
  92         MGMT_OP_LOAD_IRKS,
  93         MGMT_OP_GET_CONN_INFO,
  94         MGMT_OP_GET_CLOCK_INFO,
  95         MGMT_OP_ADD_DEVICE,
  96         MGMT_OP_REMOVE_DEVICE,
  97         MGMT_OP_LOAD_CONN_PARAM,
  98         MGMT_OP_READ_UNCONF_INDEX_LIST,
  99         MGMT_OP_READ_CONFIG_INFO,
 100         MGMT_OP_SET_EXTERNAL_CONFIG,
 101         MGMT_OP_SET_PUBLIC_ADDRESS,
 102         MGMT_OP_START_SERVICE_DISCOVERY,
 103         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 104         MGMT_OP_READ_EXT_INDEX_LIST,
 105         MGMT_OP_READ_ADV_FEATURES,
 106         MGMT_OP_ADD_ADVERTISING,
 107         MGMT_OP_REMOVE_ADVERTISING,
 108         MGMT_OP_GET_ADV_SIZE_INFO,
 109         MGMT_OP_START_LIMITED_DISCOVERY,
 110         MGMT_OP_READ_EXT_INFO,
 111         MGMT_OP_SET_APPEARANCE,
 112 };
 113
 114 static const u16 mgmt_events[] = {
 115         MGMT_EV_CONTROLLER_ERROR,
 116         MGMT_EV_INDEX_ADDED,
 117         MGMT_EV_INDEX_REMOVED,
 118         MGMT_EV_NEW_SETTINGS,
 119         MGMT_EV_CLASS_OF_DEV_CHANGED,
 120         MGMT_EV_LOCAL_NAME_CHANGED,
 121         MGMT_EV_NEW_LINK_KEY,
 122         MGMT_EV_NEW_LONG_TERM_KEY,
 123         MGMT_EV_DEVICE_CONNECTED,
 124         MGMT_EV_DEVICE_DISCONNECTED,
 125         MGMT_EV_CONNECT_FAILED,
 126         MGMT_EV_PIN_CODE_REQUEST,
 127         MGMT_EV_USER_CONFIRM_REQUEST,
 128         MGMT_EV_USER_PASSKEY_REQUEST,
 129         MGMT_EV_AUTH_FAILED,
 130         MGMT_EV_DEVICE_FOUND,
 131         MGMT_EV_DISCOVERING,
 132         MGMT_EV_DEVICE_BLOCKED,
 133         MGMT_EV_DEVICE_UNBLOCKED,
 134         MGMT_EV_DEVICE_UNPAIRED,
 135         MGMT_EV_PASSKEY_NOTIFY,
 136         MGMT_EV_NEW_IRK,
 137         MGMT_EV_NEW_CSRK,
 138         MGMT_EV_DEVICE_ADDED,
 139         MGMT_EV_DEVICE_REMOVED,
 140         MGMT_EV_NEW_CONN_PARAM,
 141         MGMT_EV_UNCONF_INDEX_ADDED,
 142         MGMT_EV_UNCONF_INDEX_REMOVED,
 143         MGMT_EV_NEW_CONFIG_OPTIONS,
 144         MGMT_EV_EXT_INDEX_ADDED,
 145         MGMT_EV_EXT_INDEX_REMOVED,
 146         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 147         MGMT_EV_ADVERTISING_ADDED,
 148         MGMT_EV_ADVERTISING_REMOVED,
 149         MGMT_EV_EXT_INFO_CHANGED,
 150 };
 151
 152 static const u16 mgmt_untrusted_commands[] = {
 153         MGMT_OP_READ_INDEX_LIST,
 154         MGMT_OP_READ_INFO,
 155         MGMT_OP_READ_UNCONF_INDEX_LIST,
 156         MGMT_OP_READ_CONFIG_INFO,
 157         MGMT_OP_READ_EXT_INDEX_LIST,
 158         MGMT_OP_READ_EXT_INFO,
 159 };
 160
 161 static const u16 mgmt_untrusted_events[] = {
 162         MGMT_EV_INDEX_ADDED,
 163         MGMT_EV_INDEX_REMOVED,
 164         MGMT_EV_NEW_SETTINGS,
 165         MGMT_EV_CLASS_OF_DEV_CHANGED,
 166         MGMT_EV_LOCAL_NAME_CHANGED,
 167         MGMT_EV_UNCONF_INDEX_ADDED,
 168         MGMT_EV_UNCONF_INDEX_REMOVED,
 169         MGMT_EV_NEW_CONFIG_OPTIONS,
 170         MGMT_EV_EXT_INDEX_ADDED,
 171         MGMT_EV_EXT_INDEX_REMOVED,
 172         MGMT_EV_EXT_INFO_CHANGED,
 173 };
 174
 175 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 176
 177 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 178                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 179
 180 /* HCI to MGMT error code conversion table */
 181 static u8 mgmt_status_table[] = {
 182         MGMT_STATUS_SUCCESS,
 183         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 184         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 185         MGMT_STATUS_FAILED,             /* Hardware Failure */
 186         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 187         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 188         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 189         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 190         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 191         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 192         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 193         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 194         MGMT_STATUS_BUSY,               /* Command Disallowed */
 195         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 196         MGMT_STATUS_REJECTED,           /* Rejected Security */
 197         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 198         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 200         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 201         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 202         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 203         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 204         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 205         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 206         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 207         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 208         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 209         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 210         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 211         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 212         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 213         MGMT_STATUS_FAILED,             /* Unspecified Error */
 214         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 215         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 216         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 217         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 218         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 219         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 220         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 221         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 222         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 223         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 224         MGMT_STATUS_FAILED,             /* Transaction Collision */
 225         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 226         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 227         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 228         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 229         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 230         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 231         MGMT_STATUS_FAILED,             /* Slot Violation */
 232         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 233         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 234         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 235         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 236         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 237         MGMT_STATUS_BUSY,               /* Controller Busy */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 239         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 240         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 241         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 242         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 243 };
 244
 245 static u8 mgmt_status(u8 hci_status)
 246 {
 247         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 248                 return mgmt_status_table[hci_status];
 249
 250         return MGMT_STATUS_FAILED;
 251 }
 252
 253 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 254                             u16 len, int flag)
 255 {
 256         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 257                                flag, NULL);
 258 }
 259
 260 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 261                               u16 len, int flag, struct sock *skip_sk)
 262 {
 263         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 264                                flag, skip_sk);
 265 }
 266
 267 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 268                       struct sock *skip_sk)
 269 {
 270         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 271                                HCI_SOCK_TRUSTED, skip_sk);
 272 }
 273
 274 static u8 le_addr_type(u8 mgmt_addr_type)
 275 {
 276         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 277                 return ADDR_LE_DEV_PUBLIC;
 278         else
 279                 return ADDR_LE_DEV_RANDOM;
 280 }
 281
 282 void mgmt_fill_version_info(void *ver)
 283 {
 284         struct mgmt_rp_read_version *rp = ver;
 285
 286         rp->version = MGMT_VERSION;
 287         rp->revision = cpu_to_le16(MGMT_REVISION);
 288 }
 289
 290 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 291                         u16 data_len)
 292 {
 293         struct mgmt_rp_read_version rp;
 294
 295         BT_DBG("sock %p", sk);
 296
 297         mgmt_fill_version_info(&rp);
 298
 299         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 300                                  &rp, sizeof(rp));
 301 }
 302
 303 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 304                          u16 data_len)
 305 {
 306         struct mgmt_rp_read_commands *rp;
 307         u16 num_commands, num_events;
 308         size_t rp_size;
 309         int i, err;
 310
 311         BT_DBG("sock %p", sk);
 312
 313         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 314                 num_commands = ARRAY_SIZE(mgmt_commands);
 315                 num_events = ARRAY_SIZE(mgmt_events);
 316         } else {
 317                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 318                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 319         }
 320
 321         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 322
 323         rp = kmalloc(rp_size, GFP_KERNEL);
 324         if (!rp)
 325                 return -ENOMEM;
 326
 327         rp->num_commands = cpu_to_le16(num_commands);
 328         rp->num_events = cpu_to_le16(num_events);
 329
 330         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 331                 __le16 *opcode = rp->opcodes;
 332
 333                 for (i = 0; i < num_commands; i++, opcode++)
 334                         put_unaligned_le16(mgmt_commands[i], opcode);
 335
 336                 for (i = 0; i < num_events; i++, opcode++)
 337                         put_unaligned_le16(mgmt_events[i], opcode);
 338         } else {
 339                 __le16 *opcode = rp->opcodes;
 340
 341                 for (i = 0; i < num_commands; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 343
 344                 for (i = 0; i < num_events; i++, opcode++)
 345                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 346         }
 347
 348         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 349                                 rp, rp_size);
 350         kfree(rp);
 351
 352         return err;
 353 }
 354
 355 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 356                            u16 data_len)
 357 {
 358         struct mgmt_rp_read_index_list *rp;
 359         struct hci_dev *d;
 360         size_t rp_len;
 361         u16 count;
 362         int err;
 363
 364         BT_DBG("sock %p", sk);
 365
 366         read_lock(&hci_dev_list_lock);
 367
 368         count = 0;
 369         list_for_each_entry(d, &hci_dev_list, list) {
 370                 if (d->dev_type == HCI_PRIMARY &&
 371                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 372                         count++;
 373         }
 374
 375         rp_len = sizeof(*rp) + (2 * count);
 376         rp = kmalloc(rp_len, GFP_ATOMIC);
 377         if (!rp) {
 378                 read_unlock(&hci_dev_list_lock);
 379                 return -ENOMEM;
 380         }
 381
 382         count = 0;
 383         list_for_each_entry(d, &hci_dev_list, list) {
 384                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 385                     hci_dev_test_flag(d, HCI_CONFIG) ||
 386                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 387                         continue;
 388
 389                 /* Devices marked as raw-only are neither configured
 390                  * nor unconfigured controllers.
 391                  */
 392                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 393                         continue;
 394
 395                 if (d->dev_type == HCI_PRIMARY &&
 396                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 397                         rp->index[count++] = cpu_to_le16(d->id);
 398                         BT_DBG("Added hci%u", d->id);
 399                 }
 400         }
 401
 402         rp->num_controllers = cpu_to_le16(count);
 403         rp_len = sizeof(*rp) + (2 * count);
 404
 405         read_unlock(&hci_dev_list_lock);
 406
 407         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 408                                 0, rp, rp_len);
 409
 410         kfree(rp);
 411
 412         return err;
 413 }
 414
 415 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 416                                   void *data, u16 data_len)
 417 {
 418         struct mgmt_rp_read_unconf_index_list *rp;
 419         struct hci_dev *d;
 420         size_t rp_len;
 421         u16 count;
 422         int err;
 423
 424         BT_DBG("sock %p", sk);
 425
 426         read_lock(&hci_dev_list_lock);
 427
 428         count = 0;
 429         list_for_each_entry(d, &hci_dev_list, list) {
 430                 if (d->dev_type == HCI_PRIMARY &&
 431                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 432                         count++;
 433         }
 434
 435         rp_len = sizeof(*rp) + (2 * count);
 436         rp = kmalloc(rp_len, GFP_ATOMIC);
 437         if (!rp) {
 438                 read_unlock(&hci_dev_list_lock);
 439                 return -ENOMEM;
 440         }
 441
 442         count = 0;
 443         list_for_each_entry(d, &hci_dev_list, list) {
 444                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 445                     hci_dev_test_flag(d, HCI_CONFIG) ||
 446                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 447                         continue;
 448
 449                 /* Devices marked as raw-only are neither configured
 450                  * nor unconfigured controllers.
 451                  */
 452                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 453                         continue;
 454
 455                 if (d->dev_type == HCI_PRIMARY &&
 456                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 457                         rp->index[count++] = cpu_to_le16(d->id);
 458                         BT_DBG("Added hci%u", d->id);
 459                 }
 460         }
 461
 462         rp->num_controllers = cpu_to_le16(count);
 463         rp_len = sizeof(*rp) + (2 * count);
 464
 465         read_unlock(&hci_dev_list_lock);
 466
 467         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 468                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 469
 470         kfree(rp);
 471
 472         return err;
 473 }
 474
 475 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 476                                void *data, u16 data_len)
 477 {
 478         struct mgmt_rp_read_ext_index_list *rp;
 479         struct hci_dev *d;
 480         u16 count;
 481         int err;
 482
 483         BT_DBG("sock %p", sk);
 484
 485         read_lock(&hci_dev_list_lock);
 486
 487         count = 0;
 488         list_for_each_entry(d, &hci_dev_list, list) {
 489                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 490                         count++;
 491         }
 492
 493         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 494         if (!rp) {
 495                 read_unlock(&hci_dev_list_lock);
 496                 return -ENOMEM;
 497         }
 498
 499         count = 0;
 500         list_for_each_entry(d, &hci_dev_list, list) {
 501                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 502                     hci_dev_test_flag(d, HCI_CONFIG) ||
 503                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 504                         continue;
 505
 506                 /* Devices marked as raw-only are neither configured
 507                  * nor unconfigured controllers.
 508                  */
 509                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 510                         continue;
 511
 512                 if (d->dev_type == HCI_PRIMARY) {
 513                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 514                                 rp->entry[count].type = 0x01;
 515                         else
 516                                 rp->entry[count].type = 0x00;
 517                 } else if (d->dev_type == HCI_AMP) {
 518                         rp->entry[count].type = 0x02;
 519                 } else {
 520                         continue;
 521                 }
 522
 523                 rp->entry[count].bus = d->bus;
 524                 rp->entry[count++].index = cpu_to_le16(d->id);
 525                 BT_DBG("Added hci%u", d->id);
 526         }
 527
 528         rp->num_controllers = cpu_to_le16(count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 542                                 struct_size(rp, entry, count));
 543
 544         kfree(rp);
 545
 546         return err;
 547 }
 548
 549 static bool is_configured(struct hci_dev *hdev)
 550 {
 551         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 552             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 553                 return false;
 554
 555         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 556              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 557             !bacmp(&hdev->public_addr, BDADDR_ANY))
 558                 return false;
 559
 560         return true;
 561 }
 562
 563 static __le32 get_missing_options(struct hci_dev *hdev)
 564 {
 565         u32 options = 0;
 566
 567         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 568             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 569                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 570
 571         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 572              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 573             !bacmp(&hdev->public_addr, BDADDR_ANY))
 574                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 575
 576         return cpu_to_le32(options);
 577 }
 578
 579 static int new_options(struct hci_dev *hdev, struct sock *skip)
 580 {
 581         __le32 options = get_missing_options(hdev);
 582
 583         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 584                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 585 }
 586
 587 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 588 {
 589         __le32 options = get_missing_options(hdev);
 590
 591         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 592                                  sizeof(options));
 593 }
 594
 595 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 596                             void *data, u16 data_len)
 597 {
 598         struct mgmt_rp_read_config_info rp;
 599         u32 options = 0;
 600
 601         BT_DBG("sock %p %s", sk, hdev->name);
 602
 603         hci_dev_lock(hdev);
 604
 605         memset(&rp, 0, sizeof(rp));
 606         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 607
 608         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 609                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 610
 611         if (hdev->set_bdaddr)
 612                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 613
 614         rp.supported_options = cpu_to_le32(options);
 615         rp.missing_options = get_missing_options(hdev);
 616
 617         hci_dev_unlock(hdev);
 618
 619         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 620                                  &rp, sizeof(rp));
 621 }
 622
 623 static u32 get_supported_phys(struct hci_dev *hdev)
 624 {
 625         u32 supported_phys = 0;
 626
 627         if (lmp_bredr_capable(hdev)) {
 628                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_3SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 632
 633                 if (hdev->features[0][0] & LMP_5SLOT)
 634                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 635
 636                 if (lmp_edr_2m_capable(hdev)) {
 637                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 638
 639                         if (lmp_edr_3slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 641
 642                         if (lmp_edr_5slot_capable(hdev))
 643                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 644
 645                         if (lmp_edr_3m_capable(hdev)) {
 646                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 647
 648                                 if (lmp_edr_3slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 650
 651                                 if (lmp_edr_5slot_capable(hdev))
 652                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 653                         }
 654                 }
 655         }
 656
 657         if (lmp_le_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_LE_1M_TX;
 659                 supported_phys |= MGMT_PHY_LE_1M_RX;
 660
 661                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 662                         supported_phys |= MGMT_PHY_LE_2M_TX;
 663                         supported_phys |= MGMT_PHY_LE_2M_RX;
 664                 }
 665
 666                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 667                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 668                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 669                 }
 670         }
 671
 672         return supported_phys;
 673 }
 674
 675 static u32 get_selected_phys(struct hci_dev *hdev)
 676 {
 677         u32 selected_phys = 0;
 678
 679         if (lmp_bredr_capable(hdev)) {
 680                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 683                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 684
 685                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 686                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 687
 688                 if (lmp_edr_2m_capable(hdev)) {
 689                         if (!(hdev->pkt_type & HCI_2DH1))
 690                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 691
 692                         if (lmp_edr_3slot_capable(hdev) &&
 693                             !(hdev->pkt_type & HCI_2DH3))
 694                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 695
 696                         if (lmp_edr_5slot_capable(hdev) &&
 697                             !(hdev->pkt_type & HCI_2DH5))
 698                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 699
 700                         if (lmp_edr_3m_capable(hdev)) {
 701                                 if (!(hdev->pkt_type & HCI_3DH1))
 702                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 703
 704                                 if (lmp_edr_3slot_capable(hdev) &&
 705                                     !(hdev->pkt_type & HCI_3DH3))
 706                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 707
 708                                 if (lmp_edr_5slot_capable(hdev) &&
 709                                     !(hdev->pkt_type & HCI_3DH5))
 710                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 711                         }
 712                 }
 713         }
 714
 715         if (lmp_le_capable(hdev)) {
 716                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_TX;
 718
 719                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 720                         selected_phys |= MGMT_PHY_LE_1M_RX;
 721
 722                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_TX;
 724
 725                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 726                         selected_phys |= MGMT_PHY_LE_2M_RX;
 727
 728                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 730
 731                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 732                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 733         }
 734
 735         return selected_phys;
 736 }
 737
 738 static u32 get_configurable_phys(struct hci_dev *hdev)
 739 {
 740         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 741                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 742 }
 743
 744 static u32 get_supported_settings(struct hci_dev *hdev)
 745 {
 746         u32 settings = 0;
 747
 748         settings |= MGMT_SETTING_POWERED;
 749         settings |= MGMT_SETTING_BONDABLE;
 750         settings |= MGMT_SETTING_DEBUG_KEYS;
 751         settings |= MGMT_SETTING_CONNECTABLE;
 752         settings |= MGMT_SETTING_DISCOVERABLE;
 753
 754         if (lmp_bredr_capable(hdev)) {
 755                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 756                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 757                 settings |= MGMT_SETTING_BREDR;
 758                 settings |= MGMT_SETTING_LINK_SECURITY;
 759
 760                 if (lmp_ssp_capable(hdev)) {
 761                         settings |= MGMT_SETTING_SSP;
 762                         settings |= MGMT_SETTING_HS;
 763                 }
 764
 765                 if (lmp_sc_capable(hdev))
 766                         settings |= MGMT_SETTING_SECURE_CONN;
 767         }
 768
 769         if (lmp_le_capable(hdev)) {
 770                 settings |= MGMT_SETTING_LE;
 771                 settings |= MGMT_SETTING_ADVERTISING;
 772                 settings |= MGMT_SETTING_SECURE_CONN;
 773                 settings |= MGMT_SETTING_PRIVACY;
 774                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 775         }
 776
 777         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 778             hdev->set_bdaddr)
 779                 settings |= MGMT_SETTING_CONFIGURATION;
 780
 781         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 782
 783         return settings;
 784 }
 785
 786 static u32 get_current_settings(struct hci_dev *hdev)
 787 {
 788         u32 settings = 0;
 789
 790         if (hdev_is_powered(hdev))
 791                 settings |= MGMT_SETTING_POWERED;
 792
 793         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 794                 settings |= MGMT_SETTING_CONNECTABLE;
 795
 796         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 797                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 798
 799         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 800                 settings |= MGMT_SETTING_DISCOVERABLE;
 801
 802         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 803                 settings |= MGMT_SETTING_BONDABLE;
 804
 805         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 806                 settings |= MGMT_SETTING_BREDR;
 807
 808         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 809                 settings |= MGMT_SETTING_LE;
 810
 811         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 812                 settings |= MGMT_SETTING_LINK_SECURITY;
 813
 814         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 815                 settings |= MGMT_SETTING_SSP;
 816
 817         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 818                 settings |= MGMT_SETTING_HS;
 819
 820         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 821                 settings |= MGMT_SETTING_ADVERTISING;
 822
 823         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 824                 settings |= MGMT_SETTING_SECURE_CONN;
 825
 826         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 827                 settings |= MGMT_SETTING_DEBUG_KEYS;
 828
 829         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 830                 settings |= MGMT_SETTING_PRIVACY;
 831
 832         /* The current setting for static address has two purposes. The
 833          * first is to indicate if the static address will be used and
 834          * the second is to indicate if it is actually set.
 835          *
 836          * This means if the static address is not configured, this flag
 837          * will never be set. If the address is configured, then if the
 838          * address is actually used decides if the flag is set or not.
 839          *
 840          * For single mode LE only controllers and dual-mode controllers
 841          * with BR/EDR disabled, the existence of the static address will
 842          * be evaluated.
 843          */
 844         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 845             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 846             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 847                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 848                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 849         }
 850
 851         return settings;
 852 }
 853
 854 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 855 {
 856         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 857 }
 858
 859 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 860                                                   struct hci_dev *hdev,
 861                                                   const void *data)
 862 {
 863         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 864 }
 865
 866 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 867 {
 868         struct mgmt_pending_cmd *cmd;
 869
 870         /* If there's a pending mgmt command the flags will not yet have
 871          * their final values, so check for this first.
 872          */
 873         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 874         if (cmd) {
 875                 struct mgmt_mode *cp = cmd->param;
 876                 if (cp->val == 0x01)
 877                         return LE_AD_GENERAL;
 878                 else if (cp->val == 0x02)
 879                         return LE_AD_LIMITED;
 880         } else {
 881                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 882                         return LE_AD_LIMITED;
 883                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 884                         return LE_AD_GENERAL;
 885         }
 886
 887         return 0;
 888 }
 889
 890 bool mgmt_get_connectable(struct hci_dev *hdev)
 891 {
 892         struct mgmt_pending_cmd *cmd;
 893
 894         /* If there's a pending mgmt command the flag will not yet have
 895          * it's final value, so check for this first.
 896          */
 897         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 898         if (cmd) {
 899                 struct mgmt_mode *cp = cmd->param;
 900
 901                 return cp->val;
 902         }
 903
 904         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 905 }
 906
 907 static void service_cache_off(struct work_struct *work)
 908 {
 909         struct hci_dev *hdev = container_of(work, struct hci_dev,
 910                                             service_cache.work);
 911         struct hci_request req;
 912
 913         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 914                 return;
 915
 916         hci_req_init(&req, hdev);
 917
 918         hci_dev_lock(hdev);
 919
 920         __hci_req_update_eir(&req);
 921         __hci_req_update_class(&req);
 922
 923         hci_dev_unlock(hdev);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void rpa_expired(struct work_struct *work)
 929 {
 930         struct hci_dev *hdev = container_of(work, struct hci_dev,
 931                                             rpa_expired.work);
 932         struct hci_request req;
 933
 934         BT_DBG("");
 935
 936         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 937
 938         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 939                 return;
 940
 941         /* The generation of a new RPA and programming it into the
 942          * controller happens in the hci_req_enable_advertising()
 943          * function.
 944          */
 945         hci_req_init(&req, hdev);
 946         if (ext_adv_capable(hdev))
 947                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 948         else
 949                 __hci_req_enable_advertising(&req);
 950         hci_req_run(&req, NULL);
 951 }
 952
 953 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 954 {
 955         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 956                 return;
 957
 958         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 959         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 960
 961         /* Non-mgmt controlled devices get this bit set
 962          * implicitly so that pairing works for them, however
 963          * for mgmt we require user-space to explicitly enable
 964          * it
 965          */
 966         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 967 }
 968
 969 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 970                                 void *data, u16 data_len)
 971 {
 972         struct mgmt_rp_read_info rp;
 973
 974         BT_DBG("sock %p %s", sk, hdev->name);
 975
 976         hci_dev_lock(hdev);
 977
 978         memset(&rp, 0, sizeof(rp));
 979
 980         bacpy(&rp.bdaddr, &hdev->bdaddr);
 981
 982         rp.version = hdev->hci_ver;
 983         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 984
 985         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 986         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 987
 988         memcpy(rp.dev_class, hdev->dev_class, 3);
 989
 990         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 991         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 992
 993         hci_dev_unlock(hdev);
 994
 995         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 996                                  sizeof(rp));
 997 }
 998
 999 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1000 {
1001         u16 eir_len = 0;
1002         size_t name_len;
1003
1004         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1005                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1006                                           hdev->dev_class, 3);
1007
1008         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1009                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1010                                           hdev->appearance);
1011
1012         name_len = strlen(hdev->dev_name);
1013         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1014                                   hdev->dev_name, name_len);
1015
1016         name_len = strlen(hdev->short_name);
1017         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1018                                   hdev->short_name, name_len);
1019
1020         return eir_len;
1021 }
1022
1023 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1024                                     void *data, u16 data_len)
1025 {
1026         char buf[512];
1027         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1028         u16 eir_len;
1029
1030         BT_DBG("sock %p %s", sk, hdev->name);
1031
1032         memset(&buf, 0, sizeof(buf));
1033
1034         hci_dev_lock(hdev);
1035
1036         bacpy(&rp->bdaddr, &hdev->bdaddr);
1037
1038         rp->version = hdev->hci_ver;
1039         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1040
1041         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1042         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1043
1044
1045         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1046         rp->eir_len = cpu_to_le16(eir_len);
1047
1048         hci_dev_unlock(hdev);
1049
1050         /* If this command is called at least once, then the events
1051          * for class of device and local name changes are disabled
1052          * and only the new extended controller information event
1053          * is used.
