net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   10
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105 };
 106
 107 static const u16 mgmt_events[] = {
 108         MGMT_EV_CONTROLLER_ERROR,
 109         MGMT_EV_INDEX_ADDED,
 110         MGMT_EV_INDEX_REMOVED,
 111         MGMT_EV_NEW_SETTINGS,
 112         MGMT_EV_CLASS_OF_DEV_CHANGED,
 113         MGMT_EV_LOCAL_NAME_CHANGED,
 114         MGMT_EV_NEW_LINK_KEY,
 115         MGMT_EV_NEW_LONG_TERM_KEY,
 116         MGMT_EV_DEVICE_CONNECTED,
 117         MGMT_EV_DEVICE_DISCONNECTED,
 118         MGMT_EV_CONNECT_FAILED,
 119         MGMT_EV_PIN_CODE_REQUEST,
 120         MGMT_EV_USER_CONFIRM_REQUEST,
 121         MGMT_EV_USER_PASSKEY_REQUEST,
 122         MGMT_EV_AUTH_FAILED,
 123         MGMT_EV_DEVICE_FOUND,
 124         MGMT_EV_DISCOVERING,
 125         MGMT_EV_DEVICE_BLOCKED,
 126         MGMT_EV_DEVICE_UNBLOCKED,
 127         MGMT_EV_DEVICE_UNPAIRED,
 128         MGMT_EV_PASSKEY_NOTIFY,
 129         MGMT_EV_NEW_IRK,
 130         MGMT_EV_NEW_CSRK,
 131         MGMT_EV_DEVICE_ADDED,
 132         MGMT_EV_DEVICE_REMOVED,
 133         MGMT_EV_NEW_CONN_PARAM,
 134         MGMT_EV_UNCONF_INDEX_ADDED,
 135         MGMT_EV_UNCONF_INDEX_REMOVED,
 136         MGMT_EV_NEW_CONFIG_OPTIONS,
 137         MGMT_EV_EXT_INDEX_ADDED,
 138         MGMT_EV_EXT_INDEX_REMOVED,
 139         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 140         MGMT_EV_ADVERTISING_ADDED,
 141         MGMT_EV_ADVERTISING_REMOVED,
 142 };
 143
 144 static const u16 mgmt_untrusted_commands[] = {
 145         MGMT_OP_READ_INDEX_LIST,
 146         MGMT_OP_READ_INFO,
 147         MGMT_OP_READ_UNCONF_INDEX_LIST,
 148         MGMT_OP_READ_CONFIG_INFO,
 149         MGMT_OP_READ_EXT_INDEX_LIST,
 150 };
 151
 152 static const u16 mgmt_untrusted_events[] = {
 153         MGMT_EV_INDEX_ADDED,
 154         MGMT_EV_INDEX_REMOVED,
 155         MGMT_EV_NEW_SETTINGS,
 156         MGMT_EV_CLASS_OF_DEV_CHANGED,
 157         MGMT_EV_LOCAL_NAME_CHANGED,
 158         MGMT_EV_UNCONF_INDEX_ADDED,
 159         MGMT_EV_UNCONF_INDEX_REMOVED,
 160         MGMT_EV_NEW_CONFIG_OPTIONS,
 161         MGMT_EV_EXT_INDEX_ADDED,
 162         MGMT_EV_EXT_INDEX_REMOVED,
 163 };
 164
 165 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 166
 167 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 168                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 169
 170 /* HCI to MGMT error code conversion table */
 171 static u8 mgmt_status_table[] = {
 172         MGMT_STATUS_SUCCESS,
 173         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 174         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 175         MGMT_STATUS_FAILED,             /* Hardware Failure */
 176         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 177         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 178         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 179         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 180         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 181         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 182         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 183         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 184         MGMT_STATUS_BUSY,               /* Command Disallowed */
 185         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 186         MGMT_STATUS_REJECTED,           /* Rejected Security */
 187         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 188         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 191         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 192         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 193         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 194         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 195         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 196         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 197         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 199         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 200         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 201         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 203         MGMT_STATUS_FAILED,             /* Unspecified Error */
 204         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 205         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 206         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 207         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 208         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 209         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 210         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 212         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 213         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 214         MGMT_STATUS_FAILED,             /* Transaction Collision */
 215         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 216         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 217         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 218         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 219         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 220         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 221         MGMT_STATUS_FAILED,             /* Slot Violation */
 222         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 223         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 225         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 226         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 227         MGMT_STATUS_BUSY,               /* Controller Busy */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 229         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 230         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 231         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 232         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 233 };
 234
 235 static u8 mgmt_status(u8 hci_status)
 236 {
 237         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 238                 return mgmt_status_table[hci_status];
 239
 240         return MGMT_STATUS_FAILED;
 241 }
 242
 243 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 244                             u16 len, int flag)
 245 {
 246         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 247                                flag, NULL);
 248 }
 249
 250 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 251                               u16 len, int flag, struct sock *skip_sk)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, skip_sk);
 255 }
 256
 257 static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                HCI_MGMT_GENERIC_EVENTS, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 280                         u16 data_len)
 281 {
 282         struct mgmt_rp_read_version rp;
 283
 284         BT_DBG("sock %p", sk);
 285
 286         rp.version = MGMT_VERSION;
 287         rp.revision = cpu_to_le16(MGMT_REVISION);
 288
 289         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 290                                  &rp, sizeof(rp));
 291 }
 292
 293 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 294                          u16 data_len)
 295 {
 296         struct mgmt_rp_read_commands *rp;
 297         u16 num_commands, num_events;
 298         size_t rp_size;
 299         int i, err;
 300
 301         BT_DBG("sock %p", sk);
 302
 303         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 304                 num_commands = ARRAY_SIZE(mgmt_commands);
 305                 num_events = ARRAY_SIZE(mgmt_events);
 306         } else {
 307                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 308                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 309         }
 310
 311         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 312
 313         rp = kmalloc(rp_size, GFP_KERNEL);
 314         if (!rp)
 315                 return -ENOMEM;
 316
 317         rp->num_commands = cpu_to_le16(num_commands);
 318         rp->num_events = cpu_to_le16(num_events);
 319
 320         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 321                 __le16 *opcode = rp->opcodes;
 322
 323                 for (i = 0; i < num_commands; i++, opcode++)
 324                         put_unaligned_le16(mgmt_commands[i], opcode);
 325
 326                 for (i = 0; i < num_events; i++, opcode++)
 327                         put_unaligned_le16(mgmt_events[i], opcode);
 328         } else {
 329                 __le16 *opcode = rp->opcodes;
 330
 331                 for (i = 0; i < num_commands; i++, opcode++)
 332                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 333
 334                 for (i = 0; i < num_events; i++, opcode++)
 335                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 336         }
 337
 338         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 339                                 rp, rp_size);
 340         kfree(rp);
 341
 342         return err;
 343 }
 344
 345 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 346                            u16 data_len)
 347 {
 348         struct mgmt_rp_read_index_list *rp;
 349         struct hci_dev *d;
 350         size_t rp_len;
 351         u16 count;
 352         int err;
 353
 354         BT_DBG("sock %p", sk);
 355
 356         read_lock(&hci_dev_list_lock);
 357
 358         count = 0;
 359         list_for_each_entry(d, &hci_dev_list, list) {
 360                 if (d->dev_type == HCI_BREDR &&
 361                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 362                         count++;
 363         }
 364
 365         rp_len = sizeof(*rp) + (2 * count);
 366         rp = kmalloc(rp_len, GFP_ATOMIC);
 367         if (!rp) {
 368                 read_unlock(&hci_dev_list_lock);
 369                 return -ENOMEM;
 370         }
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 375                     hci_dev_test_flag(d, HCI_CONFIG) ||
 376                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 377                         continue;
 378
 379                 /* Devices marked as raw-only are neither configured
 380                  * nor unconfigured controllers.
 381                  */
 382                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 383                         continue;
 384
 385                 if (d->dev_type == HCI_BREDR &&
 386                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 387                         rp->index[count++] = cpu_to_le16(d->id);
 388                         BT_DBG("Added hci%u", d->id);
 389                 }
 390         }
 391
 392         rp->num_controllers = cpu_to_le16(count);
 393         rp_len = sizeof(*rp) + (2 * count);
 394
 395         read_unlock(&hci_dev_list_lock);
 396
 397         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 398                                 0, rp, rp_len);
 399
 400         kfree(rp);
 401
 402         return err;
 403 }
 404
 405 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 406                                   void *data, u16 data_len)
 407 {
 408         struct mgmt_rp_read_unconf_index_list *rp;
 409         struct hci_dev *d;
 410         size_t rp_len;
 411         u16 count;
 412         int err;
 413
 414         BT_DBG("sock %p", sk);
 415
 416         read_lock(&hci_dev_list_lock);
 417
 418         count = 0;
 419         list_for_each_entry(d, &hci_dev_list, list) {
 420                 if (d->dev_type == HCI_BREDR &&
 421                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 422                         count++;
 423         }
 424
 425         rp_len = sizeof(*rp) + (2 * count);
 426         rp = kmalloc(rp_len, GFP_ATOMIC);
 427         if (!rp) {
 428                 read_unlock(&hci_dev_list_lock);
 429                 return -ENOMEM;
 430         }
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 435                     hci_dev_test_flag(d, HCI_CONFIG) ||
 436                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 437                         continue;
 438
 439                 /* Devices marked as raw-only are neither configured
 440                  * nor unconfigured controllers.
 441                  */
 442                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 443                         continue;
 444
 445                 if (d->dev_type == HCI_BREDR &&
 446                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 447                         rp->index[count++] = cpu_to_le16(d->id);
 448                         BT_DBG("Added hci%u", d->id);
 449                 }
 450         }
 451
 452         rp->num_controllers = cpu_to_le16(count);
 453         rp_len = sizeof(*rp) + (2 * count);
 454
 455         read_unlock(&hci_dev_list_lock);
 456
 457         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 458                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 459
 460         kfree(rp);
 461
 462         return err;
 463 }
 464
 465 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 466                                void *data, u16 data_len)
 467 {
 468         struct mgmt_rp_read_ext_index_list *rp;
 469         struct hci_dev *d;
 470         size_t rp_len;
 471         u16 count;
 472         int err;
 473
 474         BT_DBG("sock %p", sk);
 475
 476         read_lock(&hci_dev_list_lock);
 477
 478         count = 0;
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
 481                         count++;
 482         }
 483
 484         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 485         rp = kmalloc(rp_len, GFP_ATOMIC);
 486         if (!rp) {
 487                 read_unlock(&hci_dev_list_lock);
 488                 return -ENOMEM;
 489         }
 490
 491         count = 0;
 492         list_for_each_entry(d, &hci_dev_list, list) {
 493                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 494                     hci_dev_test_flag(d, HCI_CONFIG) ||
 495                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 496                         continue;
 497
 498                 /* Devices marked as raw-only are neither configured
 499                  * nor unconfigured controllers.