1054          */
1055         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1056         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1057         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1058
1059         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1060                                  sizeof(*rp) + eir_len);
1061 }
1062
1063 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1064 {
1065         char buf[512];
1066         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1067         u16 eir_len;
1068
1069         memset(buf, 0, sizeof(buf));
1070
1071         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1072         ev->eir_len = cpu_to_le16(eir_len);
1073
1074         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1075                                   sizeof(*ev) + eir_len,
1076                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1077 }
1078
1079 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1080 {
1081         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1082
1083         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1084                                  sizeof(settings));
1085 }
1086
1087 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1088 {
1089         BT_DBG("%s status 0x%02x", hdev->name, status);
1090
1091         if (hci_conn_count(hdev) == 0) {
1092                 cancel_delayed_work(&hdev->power_off);
1093                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1094         }
1095 }
1096
1097 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1098 {
1099         struct mgmt_ev_advertising_added ev;
1100
1101         ev.instance = instance;
1102
1103         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1104 }
1105
1106 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1107                               u8 instance)
1108 {
1109         struct mgmt_ev_advertising_removed ev;
1110
1111         ev.instance = instance;
1112
1113         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1114 }
1115
1116 static void cancel_adv_timeout(struct hci_dev *hdev)
1117 {
1118         if (hdev->adv_instance_timeout) {
1119                 hdev->adv_instance_timeout = 0;
1120                 cancel_delayed_work(&hdev->adv_instance_expire);
1121         }
1122 }
1123
1124 static int clean_up_hci_state(struct hci_dev *hdev)
1125 {
1126         struct hci_request req;
1127         struct hci_conn *conn;
1128         bool discov_stopped;
1129         int err;
1130
1131         hci_req_init(&req, hdev);
1132
1133         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1134             test_bit(HCI_PSCAN, &hdev->flags)) {
1135                 u8 scan = 0x00;
1136                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1137         }
1138
1139         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1140
1141         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1142                 __hci_req_disable_advertising(&req);
1143
1144         discov_stopped = hci_req_stop_discovery(&req);
1145
1146         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1147                 /* 0x15 == Terminated due to Power Off */
1148                 __hci_abort_conn(&req, conn, 0x15);
1149         }
1150
1151         err = hci_req_run(&req, clean_up_hci_complete);
1152         if (!err && discov_stopped)
1153                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1154
1155         return err;
1156 }
1157
1158 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1159                        u16 len)
1160 {
1161         struct mgmt_mode *cp = data;
1162         struct mgmt_pending_cmd *cmd;
1163         int err;
1164
1165         BT_DBG("request for %s", hdev->name);
1166
1167         if (cp->val != 0x00 && cp->val != 0x01)
1168                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1169                                        MGMT_STATUS_INVALID_PARAMS);
1170
1171         hci_dev_lock(hdev);
1172
1173         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1174                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1175                                       MGMT_STATUS_BUSY);
1176                 goto failed;
1177         }
1178
1179         if (!!cp->val == hdev_is_powered(hdev)) {
1180                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1181                 goto failed;
1182         }
1183
1184         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1185         if (!cmd) {
1186                 err = -ENOMEM;
1187                 goto failed;
1188         }
1189
1190         if (cp->val) {
1191                 queue_work(hdev->req_workqueue, &hdev->power_on);
1192                 err = 0;
1193         } else {
1194                 /* Disconnect connections, stop scans, etc */
1195                 err = clean_up_hci_state(hdev);
1196                 if (!err)
1197                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1198                                            HCI_POWER_OFF_TIMEOUT);
1199
1200                 /* ENODATA means there were no HCI commands queued */
1201                 if (err == -ENODATA) {
1202                         cancel_delayed_work(&hdev->power_off);
1203                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1204                         err = 0;
1205                 }
1206         }
1207
1208 failed:
1209         hci_dev_unlock(hdev);
1210         return err;
1211 }
1212
1213 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1214 {
1215         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1216
1217         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1218                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1219 }
1220
1221 int mgmt_new_settings(struct hci_dev *hdev)
1222 {
1223         return new_settings(hdev, NULL);
1224 }
1225
1226 struct cmd_lookup {
1227         struct sock *sk;
1228         struct hci_dev *hdev;
1229         u8 mgmt_status;
1230 };
1231
1232 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1233 {
1234         struct cmd_lookup *match = data;
1235
1236         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1237
1238         list_del(&cmd->list);
1239
1240         if (match->sk == NULL) {
1241                 match->sk = cmd->sk;
1242                 sock_hold(match->sk);
1243         }
1244
1245         mgmt_pending_free(cmd);
1246 }
1247
1248 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1249 {
1250         u8 *status = data;
1251
1252         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1253         mgmt_pending_remove(cmd);
1254 }
1255
1256 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1257 {
1258         if (cmd->cmd_complete) {
1259                 u8 *status = data;
1260
1261                 cmd->cmd_complete(cmd, *status);
1262                 mgmt_pending_remove(cmd);
1263
1264                 return;
1265         }
1266
1267         cmd_status_rsp(cmd, data);
1268 }
1269
1270 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1271 {
1272         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1273                                  cmd->param, cmd->param_len);
1274 }
1275
1276 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1277 {
1278         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1279                                  cmd->param, sizeof(struct mgmt_addr_info));
1280 }
1281
1282 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1283 {
1284         if (!lmp_bredr_capable(hdev))
1285                 return MGMT_STATUS_NOT_SUPPORTED;
1286         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1287                 return MGMT_STATUS_REJECTED;
1288         else
1289                 return MGMT_STATUS_SUCCESS;
1290 }
1291
1292 static u8 mgmt_le_support(struct hci_dev *hdev)
1293 {
1294         if (!lmp_le_capable(hdev))
1295                 return MGMT_STATUS_NOT_SUPPORTED;
1296         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1297                 return MGMT_STATUS_REJECTED;
1298         else
1299                 return MGMT_STATUS_SUCCESS;
1300 }
1301
1302 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1303 {
1304         struct mgmt_pending_cmd *cmd;
1305
1306         BT_DBG("status 0x%02x", status);
1307
1308         hci_dev_lock(hdev);
1309
1310         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1311         if (!cmd)
1312                 goto unlock;
1313
1314         if (status) {
1315                 u8 mgmt_err = mgmt_status(status);
1316                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1317                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1318                 goto remove_cmd;
1319         }
1320
1321         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1322             hdev->discov_timeout > 0) {
1323                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1324                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1325         }
1326
1327         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1328         new_settings(hdev, cmd->sk);
1329
1330 remove_cmd:
1331         mgmt_pending_remove(cmd);
1332
1333 unlock:
1334         hci_dev_unlock(hdev);
1335 }
1336
1337 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1338                             u16 len)
1339 {
1340         struct mgmt_cp_set_discoverable *cp = data;
1341         struct mgmt_pending_cmd *cmd;
1342         u16 timeout;
1343         int err;
1344
1345         BT_DBG("request for %s", hdev->name);
1346
1347         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1348             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1350                                        MGMT_STATUS_REJECTED);
1351
1352         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1353                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1354                                        MGMT_STATUS_INVALID_PARAMS);
1355
1356         timeout = __le16_to_cpu(cp->timeout);
1357
1358         /* Disabling discoverable requires that no timeout is set,
1359          * and enabling limited discoverable requires a timeout.
1360          */
1361         if ((cp->val == 0x00 && timeout > 0) ||
1362             (cp->val == 0x02 && timeout == 0))
1363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1364                                        MGMT_STATUS_INVALID_PARAMS);
1365
1366         hci_dev_lock(hdev);
1367
1368         if (!hdev_is_powered(hdev) && timeout > 0) {
1369                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1370                                       MGMT_STATUS_NOT_POWERED);
1371                 goto failed;
1372         }
1373
1374         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1375             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1376                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1377                                       MGMT_STATUS_BUSY);
1378                 goto failed;
1379         }
1380
1381         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1382                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1383                                       MGMT_STATUS_REJECTED);
1384                 goto failed;
1385         }
1386
1387         if (!hdev_is_powered(hdev)) {
1388                 bool changed = false;
1389
1390                 /* Setting limited discoverable when powered off is
1391                  * not a valid operation since it requires a timeout
1392                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1393                  */
1394                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1395                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1396                         changed = true;
1397                 }
1398
1399                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1400                 if (err < 0)
1401                         goto failed;
1402
1403                 if (changed)
1404                         err = new_settings(hdev, sk);
1405
1406                 goto failed;
1407         }
1408
1409         /* If the current mode is the same, then just update the timeout
1410          * value with the new value. And if only the timeout gets updated,
1411          * then no need for any HCI transactions.
1412          */
1413         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1414             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1415                                                    HCI_LIMITED_DISCOVERABLE)) {
1416                 cancel_delayed_work(&hdev->discov_off);
1417                 hdev->discov_timeout = timeout;
1418
1419                 if (cp->val && hdev->discov_timeout > 0) {
1420                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1421                         queue_delayed_work(hdev->req_workqueue,
1422                                            &hdev->discov_off, to);
1423                 }
1424
1425                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1426                 goto failed;
1427         }
1428
1429         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1430         if (!cmd) {
1431                 err = -ENOMEM;
1432                 goto failed;
1433         }
1434
1435         /* Cancel any potential discoverable timeout that might be
1436          * still active and store new timeout value. The arming of
1437          * the timeout happens in the complete handler.
1438          */
1439         cancel_delayed_work(&hdev->discov_off);
1440         hdev->discov_timeout = timeout;
1441
1442         if (cp->val)
1443                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1444         else
1445                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1446
1447         /* Limited discoverable mode */
1448         if (cp->val == 0x02)
1449                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1450         else
1451                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1452
1453         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1454         err = 0;
1455
1456 failed:
1457         hci_dev_unlock(hdev);
1458         return err;
1459 }
1460
1461 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1462 {
1463         struct mgmt_pending_cmd *cmd;
1464
1465         BT_DBG("status 0x%02x", status);
1466
1467         hci_dev_lock(hdev);
1468
1469         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1470         if (!cmd)
1471                 goto unlock;
1472
1473         if (status) {
1474                 u8 mgmt_err = mgmt_status(status);
1475                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1476                 goto remove_cmd;
1477         }
1478
1479         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1480         new_settings(hdev, cmd->sk);
1481
1482 remove_cmd:
1483         mgmt_pending_remove(cmd);
1484
1485 unlock:
1486         hci_dev_unlock(hdev);
1487 }
1488
1489 static int set_connectable_update_settings(struct hci_dev *hdev,
1490                                            struct sock *sk, u8 val)
1491 {
1492         bool changed = false;
1493         int err;
1494
1495         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1496                 changed = true;
1497
1498         if (val) {
1499                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1500         } else {
1501                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1502                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1503         }
1504
1505         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1506         if (err < 0)
1507                 return err;
1508
1509         if (changed) {
1510                 hci_req_update_scan(hdev);
1511                 hci_update_background_scan(hdev);
1512                 return new_settings(hdev, sk);
1513         }
1514
1515         return 0;
1516 }
1517
1518 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1519                            u16 len)
1520 {
1521         struct mgmt_mode *cp = data;
1522         struct mgmt_pending_cmd *cmd;
1523         int err;
1524
1525         BT_DBG("request for %s", hdev->name);
1526
1527         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1528             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1529                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1530                                        MGMT_STATUS_REJECTED);
1531
1532         if (cp->val != 0x00 && cp->val != 0x01)
1533                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1534                                        MGMT_STATUS_INVALID_PARAMS);
1535
1536         hci_dev_lock(hdev);
1537
1538         if (!hdev_is_powered(hdev)) {
1539                 err = set_connectable_update_settings(hdev, sk, cp->val);
1540                 goto failed;
1541         }
1542
1543         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1544             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1545                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1546                                       MGMT_STATUS_BUSY);
1547                 goto failed;
1548         }
1549
1550         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1551         if (!cmd) {
1552                 err = -ENOMEM;
1553                 goto failed;
1554         }
1555
1556         if (cp->val) {
1557                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1558         } else {
1559                 if (hdev->discov_timeout > 0)
1560                         cancel_delayed_work(&hdev->discov_off);
1561
1562                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1563                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1564                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1565         }
1566
1567         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1568         err = 0;
1569
1570 failed:
1571         hci_dev_unlock(hdev);
1572         return err;
1573 }
1574
1575 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1576                         u16 len)
1577 {
1578         struct mgmt_mode *cp = data;
1579         bool changed;
1580         int err;
1581
1582         BT_DBG("request for %s", hdev->name);
1583
1584         if (cp->val != 0x00 && cp->val != 0x01)
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1586                                        MGMT_STATUS_INVALID_PARAMS);
1587
1588         hci_dev_lock(hdev);
1589
1590         if (cp->val)
1591                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1592         else
1593                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1594
1595         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1596         if (err < 0)
1597                 goto unlock;
1598
1599         if (changed) {
1600                 /* In limited privacy mode the change of bondable mode
1601                  * may affect the local advertising address.
1602                  */
1603                 if (hdev_is_powered(hdev) &&
1604                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1605                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1606                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1607                         queue_work(hdev->req_workqueue,
1608                                    &hdev->discoverable_update);
1609
1610                 err = new_settings(hdev, sk);
1611         }
1612
1613 unlock:
1614         hci_dev_unlock(hdev);
1615         return err;
1616 }
1617
1618 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1619                              u16 len)
1620 {
1621         struct mgmt_mode *cp = data;
1622         struct mgmt_pending_cmd *cmd;
1623         u8 val, status;
1624         int err;
1625
1626         BT_DBG("request for %s", hdev->name);
1627
1628         status = mgmt_bredr_support(hdev);
1629         if (status)
1630                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1631                                        status);
1632
1633         if (cp->val != 0x00 && cp->val != 0x01)
1634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1635                                        MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (!hdev_is_powered(hdev)) {
1640                 bool changed = false;
1641
1642                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1643                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1644                         changed = true;
1645                 }
1646
1647                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1648                 if (err < 0)
1649                         goto failed;
1650
1651                 if (changed)
1652                         err = new_settings(hdev, sk);
1653
1654                 goto failed;
1655         }
1656
1657         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1658                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1659                                       MGMT_STATUS_BUSY);
1660                 goto failed;
1661         }
1662
1663         val = !!cp->val;
1664
1665         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1666                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1667                 goto failed;
1668         }
1669
1670         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1671         if (!cmd) {
1672                 err = -ENOMEM;
1673                 goto failed;
1674         }
1675
1676         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1677         if (err < 0) {
1678                 mgmt_pending_remove(cmd);
1679                 goto failed;
1680         }
1681
1682 failed:
1683         hci_dev_unlock(hdev);
1684         return err;
1685 }
1686
1687 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1688 {
1689         struct mgmt_mode *cp = data;
1690         struct mgmt_pending_cmd *cmd;
1691         u8 status;
1692         int err;
1693
1694         BT_DBG("request for %s", hdev->name);
1695
1696         status = mgmt_bredr_support(hdev);
1697         if (status)
1698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1699
1700         if (!lmp_ssp_capable(hdev))
1701                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1702                                        MGMT_STATUS_NOT_SUPPORTED);
1703
1704         if (cp->val != 0x00 && cp->val != 0x01)
1705                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1706                                        MGMT_STATUS_INVALID_PARAMS);
1707
1708         hci_dev_lock(hdev);
1709
1710         if (!hdev_is_powered(hdev)) {
1711                 bool changed;
1712
1713                 if (cp->val) {
1714                         changed = !hci_dev_test_and_set_flag(hdev,
1715                                                              HCI_SSP_ENABLED);
1716                 } else {
1717                         changed = hci_dev_test_and_clear_flag(hdev,
1718                                                               HCI_SSP_ENABLED);
1719                         if (!changed)
1720                                 changed = hci_dev_test_and_clear_flag(hdev,
1721                                                                       HCI_HS_ENABLED);
1722                         else
1723                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1724                 }
1725
1726                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1727                 if (err < 0)
1728                         goto failed;
1729
1730                 if (changed)
1731                         err = new_settings(hdev, sk);
1732
1733                 goto failed;
1734         }
1735
1736         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1737                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1738                                       MGMT_STATUS_BUSY);
1739                 goto failed;
1740         }
1741
1742         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1743                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1744                 goto failed;
1745         }
1746
1747         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1748         if (!cmd) {
1749                 err = -ENOMEM;
1750                 goto failed;
1751         }
1752
1753         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1754                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1755                              sizeof(cp->val), &cp->val);
1756
1757         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1758         if (err < 0) {
1759                 mgmt_pending_remove(cmd);
1760                 goto failed;
1761         }
1762
1763 failed:
1764         hci_dev_unlock(hdev);
1765         return err;
1766 }
1767
1768 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1769 {
1770         struct mgmt_mode *cp = data;
1771         bool changed;
1772         u8 status;
1773         int err;
1774
1775         BT_DBG("request for %s", hdev->name);
1776
1777         status = mgmt_bredr_support(hdev);
1778         if (status)
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1780
1781         if (!lmp_ssp_capable(hdev))
1782                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1783                                        MGMT_STATUS_NOT_SUPPORTED);
1784
1785         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1786                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1787                                        MGMT_STATUS_REJECTED);
1788
1789         if (cp->val != 0x00 && cp->val != 0x01)
1790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1791                                        MGMT_STATUS_INVALID_PARAMS);
1792
1793         hci_dev_lock(hdev);
1794
1795         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1796                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1797                                       MGMT_STATUS_BUSY);
1798                 goto unlock;
1799         }
1800
1801         if (cp->val) {
1802                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1803         } else {
1804                 if (hdev_is_powered(hdev)) {
1805                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1806                                               MGMT_STATUS_REJECTED);
1807                         goto unlock;
1808                 }
1809
1810                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1811         }
1812
1813         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1814         if (err < 0)
1815                 goto unlock;
1816
1817         if (changed)
1818                 err = new_settings(hdev, sk);
1819
1820 unlock:
1821         hci_dev_unlock(hdev);
1822         return err;
1823 }
1824
1825 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1826 {
1827         struct cmd_lookup match = { NULL, hdev };
1828
1829         hci_dev_lock(hdev);
1830
1831         if (status) {
1832                 u8 mgmt_err = mgmt_status(status);
1833
1834                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1835                                      &mgmt_err);
1836                 goto unlock;
1837         }
1838
1839         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1840
1841         new_settings(hdev, match.sk);
1842
1843         if (match.sk)
1844                 sock_put(match.sk);
1845
1846         /* Make sure the controller has a good default for
1847          * advertising data. Restrict the update to when LE
1848          * has actually been enabled. During power on, the
1849          * update in powered_update_hci will take care of it.
1850          */
1851         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1852                 struct hci_request req;
1853                 hci_req_init(&req, hdev);
1854                 if (ext_adv_capable(hdev)) {
1855                         int err;
1856
1857                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1858                         if (!err)
1859                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1860                 } else {
1861                         __hci_req_update_adv_data(&req, 0x00);
1862                         __hci_req_update_scan_rsp_data(&req, 0x00);
1863                 }
1864                 hci_req_run(&req, NULL);
1865                 hci_update_background_scan(hdev);
1866         }
1867
1868 unlock:
1869         hci_dev_unlock(hdev);
1870 }
1871
1872 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1873 {
1874         struct mgmt_mode *cp = data;
1875         struct hci_cp_write_le_host_supported hci_cp;
1876         struct mgmt_pending_cmd *cmd;
1877         struct hci_request req;
1878         int err;
1879         u8 val, enabled;
1880
1881         BT_DBG("request for %s", hdev->name);
1882
1883         if (!lmp_le_capable(hdev))
1884                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1885                                        MGMT_STATUS_NOT_SUPPORTED);
1886
1887         if (cp->val != 0x00 && cp->val != 0x01)
1888                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1889                                        MGMT_STATUS_INVALID_PARAMS);
1890
1891         /* Bluetooth single mode LE only controllers or dual-mode
1892          * controllers configured as LE only devices, do not allow
1893          * switching LE off. These have either LE enabled explicitly
1894          * or BR/EDR has been previously switched off.
1895          *
1896          * When trying to enable an already enabled LE, then gracefully
1897          * send a positive response. Trying to disable it however will
1898          * result into rejection.
1899          */
1900         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1901                 if (cp->val == 0x01)
1902                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1903
1904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1905                                        MGMT_STATUS_REJECTED);
1906         }
1907
1908         hci_dev_lock(hdev);
1909
1910         val = !!cp->val;
1911         enabled = lmp_host_le_capable(hdev);
1912
1913         if (!val)
1914                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1915
1916         if (!hdev_is_powered(hdev) || val == enabled) {
1917                 bool changed = false;
1918
1919                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1920                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1921                         changed = true;
1922                 }
1923
1924                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1925                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1926                         changed = true;
1927                 }
1928
1929                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1930                 if (err < 0)
1931                         goto unlock;
1932
1933                 if (changed)
1934                         err = new_settings(hdev, sk);
1935
1936                 goto unlock;
1937         }
1938
1939         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1940             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1941                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1942                                       MGMT_STATUS_BUSY);
1943                 goto unlock;
1944         }
1945
1946         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1947         if (!cmd) {
1948                 err = -ENOMEM;
1949                 goto unlock;
1950         }
1951
1952         hci_req_init(&req, hdev);
1953
1954         memset(&hci_cp, 0, sizeof(hci_cp));
1955
1956         if (val) {
1957                 hci_cp.le = val;
1958                 hci_cp.simul = 0x00;
1959         } else {
1960                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1961                         __hci_req_disable_advertising(&req);
1962
1963                 if (ext_adv_capable(hdev))
1964                         __hci_req_clear_ext_adv_sets(&req);
1965         }
1966
1967         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1968                     &hci_cp);
1969
1970         err = hci_req_run(&req, le_enable_complete);
1971         if (err < 0)
1972                 mgmt_pending_remove(cmd);
1973
1974 unlock:
1975         hci_dev_unlock(hdev);
1976         return err;
1977 }
1978
1979 /* This is a helper function to test for pending mgmt commands that can
1980  * cause CoD or EIR HCI commands. We can only allow one such pending
1981  * mgmt command at a time since otherwise we cannot easily track what
1982  * the current values are, will be, and based on that calculate if a new
1983  * HCI command needs to be sent and if yes with what value.