 500                  */
 501                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 502                         continue;
 503
 504                 if (d->dev_type == HCI_BREDR) {
 505                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 506                                 rp->entry[count].type = 0x01;
 507                         else
 508                                 rp->entry[count].type = 0x00;
 509                 } else if (d->dev_type == HCI_AMP) {
 510                         rp->entry[count].type = 0x02;
 511                 } else {
 512                         continue;
 513                 }
 514
 515                 rp->entry[count].bus = d->bus;
 516                 rp->entry[count++].index = cpu_to_le16(d->id);
 517                 BT_DBG("Added hci%u", d->id);
 518         }
 519
 520         rp->num_controllers = cpu_to_le16(count);
 521         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 522
 523         read_unlock(&hci_dev_list_lock);
 524
 525         /* If this command is called at least once, then all the
 526          * default index and unconfigured index events are disabled
 527          * and from now on only extended index events are used.
 528          */
 529         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 530         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 531         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 532
 533         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 534                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 535
 536         kfree(rp);
 537
 538         return err;
 539 }
 540
 541 static bool is_configured(struct hci_dev *hdev)
 542 {
 543         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 544             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 545                 return false;
 546
 547         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 548             !bacmp(&hdev->public_addr, BDADDR_ANY))
 549                 return false;
 550
 551         return true;
 552 }
 553
 554 static __le32 get_missing_options(struct hci_dev *hdev)
 555 {
 556         u32 options = 0;
 557
 558         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 559             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 560                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 561
 562         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 563             !bacmp(&hdev->public_addr, BDADDR_ANY))
 564                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 565
 566         return cpu_to_le32(options);
 567 }
 568
 569 static int new_options(struct hci_dev *hdev, struct sock *skip)
 570 {
 571         __le32 options = get_missing_options(hdev);
 572
 573         return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 574                                   sizeof(options), skip);
 575 }
 576
 577 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 578 {
 579         __le32 options = get_missing_options(hdev);
 580
 581         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 582                                  sizeof(options));
 583 }
 584
 585 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 586                             void *data, u16 data_len)
 587 {
 588         struct mgmt_rp_read_config_info rp;
 589         u32 options = 0;
 590
 591         BT_DBG("sock %p %s", sk, hdev->name);
 592
 593         hci_dev_lock(hdev);
 594
 595         memset(&rp, 0, sizeof(rp));
 596         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 597
 598         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 599                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 600
 601         if (hdev->set_bdaddr)
 602                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 603
 604         rp.supported_options = cpu_to_le32(options);
 605         rp.missing_options = get_missing_options(hdev);
 606
 607         hci_dev_unlock(hdev);
 608
 609         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 610                                  &rp, sizeof(rp));
 611 }
 612
 613 static u32 get_supported_settings(struct hci_dev *hdev)
 614 {
 615         u32 settings = 0;
 616
 617         settings |= MGMT_SETTING_POWERED;
 618         settings |= MGMT_SETTING_BONDABLE;
 619         settings |= MGMT_SETTING_DEBUG_KEYS;
 620         settings |= MGMT_SETTING_CONNECTABLE;
 621         settings |= MGMT_SETTING_DISCOVERABLE;
 622
 623         if (lmp_bredr_capable(hdev)) {
 624                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 625                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 626                 settings |= MGMT_SETTING_BREDR;
 627                 settings |= MGMT_SETTING_LINK_SECURITY;
 628
 629                 if (lmp_ssp_capable(hdev)) {
 630                         settings |= MGMT_SETTING_SSP;
 631                         settings |= MGMT_SETTING_HS;
 632                 }
 633
 634                 if (lmp_sc_capable(hdev))
 635                         settings |= MGMT_SETTING_SECURE_CONN;
 636         }
 637
 638         if (lmp_le_capable(hdev)) {
 639                 settings |= MGMT_SETTING_LE;
 640                 settings |= MGMT_SETTING_ADVERTISING;
 641                 settings |= MGMT_SETTING_SECURE_CONN;
 642                 settings |= MGMT_SETTING_PRIVACY;
 643                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 644         }
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 647             hdev->set_bdaddr)
 648                 settings |= MGMT_SETTING_CONFIGURATION;
 649
 650         return settings;
 651 }
 652
 653 static u32 get_current_settings(struct hci_dev *hdev)
 654 {
 655         u32 settings = 0;
 656
 657         if (hdev_is_powered(hdev))
 658                 settings |= MGMT_SETTING_POWERED;
 659
 660         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 661                 settings |= MGMT_SETTING_CONNECTABLE;
 662
 663         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 664                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 665
 666         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 667                 settings |= MGMT_SETTING_DISCOVERABLE;
 668
 669         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 670                 settings |= MGMT_SETTING_BONDABLE;
 671
 672         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 673                 settings |= MGMT_SETTING_BREDR;
 674
 675         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 676                 settings |= MGMT_SETTING_LE;
 677
 678         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 679                 settings |= MGMT_SETTING_LINK_SECURITY;
 680
 681         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 682                 settings |= MGMT_SETTING_SSP;
 683
 684         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 685                 settings |= MGMT_SETTING_HS;
 686
 687         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 688                 settings |= MGMT_SETTING_ADVERTISING;
 689
 690         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 691                 settings |= MGMT_SETTING_SECURE_CONN;
 692
 693         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 694                 settings |= MGMT_SETTING_DEBUG_KEYS;
 695
 696         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 697                 settings |= MGMT_SETTING_PRIVACY;
 698
 699         /* The current setting for static address has two purposes. The
 700          * first is to indicate if the static address will be used and
 701          * the second is to indicate if it is actually set.