1984  */
1985 static bool pending_eir_or_class(struct hci_dev *hdev)
1986 {
1987         struct mgmt_pending_cmd *cmd;
1988
1989         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1990                 switch (cmd->opcode) {
1991                 case MGMT_OP_ADD_UUID:
1992                 case MGMT_OP_REMOVE_UUID:
1993                 case MGMT_OP_SET_DEV_CLASS:
1994                 case MGMT_OP_SET_POWERED:
1995                         return true;
1996                 }
1997         }
1998
1999         return false;
2000 }
2001
2002 static const u8 bluetooth_base_uuid[] = {
2003                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2004                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2005 };
2006
2007 static u8 get_uuid_size(const u8 *uuid)
2008 {
2009         u32 val;
2010
2011         if (memcmp(uuid, bluetooth_base_uuid, 12))
2012                 return 128;
2013
2014         val = get_unaligned_le32(&uuid[12]);
2015         if (val > 0xffff)
2016                 return 32;
2017
2018         return 16;
2019 }
2020
2021 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2022 {
2023         struct mgmt_pending_cmd *cmd;
2024
2025         hci_dev_lock(hdev);
2026
2027         cmd = pending_find(mgmt_op, hdev);
2028         if (!cmd)
2029                 goto unlock;
2030
2031         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2032                           mgmt_status(status), hdev->dev_class, 3);
2033
2034         mgmt_pending_remove(cmd);
2035
2036 unlock:
2037         hci_dev_unlock(hdev);
2038 }
2039
2040 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2041 {
2042         BT_DBG("status 0x%02x", status);
2043
2044         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2045 }
2046
2047 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2048 {
2049         struct mgmt_cp_add_uuid *cp = data;
2050         struct mgmt_pending_cmd *cmd;
2051         struct hci_request req;
2052         struct bt_uuid *uuid;
2053         int err;
2054
2055         BT_DBG("request for %s", hdev->name);
2056
2057         hci_dev_lock(hdev);
2058
2059         if (pending_eir_or_class(hdev)) {
2060                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2061                                       MGMT_STATUS_BUSY);
2062                 goto failed;
2063         }
2064
2065         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2066         if (!uuid) {
2067                 err = -ENOMEM;
2068                 goto failed;
2069         }
2070
2071         memcpy(uuid->uuid, cp->uuid, 16);
2072         uuid->svc_hint = cp->svc_hint;
2073         uuid->size = get_uuid_size(cp->uuid);
2074
2075         list_add_tail(&uuid->list, &hdev->uuids);
2076
2077         hci_req_init(&req, hdev);
2078
2079         __hci_req_update_class(&req);
2080         __hci_req_update_eir(&req);
2081
2082         err = hci_req_run(&req, add_uuid_complete);
2083         if (err < 0) {
2084                 if (err != -ENODATA)
2085                         goto failed;
2086
2087                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2088                                         hdev->dev_class, 3);
2089                 goto failed;
2090         }
2091
2092         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2093         if (!cmd) {
2094                 err = -ENOMEM;
2095                 goto failed;
2096         }
2097
2098         err = 0;
2099
2100 failed:
2101         hci_dev_unlock(hdev);
2102         return err;
2103 }
2104
2105 static bool enable_service_cache(struct hci_dev *hdev)
2106 {
2107         if (!hdev_is_powered(hdev))
2108                 return false;
2109
2110         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2111                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2112                                    CACHE_TIMEOUT);
2113                 return true;
2114         }
2115
2116         return false;
2117 }
2118
2119 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2120 {
2121         BT_DBG("status 0x%02x", status);
2122
2123         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2124 }
2125
2126 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2127                        u16 len)
2128 {
2129         struct mgmt_cp_remove_uuid *cp = data;
2130         struct mgmt_pending_cmd *cmd;
2131         struct bt_uuid *match, *tmp;
2132         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2133         struct hci_request req;
2134         int err, found;
2135
2136         BT_DBG("request for %s", hdev->name);
2137
2138         hci_dev_lock(hdev);
2139
2140         if (pending_eir_or_class(hdev)) {
2141                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2142                                       MGMT_STATUS_BUSY);
2143                 goto unlock;
2144         }
2145
2146         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2147                 hci_uuids_clear(hdev);
2148
2149                 if (enable_service_cache(hdev)) {
2150                         err = mgmt_cmd_complete(sk, hdev->id,
2151                                                 MGMT_OP_REMOVE_UUID,
2152                                                 0, hdev->dev_class, 3);
2153                         goto unlock;
2154                 }
2155
2156                 goto update_class;
2157         }
2158
2159         found = 0;
2160
2161         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2162                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2163                         continue;
2164
2165                 list_del(&match->list);
2166                 kfree(match);
2167                 found++;
2168         }
2169
2170         if (found == 0) {
2171                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2172                                       MGMT_STATUS_INVALID_PARAMS);
2173                 goto unlock;
2174         }
2175
2176 update_class:
2177         hci_req_init(&req, hdev);
2178
2179         __hci_req_update_class(&req);
2180         __hci_req_update_eir(&req);
2181
2182         err = hci_req_run(&req, remove_uuid_complete);
2183         if (err < 0) {
2184                 if (err != -ENODATA)
2185                         goto unlock;
2186
2187                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2188                                         hdev->dev_class, 3);
2189                 goto unlock;
2190         }
2191
2192         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2193         if (!cmd) {
2194                 err = -ENOMEM;
2195                 goto unlock;
2196         }
2197
2198         err = 0;
2199
2200 unlock:
2201         hci_dev_unlock(hdev);
2202         return err;
2203 }
2204
2205 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2206 {
2207         BT_DBG("status 0x%02x", status);
2208
2209         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2210 }
2211
2212 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2213                          u16 len)
2214 {
2215         struct mgmt_cp_set_dev_class *cp = data;
2216         struct mgmt_pending_cmd *cmd;
2217         struct hci_request req;
2218         int err;
2219
2220         BT_DBG("request for %s", hdev->name);
2221
2222         if (!lmp_bredr_capable(hdev))
2223                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2224                                        MGMT_STATUS_NOT_SUPPORTED);
2225
2226         hci_dev_lock(hdev);
2227
2228         if (pending_eir_or_class(hdev)) {
2229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2230                                       MGMT_STATUS_BUSY);
2231                 goto unlock;
2232         }
2233
2234         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2235                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2236                                       MGMT_STATUS_INVALID_PARAMS);
2237                 goto unlock;
2238         }
2239
2240         hdev->major_class = cp->major;
2241         hdev->minor_class = cp->minor;
2242
2243         if (!hdev_is_powered(hdev)) {
2244                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2245                                         hdev->dev_class, 3);
2246                 goto unlock;
2247         }
2248
2249         hci_req_init(&req, hdev);
2250
2251         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2252                 hci_dev_unlock(hdev);
2253                 cancel_delayed_work_sync(&hdev->service_cache);
2254                 hci_dev_lock(hdev);
2255                 __hci_req_update_eir(&req);
2256         }
2257
2258         __hci_req_update_class(&req);
2259
2260         err = hci_req_run(&req, set_class_complete);
2261         if (err < 0) {
2262                 if (err != -ENODATA)
2263                         goto unlock;
2264
2265                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2266                                         hdev->dev_class, 3);
2267                 goto unlock;
2268         }
2269
2270         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2271         if (!cmd) {
2272                 err = -ENOMEM;
2273                 goto unlock;
2274         }
2275
2276         err = 0;
2277
2278 unlock:
2279         hci_dev_unlock(hdev);
2280         return err;
2281 }
2282
2283 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2284                           u16 len)
2285 {
2286         struct mgmt_cp_load_link_keys *cp = data;
2287         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2288                                    sizeof(struct mgmt_link_key_info));
2289         u16 key_count, expected_len;
2290         bool changed;
2291         int i;
2292
2293         BT_DBG("request for %s", hdev->name);
2294
2295         if (!lmp_bredr_capable(hdev))
2296                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2297                                        MGMT_STATUS_NOT_SUPPORTED);
2298
2299         key_count = __le16_to_cpu(cp->key_count);
2300         if (key_count > max_key_count) {
2301                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2302                            key_count);
2303                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2304                                        MGMT_STATUS_INVALID_PARAMS);
2305         }
2306
2307         expected_len = struct_size(cp, keys, key_count);
2308         if (expected_len != len) {
2309                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2310                            expected_len, len);
2311                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2312                                        MGMT_STATUS_INVALID_PARAMS);
2313         }
2314
2315         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2317                                        MGMT_STATUS_INVALID_PARAMS);
2318
2319         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2320                key_count);
2321
2322         for (i = 0; i < key_count; i++) {
2323                 struct mgmt_link_key_info *key = &cp->keys[i];
2324
2325                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2326                         return mgmt_cmd_status(sk, hdev->id,
2327                                                MGMT_OP_LOAD_LINK_KEYS,
2328                                                MGMT_STATUS_INVALID_PARAMS);
2329         }
2330
2331         hci_dev_lock(hdev);
2332
2333         hci_link_keys_clear(hdev);
2334
2335         if (cp->debug_keys)
2336                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2337         else
2338                 changed = hci_dev_test_and_clear_flag(hdev,
2339                                                       HCI_KEEP_DEBUG_KEYS);
2340
2341         if (changed)
2342                 new_settings(hdev, NULL);
2343
2344         for (i = 0; i < key_count; i++) {
2345                 struct mgmt_link_key_info *key = &cp->keys[i];
2346
2347                 /* Always ignore debug keys and require a new pairing if
2348                  * the user wants to use them.
2349                  */
2350                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2351                         continue;
2352
2353                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2354                                  key->type, key->pin_len, NULL);
2355         }
2356
2357         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2358
2359         hci_dev_unlock(hdev);
2360
2361         return 0;
2362 }
2363
2364 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2365                            u8 addr_type, struct sock *skip_sk)
2366 {
2367         struct mgmt_ev_device_unpaired ev;
2368
2369         bacpy(&ev.addr.bdaddr, bdaddr);
2370         ev.addr.type = addr_type;
2371
2372         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2373                           skip_sk);
2374 }
2375
2376 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2377                          u16 len)
2378 {
2379         struct mgmt_cp_unpair_device *cp = data;
2380         struct mgmt_rp_unpair_device rp;
2381         struct hci_conn_params *params;
2382         struct mgmt_pending_cmd *cmd;
2383         struct hci_conn *conn;
2384         u8 addr_type;
2385         int err;
2386
2387         memset(&rp, 0, sizeof(rp));
2388         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2389         rp.addr.type = cp->addr.type;
2390
2391         if (!bdaddr_type_is_valid(cp->addr.type))
2392                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2393                                          MGMT_STATUS_INVALID_PARAMS,
2394                                          &rp, sizeof(rp));
2395
2396         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2397                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2398                                          MGMT_STATUS_INVALID_PARAMS,
2399                                          &rp, sizeof(rp));
2400
2401         hci_dev_lock(hdev);
2402
2403         if (!hdev_is_powered(hdev)) {
2404                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2405                                         MGMT_STATUS_NOT_POWERED, &rp,
2406                                         sizeof(rp));
2407                 goto unlock;
2408         }
2409
2410         if (cp->addr.type == BDADDR_BREDR) {
2411                 /* If disconnection is requested, then look up the
2412                  * connection. If the remote device is connected, it
2413                  * will be later used to terminate the link.
2414                  *
2415                  * Setting it to NULL explicitly will cause no
2416                  * termination of the link.
2417                  */
2418                 if (cp->disconnect)
2419                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2420                                                        &cp->addr.bdaddr);
2421                 else
2422                         conn = NULL;
2423
2424                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2425                 if (err < 0) {
2426                         err = mgmt_cmd_complete(sk, hdev->id,
2427                                                 MGMT_OP_UNPAIR_DEVICE,
2428                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2429                                                 sizeof(rp));
2430                         goto unlock;
2431                 }
2432
2433                 goto done;
2434         }
2435
2436         /* LE address type */
2437         addr_type = le_addr_type(cp->addr.type);
2438
2439         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2440         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2441         if (err < 0) {
2442                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2443                                         MGMT_STATUS_NOT_PAIRED, &rp,
2444                                         sizeof(rp));
2445                 goto unlock;
2446         }
2447
2448         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2449         if (!conn) {
2450                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2451                 goto done;
2452         }
2453
2454
2455         /* Defer clearing up the connection parameters until closing to
2456          * give a chance of keeping them if a repairing happens.
2457          */
2458         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2459
2460         /* Disable auto-connection parameters if present */
2461         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2462         if (params) {
2463                 if (params->explicit_connect)
2464                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2465                 else
2466                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2467         }
2468
2469         /* If disconnection is not requested, then clear the connection
2470          * variable so that the link is not terminated.
2471          */
2472         if (!cp->disconnect)
2473                 conn = NULL;
2474
2475 done:
2476         /* If the connection variable is set, then termination of the
2477          * link is requested.
2478          */
2479         if (!conn) {
2480                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2481                                         &rp, sizeof(rp));
2482                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2483                 goto unlock;
2484         }
2485
2486         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2487                                sizeof(*cp));
2488         if (!cmd) {
2489                 err = -ENOMEM;
2490                 goto unlock;
2491         }
2492
2493         cmd->cmd_complete = addr_cmd_complete;
2494
2495         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2496         if (err < 0)
2497                 mgmt_pending_remove(cmd);
2498
2499 unlock:
2500         hci_dev_unlock(hdev);
2501         return err;
2502 }
2503
2504 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2505                       u16 len)
2506 {
2507         struct mgmt_cp_disconnect *cp = data;
2508         struct mgmt_rp_disconnect rp;
2509         struct mgmt_pending_cmd *cmd;
2510         struct hci_conn *conn;
2511         int err;
2512
2513         BT_DBG("");
2514
2515         memset(&rp, 0, sizeof(rp));
2516         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2517         rp.addr.type = cp->addr.type;
2518
2519         if (!bdaddr_type_is_valid(cp->addr.type))
2520                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2521                                          MGMT_STATUS_INVALID_PARAMS,
2522                                          &rp, sizeof(rp));
2523
2524         hci_dev_lock(hdev);
2525
2526         if (!test_bit(HCI_UP, &hdev->flags)) {
2527                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2528                                         MGMT_STATUS_NOT_POWERED, &rp,
2529                                         sizeof(rp));
2530                 goto failed;
2531         }
2532
2533         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2534                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2535                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2536                 goto failed;
2537         }
2538
2539         if (cp->addr.type == BDADDR_BREDR)
2540                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2541                                                &cp->addr.bdaddr);
2542         else
2543                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2544                                                le_addr_type(cp->addr.type));
2545
2546         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2548                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2549                                         sizeof(rp));
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         cmd->cmd_complete = generic_cmd_complete;
2560
2561         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2562         if (err < 0)
2563                 mgmt_pending_remove(cmd);
2564
2565 failed:
2566         hci_dev_unlock(hdev);
2567         return err;
2568 }
2569
2570 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2571 {
2572         switch (link_type) {
2573         case LE_LINK:
2574                 switch (addr_type) {
2575                 case ADDR_LE_DEV_PUBLIC:
2576                         return BDADDR_LE_PUBLIC;
2577
2578                 default:
2579                         /* Fallback to LE Random address type */
2580                         return BDADDR_LE_RANDOM;
2581                 }
2582
2583         default:
2584                 /* Fallback to BR/EDR type */
2585                 return BDADDR_BREDR;
2586         }
2587 }
2588
2589 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2590                            u16 data_len)
2591 {
2592         struct mgmt_rp_get_connections *rp;
2593         struct hci_conn *c;
2594         int err;
2595         u16 i;
2596
2597         BT_DBG("");
2598
2599         hci_dev_lock(hdev);
2600
2601         if (!hdev_is_powered(hdev)) {
2602                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2603                                       MGMT_STATUS_NOT_POWERED);
2604                 goto unlock;
2605         }
2606
2607         i = 0;
2608         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2609                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2610                         i++;
2611         }
2612
2613         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2614         if (!rp) {
2615                 err = -ENOMEM;
2616                 goto unlock;
2617         }
2618
2619         i = 0;
2620         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2621                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2622                         continue;
2623                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2624                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2625                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2626                         continue;
2627                 i++;
2628         }
2629
2630         rp->conn_count = cpu_to_le16(i);
2631
2632         /* Recalculate length in case of filtered SCO connections, etc */
2633         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2634                                 struct_size(rp, addr, i));
2635
2636         kfree(rp);
2637
2638 unlock:
2639         hci_dev_unlock(hdev);
2640         return err;
2641 }
2642
2643 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2644                                    struct mgmt_cp_pin_code_neg_reply *cp)
2645 {
2646         struct mgmt_pending_cmd *cmd;
2647         int err;
2648
2649         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2650                                sizeof(*cp));
2651         if (!cmd)
2652                 return -ENOMEM;
2653
2654         cmd->cmd_complete = addr_cmd_complete;
2655
2656         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2657                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2658         if (err < 0)
2659                 mgmt_pending_remove(cmd);
2660
2661         return err;
2662 }
2663
2664 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2665                           u16 len)
2666 {
2667         struct hci_conn *conn;
2668         struct mgmt_cp_pin_code_reply *cp = data;
2669         struct hci_cp_pin_code_reply reply;
2670         struct mgmt_pending_cmd *cmd;
2671         int err;
2672
2673         BT_DBG("");
2674
2675         hci_dev_lock(hdev);
2676
2677         if (!hdev_is_powered(hdev)) {
2678                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2679                                       MGMT_STATUS_NOT_POWERED);
2680                 goto failed;
2681         }
2682
2683         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2684         if (!conn) {
2685                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2686                                       MGMT_STATUS_NOT_CONNECTED);
2687                 goto failed;
2688         }
2689
2690         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2691                 struct mgmt_cp_pin_code_neg_reply ncp;
2692
2693                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2694
2695                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2696
2697                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2698                 if (err >= 0)
2699                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2700                                               MGMT_STATUS_INVALID_PARAMS);
2701
2702                 goto failed;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto failed;
2709         }
2710
2711         cmd->cmd_complete = addr_cmd_complete;
2712
2713         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2714         reply.pin_len = cp->pin_len;
2715         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2716
2717         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2718         if (err < 0)
2719                 mgmt_pending_remove(cmd);
2720
2721 failed:
2722         hci_dev_unlock(hdev);
2723         return err;
2724 }
2725
2726 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2727                              u16 len)
2728 {
2729         struct mgmt_cp_set_io_capability *cp = data;
2730
2731         BT_DBG("");
2732
2733         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2734                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2735                                        MGMT_STATUS_INVALID_PARAMS);
2736
2737         hci_dev_lock(hdev);
2738
2739         hdev->io_capability = cp->io_capability;
2740
2741         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2742                hdev->io_capability);
2743
2744         hci_dev_unlock(hdev);
2745
2746         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2747                                  NULL, 0);
2748 }
2749
2750 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2751 {
2752         struct hci_dev *hdev = conn->hdev;
2753         struct mgmt_pending_cmd *cmd;
2754
2755         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2756                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2757                         continue;
2758
2759                 if (cmd->user_data != conn)
2760                         continue;
2761
2762                 return cmd;
2763         }
2764
2765         return NULL;
2766 }
2767
2768 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2769 {
2770         struct mgmt_rp_pair_device rp;
2771         struct hci_conn *conn = cmd->user_data;
2772         int err;
2773
2774         bacpy(&rp.addr.bdaddr, &conn->dst);
2775         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2776
2777         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2778                                 status, &rp, sizeof(rp));
2779
2780         /* So we don't get further callbacks for this connection */
2781         conn->connect_cfm_cb = NULL;
2782         conn->security_cfm_cb = NULL;
2783         conn->disconn_cfm_cb = NULL;
2784
2785         hci_conn_drop(conn);
2786
2787         /* The device is paired so there is no need to remove
2788          * its connection parameters anymore.
2789          */
2790         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2791
2792         hci_conn_put(conn);
2793
2794         return err;
2795 }
2796
2797 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2798 {
2799         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2800         struct mgmt_pending_cmd *cmd;
2801
2802         cmd = find_pairing(conn);
2803         if (cmd) {
2804                 cmd->cmd_complete(cmd, status);
2805                 mgmt_pending_remove(cmd);
2806         }
2807 }
2808
2809 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2810 {
2811         struct mgmt_pending_cmd *cmd;
2812
2813         BT_DBG("status %u", status);
2814
2815         cmd = find_pairing(conn);
2816         if (!cmd) {
2817                 BT_DBG("Unable to find a pending command");
2818                 return;
2819         }
2820
2821         cmd->cmd_complete(cmd, mgmt_status(status));
2822         mgmt_pending_remove(cmd);
2823 }
2824
2825 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2826 {
2827         struct mgmt_pending_cmd *cmd;
2828
2829         BT_DBG("status %u", status);
2830
2831         if (!status)
2832                 return;
2833
2834         cmd = find_pairing(conn);
2835         if (!cmd) {
2836                 BT_DBG("Unable to find a pending command");
2837                 return;
2838         }
2839
2840         cmd->cmd_complete(cmd, mgmt_status(status));
2841         mgmt_pending_remove(cmd);
2842 }
2843
2844 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2845                        u16 len)
2846 {
2847         struct mgmt_cp_pair_device *cp = data;
2848         struct mgmt_rp_pair_device rp;
2849         struct mgmt_pending_cmd *cmd;
2850         u8 sec_level, auth_type;
2851         struct hci_conn *conn;
2852         int err;
2853
2854         BT_DBG("");
2855
2856         memset(&rp, 0, sizeof(rp));
2857         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2858         rp.addr.type = cp->addr.type;
2859
2860         if (!bdaddr_type_is_valid(cp->addr.type))
2861                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2862                                          MGMT_STATUS_INVALID_PARAMS,
2863                                          &rp, sizeof(rp));
2864
2865         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2866                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867                                          MGMT_STATUS_INVALID_PARAMS,
2868                                          &rp, sizeof(rp));
2869
2870         hci_dev_lock(hdev);
2871
2872         if (!hdev_is_powered(hdev)) {
2873                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2874                                         MGMT_STATUS_NOT_POWERED, &rp,
2875                                         sizeof(rp));
2876                 goto unlock;
2877         }
2878
2879         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2880                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2881                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2882                                         sizeof(rp));
2883                 goto unlock;
2884         }
2885
2886         sec_level = BT_SECURITY_MEDIUM;
2887         auth_type = HCI_AT_DEDICATED_BONDING;
2888
2889         if (cp->addr.type == BDADDR_BREDR) {
2890                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2891                                        auth_type);
2892         } else {
2893                 u8 addr_type = le_addr_type(cp->addr.type);
2894                 struct hci_conn_params *p;
2895
2896                 /* When pairing a new device, it is expected to remember
2897                  * this device for future connections. Adding the connection
2898                  * parameter information ahead of time allows tracking
2899                  * of the slave preferred values and will speed up any
2900                  * further connection establishment.
2901                  *
2902                  * If connection parameters already exist, then they
2903                  * will be kept and this function does nothing.
2904                  */
2905                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2906
2907                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2908                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2909
2910                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2911                                            addr_type, sec_level,
2912                                            HCI_LE_CONN_TIMEOUT);
2913         }
2914
2915         if (IS_ERR(conn)) {
2916                 int status;
2917
2918                 if (PTR_ERR(conn) == -EBUSY)
2919                         status = MGMT_STATUS_BUSY;
2920                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2921                         status = MGMT_STATUS_NOT_SUPPORTED;
2922                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2923                         status = MGMT_STATUS_REJECTED;
2924                 else
2925                         status = MGMT_STATUS_CONNECT_FAILED;
2926
2927                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                         status, &rp, sizeof(rp));
2929                 goto unlock;
2930         }
2931
2932         if (conn->connect_cfm_cb) {
2933                 hci_conn_drop(conn);
2934                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2935                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2940         if (!cmd) {
2941                 err = -ENOMEM;
2942                 hci_conn_drop(conn);
2943                 goto unlock;
2944         }
2945
2946         cmd->cmd_complete = pairing_complete;
2947
2948         /* For LE, just connecting isn't a proof that the pairing finished */
2949         if (cp->addr.type == BDADDR_BREDR) {
2950                 conn->connect_cfm_cb = pairing_complete_cb;
2951                 conn->security_cfm_cb = pairing_complete_cb;
2952                 conn->disconn_cfm_cb = pairing_complete_cb;
2953         } else {
2954                 conn->connect_cfm_cb = le_pairing_complete_cb;
2955                 conn->security_cfm_cb = le_pairing_complete_cb;
2956                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2957         }
2958
2959         conn->io_capability = cp->io_cap;
2960         cmd->user_data = hci_conn_get(conn);
2961
2962         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2963             hci_conn_security(conn, sec_level, auth_type, true)) {
2964                 cmd->cmd_complete(cmd, 0);
2965                 mgmt_pending_remove(cmd);
2966         }
2967
2968         err = 0;
2969
2970 unlock:
2971         hci_dev_unlock(hdev);
2972         return err;
2973 }
2974
2975 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2976                               u16 len)
2977 {
2978         struct mgmt_addr_info *addr = data;
2979         struct mgmt_pending_cmd *cmd;
2980         struct hci_conn *conn;
2981         int err;
2982
2983         BT_DBG("");
2984
2985         hci_dev_lock(hdev);
2986
2987         if (!hdev_is_powered(hdev)) {
2988                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2989                                       MGMT_STATUS_NOT_POWERED);
2990                 goto unlock;
2991         }
2992
2993         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2994         if (!cmd) {
2995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2996                                       MGMT_STATUS_INVALID_PARAMS);
2997                 goto unlock;
2998         }
2999
3000         conn = cmd->user_data;
3001
3002         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3003                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3004                                       MGMT_STATUS_INVALID_PARAMS);
3005                 goto unlock;
3006         }
3007
3008         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3009         mgmt_pending_remove(cmd);
3010
3011         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3012                                 addr, sizeof(*addr));
3013 unlock:
3014         hci_dev_unlock(hdev);
3015         return err;
3016 }
3017
3018 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3019                              struct mgmt_addr_info *addr, u16 mgmt_op,
3020                              u16 hci_op, __le32 passkey)
3021 {
3022         struct mgmt_pending_cmd *cmd;
3023         struct hci_conn *conn;
3024         int err;
3025
3026         hci_dev_lock(hdev);
3027
3028         if (!hdev_is_powered(hdev)) {
3029                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3030                                         MGMT_STATUS_NOT_POWERED, addr,
3031                                         sizeof(*addr));
3032                 goto done;
3033         }
3034
3035         if (addr->type == BDADDR_BREDR)
3036                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3037         else
3038                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3039                                                le_addr_type(addr->type));
3040
3041         if (!conn) {
3042                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3043                                         MGMT_STATUS_NOT_CONNECTED, addr,
3044                                         sizeof(*addr));
3045                 goto done;
3046         }
3047
3048         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3049                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3050                 if (!err)
3051                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3052                                                 MGMT_STATUS_SUCCESS, addr,
3053                                                 sizeof(*addr));
3054                 else
3055                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3056                                                 MGMT_STATUS_FAILED, addr,
3057                                                 sizeof(*addr));
3058
3059                 goto done;
3060         }
3061
3062         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3063         if (!cmd) {
3064                 err = -ENOMEM;
3065                 goto done;
3066         }
3067
3068         cmd->cmd_complete = addr_cmd_complete;
3069
3070         /* Continue with pairing via HCI */
3071         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3072                 struct hci_cp_user_passkey_reply cp;
3073
3074                 bacpy(&cp.bdaddr, &addr->bdaddr);
3075                 cp.passkey = passkey;
3076                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3077         } else
3078                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3079                                    &addr->bdaddr);
3080
3081         if (err < 0)
3082                 mgmt_pending_remove(cmd);
3083
3084 done:
3085         hci_dev_unlock(hdev);
3086         return err;
3087 }
3088
3089 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3090                               void *data, u16 len)
3091 {
3092         struct mgmt_cp_pin_code_neg_reply *cp = data;
3093
3094         BT_DBG("");
3095
3096         return user_pairing_resp(sk, hdev, &cp->addr,
3097                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3098                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3099 }
3100
3101 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3102                               u16 len)
3103 {
3104         struct mgmt_cp_user_confirm_reply *cp = data;
3105
3106         BT_DBG("");
3107
3108         if (len != sizeof(*cp))
3109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3110                                        MGMT_STATUS_INVALID_PARAMS);
3111
3112         return user_pairing_resp(sk, hdev, &cp->addr,
3113                                  MGMT_OP_USER_CONFIRM_REPLY,
3114                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3115 }
3116
3117 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3118                                   void *data, u16 len)
3119 {
3120         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3121
3122         BT_DBG("");
3123
3124         return user_pairing_resp(sk, hdev, &cp->addr,
3125                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3126                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3127 }
3128
3129 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3130                               u16 len)
3131 {
3132         struct mgmt_cp_user_passkey_reply *cp = data;
3133
3134         BT_DBG("");
3135
3136         return user_pairing_resp(sk, hdev, &cp->addr,
3137                                  MGMT_OP_USER_PASSKEY_REPLY,
3138                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3139 }
3140
3141 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3142                                   void *data, u16 len)
3143 {
3144         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3145
3146         BT_DBG("");
3147
3148         return user_pairing_resp(sk, hdev, &cp->addr,
3149                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3150                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3151 }
3152
3153 static void adv_expire(struct hci_dev *hdev, u32 flags)
3154 {
3155         struct adv_info *adv_instance;
3156         struct hci_request req;
3157         int err;
3158
3159         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3160         if (!adv_instance)
3161                 return;
3162
3163         /* stop if current instance doesn't need to be changed */
3164         if (!(adv_instance->flags & flags))
3165                 return;
3166
3167         cancel_adv_timeout(hdev);
3168
3169         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3170         if (!adv_instance)
3171                 return;
3172
3173         hci_req_init(&req, hdev);
3174         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3175                                               true);
3176         if (err)
3177                 return;
3178
3179         hci_req_run(&req, NULL);
3180 }
3181
3182 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3183 {
3184         struct mgmt_cp_set_local_name *cp;
3185         struct mgmt_pending_cmd *cmd;
3186
3187         BT_DBG("status 0x%02x", status);
3188
3189         hci_dev_lock(hdev);
3190
3191         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3192         if (!cmd)
3193                 goto unlock;
3194
3195         cp = cmd->param;
3196
3197         if (status) {
3198                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3199                                 mgmt_status(status));
3200         } else {
3201                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3202                                   cp, sizeof(*cp));
3203
3204                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3205                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3206         }
3207
3208         mgmt_pending_remove(cmd);
3209
3210 unlock:
3211         hci_dev_unlock(hdev);
3212 }
3213
3214 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3215                           u16 len)
3216 {
3217         struct mgmt_cp_set_local_name *cp = data;
3218         struct mgmt_pending_cmd *cmd;
3219         struct hci_request req;
3220         int err;
3221
3222         BT_DBG("");
3223
3224         hci_dev_lock(hdev);
3225
3226         /* If the old values are the same as the new ones just return a
3227          * direct command complete event.