 702          *
 703          * This means if the static address is not configured, this flag
 704          * will never be set. If the address is configured, then if the
 705          * address is actually used decides if the flag is set or not.
 706          *
 707          * For single mode LE only controllers and dual-mode controllers
 708          * with BR/EDR disabled, the existence of the static address will
 709          * be evaluated.
 710          */
 711         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 712             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 713             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 714                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 715                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 716         }
 717
 718         return settings;
 719 }
 720
 721 #define PNP_INFO_SVCLASS_ID             0x1200
 722
 723 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 724 {
 725         u8 *ptr = data, *uuids_start = NULL;
 726         struct bt_uuid *uuid;
 727
 728         if (len < 4)
 729                 return ptr;
 730
 731         list_for_each_entry(uuid, &hdev->uuids, list) {
 732                 u16 uuid16;
 733
 734                 if (uuid->size != 16)
 735                         continue;
 736
 737                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 738                 if (uuid16 < 0x1100)
 739                         continue;
 740
 741                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 742                         continue;
 743
 744                 if (!uuids_start) {
 745                         uuids_start = ptr;
 746                         uuids_start[0] = 1;
 747                         uuids_start[1] = EIR_UUID16_ALL;
 748                         ptr += 2;
 749                 }
 750
 751                 /* Stop if not enough space to put next UUID */
 752                 if ((ptr - data) + sizeof(u16) > len) {
 753                         uuids_start[1] = EIR_UUID16_SOME;
 754                         break;
 755                 }
 756
 757                 *ptr++ = (uuid16 & 0x00ff);
 758                 *ptr++ = (uuid16 & 0xff00) >> 8;
 759                 uuids_start[0] += sizeof(uuid16);
 760         }
 761
 762         return ptr;
 763 }
 764
 765 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 766 {
 767         u8 *ptr = data, *uuids_start = NULL;
 768         struct bt_uuid *uuid;
 769
 770         if (len < 6)
 771                 return ptr;
 772
 773         list_for_each_entry(uuid, &hdev->uuids, list) {
 774                 if (uuid->size != 32)
 775                         continue;
 776
 777                 if (!uuids_start) {
 778                         uuids_start = ptr;
 779                         uuids_start[0] = 1;
 780                         uuids_start[1] = EIR_UUID32_ALL;
 781                         ptr += 2;
 782                 }
 783
 784                 /* Stop if not enough space to put next UUID */
 785                 if ((ptr - data) + sizeof(u32) > len) {
 786                         uuids_start[1] = EIR_UUID32_SOME;
 787                         break;
 788                 }
 789
 790                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 791                 ptr += sizeof(u32);
 792                 uuids_start[0] += sizeof(u32);
 793         }
 794
 795         return ptr;
 796 }
 797
 798 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 799 {
 800         u8 *ptr = data, *uuids_start = NULL;
 801         struct bt_uuid *uuid;
 802
 803         if (len < 18)
 804                 return ptr;
 805
 806         list_for_each_entry(uuid, &hdev->uuids, list) {
 807                 if (uuid->size != 128)
 808                         continue;
 809
 810                 if (!uuids_start) {
 811                         uuids_start = ptr;
 812                         uuids_start[0] = 1;
 813                         uuids_start[1] = EIR_UUID128_ALL;
 814                         ptr += 2;
 815                 }
 816
 817                 /* Stop if not enough space to put next UUID */
 818                 if ((ptr - data) + 16 > len) {
 819                         uuids_start[1] = EIR_UUID128_SOME;
 820                         break;
 821                 }
 822
 823                 memcpy(ptr, uuid->uuid, 16);
 824                 ptr += 16;
 825                 uuids_start[0] += 16;
 826         }
 827
 828         return ptr;
 829 }
 830
 831 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 832 {
 833         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 834 }
 835
 836 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 837                                                   struct hci_dev *hdev,
 838                                                   const void *data)
 839 {
 840         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 841 }
 842
 843 static u8 get_current_adv_instance(struct hci_dev *hdev)
 844 {
 845         /* The "Set Advertising" setting supersedes the "Add Advertising"
 846          * setting. Here we set the advertising data based on which
 847          * setting was set. When neither apply, default to the global settings,
 848          * represented by instance "0".