3228          */
3229         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3230             !memcmp(hdev->short_name, cp->short_name,
3231                     sizeof(hdev->short_name))) {
3232                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3233                                         data, len);
3234                 goto failed;
3235         }
3236
3237         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3238
3239         if (!hdev_is_powered(hdev)) {
3240                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3241
3242                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3243                                         data, len);
3244                 if (err < 0)
3245                         goto failed;
3246
3247                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3248                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3249                 ext_info_changed(hdev, sk);
3250
3251                 goto failed;
3252         }
3253
3254         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3255         if (!cmd) {
3256                 err = -ENOMEM;
3257                 goto failed;
3258         }
3259
3260         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3261
3262         hci_req_init(&req, hdev);
3263
3264         if (lmp_bredr_capable(hdev)) {
3265                 __hci_req_update_name(&req);
3266                 __hci_req_update_eir(&req);
3267         }
3268
3269         /* The name is stored in the scan response data and so
3270          * no need to udpate the advertising data here.
3271          */
3272         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3273                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3274
3275         err = hci_req_run(&req, set_name_complete);
3276         if (err < 0)
3277                 mgmt_pending_remove(cmd);
3278
3279 failed:
3280         hci_dev_unlock(hdev);
3281         return err;
3282 }
3283
3284 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3285                           u16 len)
3286 {
3287         struct mgmt_cp_set_appearance *cp = data;
3288         u16 apperance;
3289         int err;
3290
3291         BT_DBG("");
3292
3293         if (!lmp_le_capable(hdev))
3294                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3295                                        MGMT_STATUS_NOT_SUPPORTED);
3296
3297         apperance = le16_to_cpu(cp->appearance);
3298
3299         hci_dev_lock(hdev);
3300
3301         if (hdev->appearance != apperance) {
3302                 hdev->appearance = apperance;
3303
3304                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3305                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3306
3307                 ext_info_changed(hdev, sk);
3308         }
3309
3310         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3311                                 0);
3312
3313         hci_dev_unlock(hdev);
3314
3315         return err;
3316 }
3317
3318 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3319                                  void *data, u16 len)
3320 {
3321         struct mgmt_rp_get_phy_confguration rp;
3322
3323         BT_DBG("sock %p %s", sk, hdev->name);
3324
3325         hci_dev_lock(hdev);
3326
3327         memset(&rp, 0, sizeof(rp));
3328
3329         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3330         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3331         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3332
3333         hci_dev_unlock(hdev);
3334
3335         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3336                                  &rp, sizeof(rp));
3337 }
3338
3339 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3340 {
3341         struct mgmt_ev_phy_configuration_changed ev;
3342
3343         memset(&ev, 0, sizeof(ev));
3344
3345         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3346
3347         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3348                           sizeof(ev), skip);
3349 }
3350
3351 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3352                                      u16 opcode, struct sk_buff *skb)
3353 {
3354         struct mgmt_pending_cmd *cmd;
3355
3356         BT_DBG("status 0x%02x", status);
3357
3358         hci_dev_lock(hdev);
3359
3360         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3361         if (!cmd)
3362                 goto unlock;
3363
3364         if (status) {
3365                 mgmt_cmd_status(cmd->sk, hdev->id,
3366                                 MGMT_OP_SET_PHY_CONFIGURATION,
3367                                 mgmt_status(status));
3368         } else {
3369                 mgmt_cmd_complete(cmd->sk, hdev->id,
3370                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3371                                   NULL, 0);
3372
3373                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3374         }
3375
3376         mgmt_pending_remove(cmd);
3377
3378 unlock:
3379         hci_dev_unlock(hdev);
3380 }
3381
3382 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3383                                  void *data, u16 len)
3384 {
3385         struct mgmt_cp_set_phy_confguration *cp = data;
3386         struct hci_cp_le_set_default_phy cp_phy;
3387         struct mgmt_pending_cmd *cmd;
3388         struct hci_request req;
3389         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3390         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3391         bool changed = false;
3392         int err;
3393
3394         BT_DBG("sock %p %s", sk, hdev->name);
3395
3396         configurable_phys = get_configurable_phys(hdev);
3397         supported_phys = get_supported_phys(hdev);
3398         selected_phys = __le32_to_cpu(cp->selected_phys);
3399
3400         if (selected_phys & ~supported_phys)
3401                 return mgmt_cmd_status(sk, hdev->id,
3402                                        MGMT_OP_SET_PHY_CONFIGURATION,
3403                                        MGMT_STATUS_INVALID_PARAMS);
3404
3405         unconfigure_phys = supported_phys & ~configurable_phys;
3406
3407         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3408                 return mgmt_cmd_status(sk, hdev->id,
3409                                        MGMT_OP_SET_PHY_CONFIGURATION,
3410                                        MGMT_STATUS_INVALID_PARAMS);
3411
3412         if (selected_phys == get_selected_phys(hdev))
3413                 return mgmt_cmd_complete(sk, hdev->id,
3414                                          MGMT_OP_SET_PHY_CONFIGURATION,
3415                                          0, NULL, 0);
3416
3417         hci_dev_lock(hdev);
3418
3419         if (!hdev_is_powered(hdev)) {
3420                 err = mgmt_cmd_status(sk, hdev->id,
3421                                       MGMT_OP_SET_PHY_CONFIGURATION,
3422                                       MGMT_STATUS_REJECTED);
3423                 goto unlock;
3424         }
3425
3426         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3427                 err = mgmt_cmd_status(sk, hdev->id,
3428                                       MGMT_OP_SET_PHY_CONFIGURATION,
3429                                       MGMT_STATUS_BUSY);
3430                 goto unlock;
3431         }
3432
3433         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3434                 pkt_type |= (HCI_DH3 | HCI_DM3);
3435         else
3436                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3437
3438         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3439                 pkt_type |= (HCI_DH5 | HCI_DM5);
3440         else
3441                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3442
3443         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3444                 pkt_type &= ~HCI_2DH1;
3445         else
3446                 pkt_type |= HCI_2DH1;
3447
3448         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3449                 pkt_type &= ~HCI_2DH3;
3450         else
3451                 pkt_type |= HCI_2DH3;
3452
3453         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3454                 pkt_type &= ~HCI_2DH5;
3455         else
3456                 pkt_type |= HCI_2DH5;
3457
3458         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3459                 pkt_type &= ~HCI_3DH1;
3460         else
3461                 pkt_type |= HCI_3DH1;
3462
3463         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3464                 pkt_type &= ~HCI_3DH3;
3465         else
3466                 pkt_type |= HCI_3DH3;
3467
3468         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3469                 pkt_type &= ~HCI_3DH5;
3470         else
3471                 pkt_type |= HCI_3DH5;
3472
3473         if (pkt_type != hdev->pkt_type) {
3474                 hdev->pkt_type = pkt_type;
3475                 changed = true;
3476         }
3477
3478         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3479             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3480                 if (changed)
3481                         mgmt_phy_configuration_changed(hdev, sk);
3482
3483                 err = mgmt_cmd_complete(sk, hdev->id,
3484                                         MGMT_OP_SET_PHY_CONFIGURATION,
3485                                         0, NULL, 0);
3486
3487                 goto unlock;
3488         }
3489
3490         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3491                                len);
3492         if (!cmd) {
3493                 err = -ENOMEM;
3494                 goto unlock;
3495         }
3496
3497         hci_req_init(&req, hdev);
3498
3499         memset(&cp_phy, 0, sizeof(cp_phy));
3500
3501         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3502                 cp_phy.all_phys |= 0x01;
3503
3504         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3505                 cp_phy.all_phys |= 0x02;
3506
3507         if (selected_phys & MGMT_PHY_LE_1M_TX)
3508                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3509
3510         if (selected_phys & MGMT_PHY_LE_2M_TX)
3511                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3512
3513         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3514                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3515
3516         if (selected_phys & MGMT_PHY_LE_1M_RX)
3517                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3518
3519         if (selected_phys & MGMT_PHY_LE_2M_RX)
3520                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3521
3522         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3523                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3524
3525         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3526
3527         err = hci_req_run_skb(&req, set_default_phy_complete);
3528         if (err < 0)
3529                 mgmt_pending_remove(cmd);
3530
3531 unlock:
3532         hci_dev_unlock(hdev);
3533
3534         return err;
3535 }
3536
3537 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3538                                          u16 opcode, struct sk_buff *skb)
3539 {
3540         struct mgmt_rp_read_local_oob_data mgmt_rp;
3541         size_t rp_size = sizeof(mgmt_rp);
3542         struct mgmt_pending_cmd *cmd;
3543
3544         BT_DBG("%s status %u", hdev->name, status);
3545
3546         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3547         if (!cmd)
3548                 return;
3549
3550         if (status || !skb) {
3551                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3552                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3553                 goto remove;
3554         }
3555
3556         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3557
3558         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3559                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3560
3561                 if (skb->len < sizeof(*rp)) {
3562                         mgmt_cmd_status(cmd->sk, hdev->id,
3563                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3564                                         MGMT_STATUS_FAILED);
3565                         goto remove;
3566                 }
3567
3568                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3569                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3570
3571                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3572         } else {
3573                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3574
3575                 if (skb->len < sizeof(*rp)) {
3576                         mgmt_cmd_status(cmd->sk, hdev->id,
3577                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3578                                         MGMT_STATUS_FAILED);
3579                         goto remove;
3580                 }
3581
3582                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3583                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3584
3585                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3586                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3587         }
3588
3589         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3590                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3591
3592 remove:
3593         mgmt_pending_remove(cmd);
3594 }
3595
3596 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3597                                void *data, u16 data_len)
3598 {
3599         struct mgmt_pending_cmd *cmd;
3600         struct hci_request req;
3601         int err;
3602
3603         BT_DBG("%s", hdev->name);
3604
3605         hci_dev_lock(hdev);
3606
3607         if (!hdev_is_powered(hdev)) {
3608                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3609                                       MGMT_STATUS_NOT_POWERED);
3610                 goto unlock;
3611         }
3612
3613         if (!lmp_ssp_capable(hdev)) {
3614                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3615                                       MGMT_STATUS_NOT_SUPPORTED);
3616                 goto unlock;
3617         }
3618
3619         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3620                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3621                                       MGMT_STATUS_BUSY);
3622                 goto unlock;
3623         }
3624
3625         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3626         if (!cmd) {
3627                 err = -ENOMEM;
3628                 goto unlock;
3629         }
3630
3631         hci_req_init(&req, hdev);
3632
3633         if (bredr_sc_enabled(hdev))
3634                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3635         else
3636                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3637
3638         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3639         if (err < 0)
3640                 mgmt_pending_remove(cmd);
3641
3642 unlock:
3643         hci_dev_unlock(hdev);
3644         return err;
3645 }
3646
3647 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3648                                void *data, u16 len)
3649 {
3650         struct mgmt_addr_info *addr = data;
3651         int err;
3652
3653         BT_DBG("%s ", hdev->name);
3654
3655         if (!bdaddr_type_is_valid(addr->type))
3656                 return mgmt_cmd_complete(sk, hdev->id,
3657                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3658                                          MGMT_STATUS_INVALID_PARAMS,
3659                                          addr, sizeof(*addr));
3660
3661         hci_dev_lock(hdev);
3662
3663         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3664                 struct mgmt_cp_add_remote_oob_data *cp = data;
3665                 u8 status;
3666
3667                 if (cp->addr.type != BDADDR_BREDR) {
3668                         err = mgmt_cmd_complete(sk, hdev->id,
3669                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3670                                                 MGMT_STATUS_INVALID_PARAMS,
3671                                                 &cp->addr, sizeof(cp->addr));
3672                         goto unlock;
3673                 }
3674
3675                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3676                                               cp->addr.type, cp->hash,
3677                                               cp->rand, NULL, NULL);
3678                 if (err < 0)
3679                         status = MGMT_STATUS_FAILED;
3680                 else
3681                         status = MGMT_STATUS_SUCCESS;
3682
3683                 err = mgmt_cmd_complete(sk, hdev->id,
3684                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3685                                         &cp->addr, sizeof(cp->addr));
3686         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3687                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3688                 u8 *rand192, *hash192, *rand256, *hash256;
3689                 u8 status;
3690
3691                 if (bdaddr_type_is_le(cp->addr.type)) {
3692                         /* Enforce zero-valued 192-bit parameters as
3693                          * long as legacy SMP OOB isn't implemented.
3694                          */
3695                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3696                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3697                                 err = mgmt_cmd_complete(sk, hdev->id,
3698                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3699                                                         MGMT_STATUS_INVALID_PARAMS,
3700                                                         addr, sizeof(*addr));
3701                                 goto unlock;
3702                         }
3703
3704                         rand192 = NULL;
3705                         hash192 = NULL;
3706                 } else {
3707                         /* In case one of the P-192 values is set to zero,
3708                          * then just disable OOB data for P-192.
3709                          */
3710                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3711                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3712                                 rand192 = NULL;
3713                                 hash192 = NULL;
3714                         } else {
3715                                 rand192 = cp->rand192;
3716                                 hash192 = cp->hash192;
3717                         }
3718                 }
3719
3720                 /* In case one of the P-256 values is set to zero, then just
3721                  * disable OOB data for P-256.
3722                  */
3723                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3724                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3725                         rand256 = NULL;
3726                         hash256 = NULL;
3727                 } else {
3728                         rand256 = cp->rand256;
3729                         hash256 = cp->hash256;
3730                 }
3731
3732                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3733                                               cp->addr.type, hash192, rand192,
3734                                               hash256, rand256);
3735                 if (err < 0)
3736                         status = MGMT_STATUS_FAILED;
3737                 else
3738                         status = MGMT_STATUS_SUCCESS;
3739
3740                 err = mgmt_cmd_complete(sk, hdev->id,
3741                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3742                                         status, &cp->addr, sizeof(cp->addr));
3743         } else {
3744                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3745                            len);
3746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3747                                       MGMT_STATUS_INVALID_PARAMS);
3748         }
3749
3750 unlock:
3751         hci_dev_unlock(hdev);
3752         return err;
3753 }
3754
3755 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3756                                   void *data, u16 len)
3757 {
3758         struct mgmt_cp_remove_remote_oob_data *cp = data;
3759         u8 status;
3760         int err;
3761
3762         BT_DBG("%s", hdev->name);
3763
3764         if (cp->addr.type != BDADDR_BREDR)
3765                 return mgmt_cmd_complete(sk, hdev->id,
3766                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3767                                          MGMT_STATUS_INVALID_PARAMS,
3768                                          &cp->addr, sizeof(cp->addr));
3769
3770         hci_dev_lock(hdev);
3771
3772         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3773                 hci_remote_oob_data_clear(hdev);
3774                 status = MGMT_STATUS_SUCCESS;
3775                 goto done;
3776         }
3777
3778         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3779         if (err < 0)
3780                 status = MGMT_STATUS_INVALID_PARAMS;
3781         else
3782                 status = MGMT_STATUS_SUCCESS;
3783
3784 done:
3785         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3786                                 status, &cp->addr, sizeof(cp->addr));
3787
3788         hci_dev_unlock(hdev);
3789         return err;
3790 }
3791
3792 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3793 {
3794         struct mgmt_pending_cmd *cmd;
3795
3796         BT_DBG("status %d", status);
3797
3798         hci_dev_lock(hdev);
3799
3800         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3801         if (!cmd)
3802                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3803
3804         if (!cmd)
3805                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3806
3807         if (cmd) {
3808                 cmd->cmd_complete(cmd, mgmt_status(status));
3809                 mgmt_pending_remove(cmd);
3810         }
3811
3812         hci_dev_unlock(hdev);
3813 }
3814
3815 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3816                                     uint8_t *mgmt_status)
3817 {
3818         switch (type) {
3819         case DISCOV_TYPE_LE:
3820                 *mgmt_status = mgmt_le_support(hdev);
3821                 if (*mgmt_status)
3822                         return false;
3823                 break;
3824         case DISCOV_TYPE_INTERLEAVED:
3825                 *mgmt_status = mgmt_le_support(hdev);
3826                 if (*mgmt_status)
3827                         return false;
3828                 /* Intentional fall-through */
3829         case DISCOV_TYPE_BREDR:
3830                 *mgmt_status = mgmt_bredr_support(hdev);
3831                 if (*mgmt_status)
3832                         return false;
3833                 break;
3834         default:
3835                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3836                 return false;
3837         }
3838
3839         return true;
3840 }
3841
3842 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3843                                     u16 op, void *data, u16 len)
3844 {
3845         struct mgmt_cp_start_discovery *cp = data;
3846         struct mgmt_pending_cmd *cmd;
3847         u8 status;
3848         int err;
3849
3850         BT_DBG("%s", hdev->name);
3851
3852         hci_dev_lock(hdev);
3853
3854         if (!hdev_is_powered(hdev)) {
3855                 err = mgmt_cmd_complete(sk, hdev->id, op,
3856                                         MGMT_STATUS_NOT_POWERED,
3857                                         &cp->type, sizeof(cp->type));
3858                 goto failed;
3859         }
3860
3861         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3862             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3863                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3864                                         &cp->type, sizeof(cp->type));
3865                 goto failed;
3866         }
3867
3868         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3869                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3870                                         &cp->type, sizeof(cp->type));
3871                 goto failed;
3872         }
3873
3874         /* Clear the discovery filter first to free any previously
3875          * allocated memory for the UUID list.
3876          */
3877         hci_discovery_filter_clear(hdev);
3878
3879         hdev->discovery.type = cp->type;
3880         hdev->discovery.report_invalid_rssi = false;
3881         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3882                 hdev->discovery.limited = true;
3883         else
3884                 hdev->discovery.limited = false;
3885
3886         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3887         if (!cmd) {
3888                 err = -ENOMEM;
3889                 goto failed;
3890         }
3891
3892         cmd->cmd_complete = generic_cmd_complete;
3893
3894         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3895         queue_work(hdev->req_workqueue, &hdev->discov_update);
3896         err = 0;
3897
3898 failed:
3899         hci_dev_unlock(hdev);
3900         return err;
3901 }
3902
3903 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3904                            void *data, u16 len)
3905 {
3906         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3907                                         data, len);
3908 }
3909
3910 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3911                                    void *data, u16 len)
3912 {
3913         return start_discovery_internal(sk, hdev,
3914                                         MGMT_OP_START_LIMITED_DISCOVERY,
3915                                         data, len);
3916 }
3917
3918 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3919                                           u8 status)
3920 {
3921         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3922                                  cmd->param, 1);
3923 }
3924
3925 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3926                                    void *data, u16 len)
3927 {
3928         struct mgmt_cp_start_service_discovery *cp = data;
3929         struct mgmt_pending_cmd *cmd;
3930         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3931         u16 uuid_count, expected_len;
3932         u8 status;
3933         int err;
3934
3935         BT_DBG("%s", hdev->name);
3936
3937         hci_dev_lock(hdev);
3938
3939         if (!hdev_is_powered(hdev)) {
3940                 err = mgmt_cmd_complete(sk, hdev->id,
3941                                         MGMT_OP_START_SERVICE_DISCOVERY,
3942                                         MGMT_STATUS_NOT_POWERED,
3943                                         &cp->type, sizeof(cp->type));
3944                 goto failed;
3945         }
3946
3947         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3948             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3949                 err = mgmt_cmd_complete(sk, hdev->id,
3950                                         MGMT_OP_START_SERVICE_DISCOVERY,
3951                                         MGMT_STATUS_BUSY, &cp->type,
3952                                         sizeof(cp->type));
3953                 goto failed;
3954         }
3955
3956         uuid_count = __le16_to_cpu(cp->uuid_count);
3957         if (uuid_count > max_uuid_count) {
3958                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3959                            uuid_count);
3960                 err = mgmt_cmd_complete(sk, hdev->id,
3961                                         MGMT_OP_START_SERVICE_DISCOVERY,
3962                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3963                                         sizeof(cp->type));
3964                 goto failed;
3965         }
3966
3967         expected_len = sizeof(*cp) + uuid_count * 16;
3968         if (expected_len != len) {
3969                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3970                            expected_len, len);
3971                 err = mgmt_cmd_complete(sk, hdev->id,
3972                                         MGMT_OP_START_SERVICE_DISCOVERY,
3973                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3974                                         sizeof(cp->type));
3975                 goto failed;
3976         }
3977
3978         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3979                 err = mgmt_cmd_complete(sk, hdev->id,
3980                                         MGMT_OP_START_SERVICE_DISCOVERY,
3981                                         status, &cp->type, sizeof(cp->type));
3982                 goto failed;
3983         }
3984
3985         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3986                                hdev, data, len);
3987         if (!cmd) {
3988                 err = -ENOMEM;
3989                 goto failed;
3990         }
3991
3992         cmd->cmd_complete = service_discovery_cmd_complete;
3993
3994         /* Clear the discovery filter first to free any previously
3995          * allocated memory for the UUID list.