 849          */
 850         if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
 851             !hci_dev_test_flag(hdev, HCI_ADVERTISING))
 852                 return hdev->cur_adv_instance;
 853
 854         return 0x00;
 855 }
 856
 857 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 858 {
 859         u8 ad_len = 0;
 860         size_t name_len;
 861
 862         name_len = strlen(hdev->dev_name);
 863         if (name_len > 0) {
 864                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 865
 866                 if (name_len > max_len) {
 867                         name_len = max_len;
 868                         ptr[1] = EIR_NAME_SHORT;
 869                 } else
 870                         ptr[1] = EIR_NAME_COMPLETE;
 871
 872                 ptr[0] = name_len + 1;
 873
 874                 memcpy(ptr + 2, hdev->dev_name, name_len);
 875
 876                 ad_len += (name_len + 2);
 877                 ptr += (name_len + 2);
 878         }
 879
 880         return ad_len;
 881 }
 882
 883 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
 884                                         u8 *ptr)
 885 {
 886         struct adv_info *adv_instance;
 887
 888         adv_instance = hci_find_adv_instance(hdev, instance);
 889         if (!adv_instance)
 890                 return 0;
 891
 892         /* TODO: Set the appropriate entries based on advertising instance flags
 893          * here once flags other than 0 are supported.
 894          */
 895         memcpy(ptr, adv_instance->scan_rsp_data,
 896                adv_instance->scan_rsp_len);
 897
 898         return adv_instance->scan_rsp_len;
 899 }
 900
 901 static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
 902 {
 903         struct hci_dev *hdev = req->hdev;
 904         struct hci_cp_le_set_scan_rsp_data cp;
 905         u8 len;
 906
 907         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 908                 return;
 909
 910         memset(&cp, 0, sizeof(cp));
 911
 912         if (instance)
 913                 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
 914         else
 915                 len = create_default_scan_rsp_data(hdev, cp.data);
 916
 917         if (hdev->scan_rsp_data_len == len &&
 918             !memcmp(cp.data, hdev->scan_rsp_data, len))
 919                 return;
 920
 921         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 922         hdev->scan_rsp_data_len = len;
 923
 924         cp.length = len;
 925
 926         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 927 }
 928
 929 static void update_scan_rsp_data(struct hci_request *req)
 930 {
 931         update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
 932 }
 933
 934 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 935 {
 936         struct mgmt_pending_cmd *cmd;
 937
 938         /* If there's a pending mgmt command the flags will not yet have
 939          * their final values, so check for this first.
 940          */
 941         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 942         if (cmd) {
 943                 struct mgmt_mode *cp = cmd->param;
 944                 if (cp->val == 0x01)
 945                         return LE_AD_GENERAL;
 946                 else if (cp->val == 0x02)
 947                         return LE_AD_LIMITED;
 948         } else {
 949                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 950                         return LE_AD_LIMITED;
 951                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 952                         return LE_AD_GENERAL;
 953         }
 954
 955         return 0;
 956 }
 957
 958 static bool get_connectable(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flag will not yet have
 963          * it's final value, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968
 969                 return cp->val;
 970         }
 971
 972         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 973 }
 974
 975 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
 976 {
 977         u32 flags;
 978         struct adv_info *adv_instance;
 979
 980         if (instance == 0x00) {
 981                 /* Instance 0 always manages the "Tx Power" and "Flags"
 982                  * fields
 983                  */
 984                 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
 985
 986                 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
 987                  * corresponds to the "connectable" instance flag.
 988                  */
 989                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
 990                         flags |= MGMT_ADV_FLAG_CONNECTABLE;
 991
 992                 return flags;
 993         }
 994
 995         adv_instance = hci_find_adv_instance(hdev, instance);
 996
 997         /* Return 0 when we got an invalid instance identifier. */
 998         if (!adv_instance)
 999                 return 0;
1000
1001         return adv_instance->flags;
1002 }
1003
1004 static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
1005 {
1006         u8 instance = get_current_adv_instance(hdev);
1007         struct adv_info *adv_instance;
1008
1009         /* Ignore instance 0 */
1010         if (instance == 0x00)
1011                 return 0;
1012
1013         adv_instance = hci_find_adv_instance(hdev, instance);
1014         if (!adv_instance)
1015                 return 0;
1016
1017         /* TODO: Take into account the "appearance" and "local-name" flags here.
1018          * These are currently being ignored as they are not supported.
1019          */
1020         return adv_instance->scan_rsp_len;
1021 }
1022
1023 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1024 {
1025         struct adv_info *adv_instance = NULL;
1026         u8 ad_len = 0, flags = 0;
1027         u32 instance_flags;
1028
1029         /* Return 0 when the current instance identifier is invalid. */
1030         if (instance) {
1031                 adv_instance = hci_find_adv_instance(hdev, instance);
1032                 if (!adv_instance)
1033                         return 0;
1034         }
1035
1036         instance_flags = get_adv_instance_flags(hdev, instance);
1037
1038         /* The Add Advertising command allows userspace to set both the general
1039          * and limited discoverable flags.
1040          */
1041         if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1042                 flags |= LE_AD_GENERAL;
1043
1044         if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1045                 flags |= LE_AD_LIMITED;
1046
1047         if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1048                 /* If a discovery flag wasn't provided, simply use the global
1049                  * settings.
1050                  */
1051                 if (!flags)
1052                         flags |= get_adv_discov_flags(hdev);
1053
1054                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                         flags |= LE_AD_NO_BREDR;
1056
1057                 /* If flags would still be empty, then there is no need to
1058                  * include the "Flags" AD field".