3996          */
3997         hci_discovery_filter_clear(hdev);
3998
3999         hdev->discovery.result_filtering = true;
4000         hdev->discovery.type = cp->type;
4001         hdev->discovery.rssi = cp->rssi;
4002         hdev->discovery.uuid_count = uuid_count;
4003
4004         if (uuid_count > 0) {
4005                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4006                                                 GFP_KERNEL);
4007                 if (!hdev->discovery.uuids) {
4008                         err = mgmt_cmd_complete(sk, hdev->id,
4009                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4010                                                 MGMT_STATUS_FAILED,
4011                                                 &cp->type, sizeof(cp->type));
4012                         mgmt_pending_remove(cmd);
4013                         goto failed;
4014                 }
4015         }
4016
4017         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4018         queue_work(hdev->req_workqueue, &hdev->discov_update);
4019         err = 0;
4020
4021 failed:
4022         hci_dev_unlock(hdev);
4023         return err;
4024 }
4025
4026 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4027 {
4028         struct mgmt_pending_cmd *cmd;
4029
4030         BT_DBG("status %d", status);
4031
4032         hci_dev_lock(hdev);
4033
4034         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4035         if (cmd) {
4036                 cmd->cmd_complete(cmd, mgmt_status(status));
4037                 mgmt_pending_remove(cmd);
4038         }
4039
4040         hci_dev_unlock(hdev);
4041 }
4042
4043 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4044                           u16 len)
4045 {
4046         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4047         struct mgmt_pending_cmd *cmd;
4048         int err;
4049
4050         BT_DBG("%s", hdev->name);
4051
4052         hci_dev_lock(hdev);
4053
4054         if (!hci_discovery_active(hdev)) {
4055                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4056                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4057                                         sizeof(mgmt_cp->type));
4058                 goto unlock;
4059         }
4060
4061         if (hdev->discovery.type != mgmt_cp->type) {
4062                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4063                                         MGMT_STATUS_INVALID_PARAMS,
4064                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4065                 goto unlock;
4066         }
4067
4068         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4069         if (!cmd) {
4070                 err = -ENOMEM;
4071                 goto unlock;
4072         }
4073
4074         cmd->cmd_complete = generic_cmd_complete;
4075
4076         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4077         queue_work(hdev->req_workqueue, &hdev->discov_update);
4078         err = 0;
4079
4080 unlock:
4081         hci_dev_unlock(hdev);
4082         return err;
4083 }
4084
4085 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4086                         u16 len)
4087 {
4088         struct mgmt_cp_confirm_name *cp = data;
4089         struct inquiry_entry *e;
4090         int err;
4091
4092         BT_DBG("%s", hdev->name);
4093
4094         hci_dev_lock(hdev);
4095
4096         if (!hci_discovery_active(hdev)) {
4097                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4098                                         MGMT_STATUS_FAILED, &cp->addr,
4099                                         sizeof(cp->addr));
4100                 goto failed;
4101         }
4102
4103         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4104         if (!e) {
4105                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4106                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4107                                         sizeof(cp->addr));
4108                 goto failed;
4109         }
4110
4111         if (cp->name_known) {
4112                 e->name_state = NAME_KNOWN;
4113                 list_del(&e->list);
4114         } else {
4115                 e->name_state = NAME_NEEDED;
4116                 hci_inquiry_cache_update_resolve(hdev, e);
4117         }
4118
4119         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4120                                 &cp->addr, sizeof(cp->addr));
4121
4122 failed:
4123         hci_dev_unlock(hdev);
4124         return err;
4125 }
4126
4127 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4128                         u16 len)
4129 {
4130         struct mgmt_cp_block_device *cp = data;
4131         u8 status;
4132         int err;
4133
4134         BT_DBG("%s", hdev->name);
4135
4136         if (!bdaddr_type_is_valid(cp->addr.type))
4137                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4138                                          MGMT_STATUS_INVALID_PARAMS,
4139                                          &cp->addr, sizeof(cp->addr));
4140
4141         hci_dev_lock(hdev);
4142
4143         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4144                                   cp->addr.type);
4145         if (err < 0) {
4146                 status = MGMT_STATUS_FAILED;
4147                 goto done;
4148         }
4149
4150         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4151                    sk);
4152         status = MGMT_STATUS_SUCCESS;
4153
4154 done:
4155         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4156                                 &cp->addr, sizeof(cp->addr));
4157
4158         hci_dev_unlock(hdev);
4159
4160         return err;
4161 }
4162
4163 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4164                           u16 len)
4165 {
4166         struct mgmt_cp_unblock_device *cp = data;
4167         u8 status;
4168         int err;
4169
4170         BT_DBG("%s", hdev->name);
4171
4172         if (!bdaddr_type_is_valid(cp->addr.type))
4173                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4174                                          MGMT_STATUS_INVALID_PARAMS,
4175                                          &cp->addr, sizeof(cp->addr));
4176
4177         hci_dev_lock(hdev);
4178
4179         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4180                                   cp->addr.type);
4181         if (err < 0) {
4182                 status = MGMT_STATUS_INVALID_PARAMS;
4183                 goto done;
4184         }
4185
4186         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4187                    sk);
4188         status = MGMT_STATUS_SUCCESS;
4189
4190 done:
4191         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4192                                 &cp->addr, sizeof(cp->addr));
4193
4194         hci_dev_unlock(hdev);
4195
4196         return err;
4197 }
4198
4199 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4200                          u16 len)
4201 {
4202         struct mgmt_cp_set_device_id *cp = data;
4203         struct hci_request req;
4204         int err;
4205         __u16 source;
4206
4207         BT_DBG("%s", hdev->name);
4208
4209         source = __le16_to_cpu(cp->source);
4210
4211         if (source > 0x0002)
4212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4213                                        MGMT_STATUS_INVALID_PARAMS);
4214
4215         hci_dev_lock(hdev);
4216
4217         hdev->devid_source = source;
4218         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4219         hdev->devid_product = __le16_to_cpu(cp->product);
4220         hdev->devid_version = __le16_to_cpu(cp->version);
4221
4222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4223                                 NULL, 0);
4224
4225         hci_req_init(&req, hdev);
4226         __hci_req_update_eir(&req);
4227         hci_req_run(&req, NULL);
4228
4229         hci_dev_unlock(hdev);
4230
4231         return err;
4232 }
4233
4234 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4235                                         u16 opcode)
4236 {
4237         BT_DBG("status %d", status);
4238 }
4239
4240 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4241                                      u16 opcode)
4242 {
4243         struct cmd_lookup match = { NULL, hdev };
4244         struct hci_request req;
4245         u8 instance;
4246         struct adv_info *adv_instance;
4247         int err;
4248
4249         hci_dev_lock(hdev);
4250
4251         if (status) {
4252                 u8 mgmt_err = mgmt_status(status);
4253
4254                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4255                                      cmd_status_rsp, &mgmt_err);
4256                 goto unlock;
4257         }
4258
4259         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4260                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4261         else
4262                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4263
4264         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4265                              &match);
4266
4267         new_settings(hdev, match.sk);
4268
4269         if (match.sk)
4270                 sock_put(match.sk);
4271
4272         /* If "Set Advertising" was just disabled and instance advertising was
4273          * set up earlier, then re-enable multi-instance advertising.
4274          */
4275         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4276             list_empty(&hdev->adv_instances))
4277                 goto unlock;
4278
4279         instance = hdev->cur_adv_instance;
4280         if (!instance) {
4281                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4282                                                         struct adv_info, list);
4283                 if (!adv_instance)
4284                         goto unlock;
4285
4286                 instance = adv_instance->instance;
4287         }
4288
4289         hci_req_init(&req, hdev);
4290
4291         err = __hci_req_schedule_adv_instance(&req, instance, true);
4292
4293         if (!err)
4294                 err = hci_req_run(&req, enable_advertising_instance);
4295
4296         if (err)
4297                 bt_dev_err(hdev, "failed to re-configure advertising");
4298
4299 unlock:
4300         hci_dev_unlock(hdev);
4301 }
4302
4303 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4304                            u16 len)
4305 {
4306         struct mgmt_mode *cp = data;
4307         struct mgmt_pending_cmd *cmd;
4308         struct hci_request req;
4309         u8 val, status;
4310         int err;
4311
4312         BT_DBG("request for %s", hdev->name);
4313
4314         status = mgmt_le_support(hdev);
4315         if (status)
4316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4317                                        status);
4318
4319         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4321                                        MGMT_STATUS_INVALID_PARAMS);
4322
4323         hci_dev_lock(hdev);
4324
4325         val = !!cp->val;
4326
4327         /* The following conditions are ones which mean that we should
4328          * not do any HCI communication but directly send a mgmt
4329          * response to user space (after toggling the flag if
4330          * necessary).
4331          */
4332         if (!hdev_is_powered(hdev) ||
4333             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4334              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4335             hci_conn_num(hdev, LE_LINK) > 0 ||
4336             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4337              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4338                 bool changed;
4339
4340                 if (cp->val) {
4341                         hdev->cur_adv_instance = 0x00;
4342                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4343                         if (cp->val == 0x02)
4344                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4345                         else
4346                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347                 } else {
4348                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4349                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350                 }
4351
4352                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4353                 if (err < 0)
4354                         goto unlock;
4355
4356                 if (changed)
4357                         err = new_settings(hdev, sk);
4358
4359                 goto unlock;
4360         }
4361
4362         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4363             pending_find(MGMT_OP_SET_LE, hdev)) {
4364                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4365                                       MGMT_STATUS_BUSY);
4366                 goto unlock;
4367         }
4368
4369         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4370         if (!cmd) {
4371                 err = -ENOMEM;
4372                 goto unlock;
4373         }
4374
4375         hci_req_init(&req, hdev);
4376
4377         if (cp->val == 0x02)
4378                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4379         else
4380                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4381
4382         cancel_adv_timeout(hdev);
4383
4384         if (val) {
4385                 /* Switch to instance "0" for the Set Advertising setting.
4386                  * We cannot use update_[adv|scan_rsp]_data() here as the
4387                  * HCI_ADVERTISING flag is not yet set.
4388                  */
4389                 hdev->cur_adv_instance = 0x00;
4390
4391                 if (ext_adv_capable(hdev)) {
4392                         __hci_req_start_ext_adv(&req, 0x00);
4393                 } else {
4394                         __hci_req_update_adv_data(&req, 0x00);
4395                         __hci_req_update_scan_rsp_data(&req, 0x00);
4396                         __hci_req_enable_advertising(&req);
4397                 }
4398         } else {
4399                 __hci_req_disable_advertising(&req);
4400         }
4401
4402         err = hci_req_run(&req, set_advertising_complete);
4403         if (err < 0)
4404                 mgmt_pending_remove(cmd);
4405
4406 unlock:
4407         hci_dev_unlock(hdev);
4408         return err;
4409 }
4410
4411 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4412                               void *data, u16 len)
4413 {
4414         struct mgmt_cp_set_static_address *cp = data;
4415         int err;
4416
4417         BT_DBG("%s", hdev->name);
4418
4419         if (!lmp_le_capable(hdev))
4420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4421                                        MGMT_STATUS_NOT_SUPPORTED);
4422
4423         if (hdev_is_powered(hdev))
4424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4425                                        MGMT_STATUS_REJECTED);
4426
4427         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4428                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4429                         return mgmt_cmd_status(sk, hdev->id,
4430                                                MGMT_OP_SET_STATIC_ADDRESS,
4431                                                MGMT_STATUS_INVALID_PARAMS);
4432
4433                 /* Two most significant bits shall be set */
4434                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4435                         return mgmt_cmd_status(sk, hdev->id,
4436                                                MGMT_OP_SET_STATIC_ADDRESS,
4437                                                MGMT_STATUS_INVALID_PARAMS);
4438         }
4439
4440         hci_dev_lock(hdev);
4441
4442         bacpy(&hdev->static_addr, &cp->bdaddr);
4443
4444         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4445         if (err < 0)
4446                 goto unlock;
4447
4448         err = new_settings(hdev, sk);
4449
4450 unlock:
4451         hci_dev_unlock(hdev);
4452         return err;
4453 }
4454
4455 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4456                            void *data, u16 len)
4457 {
4458         struct mgmt_cp_set_scan_params *cp = data;
4459         __u16 interval, window;
4460         int err;
4461
4462         BT_DBG("%s", hdev->name);
4463
4464         if (!lmp_le_capable(hdev))
4465                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4466                                        MGMT_STATUS_NOT_SUPPORTED);
4467
4468         interval = __le16_to_cpu(cp->interval);
4469
4470         if (interval < 0x0004 || interval > 0x4000)
4471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4472                                        MGMT_STATUS_INVALID_PARAMS);
4473
4474         window = __le16_to_cpu(cp->window);
4475
4476         if (window < 0x0004 || window > 0x4000)
4477                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4478                                        MGMT_STATUS_INVALID_PARAMS);
4479
4480         if (window > interval)
4481                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4482                                        MGMT_STATUS_INVALID_PARAMS);
4483
4484         hci_dev_lock(hdev);
4485
4486         hdev->le_scan_interval = interval;
4487         hdev->le_scan_window = window;
4488
4489         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4490                                 NULL, 0);
4491
4492         /* If background scan is running, restart it so new parameters are
4493          * loaded.
4494          */
4495         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4496             hdev->discovery.state == DISCOVERY_STOPPED) {
4497                 struct hci_request req;
4498
4499                 hci_req_init(&req, hdev);
4500
4501                 hci_req_add_le_scan_disable(&req);
4502                 hci_req_add_le_passive_scan(&req);
4503
4504                 hci_req_run(&req, NULL);
4505         }
4506
4507         hci_dev_unlock(hdev);
4508
4509         return err;
4510 }
4511
4512 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4513                                       u16 opcode)
4514 {
4515         struct mgmt_pending_cmd *cmd;
4516
4517         BT_DBG("status 0x%02x", status);
4518
4519         hci_dev_lock(hdev);
4520
4521         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4522         if (!cmd)
4523                 goto unlock;
4524
4525         if (status) {
4526                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4527                                 mgmt_status(status));
4528         } else {
4529                 struct mgmt_mode *cp = cmd->param;
4530
4531                 if (cp->val)
4532                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4533                 else
4534                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4535
4536                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4537                 new_settings(hdev, cmd->sk);
4538         }
4539
4540         mgmt_pending_remove(cmd);
4541
4542 unlock:
4543         hci_dev_unlock(hdev);
4544 }
4545
4546 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4547                                 void *data, u16 len)
4548 {
4549         struct mgmt_mode *cp = data;
4550         struct mgmt_pending_cmd *cmd;
4551         struct hci_request req;
4552         int err;
4553
4554         BT_DBG("%s", hdev->name);
4555
4556         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4557             hdev->hci_ver < BLUETOOTH_VER_1_2)
4558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4559                                        MGMT_STATUS_NOT_SUPPORTED);
4560
4561         if (cp->val != 0x00 && cp->val != 0x01)
4562                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4563                                        MGMT_STATUS_INVALID_PARAMS);
4564
4565         hci_dev_lock(hdev);
4566
4567         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4569                                       MGMT_STATUS_BUSY);
4570                 goto unlock;
4571         }
4572
4573         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4574                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4575                                         hdev);
4576                 goto unlock;
4577         }
4578
4579         if (!hdev_is_powered(hdev)) {
4580                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4581                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4582                                         hdev);
4583                 new_settings(hdev, sk);
4584                 goto unlock;
4585         }
4586
4587         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4588                                data, len);
4589         if (!cmd) {
4590                 err = -ENOMEM;
4591                 goto unlock;
4592         }
4593
4594         hci_req_init(&req, hdev);
4595
4596         __hci_req_write_fast_connectable(&req, cp->val);
4597
4598         err = hci_req_run(&req, fast_connectable_complete);
4599         if (err < 0) {
4600                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4601                                       MGMT_STATUS_FAILED);
4602                 mgmt_pending_remove(cmd);
4603         }
4604
4605 unlock:
4606         hci_dev_unlock(hdev);
4607
4608         return err;
4609 }
4610
4611 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4612 {
4613         struct mgmt_pending_cmd *cmd;
4614
4615         BT_DBG("status 0x%02x", status);
4616
4617         hci_dev_lock(hdev);
4618
4619         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4620         if (!cmd)
4621                 goto unlock;
4622
4623         if (status) {
4624                 u8 mgmt_err = mgmt_status(status);
4625
4626                 /* We need to restore the flag if related HCI commands
4627                  * failed.
4628                  */
4629                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4630
4631                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4632         } else {
4633                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4634                 new_settings(hdev, cmd->sk);
4635         }
4636
4637         mgmt_pending_remove(cmd);
4638
4639 unlock:
4640         hci_dev_unlock(hdev);
4641 }
4642
4643 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4644 {
4645         struct mgmt_mode *cp = data;
4646         struct mgmt_pending_cmd *cmd;
4647         struct hci_request req;
4648         int err;
4649
4650         BT_DBG("request for %s", hdev->name);
4651
4652         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4654                                        MGMT_STATUS_NOT_SUPPORTED);
4655
4656         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4658                                        MGMT_STATUS_REJECTED);
4659
4660         if (cp->val != 0x00 && cp->val != 0x01)
4661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4662                                        MGMT_STATUS_INVALID_PARAMS);
4663
4664         hci_dev_lock(hdev);
4665
4666         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4667                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4668                 goto unlock;
4669         }
4670
4671         if (!hdev_is_powered(hdev)) {
4672                 if (!cp->val) {
4673                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4674                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4675                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4676                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4677                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4678                 }
4679
4680                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4681
4682                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4683                 if (err < 0)
4684                         goto unlock;
4685
4686                 err = new_settings(hdev, sk);
4687                 goto unlock;
4688         }
4689
4690         /* Reject disabling when powered on */
4691         if (!cp->val) {
4692                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4693                                       MGMT_STATUS_REJECTED);
4694                 goto unlock;
4695         } else {
4696                 /* When configuring a dual-mode controller to operate
4697                  * with LE only and using a static address, then switching
4698                  * BR/EDR back on is not allowed.
4699                  *
4700                  * Dual-mode controllers shall operate with the public
4701                  * address as its identity address for BR/EDR and LE. So
4702                  * reject the attempt to create an invalid configuration.
4703                  *
4704                  * The same restrictions applies when secure connections
4705                  * has been enabled. For BR/EDR this is a controller feature
4706                  * while for LE it is a host stack feature. This means that
4707                  * switching BR/EDR back on when secure connections has been
4708                  * enabled is not a supported transaction.
4709                  */
4710                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4711                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4712                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4713                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4714                                               MGMT_STATUS_REJECTED);
4715                         goto unlock;
4716                 }
4717         }
4718
4719         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4720                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4721                                       MGMT_STATUS_BUSY);
4722                 goto unlock;
4723         }
4724
4725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4726         if (!cmd) {
4727                 err = -ENOMEM;
4728                 goto unlock;
4729         }
4730
4731         /* We need to flip the bit already here so that
4732          * hci_req_update_adv_data generates the correct flags.
4733          */
4734         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4735
4736         hci_req_init(&req, hdev);
4737
4738         __hci_req_write_fast_connectable(&req, false);
4739         __hci_req_update_scan(&req);
4740
4741         /* Since only the advertising data flags will change, there
4742          * is no need to update the scan response data.
4743          */
4744         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4745
4746         err = hci_req_run(&req, set_bredr_complete);
4747         if (err < 0)
4748                 mgmt_pending_remove(cmd);
4749
4750 unlock:
4751         hci_dev_unlock(hdev);
4752         return err;
4753 }
4754
4755 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4756 {
4757         struct mgmt_pending_cmd *cmd;
4758         struct mgmt_mode *cp;
4759
4760         BT_DBG("%s status %u", hdev->name, status);
4761
4762         hci_dev_lock(hdev);
4763
4764         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4765         if (!cmd)
4766                 goto unlock;
4767
4768         if (status) {
4769                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4770                                 mgmt_status(status));
4771                 goto remove;
4772         }
4773
4774         cp = cmd->param;
4775
4776         switch (cp->val) {
4777         case 0x00:
4778                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4779                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4780                 break;
4781         case 0x01:
4782                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4783                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4784                 break;
4785         case 0x02:
4786                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4787                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4788                 break;
4789         }
4790
4791         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4792         new_settings(hdev, cmd->sk);
4793
4794 remove:
4795         mgmt_pending_remove(cmd);
4796 unlock:
4797         hci_dev_unlock(hdev);
4798 }
4799
4800 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4801                            void *data, u16 len)
4802 {
4803         struct mgmt_mode *cp = data;
4804         struct mgmt_pending_cmd *cmd;
4805         struct hci_request req;
4806         u8 val;
4807         int err;
4808
4809         BT_DBG("request for %s", hdev->name);
4810
4811         if (!lmp_sc_capable(hdev) &&
4812             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4814                                        MGMT_STATUS_NOT_SUPPORTED);
4815
4816         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4817             lmp_sc_capable(hdev) &&
4818             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4819                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4820                                        MGMT_STATUS_REJECTED);
4821
4822         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4823                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4824                                   MGMT_STATUS_INVALID_PARAMS);
4825
4826         hci_dev_lock(hdev);
4827
4828         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4829             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4830                 bool changed;
4831
4832                 if (cp->val) {
4833                         changed = !hci_dev_test_and_set_flag(hdev,
4834                                                              HCI_SC_ENABLED);
4835                         if (cp->val == 0x02)
4836                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4837                         else
4838                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4839                 } else {
4840                         changed = hci_dev_test_and_clear_flag(hdev,
4841                                                               HCI_SC_ENABLED);
4842                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4843                 }
4844
4845                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4846                 if (err < 0)
4847                         goto failed;
4848
4849                 if (changed)
4850                         err = new_settings(hdev, sk);
4851
4852                 goto failed;
4853         }
4854
4855         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4857                                       MGMT_STATUS_BUSY);
4858                 goto failed;
4859         }
4860
4861         val = !!cp->val;
4862
4863         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4864             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4865                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4866                 goto failed;
4867         }
4868
4869         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4870         if (!cmd) {
4871                 err = -ENOMEM;
4872                 goto failed;
4873         }
4874
4875         hci_req_init(&req, hdev);
4876         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4877         err = hci_req_run(&req, sc_enable_complete);
4878         if (err < 0) {
4879                 mgmt_pending_remove(cmd);
4880                 goto failed;
4881         }
4882
4883 failed:
4884         hci_dev_unlock(hdev);
4885         return err;
4886 }
4887
4888 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4889                           void *data, u16 len)
4890 {
4891         struct mgmt_mode *cp = data;
4892         bool changed, use_changed;
4893         int err;
4894
4895         BT_DBG("request for %s", hdev->name);
4896
4897         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4899                                        MGMT_STATUS_INVALID_PARAMS);
4900
4901         hci_dev_lock(hdev);
4902
4903         if (cp->val)
4904                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4905         else
4906                 changed = hci_dev_test_and_clear_flag(hdev,
4907                                                       HCI_KEEP_DEBUG_KEYS);
4908
4909         if (cp->val == 0x02)
4910                 use_changed = !hci_dev_test_and_set_flag(hdev,
4911                                                          HCI_USE_DEBUG_KEYS);
4912         else
4913                 use_changed = hci_dev_test_and_clear_flag(hdev,
4914                                                           HCI_USE_DEBUG_KEYS);
4915
4916         if (hdev_is_powered(hdev) && use_changed &&
4917             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4918                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4919                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4920                              sizeof(mode), &mode);
4921         }
4922
4923         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4924         if (err < 0)
4925                 goto unlock;
4926
4927         if (changed)
4928                 err = new_settings(hdev, sk);
4929
4930 unlock:
4931         hci_dev_unlock(hdev);
4932         return err;
4933 }
4934
4935 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4936                        u16 len)
4937 {
4938         struct mgmt_cp_set_privacy *cp = cp_data;
4939         bool changed;
4940         int err;
4941
4942         BT_DBG("request for %s", hdev->name);
4943
4944         if (!lmp_le_capable(hdev))
4945                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4946                                        MGMT_STATUS_NOT_SUPPORTED);
4947
4948         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4950                                        MGMT_STATUS_INVALID_PARAMS);
4951
4952         if (hdev_is_powered(hdev))
4953                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4954                                        MGMT_STATUS_REJECTED);
4955
4956         hci_dev_lock(hdev);
4957
4958         /* If user space supports this command it is also expected to
4959          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4960          */
4961         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4962
4963         if (cp->privacy) {
4964                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4965                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4966                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4967                 hci_adv_instances_set_rpa_expired(hdev, true);
4968                 if (cp->privacy == 0x02)
4969                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4970                 else
4971                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4972         } else {
4973                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4974                 memset(hdev->irk, 0, sizeof(hdev->irk));
4975                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4976                 hci_adv_instances_set_rpa_expired(hdev, false);
4977                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4978         }
4979
4980         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4981         if (err < 0)
4982                 goto unlock;
4983
4984         if (changed)
4985                 err = new_settings(hdev, sk);
4986
4987 unlock:
4988         hci_dev_unlock(hdev);
4989         return err;
4990 }
4991
4992 static bool irk_is_valid(struct mgmt_irk_info *irk)
4993 {
4994         switch (irk->addr.type) {
4995         case BDADDR_LE_PUBLIC:
4996                 return true;
4997
4998         case BDADDR_LE_RANDOM:
4999                 /* Two most significant bits shall be set */
5000                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5001                         return false;
5002                 return true;
5003         }
5004
5005         return false;
5006 }
5007
5008 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5009                      u16 len)
5010 {
5011         struct mgmt_cp_load_irks *cp = cp_data;
5012         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5013                                    sizeof(struct mgmt_irk_info));
5014         u16 irk_count, expected_len;
5015         int i, err;
5016
5017         BT_DBG("request for %s", hdev->name);
5018
5019         if (!lmp_le_capable(hdev))
5020                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5021                                        MGMT_STATUS_NOT_SUPPORTED);
5022
5023         irk_count = __le16_to_cpu(cp->irk_count);
5024         if (irk_count > max_irk_count) {
5025                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5026                            irk_count);
5027                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5028                                        MGMT_STATUS_INVALID_PARAMS);
5029         }
5030
5031         expected_len = struct_size(cp, irks, irk_count);
5032         if (expected_len != len) {
5033                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5034                            expected_len, len);
5035                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5036                                        MGMT_STATUS_INVALID_PARAMS);
5037         }
5038
5039         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5040
5041         for (i = 0; i < irk_count; i++) {
5042                 struct mgmt_irk_info *key = &cp->irks[i];
5043
5044                 if (!irk_is_valid(key))
5045                         return mgmt_cmd_status(sk, hdev->id,
5046                                                MGMT_OP_LOAD_IRKS,
5047                                                MGMT_STATUS_INVALID_PARAMS);
5048         }
5049
5050         hci_dev_lock(hdev);
5051
5052         hci_smp_irks_clear(hdev);
5053
5054         for (i = 0; i < irk_count; i++) {
5055                 struct mgmt_irk_info *irk = &cp->irks[i];
5056
5057                 hci_add_irk(hdev, &irk->addr.bdaddr,
5058                             le_addr_type(irk->addr.type), irk->val,
5059                             BDADDR_ANY);
5060         }
5061
5062         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5063
5064         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5065
5066         hci_dev_unlock(hdev);
5067
5068         return err;
5069 }
5070
5071 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5072 {
5073         if (key->master != 0x00 && key->master != 0x01)
5074                 return false;
5075
5076         switch (key->addr.type) {
5077         case BDADDR_LE_PUBLIC:
5078                 return true;
5079
5080         case BDADDR_LE_RANDOM:
5081                 /* Two most significant bits shall be set */
5082                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5083                         return false;
5084                 return true;
5085         }
5086
5087         return false;
5088 }
5089
5090 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5091                                void *cp_data, u16 len)
5092 {
5093         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5094         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5095                                    sizeof(struct mgmt_ltk_info));
5096         u16 key_count, expected_len;
5097         int i, err;
5098
5099         BT_DBG("request for %s", hdev->name);
5100
5101         if (!lmp_le_capable(hdev))
5102                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5103                                        MGMT_STATUS_NOT_SUPPORTED);
5104
5105         key_count = __le16_to_cpu(cp->key_count);
5106         if (key_count > max_key_count) {
5107                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5108                            key_count);
5109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5110                                        MGMT_STATUS_INVALID_PARAMS);
5111         }
5112
5113         expected_len = struct_size(cp, keys, key_count);
5114         if (expected_len != len) {
5115                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5116                            expected_len, len);
5117                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5118                                        MGMT_STATUS_INVALID_PARAMS);
5119         }
5120
5121         BT_DBG("%s key_count %u", hdev->name, key_count);
5122
5123         for (i = 0; i < key_count; i++) {
5124                 struct mgmt_ltk_info *key = &cp->keys[i];
5125
5126                 if (!ltk_is_valid(key))
5127                         return mgmt_cmd_status(sk, hdev->id,
5128                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5129                                                MGMT_STATUS_INVALID_PARAMS);
5130         }
5131
5132         hci_dev_lock(hdev);
5133
5134         hci_smp_ltks_clear(hdev);
5135
5136         for (i = 0; i < key_count; i++) {
5137                 struct mgmt_ltk_info *key = &cp->keys[i];
5138                 u8 type, authenticated;
5139
5140                 switch (key->type) {
5141                 case MGMT_LTK_UNAUTHENTICATED:
5142                         authenticated = 0x00;
5143                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5144                         break;
5145                 case MGMT_LTK_AUTHENTICATED:
5146                         authenticated = 0x01;
5147                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5148                         break;
5149                 case MGMT_LTK_P256_UNAUTH:
5150                         authenticated = 0x00;
5151                         type = SMP_LTK_P256;
5152                         break;
5153                 case MGMT_LTK_P256_AUTH:
5154                         authenticated = 0x01;
5155                         type = SMP_LTK_P256;
5156                         break;
5157                 case MGMT_LTK_P256_DEBUG:
5158                         authenticated = 0x00;
5159                         type = SMP_LTK_P256_DEBUG;
5160                         /* fall through */
5161                 default:
5162                         continue;
5163                 }
5164
5165                 hci_add_ltk(hdev, &key->addr.bdaddr,
5166                             le_addr_type(key->addr.type), type, authenticated,
5167                             key->val, key->enc_size, key->ediv, key->rand);
5168         }
5169
5170         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5171                            NULL, 0);
5172
5173         hci_dev_unlock(hdev);
5174
5175         return err;
5176 }
5177
5178 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5179 {
5180         struct hci_conn *conn = cmd->user_data;
5181         struct mgmt_rp_get_conn_info rp;
5182         int err;
5183
5184         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5185
5186         if (status == MGMT_STATUS_SUCCESS) {
5187                 rp.rssi = conn->rssi;
5188                 rp.tx_power = conn->tx_power;
5189                 rp.max_tx_power = conn->max_tx_power;
5190         } else {
5191                 rp.rssi = HCI_RSSI_INVALID;
5192                 rp.tx_power = HCI_TX_POWER_INVALID;
5193                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5194         }
5195
5196         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5197                                 status, &rp, sizeof(rp));
5198
5199         hci_conn_drop(conn);
5200         hci_conn_put(conn);
5201
5202         return err;
5203 }
5204
5205 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5206                                        u16 opcode)
5207 {
5208         struct hci_cp_read_rssi *cp;
5209         struct mgmt_pending_cmd *cmd;
5210         struct hci_conn *conn;
5211         u16 handle;
5212         u8 status;
5213
5214         BT_DBG("status 0x%02x", hci_status);
5215
5216         hci_dev_lock(hdev);
5217
5218         /* Commands sent in request are either Read RSSI or Read Transmit Power
5219          * Level so we check which one was last sent to retrieve connection
5220          * handle.  Both commands have handle as first parameter so it's safe to
5221          * cast data on the same command struct.
5222          *
5223          * First command sent is always Read RSSI and we fail only if it fails.
5224          * In other case we simply override error to indicate success as we
5225          * already remembered if TX power value is actually valid.
5226          */
5227         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5228         if (!cp) {
5229                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5230                 status = MGMT_STATUS_SUCCESS;
5231         } else {
5232                 status = mgmt_status(hci_status);
5233         }
5234
5235         if (!cp) {
5236                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5237                 goto unlock;
5238         }
5239
5240         handle = __le16_to_cpu(cp->handle);
5241         conn = hci_conn_hash_lookup_handle(hdev, handle);
5242         if (!conn) {
5243                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5244                            handle);
5245                 goto unlock;
5246         }
5247
5248         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5249         if (!cmd)
5250                 goto unlock;
5251
5252         cmd->cmd_complete(cmd, status);
5253         mgmt_pending_remove(cmd);
5254
5255 unlock:
5256         hci_dev_unlock(hdev);
5257 }
5258
5259 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5260                          u16 len)
5261 {
5262         struct mgmt_cp_get_conn_info *cp = data;
5263         struct mgmt_rp_get_conn_info rp;
5264         struct hci_conn *conn;
5265         unsigned long conn_info_age;
5266         int err = 0;
5267
5268         BT_DBG("%s", hdev->name);
5269
5270         memset(&rp, 0, sizeof(rp));
5271         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5272         rp.addr.type = cp->addr.type;
5273
5274         if (!bdaddr_type_is_valid(cp->addr.type))
5275                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5276                                          MGMT_STATUS_INVALID_PARAMS,
5277                                          &rp, sizeof(rp));
5278
5279         hci_dev_lock(hdev);
5280
5281         if (!hdev_is_powered(hdev)) {
5282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5283                                         MGMT_STATUS_NOT_POWERED, &rp,
5284                                         sizeof(rp));
5285                 goto unlock;
5286         }
5287
5288         if (cp->addr.type == BDADDR_BREDR)
5289                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5290                                                &cp->addr.bdaddr);
5291         else
5292                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5293
5294         if (!conn || conn->state != BT_CONNECTED) {
5295                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5296                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5297                                         sizeof(rp));
5298                 goto unlock;
5299         }
5300
5301         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5302                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5303                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5304                 goto unlock;
5305         }
5306
5307         /* To avoid client trying to guess when to poll again for information we
5308          * calculate conn info age as random value between min/max set in hdev.
5309          */
5310         conn_info_age = hdev->conn_info_min_age +
5311                         prandom_u32_max(hdev->conn_info_max_age -
5312                                         hdev->conn_info_min_age);
5313
5314         /* Query controller to refresh cached values if they are too old or were
5315          * never read.
5316          */
5317         if (time_after(jiffies, conn->conn_info_timestamp +
5318                        msecs_to_jiffies(conn_info_age)) ||
5319             !conn->conn_info_timestamp) {
5320                 struct hci_request req;
5321                 struct hci_cp_read_tx_power req_txp_cp;
5322                 struct hci_cp_read_rssi req_rssi_cp;
5323                 struct mgmt_pending_cmd *cmd;
5324
5325                 hci_req_init(&req, hdev);
5326                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5327                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5328                             &req_rssi_cp);
5329
5330                 /* For LE links TX power does not change thus we don't need to
5331                  * query for it once value is known.
5332                  */
5333                 if (!bdaddr_type_is_le(cp->addr.type) ||
5334                     conn->tx_power == HCI_TX_POWER_INVALID) {
5335                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5336                         req_txp_cp.type = 0x00;
5337                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5338                                     sizeof(req_txp_cp), &req_txp_cp);
5339                 }
5340
5341                 /* Max TX power needs to be read only once per connection */
5342                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5343                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5344                         req_txp_cp.type = 0x01;
5345                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5346                                     sizeof(req_txp_cp), &req_txp_cp);
5347                 }
5348
5349                 err = hci_req_run(&req, conn_info_refresh_complete);
5350                 if (err < 0)
5351                         goto unlock;
5352
5353                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5354                                        data, len);
5355                 if (!cmd) {
5356                         err = -ENOMEM;
5357                         goto unlock;
5358                 }
5359
5360                 hci_conn_hold(conn);
5361                 cmd->user_data = hci_conn_get(conn);
5362                 cmd->cmd_complete = conn_info_cmd_complete;
5363
5364                 conn->conn_info_timestamp = jiffies;
5365         } else {
5366                 /* Cache is valid, just reply with values cached in hci_conn */
5367                 rp.rssi = conn->rssi;
5368                 rp.tx_power = conn->tx_power;
5369                 rp.max_tx_power = conn->max_tx_power;
5370
5371                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5372                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5373         }
5374
5375 unlock:
5376         hci_dev_unlock(hdev);
5377         return err;
5378 }
5379
5380 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5381 {
5382         struct hci_conn *conn = cmd->user_data;
5383         struct mgmt_rp_get_clock_info rp;
5384         struct hci_dev *hdev;
5385         int err;
5386
5387         memset(&rp, 0, sizeof(rp));
5388         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5389
5390         if (status)
5391                 goto complete;
5392
5393         hdev = hci_dev_get(cmd->index);
5394         if (hdev) {
5395                 rp.local_clock = cpu_to_le32(hdev->clock);
5396                 hci_dev_put(hdev);
5397         }
5398
5399         if (conn) {
5400                 rp.piconet_clock = cpu_to_le32(conn->clock);
5401                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5402         }
5403
5404 complete:
5405         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5406                                 sizeof(rp));
5407
5408         if (conn) {
5409                 hci_conn_drop(conn);
5410                 hci_conn_put(conn);
5411         }
5412
5413         return err;
5414 }
5415
5416 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5417 {
5418         struct hci_cp_read_clock *hci_cp;
5419         struct mgmt_pending_cmd *cmd;
5420         struct hci_conn *conn;
5421
5422         BT_DBG("%s status %u", hdev->name, status);
5423
5424         hci_dev_lock(hdev);
5425
5426         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5427         if (!hci_cp)
5428                 goto unlock;
5429
5430         if (hci_cp->which) {
5431                 u16 handle = __le16_to_cpu(hci_cp->handle);
5432                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5433         } else {
5434                 conn = NULL;
5435         }
5436
5437         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5438         if (!cmd)
5439                 goto unlock;
5440
5441         cmd->cmd_complete(cmd, mgmt_status(status));
5442         mgmt_pending_remove(cmd);
5443
5444 unlock:
5445         hci_dev_unlock(hdev);
5446 }
5447
5448 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5449                          u16 len)
5450 {
5451         struct mgmt_cp_get_clock_info *cp = data;
5452         struct mgmt_rp_get_clock_info rp;
5453         struct hci_cp_read_clock hci_cp;
5454         struct mgmt_pending_cmd *cmd;
5455         struct hci_request req;
5456         struct hci_conn *conn;
5457         int err;
5458
5459         BT_DBG("%s", hdev->name);
5460
5461         memset(&rp, 0, sizeof(rp));
5462         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5463         rp.addr.type = cp->addr.type;
5464
5465         if (cp->addr.type != BDADDR_BREDR)
5466                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5467                                          MGMT_STATUS_INVALID_PARAMS,
5468                                          &rp, sizeof(rp));
5469
5470         hci_dev_lock(hdev);
5471
5472         if (!hdev_is_powered(hdev)) {
5473                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5474                                         MGMT_STATUS_NOT_POWERED, &rp,
5475                                         sizeof(rp));
5476                 goto unlock;
5477         }
5478
5479         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5480                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5481                                                &cp->addr.bdaddr);
5482                 if (!conn || conn->state != BT_CONNECTED) {
5483                         err = mgmt_cmd_complete(sk, hdev->id,
5484                                                 MGMT_OP_GET_CLOCK_INFO,
5485                                                 MGMT_STATUS_NOT_CONNECTED,
5486                                                 &rp, sizeof(rp));
5487                         goto unlock;
5488                 }
5489         } else {
5490                 conn = NULL;
5491         }
5492
5493         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5494         if (!cmd) {
5495                 err = -ENOMEM;
5496                 goto unlock;
5497         }
5498
5499         cmd->cmd_complete = clock_info_cmd_complete;
5500
5501         hci_req_init(&req, hdev);
5502
5503         memset(&hci_cp, 0, sizeof(hci_cp));
5504         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5505
5506         if (conn) {
5507                 hci_conn_hold(conn);
5508                 cmd->user_data = hci_conn_get(conn);
5509
5510                 hci_cp.handle = cpu_to_le16(conn->handle);
5511                 hci_cp.which = 0x01; /* Piconet clock */
5512                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5513         }
5514
5515         err = hci_req_run(&req, get_clock_info_complete);
5516         if (err < 0)
5517                 mgmt_pending_remove(cmd);
5518
5519 unlock:
5520         hci_dev_unlock(hdev);
5521         return err;
5522 }
5523
5524 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5525 {
5526         struct hci_conn *conn;
5527
5528         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5529         if (!conn)
5530                 return false;
5531
5532         if (conn->dst_type != type)
5533                 return false;
5534
5535         if (conn->state != BT_CONNECTED)
5536                 return false;
5537
5538         return true;
5539 }
5540
5541 /* This function requires the caller holds hdev->lock */
5542 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5543                                u8 addr_type, u8 auto_connect)
5544 {
5545         struct hci_conn_params *params;
5546
5547         params = hci_conn_params_add(hdev, addr, addr_type);
5548         if (!params)
5549                 return -EIO;
5550
5551         if (params->auto_connect == auto_connect)
5552                 return 0;
5553
5554         list_del_init(&params->action);
5555
5556         switch (auto_connect) {
5557         case HCI_AUTO_CONN_DISABLED:
5558         case HCI_AUTO_CONN_LINK_LOSS:
5559                 /* If auto connect is being disabled when we're trying to
5560                  * connect to device, keep connecting.
5561                  */
5562                 if (params->explicit_connect)
5563                         list_add(&params->action, &hdev->pend_le_conns);
5564                 break;
5565         case HCI_AUTO_CONN_REPORT:
5566                 if (params->explicit_connect)
5567                         list_add(&params->action, &hdev->pend_le_conns);
5568                 else
5569                         list_add(&params->action, &hdev->pend_le_reports);
5570                 break;
5571         case HCI_AUTO_CONN_DIRECT:
5572         case HCI_AUTO_CONN_ALWAYS:
5573                 if (!is_connected(hdev, addr, addr_type))
5574                         list_add(&params->action, &hdev->pend_le_conns);
5575                 break;
5576         }
5577
5578         params->auto_connect = auto_connect;
5579
5580         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5581                auto_connect);
5582
5583         return 0;
5584 }
5585
5586 static void device_added(struct sock *sk, struct hci_dev *hdev,
5587                          bdaddr_t *bdaddr, u8 type, u8 action)
5588 {
5589         struct mgmt_ev_device_added ev;
5590
5591         bacpy(&ev.addr.bdaddr, bdaddr);
5592         ev.addr.type = type;
5593         ev.action = action;
5594
5595         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5596 }
5597
5598 static int add_device(struct sock *sk, struct hci_dev *hdev,
5599                       void *data, u16 len)
5600 {
5601         struct mgmt_cp_add_device *cp = data;
5602         u8 auto_conn, addr_type;
5603         int err;
5604
5605         BT_DBG("%s", hdev->name);
5606
5607         if (!bdaddr_type_is_valid(cp->addr.type) ||
5608             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5609                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5610                                          MGMT_STATUS_INVALID_PARAMS,
5611                                          &cp->addr, sizeof(cp->addr));
5612
5613         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5614                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5615                                          MGMT_STATUS_INVALID_PARAMS,
5616                                          &cp->addr, sizeof(cp->addr));
5617
5618         hci_dev_lock(hdev);
5619
5620         if (cp->addr.type == BDADDR_BREDR) {
5621                 /* Only incoming connections action is supported for now */
5622                 if (cp->action != 0x01) {
5623                         err = mgmt_cmd_complete(sk, hdev->id,
5624                                                 MGMT_OP_ADD_DEVICE,
5625                                                 MGMT_STATUS_INVALID_PARAMS,
5626                                                 &cp->addr, sizeof(cp->addr));
5627                         goto unlock;
5628                 }
5629
5630                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5631                                           cp->addr.type);
5632                 if (err)
5633                         goto unlock;
5634
5635                 hci_req_update_scan(hdev);
5636
5637                 goto added;
5638         }
5639
5640         addr_type = le_addr_type(cp->addr.type);
5641
5642         if (cp->action == 0x02)
5643                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5644         else if (cp->action == 0x01)
5645                 auto_conn = HCI_AUTO_CONN_DIRECT;
5646         else
5647                 auto_conn = HCI_AUTO_CONN_REPORT;
5648
5649         /* Kernel internally uses conn_params with resolvable private
5650          * address, but Add Device allows only identity addresses.
5651          * Make sure it is enforced before calling
5652          * hci_conn_params_lookup.
5653          */
5654         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5655                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5656                                         MGMT_STATUS_INVALID_PARAMS,
5657                                         &cp->addr, sizeof(cp->addr));
5658                 goto unlock;
5659         }
5660
5661         /* If the connection parameters don't exist for this device,
5662          * they will be created and configured with defaults.
5663          */
5664         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5665                                 auto_conn) < 0) {
5666                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5667                                         MGMT_STATUS_FAILED, &cp->addr,
5668                                         sizeof(cp->addr));
5669                 goto unlock;
5670         }
5671
5672         hci_update_background_scan(hdev);
5673
5674 added:
5675         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5676
5677         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5678                                 MGMT_STATUS_SUCCESS, &cp->addr,
5679                                 sizeof(cp->addr));
5680
5681 unlock:
5682         hci_dev_unlock(hdev);
5683         return err;
5684 }
5685
5686 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5687                            bdaddr_t *bdaddr, u8 type)
5688 {
5689         struct mgmt_ev_device_removed ev;
5690
5691         bacpy(&ev.addr.bdaddr, bdaddr);
5692         ev.addr.type = type;
5693
5694         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5695 }
5696
5697 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5698                          void *data, u16 len)
5699 {
5700         struct mgmt_cp_remove_device *cp = data;
5701         int err;
5702
5703         BT_DBG("%s", hdev->name);
5704
5705         hci_dev_lock(hdev);
5706
5707         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5708                 struct hci_conn_params *params;
5709                 u8 addr_type;
5710
5711                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5712                         err = mgmt_cmd_complete(sk, hdev->id,
5713                                                 MGMT_OP_REMOVE_DEVICE,
5714                                                 MGMT_STATUS_INVALID_PARAMS,
5715                                                 &cp->addr, sizeof(cp->addr));
5716                         goto unlock;
5717                 }
5718
5719                 if (cp->addr.type == BDADDR_BREDR) {
5720                         err = hci_bdaddr_list_del(&hdev->whitelist,
5721                                                   &cp->addr.bdaddr,
5722                                                   cp->addr.type);
5723                         if (err) {
5724                                 err = mgmt_cmd_complete(sk, hdev->id,
5725                                                         MGMT_OP_REMOVE_DEVICE,
5726                                                         MGMT_STATUS_INVALID_PARAMS,
5727                                                         &cp->addr,
5728                                                         sizeof(cp->addr));
5729                                 goto unlock;
5730                         }
5731
5732                         hci_req_update_scan(hdev);
5733
5734                         device_removed(sk, hdev, &cp->addr.bdaddr,
5735                                        cp->addr.type);
5736                         goto complete;
5737                 }
5738
5739                 addr_type = le_addr_type(cp->addr.type);
5740
5741                 /* Kernel internally uses conn_params with resolvable private
5742                  * address, but Remove Device allows only identity addresses.
5743                  * Make sure it is enforced before calling
5744                  * hci_conn_params_lookup.
5745                  */
5746                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5747                         err = mgmt_cmd_complete(sk, hdev->id,
5748                                                 MGMT_OP_REMOVE_DEVICE,
5749                                                 MGMT_STATUS_INVALID_PARAMS,
5750                                                 &cp->addr, sizeof(cp->addr));
5751                         goto unlock;
5752                 }
5753
5754                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5755                                                 addr_type);
5756                 if (!params) {
5757                         err = mgmt_cmd_complete(sk, hdev->id,
5758                                                 MGMT_OP_REMOVE_DEVICE,
5759                                                 MGMT_STATUS_INVALID_PARAMS,
5760                                                 &cp->addr, sizeof(cp->addr));
5761                         goto unlock;
5762                 }
5763
5764                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5765                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5766                         err = mgmt_cmd_complete(sk, hdev->id,
5767                                                 MGMT_OP_REMOVE_DEVICE,
5768                                                 MGMT_STATUS_INVALID_PARAMS,
5769                                                 &cp->addr, sizeof(cp->addr));
5770                         goto unlock;
5771                 }
5772
5773                 list_del(&params->action);
5774                 list_del(&params->list);
5775                 kfree(params);
5776                 hci_update_background_scan(hdev);
5777
5778                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5779         } else {
5780                 struct hci_conn_params *p, *tmp;
5781                 struct bdaddr_list *b, *btmp;
5782
5783                 if (cp->addr.type) {
5784                         err = mgmt_cmd_complete(sk, hdev->id,
5785                                                 MGMT_OP_REMOVE_DEVICE,
5786                                                 MGMT_STATUS_INVALID_PARAMS,
5787                                                 &cp->addr, sizeof(cp->addr));
5788                         goto unlock;
5789                 }
5790
5791                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5792                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5793                         list_del(&b->list);
5794                         kfree(b);
5795                 }
5796
5797                 hci_req_update_scan(hdev);
5798
5799                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5800                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5801                                 continue;
5802                         device_removed(sk, hdev, &p->addr, p->addr_type);
5803                         if (p->explicit_connect) {
5804                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5805                                 continue;
5806                         }
5807                         list_del(&p->action);
5808                         list_del(&p->list);
5809                         kfree(p);
5810                 }
5811
5812                 BT_DBG("All LE connection parameters were removed");
5813
5814                 hci_update_background_scan(hdev);
5815         }
5816
5817 complete:
5818         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5819                                 MGMT_STATUS_SUCCESS, &cp->addr,
5820                                 sizeof(cp->addr));
5821 unlock:
5822         hci_dev_unlock(hdev);
5823         return err;
5824 }
5825
5826 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5827                            u16 len)
5828 {
5829         struct mgmt_cp_load_conn_param *cp = data;
5830         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5831                                      sizeof(struct mgmt_conn_param));
5832         u16 param_count, expected_len;
5833         int i;
5834
5835         if (!lmp_le_capable(hdev))
5836                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5837                                        MGMT_STATUS_NOT_SUPPORTED);
5838
5839         param_count = __le16_to_cpu(cp->param_count);
5840         if (param_count > max_param_count) {
5841                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5842                            param_count);
5843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5844                                        MGMT_STATUS_INVALID_PARAMS);
5845         }
5846
5847         expected_len = struct_size(cp, params, param_count);
5848         if (expected_len != len) {
5849                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5850                            expected_len, len);
5851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5852                                        MGMT_STATUS_INVALID_PARAMS);
5853         }
5854
5855         BT_DBG("%s param_count %u", hdev->name, param_count);
5856
5857         hci_dev_lock(hdev);
5858
5859         hci_conn_params_clear_disabled(hdev);
5860
5861         for (i = 0; i < param_count; i++) {
5862                 struct mgmt_conn_param *param = &cp->params[i];
5863                 struct hci_conn_params *hci_param;
5864                 u16 min, max, latency, timeout;
5865                 u8 addr_type;
5866
5867                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5868                        param->addr.type);
5869
5870                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5871                         addr_type = ADDR_LE_DEV_PUBLIC;
5872                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5873                         addr_type = ADDR_LE_DEV_RANDOM;
5874                 } else {
5875                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5876                         continue;
5877                 }
5878
5879                 min = le16_to_cpu(param->min_interval);
5880                 max = le16_to_cpu(param->max_interval);
5881                 latency = le16_to_cpu(param->latency);
5882                 timeout = le16_to_cpu(param->timeout);
5883
5884                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5885                        min, max, latency, timeout);
5886
5887                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5888                         bt_dev_err(hdev, "ignoring invalid connection parameters");
5889                         continue;
5890                 }
5891
5892                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5893                                                 addr_type);
5894                 if (!hci_param) {
5895                         bt_dev_err(hdev, "failed to add connection parameters");
5896                         continue;
5897                 }
5898
5899                 hci_param->conn_min_interval = min;
5900                 hci_param->conn_max_interval = max;
5901                 hci_param->conn_latency = latency;
5902                 hci_param->supervision_timeout = timeout;
5903         }
5904
5905         hci_dev_unlock(hdev);
5906
5907         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5908                                  NULL, 0);
5909 }
5910
5911 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5912                                void *data, u16 len)
5913 {
5914         struct mgmt_cp_set_external_config *cp = data;
5915         bool changed;
5916         int err;
5917
5918         BT_DBG("%s", hdev->name);
5919
5920         if (hdev_is_powered(hdev))
5921                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5922                                        MGMT_STATUS_REJECTED);
5923
5924         if (cp->config != 0x00 && cp->config != 0x01)
5925                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5926                                          MGMT_STATUS_INVALID_PARAMS);
5927
5928         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5929                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5930                                        MGMT_STATUS_NOT_SUPPORTED);
5931
5932         hci_dev_lock(hdev);
5933
5934         if (cp->config)
5935                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5936         else
5937                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5938
5939         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5940         if (err < 0)
5941                 goto unlock;
5942
5943         if (!changed)
5944                 goto unlock;
5945
5946         err = new_options(hdev, sk);
5947
5948         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5949                 mgmt_index_removed(hdev);
5950
5951                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5952                         hci_dev_set_flag(hdev, HCI_CONFIG);
5953                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5954
5955                         queue_work(hdev->req_workqueue, &hdev->power_on);
5956                 } else {
5957                         set_bit(HCI_RAW, &hdev->flags);
5958                         mgmt_index_added(hdev);
5959                 }
5960         }
5961
5962 unlock:
5963         hci_dev_unlock(hdev);
5964         return err;
5965 }
5966
5967 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5968                               void *data, u16 len)
5969 {
5970         struct mgmt_cp_set_public_address *cp = data;
5971         bool changed;
5972         int err;
5973
5974         BT_DBG("%s", hdev->name);
5975
5976         if (hdev_is_powered(hdev))
5977                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5978                                        MGMT_STATUS_REJECTED);
5979
5980         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5982                                        MGMT_STATUS_INVALID_PARAMS);
5983
5984         if (!hdev->set_bdaddr)
5985                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5986                                        MGMT_STATUS_NOT_SUPPORTED);
5987
5988         hci_dev_lock(hdev);
5989
5990         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5991         bacpy(&hdev->public_addr, &cp->bdaddr);
5992
5993         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5994         if (err < 0)
5995                 goto unlock;
5996
5997         if (!changed)
5998                 goto unlock;
5999
6000         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6001                 err = new_options(hdev, sk);
6002
6003         if (is_configured(hdev)) {
6004                 mgmt_index_removed(hdev);
6005
6006                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6007
6008                 hci_dev_set_flag(hdev, HCI_CONFIG);
6009                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6010
6011                 queue_work(hdev->req_workqueue, &hdev->power_on);
6012         }
6013
6014 unlock:
6015         hci_dev_unlock(hdev);
6016         return err;
6017 }
6018
6019 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6020                                              u16 opcode, struct sk_buff *skb)
6021 {
6022         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6023         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6024         u8 *h192, *r192, *h256, *r256;
6025         struct mgmt_pending_cmd *cmd;
6026         u16 eir_len;
6027         int err;
6028
6029         BT_DBG("%s status %u", hdev->name, status);
6030
6031         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6032         if (!cmd)
6033                 return;
6034
6035         mgmt_cp = cmd->param;
6036
6037         if (status) {
6038                 status = mgmt_status(status);
6039                 eir_len = 0;
6040
6041                 h192 = NULL;
6042                 r192 = NULL;
6043                 h256 = NULL;
6044                 r256 = NULL;
6045         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6046                 struct hci_rp_read_local_oob_data *rp;
6047
6048                 if (skb->len != sizeof(*rp)) {
6049                         status = MGMT_STATUS_FAILED;
6050                         eir_len = 0;
6051                 } else {
6052                         status = MGMT_STATUS_SUCCESS;
6053                         rp = (void *)skb->data;
6054
6055                         eir_len = 5 + 18 + 18;
6056                         h192 = rp->hash;
6057                         r192 = rp->rand;
6058                         h256 = NULL;
6059                         r256 = NULL;
6060                 }
6061         } else {
6062                 struct hci_rp_read_local_oob_ext_data *rp;
6063
6064                 if (skb->len != sizeof(*rp)) {
6065                         status = MGMT_STATUS_FAILED;
6066                         eir_len = 0;
6067                 } else {
6068                         status = MGMT_STATUS_SUCCESS;
6069                         rp = (void *)skb->data;
6070
6071                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6072                                 eir_len = 5 + 18 + 18;
6073                                 h192 = NULL;
6074                                 r192 = NULL;
6075                         } else {
6076                                 eir_len = 5 + 18 + 18 + 18 + 18;
6077                                 h192 = rp->hash192;
6078                                 r192 = rp->rand192;
6079                         }
6080
6081                         h256 = rp->hash256;
6082                         r256 = rp->rand256;
6083                 }
6084         }
6085
6086         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6087         if (!mgmt_rp)
6088                 goto done;
6089
6090         if (status)
6091                 goto send_rsp;
6092
6093         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6094                                   hdev->dev_class, 3);
6095
6096         if (h192 && r192) {
6097                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6098                                           EIR_SSP_HASH_C192, h192, 16);
6099                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6100                                           EIR_SSP_RAND_R192, r192, 16);
6101         }
6102
6103         if (h256 && r256) {
6104                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6105                                           EIR_SSP_HASH_C256, h256, 16);
6106                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6107                                           EIR_SSP_RAND_R256, r256, 16);
6108         }
6109
6110 send_rsp:
6111         mgmt_rp->type = mgmt_cp->type;
6112         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6113
6114         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6115                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6116                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6117         if (err < 0 || status)
6118                 goto done;
6119
6120         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6121
6122         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6123                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6124                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6125 done:
6126         kfree(mgmt_rp);
6127         mgmt_pending_remove(cmd);
6128 }
6129
6130 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6131                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6132 {
6133         struct mgmt_pending_cmd *cmd;
6134         struct hci_request req;
6135         int err;
6136
6137         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6138                                cp, sizeof(*cp));
6139         if (!cmd)
6140                 return -ENOMEM;
6141
6142         hci_req_init(&req, hdev);
6143
6144         if (bredr_sc_enabled(hdev))
6145                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6146         else
6147                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6148
6149         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6150         if (err < 0) {
6151                 mgmt_pending_remove(cmd);
6152                 return err;
6153         }
6154
6155         return 0;
6156 }
6157
6158 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6159                                    void *data, u16 data_len)
6160 {
6161         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6162         struct mgmt_rp_read_local_oob_ext_data *rp;
6163         size_t rp_len;
6164         u16 eir_len;
6165         u8 status, flags, role, addr[7], hash[16], rand[16];
6166         int err;
6167
6168         BT_DBG("%s", hdev->name);
6169
6170         if (hdev_is_powered(hdev)) {
6171                 switch (cp->type) {
6172                 case BIT(BDADDR_BREDR):
6173                         status = mgmt_bredr_support(hdev);
6174                         if (status)
6175                                 eir_len = 0;
6176                         else
6177                                 eir_len = 5;
6178                         break;
6179                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6180                         status = mgmt_le_support(hdev);
6181                         if (status)
6182                                 eir_len = 0;
6183                         else
6184                                 eir_len = 9 + 3 + 18 + 18 + 3;
6185                         break;
6186                 default:
6187                         status = MGMT_STATUS_INVALID_PARAMS;
6188                         eir_len = 0;
6189                         break;
6190                 }
6191         } else {
6192                 status = MGMT_STATUS_NOT_POWERED;
6193                 eir_len = 0;
6194         }
6195
6196         rp_len = sizeof(*rp) + eir_len;
6197         rp = kmalloc(rp_len, GFP_ATOMIC);
6198         if (!rp)
6199                 return -ENOMEM;
6200
6201         if (status)
6202                 goto complete;
6203
6204         hci_dev_lock(hdev);
6205
6206         eir_len = 0;
6207         switch (cp->type) {
6208         case BIT(BDADDR_BREDR):
6209                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6210                         err = read_local_ssp_oob_req(hdev, sk, cp);
6211                         hci_dev_unlock(hdev);
6212                         if (!err)
6213                                 goto done;
6214
6215                         status = MGMT_STATUS_FAILED;
6216                         goto complete;
6217                 } else {
6218                         eir_len = eir_append_data(rp->eir, eir_len,
6219                                                   EIR_CLASS_OF_DEV,
6220                                                   hdev->dev_class, 3);
6221                 }
6222                 break;
6223         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6224                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6225                     smp_generate_oob(hdev, hash, rand) < 0) {
6226                         hci_dev_unlock(hdev);
6227                         status = MGMT_STATUS_FAILED;
6228                         goto complete;
6229                 }
6230
6231                 /* This should return the active RPA, but since the RPA
6232                  * is only programmed on demand, it is really hard to fill
6233                  * this in at the moment. For now disallow retrieving
6234                  * local out-of-band data when privacy is in use.