1059                  */
1060                 if (flags) {
1061                         ptr[0] = 0x02;
1062                         ptr[1] = EIR_FLAGS;
1063                         ptr[2] = flags;
1064
1065                         ad_len += 3;
1066                         ptr += 3;
1067                 }
1068         }
1069
1070         if (adv_instance) {
1071                 memcpy(ptr, adv_instance->adv_data,
1072                        adv_instance->adv_data_len);
1073                 ad_len += adv_instance->adv_data_len;
1074                 ptr += adv_instance->adv_data_len;
1075         }
1076
1077         /* Provide Tx Power only if we can provide a valid value for it */
1078         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1079             (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1080                 ptr[0] = 0x02;
1081                 ptr[1] = EIR_TX_POWER;
1082                 ptr[2] = (u8)hdev->adv_tx_power;
1083
1084                 ad_len += 3;
1085                 ptr += 3;
1086         }
1087
1088         return ad_len;
1089 }
1090
1091 static void update_inst_adv_data(struct hci_request *req, u8 instance)
1092 {
1093         struct hci_dev *hdev = req->hdev;
1094         struct hci_cp_le_set_adv_data cp;
1095         u8 len;
1096
1097         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1098                 return;
1099
1100         memset(&cp, 0, sizeof(cp));
1101
1102         len = create_instance_adv_data(hdev, instance, cp.data);
1103
1104         /* There's nothing to do if the data hasn't changed */
1105         if (hdev->adv_data_len == len &&
1106             memcmp(cp.data, hdev->adv_data, len) == 0)
1107                 return;
1108
1109         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1110         hdev->adv_data_len = len;
1111
1112         cp.length = len;
1113
1114         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1115 }
1116
1117 static void update_adv_data(struct hci_request *req)
1118 {
1119         update_inst_adv_data(req, get_current_adv_instance(req->hdev));
1120 }
1121
1122 int mgmt_update_adv_data(struct hci_dev *hdev)
1123 {
1124         struct hci_request req;
1125
1126         hci_req_init(&req, hdev);
1127         update_adv_data(&req);
1128
1129         return hci_req_run(&req, NULL);
1130 }
1131
1132 static void create_eir(struct hci_dev *hdev, u8 *data)
1133 {
1134         u8 *ptr = data;
1135         size_t name_len;
1136
1137         name_len = strlen(hdev->dev_name);
1138
1139         if (name_len > 0) {
1140                 /* EIR Data type */
1141                 if (name_len > 48) {
1142                         name_len = 48;
1143                         ptr[1] = EIR_NAME_SHORT;
1144                 } else
1145                         ptr[1] = EIR_NAME_COMPLETE;
1146
1147                 /* EIR Data length */
1148                 ptr[0] = name_len + 1;
1149
1150                 memcpy(ptr + 2, hdev->dev_name, name_len);
1151
1152                 ptr += (name_len + 2);
1153         }
1154
1155         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1156                 ptr[0] = 2;
1157                 ptr[1] = EIR_TX_POWER;
1158                 ptr[2] = (u8) hdev->inq_tx_power;
1159
1160                 ptr += 3;
1161         }
1162
1163         if (hdev->devid_source > 0) {
1164                 ptr[0] = 9;
1165                 ptr[1] = EIR_DEVICE_ID;
1166
1167                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1168                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1169                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1170                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1171
1172                 ptr += 10;
1173         }
1174
1175         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1176         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1177         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1178 }
1179
1180 static void update_eir(struct hci_request *req)
1181 {
1182         struct hci_dev *hdev = req->hdev;
1183         struct hci_cp_write_eir cp;
1184
1185         if (!hdev_is_powered(hdev))
1186                 return;
1187
1188         if (!lmp_ext_inq_capable(hdev))
1189                 return;
1190
1191         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1192                 return;
1193
1194         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1195                 return;
1196
1197         memset(&cp, 0, sizeof(cp));
1198
1199         create_eir(hdev, cp.data);
1200
1201         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1202                 return;
1203
1204         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1205
1206         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1207 }
1208
1209 static u8 get_service_classes(struct hci_dev *hdev)
1210 {
1211         struct bt_uuid *uuid;
1212         u8 val = 0;
1213
1214         list_for_each_entry(uuid, &hdev->uuids, list)
1215                 val |= uuid->svc_hint;
1216
1217         return val;
1218 }
1219
1220 static void update_class(struct hci_request *req)
1221 {
1222         struct hci_dev *hdev = req->hdev;
1223         u8 cod[3];
1224
1225         BT_DBG("%s", hdev->name);
1226
1227         if (!hdev_is_powered(hdev))
1228                 return;
1229
1230         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1231                 return;
1232
1233         if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1234                 return;
1235
1236         cod[0] = hdev->minor_class;
1237         cod[1] = hdev->major_class;
1238         cod[2] = get_service_classes(hdev);
1239
1240         if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1241                 cod[1] |= 0x20;
1242
1243         if (memcmp(cod, hdev->dev_class, 3) == 0)
1244                 return;
1245
1246         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1247 }
1248
1249 static void disable_advertising(struct hci_request *req)
1250 {
1251         u8 enable = 0x00;
1252
1253         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1254 }
1255
1256 static void enable_advertising(struct hci_request *req)
1257 {
1258         struct hci_dev *hdev = req->hdev;
1259         struct hci_cp_le_set_adv_param cp;
1260         u8 own_addr_type, enable = 0x01;
1261         bool connectable;
1262         u8 instance;
1263         u32 flags;
1264
1265         if (hci_conn_num(hdev, LE_LINK) > 0)
1266                 return;
1267
1268         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1269                 disable_advertising(req);
1270
1271         /* Clear the HCI_LE_ADV bit temporarily so that the
1272          * hci_update_random_address knows that it's safe to go ahead
1273          * and write a new random address. The flag will be set back on
1274          * as soon as the SET_ADV_ENABLE HCI command completes.