6235                  *
6236                  * Returning the identity address will not help here since
6237                  * pairing happens before the identity resolving key is
6238                  * known and thus the connection establishment happens
6239                  * based on the RPA and not the identity address.
6240                  */
6241                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6242                         hci_dev_unlock(hdev);
6243                         status = MGMT_STATUS_REJECTED;
6244                         goto complete;
6245                 }
6246
6247                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6248                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6249                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6250                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6251                         memcpy(addr, &hdev->static_addr, 6);
6252                         addr[6] = 0x01;
6253                 } else {
6254                         memcpy(addr, &hdev->bdaddr, 6);
6255                         addr[6] = 0x00;
6256                 }
6257
6258                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6259                                           addr, sizeof(addr));
6260
6261                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6262                         role = 0x02;
6263                 else
6264                         role = 0x01;
6265
6266                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6267                                           &role, sizeof(role));
6268
6269                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6270                         eir_len = eir_append_data(rp->eir, eir_len,
6271                                                   EIR_LE_SC_CONFIRM,
6272                                                   hash, sizeof(hash));
6273
6274                         eir_len = eir_append_data(rp->eir, eir_len,
6275                                                   EIR_LE_SC_RANDOM,
6276                                                   rand, sizeof(rand));
6277                 }
6278
6279                 flags = mgmt_get_adv_discov_flags(hdev);
6280
6281                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6282                         flags |= LE_AD_NO_BREDR;
6283
6284                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6285                                           &flags, sizeof(flags));
6286                 break;
6287         }
6288
6289         hci_dev_unlock(hdev);
6290
6291         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6292
6293         status = MGMT_STATUS_SUCCESS;
6294
6295 complete:
6296         rp->type = cp->type;
6297         rp->eir_len = cpu_to_le16(eir_len);
6298
6299         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6300                                 status, rp, sizeof(*rp) + eir_len);
6301         if (err < 0 || status)
6302                 goto done;
6303
6304         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6305                                  rp, sizeof(*rp) + eir_len,
6306                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6307
6308 done:
6309         kfree(rp);
6310
6311         return err;
6312 }
6313
6314 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6315 {
6316         u32 flags = 0;
6317
6318         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6319         flags |= MGMT_ADV_FLAG_DISCOV;
6320         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6321         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6322         flags |= MGMT_ADV_FLAG_APPEARANCE;
6323         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6324
6325         /* In extended adv TX_POWER returned from Set Adv Param
6326          * will be always valid.
6327          */
6328         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6329             ext_adv_capable(hdev))
6330                 flags |= MGMT_ADV_FLAG_TX_POWER;
6331
6332         if (ext_adv_capable(hdev)) {
6333                 flags |= MGMT_ADV_FLAG_SEC_1M;
6334
6335                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6336                         flags |= MGMT_ADV_FLAG_SEC_2M;
6337
6338                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6339                         flags |= MGMT_ADV_FLAG_SEC_CODED;
6340         }
6341
6342         return flags;
6343 }
6344
6345 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6346                              void *data, u16 data_len)
6347 {
6348         struct mgmt_rp_read_adv_features *rp;
6349         size_t rp_len;
6350         int err;
6351         struct adv_info *adv_instance;
6352         u32 supported_flags;
6353         u8 *instance;
6354
6355         BT_DBG("%s", hdev->name);
6356
6357         if (!lmp_le_capable(hdev))
6358                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6359                                        MGMT_STATUS_REJECTED);
6360
6361         hci_dev_lock(hdev);
6362
6363         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6364         rp = kmalloc(rp_len, GFP_ATOMIC);
6365         if (!rp) {
6366                 hci_dev_unlock(hdev);
6367                 return -ENOMEM;
6368         }
6369
6370         supported_flags = get_supported_adv_flags(hdev);
6371
6372         rp->supported_flags = cpu_to_le32(supported_flags);
6373         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6374         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6375         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6376         rp->num_instances = hdev->adv_instance_cnt;
6377
6378         instance = rp->instance;
6379         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6380                 *instance = adv_instance->instance;
6381                 instance++;
6382         }
6383
6384         hci_dev_unlock(hdev);
6385
6386         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6387                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6388
6389         kfree(rp);
6390
6391         return err;
6392 }
6393
6394 static u8 calculate_name_len(struct hci_dev *hdev)
6395 {
6396         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6397
6398         return append_local_name(hdev, buf, 0);
6399 }
6400
6401 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6402                            bool is_adv_data)
6403 {
6404         u8 max_len = HCI_MAX_AD_LENGTH;
6405
6406         if (is_adv_data) {
6407                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6408                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6409                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6410                         max_len -= 3;
6411
6412                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6413                         max_len -= 3;
6414         } else {
6415                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6416                         max_len -= calculate_name_len(hdev);
6417
6418                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6419                         max_len -= 4;
6420         }
6421
6422         return max_len;
6423 }
6424
6425 static bool flags_managed(u32 adv_flags)
6426 {
6427         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6428                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6429                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6430 }
6431
6432 static bool tx_power_managed(u32 adv_flags)
6433 {
6434         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6435 }
6436
6437 static bool name_managed(u32 adv_flags)
6438 {
6439         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6440 }
6441
6442 static bool appearance_managed(u32 adv_flags)
6443 {
6444         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6445 }
6446
6447 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6448                               u8 len, bool is_adv_data)
6449 {
6450         int i, cur_len;
6451         u8 max_len;
6452
6453         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6454
6455         if (len > max_len)
6456                 return false;
6457
6458         /* Make sure that the data is correctly formatted. */
6459         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6460                 cur_len = data[i];
6461
6462                 if (data[i + 1] == EIR_FLAGS &&
6463                     (!is_adv_data || flags_managed(adv_flags)))
6464                         return false;
6465
6466                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6467                         return false;
6468
6469                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6470                         return false;
6471
6472                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6473                         return false;
6474
6475                 if (data[i + 1] == EIR_APPEARANCE &&
6476                     appearance_managed(adv_flags))
6477                         return false;
6478
6479                 /* If the current field length would exceed the total data
6480                  * length, then it's invalid.
6481                  */
6482                 if (i + cur_len >= len)
6483                         return false;
6484         }
6485
6486         return true;
6487 }
6488
6489 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6490                                      u16 opcode)
6491 {
6492         struct mgmt_pending_cmd *cmd;
6493         struct mgmt_cp_add_advertising *cp;
6494         struct mgmt_rp_add_advertising rp;
6495         struct adv_info *adv_instance, *n;
6496         u8 instance;
6497
6498         BT_DBG("status %d", status);
6499
6500         hci_dev_lock(hdev);
6501
6502         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6503
6504         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6505                 if (!adv_instance->pending)
6506                         continue;
6507
6508                 if (!status) {
6509                         adv_instance->pending = false;
6510                         continue;
6511                 }
6512
6513                 instance = adv_instance->instance;
6514
6515                 if (hdev->cur_adv_instance == instance)
6516                         cancel_adv_timeout(hdev);
6517
6518                 hci_remove_adv_instance(hdev, instance);
6519                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6520         }
6521
6522         if (!cmd)
6523                 goto unlock;
6524
6525         cp = cmd->param;
6526         rp.instance = cp->instance;
6527
6528         if (status)
6529                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6530                                 mgmt_status(status));
6531         else
6532                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6533                                   mgmt_status(status), &rp, sizeof(rp));
6534
6535         mgmt_pending_remove(cmd);
6536
6537 unlock:
6538         hci_dev_unlock(hdev);
6539 }
6540
6541 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6542                            void *data, u16 data_len)
6543 {
6544         struct mgmt_cp_add_advertising *cp = data;
6545         struct mgmt_rp_add_advertising rp;
6546         u32 flags;
6547         u32 supported_flags, phy_flags;
6548         u8 status;
6549         u16 timeout, duration;
6550         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6551         u8 schedule_instance = 0;
6552         struct adv_info *next_instance;
6553         int err;
6554         struct mgmt_pending_cmd *cmd;
6555         struct hci_request req;
6556
6557         BT_DBG("%s", hdev->name);
6558
6559         status = mgmt_le_support(hdev);
6560         if (status)
6561                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6562                                        status);
6563
6564         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6566                                        MGMT_STATUS_INVALID_PARAMS);
6567
6568         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6570                                        MGMT_STATUS_INVALID_PARAMS);
6571
6572         flags = __le32_to_cpu(cp->flags);
6573         timeout = __le16_to_cpu(cp->timeout);
6574         duration = __le16_to_cpu(cp->duration);
6575
6576         /* The current implementation only supports a subset of the specified
6577          * flags. Also need to check mutual exclusiveness of sec flags.
6578          */
6579         supported_flags = get_supported_adv_flags(hdev);
6580         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6581         if (flags & ~supported_flags ||
6582             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6583                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6584                                        MGMT_STATUS_INVALID_PARAMS);
6585
6586         hci_dev_lock(hdev);
6587
6588         if (timeout && !hdev_is_powered(hdev)) {
6589                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6590                                       MGMT_STATUS_REJECTED);
6591                 goto unlock;
6592         }
6593
6594         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6595             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6596             pending_find(MGMT_OP_SET_LE, hdev)) {
6597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6598                                       MGMT_STATUS_BUSY);
6599                 goto unlock;
6600         }
6601
6602         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6603             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6604                                cp->scan_rsp_len, false)) {
6605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6606                                       MGMT_STATUS_INVALID_PARAMS);
6607                 goto unlock;
6608         }
6609
6610         err = hci_add_adv_instance(hdev, cp->instance, flags,
6611                                    cp->adv_data_len, cp->data,
6612                                    cp->scan_rsp_len,
6613                                    cp->data + cp->adv_data_len,
6614                                    timeout, duration);
6615         if (err < 0) {
6616                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6617                                       MGMT_STATUS_FAILED);
6618                 goto unlock;
6619         }
6620
6621         /* Only trigger an advertising added event if a new instance was
6622          * actually added.
6623          */
6624         if (hdev->adv_instance_cnt > prev_instance_cnt)
6625                 mgmt_advertising_added(sk, hdev, cp->instance);
6626
6627         if (hdev->cur_adv_instance == cp->instance) {
6628                 /* If the currently advertised instance is being changed then
6629                  * cancel the current advertising and schedule the next
6630                  * instance. If there is only one instance then the overridden
6631                  * advertising data will be visible right away.
6632                  */
6633                 cancel_adv_timeout(hdev);
6634
6635                 next_instance = hci_get_next_instance(hdev, cp->instance);
6636                 if (next_instance)
6637                         schedule_instance = next_instance->instance;
6638         } else if (!hdev->adv_instance_timeout) {
6639                 /* Immediately advertise the new instance if no other
6640                  * instance is currently being advertised.
6641                  */
6642                 schedule_instance = cp->instance;
6643         }
6644
6645         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6646          * there is no instance to be advertised then we have no HCI
6647          * communication to make. Simply return.
6648          */
6649         if (!hdev_is_powered(hdev) ||
6650             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6651             !schedule_instance) {
6652                 rp.instance = cp->instance;
6653                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6654                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6655                 goto unlock;
6656         }
6657
6658         /* We're good to go, update advertising data, parameters, and start
6659          * advertising.
6660          */
6661         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6662                                data_len);
6663         if (!cmd) {
6664                 err = -ENOMEM;
6665                 goto unlock;
6666         }
6667
6668         hci_req_init(&req, hdev);
6669
6670         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6671
6672         if (!err)
6673                 err = hci_req_run(&req, add_advertising_complete);
6674
6675         if (err < 0)
6676                 mgmt_pending_remove(cmd);
6677
6678 unlock:
6679         hci_dev_unlock(hdev);
6680
6681         return err;
6682 }
6683
6684 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6685                                         u16 opcode)
6686 {
6687         struct mgmt_pending_cmd *cmd;
6688         struct mgmt_cp_remove_advertising *cp;
6689         struct mgmt_rp_remove_advertising rp;
6690
6691         BT_DBG("status %d", status);
6692
6693         hci_dev_lock(hdev);
6694
6695         /* A failure status here only means that we failed to disable
6696          * advertising. Otherwise, the advertising instance has been removed,
6697          * so report success.
6698          */
6699         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6700         if (!cmd)
6701                 goto unlock;
6702
6703         cp = cmd->param;
6704         rp.instance = cp->instance;
6705
6706         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6707                           &rp, sizeof(rp));
6708         mgmt_pending_remove(cmd);
6709
6710 unlock:
6711         hci_dev_unlock(hdev);
6712 }
6713
6714 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6715                               void *data, u16 data_len)
6716 {
6717         struct mgmt_cp_remove_advertising *cp = data;
6718         struct mgmt_rp_remove_advertising rp;
6719         struct mgmt_pending_cmd *cmd;
6720         struct hci_request req;
6721         int err;
6722
6723         BT_DBG("%s", hdev->name);
6724
6725         hci_dev_lock(hdev);
6726
6727         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6728                 err = mgmt_cmd_status(sk, hdev->id,
6729                                       MGMT_OP_REMOVE_ADVERTISING,
6730                                       MGMT_STATUS_INVALID_PARAMS);
6731                 goto unlock;
6732         }
6733
6734         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6735             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6736             pending_find(MGMT_OP_SET_LE, hdev)) {
6737                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6738                                       MGMT_STATUS_BUSY);
6739                 goto unlock;
6740         }
6741
6742         if (list_empty(&hdev->adv_instances)) {
6743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6744                                       MGMT_STATUS_INVALID_PARAMS);
6745                 goto unlock;
6746         }
6747
6748         hci_req_init(&req, hdev);
6749
6750         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6751
6752         if (list_empty(&hdev->adv_instances))
6753                 __hci_req_disable_advertising(&req);
6754
6755         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6756          * flag is set or the device isn't powered then we have no HCI
6757          * communication to make. Simply return.
6758          */
6759         if (skb_queue_empty(&req.cmd_q) ||
6760             !hdev_is_powered(hdev) ||
6761             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6762                 hci_req_purge(&req);
6763                 rp.instance = cp->instance;
6764                 err = mgmt_cmd_complete(sk, hdev->id,
6765                                         MGMT_OP_REMOVE_ADVERTISING,
6766                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6767                 goto unlock;
6768         }
6769
6770         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6771                                data_len);
6772         if (!cmd) {
6773                 err = -ENOMEM;
6774                 goto unlock;
6775         }
6776
6777         err = hci_req_run(&req, remove_advertising_complete);
6778         if (err < 0)
6779                 mgmt_pending_remove(cmd);
6780
6781 unlock:
6782         hci_dev_unlock(hdev);
6783
6784         return err;
6785 }
6786
6787 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6788                              void *data, u16 data_len)
6789 {
6790         struct mgmt_cp_get_adv_size_info *cp = data;
6791         struct mgmt_rp_get_adv_size_info rp;
6792         u32 flags, supported_flags;
6793         int err;
6794
6795         BT_DBG("%s", hdev->name);
6796
6797         if (!lmp_le_capable(hdev))
6798                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6799                                        MGMT_STATUS_REJECTED);
6800
6801         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6803                                        MGMT_STATUS_INVALID_PARAMS);
6804
6805         flags = __le32_to_cpu(cp->flags);
6806
6807         /* The current implementation only supports a subset of the specified
6808          * flags.
6809          */
6810         supported_flags = get_supported_adv_flags(hdev);
6811         if (flags & ~supported_flags)
6812                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6813                                        MGMT_STATUS_INVALID_PARAMS);
6814
6815         rp.instance = cp->instance;
6816         rp.flags = cp->flags;
6817         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6818         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6819
6820         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6821                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6822
6823         return err;
6824 }
6825
6826 static const struct hci_mgmt_handler mgmt_handlers[] = {
6827         { NULL }, /* 0x0000 (no command) */
6828         { read_version,            MGMT_READ_VERSION_SIZE,
6829                                                 HCI_MGMT_NO_HDEV |
6830                                                 HCI_MGMT_UNTRUSTED },
6831         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6832                                                 HCI_MGMT_NO_HDEV |
6833                                                 HCI_MGMT_UNTRUSTED },
6834         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6835                                                 HCI_MGMT_NO_HDEV |
6836                                                 HCI_MGMT_UNTRUSTED },
6837         { read_controller_info,    MGMT_READ_INFO_SIZE,
6838                                                 HCI_MGMT_UNTRUSTED },
6839         { set_powered,             MGMT_SETTING_SIZE },
6840         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6841         { set_connectable,         MGMT_SETTING_SIZE },
6842         { set_fast_connectable,    MGMT_SETTING_SIZE },
6843         { set_bondable,            MGMT_SETTING_SIZE },
6844         { set_link_security,       MGMT_SETTING_SIZE },
6845         { set_ssp,                 MGMT_SETTING_SIZE },
6846         { set_hs,                  MGMT_SETTING_SIZE },
6847         { set_le,                  MGMT_SETTING_SIZE },
6848         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6849         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6850         { add_uuid,                MGMT_ADD_UUID_SIZE },
6851         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6852         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6853                                                 HCI_MGMT_VAR_LEN },
6854         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6855                                                 HCI_MGMT_VAR_LEN },
6856         { disconnect,              MGMT_DISCONNECT_SIZE },
6857         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6858         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6859         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6860         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6861         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6862         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6863         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6864         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6865         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6866         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6867         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6868         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6869         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6870                                                 HCI_MGMT_VAR_LEN },
6871         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6872         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6873         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6874         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6875         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6876         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6877         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6878         { set_advertising,         MGMT_SETTING_SIZE },
6879         { set_bredr,               MGMT_SETTING_SIZE },
6880         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6881         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6882         { set_secure_conn,         MGMT_SETTING_SIZE },
6883         { set_debug_keys,          MGMT_SETTING_SIZE },
6884         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6885         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6886                                                 HCI_MGMT_VAR_LEN },
6887         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6888         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6889         { add_device,              MGMT_ADD_DEVICE_SIZE },
6890         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6891         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6892                                                 HCI_MGMT_VAR_LEN },
6893         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6894                                                 HCI_MGMT_NO_HDEV |
6895                                                 HCI_MGMT_UNTRUSTED },
6896         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6897                                                 HCI_MGMT_UNCONFIGURED |
6898                                                 HCI_MGMT_UNTRUSTED },
6899         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6900                                                 HCI_MGMT_UNCONFIGURED },
6901         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6902                                                 HCI_MGMT_UNCONFIGURED },
6903         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6904                                                 HCI_MGMT_VAR_LEN },
6905         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6906         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6907                                                 HCI_MGMT_NO_HDEV |
6908                                                 HCI_MGMT_UNTRUSTED },
6909         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6910         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6911                                                 HCI_MGMT_VAR_LEN },
6912         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6913         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6914         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6915         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6916                                                 HCI_MGMT_UNTRUSTED },
6917         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6918         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6919         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6920 };
6921
6922 #ifdef TIZEN_BT
6923 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
6924         { NULL }, /* 0x0000 (no command) */
6925 };
6926 #endif
6927
6928 void mgmt_index_added(struct hci_dev *hdev)
6929 {
6930         struct mgmt_ev_ext_index ev;
6931
6932         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6933                 return;
6934
6935         switch (hdev->dev_type) {
6936         case HCI_PRIMARY:
6937                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6938                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6939                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6940                         ev.type = 0x01;
6941                 } else {
6942                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6943                                          HCI_MGMT_INDEX_EVENTS);
6944                         ev.type = 0x00;
6945                 }
6946                 break;
6947         case HCI_AMP:
6948                 ev.type = 0x02;
6949                 break;
6950         default:
6951                 return;
6952         }
6953
6954         ev.bus = hdev->bus;
6955
6956         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6957                          HCI_MGMT_EXT_INDEX_EVENTS);
6958 }
6959
6960 void mgmt_index_removed(struct hci_dev *hdev)
6961 {
6962         struct mgmt_ev_ext_index ev;
6963         u8 status = MGMT_STATUS_INVALID_INDEX;
6964
6965         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6966                 return;
6967
6968         switch (hdev->dev_type) {
6969         case HCI_PRIMARY:
6970                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6971
6972                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6973                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6974                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6975                         ev.type = 0x01;
6976                 } else {
6977                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6978                                          HCI_MGMT_INDEX_EVENTS);
6979                         ev.type = 0x00;
6980                 }
6981                 break;
6982         case HCI_AMP:
6983                 ev.type = 0x02;
6984                 break;
6985         default:
6986                 return;
6987         }
6988
6989         ev.bus = hdev->bus;
6990
6991         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6992                          HCI_MGMT_EXT_INDEX_EVENTS);
6993 }
6994
6995 /* This function requires the caller holds hdev->lock */
6996 static void restart_le_actions(struct hci_dev *hdev)
6997 {
6998         struct hci_conn_params *p;
6999
7000         list_for_each_entry(p, &hdev->le_conn_params, list) {
7001                 /* Needed for AUTO_OFF case where might not "really"
7002                  * have been powered off.
7003                  */
7004                 list_del_init(&p->action);
7005
7006                 switch (p->auto_connect) {
7007                 case HCI_AUTO_CONN_DIRECT:
7008                 case HCI_AUTO_CONN_ALWAYS:
7009                         list_add(&p->action, &hdev->pend_le_conns);
7010                         break;
7011                 case HCI_AUTO_CONN_REPORT:
7012                         list_add(&p->action, &hdev->pend_le_reports);
7013                         break;
7014                 default:
7015                         break;
7016                 }
7017         }
7018 }
7019
7020 void mgmt_power_on(struct hci_dev *hdev, int err)
7021 {
7022         struct cmd_lookup match = { NULL, hdev };
7023
7024         BT_DBG("err %d", err);
7025
7026         hci_dev_lock(hdev);
7027
7028         if (!err) {
7029                 restart_le_actions(hdev);
7030                 hci_update_background_scan(hdev);
7031         }
7032
7033         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7034
7035         new_settings(hdev, match.sk);
7036
7037         if (match.sk)
7038                 sock_put(match.sk);
7039
7040         hci_dev_unlock(hdev);
7041 }
7042
7043 void __mgmt_power_off(struct hci_dev *hdev)
7044 {
7045         struct cmd_lookup match = { NULL, hdev };
7046         u8 status, zero_cod[] = { 0, 0, 0 };
7047
7048         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7049
7050         /* If the power off is because of hdev unregistration let
7051          * use the appropriate INVALID_INDEX status. Otherwise use
7052          * NOT_POWERED. We cover both scenarios here since later in
7053          * mgmt_index_removed() any hci_conn callbacks will have already
7054          * been triggered, potentially causing misleading DISCONNECTED
7055          * status responses.
7056          */
7057         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7058                 status = MGMT_STATUS_INVALID_INDEX;
7059         else
7060                 status = MGMT_STATUS_NOT_POWERED;
7061
7062         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7063
7064         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7065                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7066                                    zero_cod, sizeof(zero_cod),
7067                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7068                 ext_info_changed(hdev, NULL);
7069         }
7070
7071         new_settings(hdev, match.sk);
7072
7073         if (match.sk)
7074                 sock_put(match.sk);
7075 }
7076
7077 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7078 {
7079         struct mgmt_pending_cmd *cmd;
7080         u8 status;
7081
7082         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7083         if (!cmd)
7084                 return;
7085
7086         if (err == -ERFKILL)
7087                 status = MGMT_STATUS_RFKILLED;
7088         else
7089                 status = MGMT_STATUS_FAILED;
7090
7091         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7092
7093         mgmt_pending_remove(cmd);
7094 }
7095
7096 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7097                        bool persistent)
7098 {
7099         struct mgmt_ev_new_link_key ev;
7100
7101         memset(&ev, 0, sizeof(ev));
7102
7103         ev.store_hint = persistent;
7104         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7105         ev.key.addr.type = BDADDR_BREDR;
7106         ev.key.type = key->type;
7107         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7108         ev.key.pin_len = key->pin_len;
7109
7110         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7111 }
7112
7113 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7114 {
7115         switch (ltk->type) {
7116         case SMP_LTK:
7117         case SMP_LTK_SLAVE:
7118                 if (ltk->authenticated)
7119                         return MGMT_LTK_AUTHENTICATED;
7120                 return MGMT_LTK_UNAUTHENTICATED;
7121         case SMP_LTK_P256:
7122                 if (ltk->authenticated)
7123                         return MGMT_LTK_P256_AUTH;
7124                 return MGMT_LTK_P256_UNAUTH;
7125         case SMP_LTK_P256_DEBUG:
7126                 return MGMT_LTK_P256_DEBUG;
7127         }
7128
7129         return MGMT_LTK_UNAUTHENTICATED;
7130 }
7131
7132 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7133 {
7134         struct mgmt_ev_new_long_term_key ev;
7135
7136         memset(&ev, 0, sizeof(ev));
7137
7138         /* Devices using resolvable or non-resolvable random addresses
7139          * without providing an identity resolving key don't require
7140          * to store long term keys. Their addresses will change the
7141          * next time around.
7142          *
7143          * Only when a remote device provides an identity address
7144          * make sure the long term key is stored. If the remote
7145          * identity is known, the long term keys are internally
7146          * mapped to the identity address. So allow static random
7147          * and public addresses here.
7148          */
7149         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7150             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7151                 ev.store_hint = 0x00;
7152         else
7153                 ev.store_hint = persistent;
7154
7155         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7156         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7157         ev.key.type = mgmt_ltk_type(key);
7158         ev.key.enc_size = key->enc_size;
7159         ev.key.ediv = key->ediv;
7160         ev.key.rand = key->rand;
7161
7162         if (key->type == SMP_LTK)
7163                 ev.key.master = 1;
7164
7165         /* Make sure we copy only the significant bytes based on the
7166          * encryption key size, and set the rest of the value to zeroes.
7167          */
7168         memcpy(ev.key.val, key->val, key->enc_size);
7169         memset(ev.key.val + key->enc_size, 0,
7170                sizeof(ev.key.val) - key->enc_size);
7171
7172         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7173 }
7174
7175 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7176 {
7177         struct mgmt_ev_new_irk ev;
7178
7179         memset(&ev, 0, sizeof(ev));
7180
7181         ev.store_hint = persistent;
7182
7183         bacpy(&ev.rpa, &irk->rpa);
7184         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7185         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7186         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7187
7188         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7189 }
7190
7191 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7192                    bool persistent)
7193 {
7194         struct mgmt_ev_new_csrk ev;
7195
7196         memset(&ev, 0, sizeof(ev));
7197
7198         /* Devices using resolvable or non-resolvable random addresses
7199          * without providing an identity resolving key don't require
7200          * to store signature resolving keys. Their addresses will change
7201          * the next time around.
7202          *
7203          * Only when a remote device provides an identity address
7204          * make sure the signature resolving key is stored. So allow
7205          * static random and public addresses here.
7206          */
7207         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7208             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7209                 ev.store_hint = 0x00;
7210         else
7211                 ev.store_hint = persistent;
7212
7213         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7214         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7215         ev.key.type = csrk->type;
7216         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7217
7218         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7219 }
7220
7221 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7222                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7223                          u16 max_interval, u16 latency, u16 timeout)
7224 {
7225         struct mgmt_ev_new_conn_param ev;
7226
7227         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7228                 return;
7229
7230         memset(&ev, 0, sizeof(ev));
7231         bacpy(&ev.addr.bdaddr, bdaddr);
7232         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7233         ev.store_hint = store_hint;
7234         ev.min_interval = cpu_to_le16(min_interval);
7235         ev.max_interval = cpu_to_le16(max_interval);
7236         ev.latency = cpu_to_le16(latency);
7237         ev.timeout = cpu_to_le16(timeout);
7238
7239         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7240 }
7241
7242 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7243                            u32 flags, u8 *name, u8 name_len)
7244 {
7245         char buf[512];
7246         struct mgmt_ev_device_connected *ev = (void *) buf;
7247         u16 eir_len = 0;
7248
7249         bacpy(&ev->addr.bdaddr, &conn->dst);
7250         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7251
7252         ev->flags = __cpu_to_le32(flags);
7253
7254         /* We must ensure that the EIR Data fields are ordered and
7255          * unique. Keep it simple for now and avoid the problem by not
7256          * adding any BR/EDR data to the LE adv.
7257          */
7258         if (conn->le_adv_data_len > 0) {
7259                 memcpy(&ev->eir[eir_len],
7260                        conn->le_adv_data, conn->le_adv_data_len);
7261                 eir_len = conn->le_adv_data_len;
7262         } else {
7263                 if (name_len > 0)
7264                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7265                                                   name, name_len);
7266
7267                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7268                         eir_len = eir_append_data(ev->eir, eir_len,
7269                                                   EIR_CLASS_OF_DEV,
7270                                                   conn->dev_class, 3);
7271         }
7272
7273         ev->eir_len = cpu_to_le16(eir_len);
7274
7275         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7276                     sizeof(*ev) + eir_len, NULL);
7277 }
7278
7279 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7280 {
7281         struct sock **sk = data;
7282
7283         cmd->cmd_complete(cmd, 0);
7284
7285         *sk = cmd->sk;
7286         sock_hold(*sk);
7287
7288         mgmt_pending_remove(cmd);
7289 }
7290
7291 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7292 {
7293         struct hci_dev *hdev = data;
7294         struct mgmt_cp_unpair_device *cp = cmd->param;
7295
7296         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7297
7298         cmd->cmd_complete(cmd, 0);
7299         mgmt_pending_remove(cmd);
7300 }
7301
7302 bool mgmt_powering_down(struct hci_dev *hdev)
7303 {
7304         struct mgmt_pending_cmd *cmd;
7305         struct mgmt_mode *cp;
7306
7307         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7308         if (!cmd)
7309                 return false;
7310
7311         cp = cmd->param;
7312         if (!cp->val)
7313                 return true;
7314
7315         return false;
7316 }
7317
7318 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7319                               u8 link_type, u8 addr_type, u8 reason,
7320                               bool mgmt_connected)
7321 {
7322         struct mgmt_ev_device_disconnected ev;
7323         struct sock *sk = NULL;
7324
7325         /* The connection is still in hci_conn_hash so test for 1
7326          * instead of 0 to know if this is the last one.
7327          */
7328         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7329                 cancel_delayed_work(&hdev->power_off);
7330                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7331         }
7332
7333         if (!mgmt_connected)
7334                 return;
7335
7336         if (link_type != ACL_LINK && link_type != LE_LINK)
7337                 return;
7338
7339         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7340
7341         bacpy(&ev.addr.bdaddr, bdaddr);
7342         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7343         ev.reason = reason;
7344
7345         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7346
7347         if (sk)
7348                 sock_put(sk);
7349
7350         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7351                              hdev);
7352 }
7353
7354 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7355                             u8 link_type, u8 addr_type, u8 status)
7356 {
7357         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7358         struct mgmt_cp_disconnect *cp;
7359         struct mgmt_pending_cmd *cmd;
7360
7361         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7362                              hdev);
7363
7364         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7365         if (!cmd)
7366                 return;
7367
7368         cp = cmd->param;
7369
7370         if (bacmp(bdaddr, &cp->addr.bdaddr))
7371                 return;
7372
7373         if (cp->addr.type != bdaddr_type)
7374                 return;
7375
7376         cmd->cmd_complete(cmd, mgmt_status(status));
7377         mgmt_pending_remove(cmd);
7378 }
7379
7380 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7381                          u8 addr_type, u8 status)
7382 {
7383         struct mgmt_ev_connect_failed ev;
7384
7385         /* The connection is still in hci_conn_hash so test for 1
7386          * instead of 0 to know if this is the last one.
7387          */
7388         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7389                 cancel_delayed_work(&hdev->power_off);
7390                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7391         }
7392
7393         bacpy(&ev.addr.bdaddr, bdaddr);
7394         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7395         ev.status = mgmt_status(status);
7396
7397         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7398 }
7399
7400 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7401 {
7402         struct mgmt_ev_pin_code_request ev;
7403
7404         bacpy(&ev.addr.bdaddr, bdaddr);
7405         ev.addr.type = BDADDR_BREDR;
7406         ev.secure = secure;
7407
7408         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7409 }
7410
7411 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7412                                   u8 status)
7413 {
7414         struct mgmt_pending_cmd *cmd;
7415
7416         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7417         if (!cmd)
7418                 return;
7419
7420         cmd->cmd_complete(cmd, mgmt_status(status));
7421         mgmt_pending_remove(cmd);
7422 }
7423
7424 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7425                                       u8 status)
7426 {
7427         struct mgmt_pending_cmd *cmd;
7428
7429         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7430         if (!cmd)
7431                 return;
7432
7433         cmd->cmd_complete(cmd, mgmt_status(status));
7434         mgmt_pending_remove(cmd);
7435 }
7436
7437 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7438                               u8 link_type, u8 addr_type, u32 value,
7439                               u8 confirm_hint)
7440 {
7441         struct mgmt_ev_user_confirm_request ev;
7442
7443         BT_DBG("%s", hdev->name);
7444
7445         bacpy(&ev.addr.bdaddr, bdaddr);
7446         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7447         ev.confirm_hint = confirm_hint;
7448         ev.value = cpu_to_le32(value);
7449
7450         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7451                           NULL);
7452 }
7453
7454 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7455                               u8 link_type, u8 addr_type)
7456 {
7457         struct mgmt_ev_user_passkey_request ev;
7458
7459         BT_DBG("%s", hdev->name);
7460
7461         bacpy(&ev.addr.bdaddr, bdaddr);
7462         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7463
7464         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7465                           NULL);
7466 }
7467
7468 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7469                                       u8 link_type, u8 addr_type, u8 status,
7470                                       u8 opcode)
7471 {
7472         struct mgmt_pending_cmd *cmd;
7473
7474         cmd = pending_find(opcode, hdev);
7475         if (!cmd)
7476                 return -ENOENT;
7477
7478         cmd->cmd_complete(cmd, mgmt_status(status));
7479         mgmt_pending_remove(cmd);
7480
7481         return 0;
7482 }
7483
7484 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7485                                      u8 link_type, u8 addr_type, u8 status)
7486 {
7487         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7488                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7489 }
7490
7491 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7492                                          u8 link_type, u8 addr_type, u8 status)
7493 {
7494         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7495                                           status,
7496                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7497 }
7498
7499 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7500                                      u8 link_type, u8 addr_type, u8 status)
7501 {
7502         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7503                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7504 }
7505
7506 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7507                                          u8 link_type, u8 addr_type, u8 status)
7508 {
7509         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7510                                           status,
7511                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7512 }
7513
7514 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7515                              u8 link_type, u8 addr_type, u32 passkey,
7516                              u8 entered)
7517 {
7518         struct mgmt_ev_passkey_notify ev;
7519
7520         BT_DBG("%s", hdev->name);
7521
7522         bacpy(&ev.addr.bdaddr, bdaddr);
7523         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7524         ev.passkey = __cpu_to_le32(passkey);
7525         ev.entered = entered;
7526
7527         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7528 }
7529
7530 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7531 {
7532         struct mgmt_ev_auth_failed ev;
7533         struct mgmt_pending_cmd *cmd;
7534         u8 status = mgmt_status(hci_status);
7535
7536         bacpy(&ev.addr.bdaddr, &conn->dst);
7537         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7538         ev.status = status;
7539
7540         cmd = find_pairing(conn);
7541
7542         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7543                     cmd ? cmd->sk : NULL);
7544
7545         if (cmd) {
7546                 cmd->cmd_complete(cmd, status);
7547                 mgmt_pending_remove(cmd);
7548         }
7549 }
7550
7551 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7552 {
7553         struct cmd_lookup match = { NULL, hdev };
7554         bool changed;
7555
7556         if (status) {
7557                 u8 mgmt_err = mgmt_status(status);
7558                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7559                                      cmd_status_rsp, &mgmt_err);
7560                 return;
7561         }
7562
7563         if (test_bit(HCI_AUTH, &hdev->flags))
7564                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7565         else
7566                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7567
7568         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7569                              &match);
7570
7571         if (changed)
7572                 new_settings(hdev, match.sk);
7573
7574         if (match.sk)
7575                 sock_put(match.sk);
7576 }
7577
7578 static void clear_eir(struct hci_request *req)
7579 {
7580         struct hci_dev *hdev = req->hdev;
7581         struct hci_cp_write_eir cp;
7582
7583         if (!lmp_ext_inq_capable(hdev))
7584                 return;
7585
7586         memset(hdev->eir, 0, sizeof(hdev->eir));
7587
7588         memset(&cp, 0, sizeof(cp));
7589
7590         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7591 }
7592
7593 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7594 {
7595         struct cmd_lookup match = { NULL, hdev };
7596         struct hci_request req;
7597         bool changed = false;
7598
7599         if (status) {
7600                 u8 mgmt_err = mgmt_status(status);
7601
7602                 if (enable && hci_dev_test_and_clear_flag(hdev,
7603                                                           HCI_SSP_ENABLED)) {
7604                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7605                         new_settings(hdev, NULL);
7606                 }
7607
7608                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7609                                      &mgmt_err);
7610                 return;
7611         }
7612
7613         if (enable) {
7614                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7615         } else {
7616                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7617                 if (!changed)
7618                         changed = hci_dev_test_and_clear_flag(hdev,
7619                                                               HCI_HS_ENABLED);
7620                 else
7621                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7622         }
7623
7624         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7625
7626         if (changed)
7627                 new_settings(hdev, match.sk);
7628
7629         if (match.sk)
7630                 sock_put(match.sk);
7631
7632         hci_req_init(&req, hdev);
7633
7634         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7635                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7636                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7637                                     sizeof(enable), &enable);
7638                 __hci_req_update_eir(&req);
7639         } else {
7640                 clear_eir(&req);
7641         }
7642
7643         hci_req_run(&req, NULL);
7644 }
7645
7646 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7647 {
7648         struct cmd_lookup *match = data;
7649
7650         if (match->sk == NULL) {
7651                 match->sk = cmd->sk;
7652                 sock_hold(match->sk);
7653         }
7654 }
7655
7656 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7657                                     u8 status)
7658 {
7659         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7660
7661         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7662         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7663         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7664
7665         if (!status) {
7666                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7667                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7668                 ext_info_changed(hdev, NULL);
7669         }
7670
7671         if (match.sk)
7672                 sock_put(match.sk);
7673 }
7674
7675 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7676 {
7677         struct mgmt_cp_set_local_name ev;
7678         struct mgmt_pending_cmd *cmd;
7679
7680         if (status)
7681                 return;
7682
7683         memset(&ev, 0, sizeof(ev));
7684         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7685         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7686
7687         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7688         if (!cmd) {
7689                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7690
7691                 /* If this is a HCI command related to powering on the
7692                  * HCI dev don't send any mgmt signals.
7693                  */
7694                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7695                         return;
7696         }
7697
7698         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7699                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7700         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7701 }
7702
7703 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7704 {
7705         int i;
7706
7707         for (i = 0; i < uuid_count; i++) {
7708                 if (!memcmp(uuid, uuids[i], 16))
7709                         return true;
7710         }
7711
7712         return false;
7713 }
7714
7715 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7716 {
7717         u16 parsed = 0;
7718
7719         while (parsed < eir_len) {
7720                 u8 field_len = eir[0];
7721                 u8 uuid[16];
7722                 int i;
7723
7724                 if (field_len == 0)
7725                         break;
7726
7727                 if (eir_len - parsed < field_len + 1)
7728                         break;
7729
7730                 switch (eir[1]) {
7731                 case EIR_UUID16_ALL:
7732                 case EIR_UUID16_SOME:
7733                         for (i = 0; i + 3 <= field_len; i += 2) {
7734                                 memcpy(uuid, bluetooth_base_uuid, 16);
7735                                 uuid[13] = eir[i + 3];
7736                                 uuid[12] = eir[i + 2];
7737                                 if (has_uuid(uuid, uuid_count, uuids))
7738                                         return true;
7739                         }
7740                         break;
7741                 case EIR_UUID32_ALL:
7742                 case EIR_UUID32_SOME:
7743                         for (i = 0; i + 5 <= field_len; i += 4) {
7744                                 memcpy(uuid, bluetooth_base_uuid, 16);
7745                                 uuid[15] = eir[i + 5];
7746                                 uuid[14] = eir[i + 4];
7747                                 uuid[13] = eir[i + 3];
7748                                 uuid[12] = eir[i + 2];
7749                                 if (has_uuid(uuid, uuid_count, uuids))
7750                                         return true;
7751                         }
7752                         break;
7753                 case EIR_UUID128_ALL:
7754                 case EIR_UUID128_SOME:
7755                         for (i = 0; i + 17 <= field_len; i += 16) {
7756                                 memcpy(uuid, eir + i + 2, 16);
7757                                 if (has_uuid(uuid, uuid_count, uuids))
7758                                         return true;
7759                         }
7760                         break;
7761                 }
7762
7763                 parsed += field_len + 1;
7764                 eir += field_len + 1;
7765         }
7766
7767         return false;
7768 }
7769
7770 static void restart_le_scan(struct hci_dev *hdev)
7771 {
7772         /* If controller is not scanning we are done. */
7773         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7774                 return;
7775
7776         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7777                        hdev->discovery.scan_start +
7778                        hdev->discovery.scan_duration))
7779                 return;
7780
7781         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7782                            DISCOV_LE_RESTART_DELAY);
7783 }
7784
7785 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7786                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7787 {
7788         /* If a RSSI threshold has been specified, and
7789          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7790          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7791          * is set, let it through for further processing, as we might need to
7792          * restart the scan.
7793          *
7794          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7795          * the results are also dropped.
7796          */
7797         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7798             (rssi == HCI_RSSI_INVALID ||
7799             (rssi < hdev->discovery.rssi &&
7800              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7801                 return  false;
7802
7803         if (hdev->discovery.uuid_count != 0) {
7804                 /* If a list of UUIDs is provided in filter, results with no
7805                  * matching UUID should be dropped.
7806                  */
7807                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7808                                    hdev->discovery.uuids) &&
7809                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7810                                    hdev->discovery.uuid_count,
7811                                    hdev->discovery.uuids))
7812                         return false;
7813         }
7814
7815         /* If duplicate filtering does not report RSSI changes, then restart
7816          * scanning to ensure updated result with updated RSSI values.
7817          */
7818         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7819                 restart_le_scan(hdev);
7820
7821                 /* Validate RSSI value against the RSSI threshold once more. */
7822                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7823                     rssi < hdev->discovery.rssi)
7824                         return false;
7825         }
7826
7827         return true;
7828 }
7829
7830 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7831                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7832                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7833 {
7834         char buf[512];
7835         struct mgmt_ev_device_found *ev = (void *)buf;
7836         size_t ev_size;
7837
7838         /* Don't send events for a non-kernel initiated discovery. With
7839          * LE one exception is if we have pend_le_reports > 0 in which
7840          * case we're doing passive scanning and want these events.
7841          */
7842         if (!hci_discovery_active(hdev)) {
7843                 if (link_type == ACL_LINK)
7844                         return;
7845                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7846                         return;
7847         }
7848
7849         if (hdev->discovery.result_filtering) {
7850                 /* We are using service discovery */
7851                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7852                                      scan_rsp_len))
7853                         return;
7854         }
7855
7856         if (hdev->discovery.limited) {
7857                 /* Check for limited discoverable bit */
7858                 if (dev_class) {
7859                         if (!(dev_class[1] & 0x20))
7860                                 return;
7861                 } else {
7862                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7863                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7864                                 return;
7865                 }
7866         }
7867
7868         /* Make sure that the buffer is big enough. The 5 extra bytes
7869          * are for the potential CoD field.
7870          */
7871         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7872                 return;
7873
7874         memset(buf, 0, sizeof(buf));
7875
7876         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7877          * RSSI value was reported as 0 when not available. This behavior
7878          * is kept when using device discovery. This is required for full
7879          * backwards compatibility with the API.
7880          *
7881          * However when using service discovery, the value 127 will be
7882          * returned when the RSSI is not available.
7883          */
7884         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7885             link_type == ACL_LINK)
7886                 rssi = 0;
7887
7888         bacpy(&ev->addr.bdaddr, bdaddr);
7889         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7890         ev->rssi = rssi;
7891         ev->flags = cpu_to_le32(flags);
7892
7893         if (eir_len > 0)
7894                 /* Copy EIR or advertising data into event */
7895                 memcpy(ev->eir, eir, eir_len);
7896
7897         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7898                                        NULL))
7899                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7900                                           dev_class, 3);
7901
7902         if (scan_rsp_len > 0)
7903                 /* Append scan response data to event */
7904                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7905
7906         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7907         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7908
7909         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7910 }
7911
7912 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7913                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7914 {
7915         struct mgmt_ev_device_found *ev;
7916         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7917         u16 eir_len;
7918
7919         ev = (struct mgmt_ev_device_found *) buf;
7920
7921         memset(buf, 0, sizeof(buf));
7922
7923         bacpy(&ev->addr.bdaddr, bdaddr);
7924         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7925         ev->rssi = rssi;
7926
7927         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7928                                   name_len);
7929
7930         ev->eir_len = cpu_to_le16(eir_len);
7931
7932         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7933 }
7934
7935 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7936 {
7937         struct mgmt_ev_discovering ev;
7938
7939         BT_DBG("%s discovering %u", hdev->name, discovering);
7940
7941         memset(&ev, 0, sizeof(ev));
7942         ev.type = hdev->discovery.type;
7943         ev.discovering = discovering;
7944
7945         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7946 }
7947
7948 static struct hci_mgmt_chan chan = {
7949         .channel        = HCI_CHANNEL_CONTROL,
7950         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7951         .handlers       = mgmt_handlers,
7952 #ifdef TIZEN_BT
7953         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
7954         .tizen_handlers = tizen_mgmt_handlers,
7955 #endif
7956         .hdev_init      = mgmt_init_hdev,
7957 };
7958
7959 int mgmt_init(void)
7960 {
7961         return hci_mgmt_chan_register(&chan);
7962 }
7963
7964 void mgmt_exit(void)
7965 {
7966         hci_mgmt_chan_unregister(&chan);
7967 }