1275          */
1276         hci_dev_clear_flag(hdev, HCI_LE_ADV);
1277
1278         instance = get_current_adv_instance(hdev);
1279         flags = get_adv_instance_flags(hdev, instance);
1280
1281         /* If the "connectable" instance flag was not set, then choose between
1282          * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1283          */
1284         connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1285                       get_connectable(hdev);
1286
1287         /* Set require_privacy to true only when non-connectable
1288          * advertising is used. In that case it is fine to use a
1289          * non-resolvable private address.
1290          */
1291         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1292                 return;
1293
1294         memset(&cp, 0, sizeof(cp));
1295         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1296         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1297
1298         if (connectable)
1299                 cp.type = LE_ADV_IND;
1300         else if (get_cur_adv_instance_scan_rsp_len(hdev))
1301                 cp.type = LE_ADV_SCAN_IND;
1302         else
1303                 cp.type = LE_ADV_NONCONN_IND;
1304
1305         cp.own_address_type = own_addr_type;
1306         cp.channel_map = hdev->le_adv_channel_map;
1307
1308         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1309
1310         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1311 }
1312
1313 static void service_cache_off(struct work_struct *work)
1314 {
1315         struct hci_dev *hdev = container_of(work, struct hci_dev,
1316                                             service_cache.work);
1317         struct hci_request req;
1318
1319         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1320                 return;
1321
1322         hci_req_init(&req, hdev);
1323
1324         hci_dev_lock(hdev);
1325
1326         update_eir(&req);
1327         update_class(&req);
1328
1329         hci_dev_unlock(hdev);
1330
1331         hci_req_run(&req, NULL);
1332 }
1333
1334 static void rpa_expired(struct work_struct *work)
1335 {
1336         struct hci_dev *hdev = container_of(work, struct hci_dev,
1337                                             rpa_expired.work);
1338         struct hci_request req;
1339
1340         BT_DBG("");
1341
1342         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1343
1344         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1345                 return;
1346
1347         /* The generation of a new RPA and programming it into the
1348          * controller happens in the enable_advertising() function.
1349          */
1350         hci_req_init(&req, hdev);
1351         enable_advertising(&req);
1352         hci_req_run(&req, NULL);
1353 }
1354
1355 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1356 {
1357         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1358                 return;
1359
1360         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1361         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1362
1363         /* Non-mgmt controlled devices get this bit set
1364          * implicitly so that pairing works for them, however
1365          * for mgmt we require user-space to explicitly enable
1366          * it
1367          */
1368         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1369 }
1370
1371 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1372                                 void *data, u16 data_len)
1373 {
1374         struct mgmt_rp_read_info rp;
1375
1376         BT_DBG("sock %p %s", sk, hdev->name);
1377
1378         hci_dev_lock(hdev);
1379
1380         memset(&rp, 0, sizeof(rp));
1381
1382         bacpy(&rp.bdaddr, &hdev->bdaddr);
1383
1384         rp.version = hdev->hci_ver;
1385         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1386
1387         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1388         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1389
1390         memcpy(rp.dev_class, hdev->dev_class, 3);
1391
1392         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1393         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1394
1395         hci_dev_unlock(hdev);
1396
1397         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1398                                  sizeof(rp));
1399 }
1400
1401 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1402 {
1403         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1404
1405         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1406                                  sizeof(settings));
1407 }
1408
1409 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1410 {
1411         BT_DBG("%s status 0x%02x", hdev->name, status);
1412
1413         if (hci_conn_count(hdev) == 0) {
1414                 cancel_delayed_work(&hdev->power_off);
1415                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1416         }
1417 }
1418
1419 static bool hci_stop_discovery(struct hci_request *req)
1420 {
1421         struct hci_dev *hdev = req->hdev;
1422         struct hci_cp_remote_name_req_cancel cp;
1423         struct inquiry_entry *e;
1424
1425         switch (hdev->discovery.state) {
1426         case DISCOVERY_FINDING:
1427                 if (test_bit(HCI_INQUIRY, &hdev->flags))
1428                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1429
1430                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1431                         cancel_delayed_work(&hdev->le_scan_disable);
1432                         hci_req_add_le_scan_disable(req);
1433                 }
1434
1435                 return true;
1436
1437         case DISCOVERY_RESOLVING:
1438                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1439                                                      NAME_PENDING);
1440                 if (!e)
1441                         break;
1442
1443                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1444                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1445                             &cp);
1446
1447                 return true;
1448
1449         default:
1450                 /* Passive scanning */
1451                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1452                         hci_req_add_le_scan_disable(req);
1453                         return true;
1454                 }
1455
1456                 break;
1457         }
1458
1459         return false;
1460 }
1461
1462 static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1463                               u8 instance)
1464 {
1465         struct mgmt_ev_advertising_added ev;
1466
1467         ev.instance = instance;
1468
1469         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1470 }
1471
1472 static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1473                                 u8 instance)
1474 {
1475         struct mgmt_ev_advertising_removed ev;
1476
1477         ev.instance = instance;
1478
1479         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1480 }
1481
1482 static int schedule_adv_instance(struct hci_request *req, u8 instance,
1483                                  bool force) {
1484         struct hci_dev *hdev = req->hdev;
1485         struct adv_info *adv_instance = NULL;
1486         u16 timeout;
1487
1488         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1489             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1490                 return -EPERM;
1491
1492         if (hdev->adv_instance_timeout)
1493                 return -EBUSY;
1494
1495         adv_instance = hci_find_adv_instance(hdev, instance);
1496         if (!adv_instance)
1497                 return -ENOENT;
1498
1499         /* A zero timeout means unlimited advertising. As long as there is
1500          * only one instance, duration should be ignored. We still set a timeout
1501          * in case further instances are being added later on.
1502          *
1503          * If the remaining lifetime of the instance is more than the duration
1504          * then the timeout corresponds to the duration, otherwise it will be
1505          * reduced to the remaining instance lifetime.
1506          */
1507         if (adv_instance->timeout == 0 ||
1508             adv_instance->duration <= adv_instance->remaining_time)
1509                 timeout = adv_instance->duration;
1510         else
1511                 timeout = adv_instance->remaining_time;
1512
1513         /* The remaining time is being reduced unless the instance is being
1514          * advertised without time limit.
1515          */
1516         if (adv_instance->timeout)
1517                 adv_instance->remaining_time =
1518                                 adv_instance->remaining_time - timeout;
1519
1520         hdev->adv_instance_timeout = timeout;
1521         queue_delayed_work(hdev->workqueue,
1522                            &hdev->adv_instance_expire,
1523                            msecs_to_jiffies(timeout * 1000));
1524
1525         /* If we're just re-scheduling the same instance again then do not
1526          * execute any HCI commands. This happens when a single instance is
1527          * being advertised.
1528          */
1529         if (!force && hdev->cur_adv_instance == instance &&
1530             hci_dev_test_flag(hdev, HCI_LE_ADV))
1531                 return 0;
1532
1533         hdev->cur_adv_instance = instance;
1534         update_adv_data(req);
1535         update_scan_rsp_data(req);
1536         enable_advertising(req);
1537
1538         return 0;
1539 }
1540
1541 static void cancel_adv_timeout(struct hci_dev *hdev)
1542 {
1543         if (hdev->adv_instance_timeout) {
1544                 hdev->adv_instance_timeout = 0;
1545                 cancel_delayed_work(&hdev->adv_instance_expire);
1546         }
1547 }
1548
1549 /* For a single instance:
1550  * - force == true: The instance will be removed even when its remaining
1551  *   lifetime is not zero.
1552  * - force == false: the instance will be deactivated but kept stored unless
1553  *   the remaining lifetime is zero.
1554  *
1555  * For instance == 0x00:
1556  * - force == true: All instances will be removed regardless of their timeout
1557  *   setting.
1558  * - force == false: Only instances that have a timeout will be removed.
1559  */
1560 static void clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1561                                u8 instance, bool force)
1562 {
1563         struct adv_info *adv_instance, *n, *next_instance = NULL;
1564         int err;
1565         u8 rem_inst;
1566
1567         /* Cancel any timeout concerning the removed instance(s). */
1568         if (!instance || hdev->cur_adv_instance == instance)
1569                 cancel_adv_timeout(hdev);
1570
1571         /* Get the next instance to advertise BEFORE we remove
1572          * the current one. This can be the same instance again
1573          * if there is only one instance.
1574          */
1575         if (instance && hdev->cur_adv_instance == instance)
1576                 next_instance = hci_get_next_instance(hdev, instance);
1577
1578         if (instance == 0x00) {
1579                 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1580                                          list) {
1581                         if (!(force || adv_instance->timeout))
1582                                 continue;
1583
1584                         rem_inst = adv_instance->instance;
1585                         err = hci_remove_adv_instance(hdev, rem_inst);
1586                         if (!err)
1587                                 advertising_removed(NULL, hdev, rem_inst);
1588                 }
1589                 hdev->cur_adv_instance = 0x00;
1590         } else {
1591                 adv_instance = hci_find_adv_instance(hdev, instance);
1592
1593                 if (force || (adv_instance && adv_instance->timeout &&
1594                               !adv_instance->remaining_time)) {
1595                         /* Don't advertise a removed instance. */
1596                         if (next_instance &&
1597                             next_instance->instance == instance)
1598                                 next_instance = NULL;
1599
1600                         err = hci_remove_adv_instance(hdev, instance);
1601                         if (!err)
1602                                 advertising_removed(NULL, hdev, instance);
1603                 }
1604         }
1605
1606         if (list_empty(&hdev->adv_instances)) {
1607                 hdev->cur_adv_instance = 0x00;
1608                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1609         }
1610
1611         if (!req || !hdev_is_powered(hdev) ||
1612             hci_dev_test_flag(hdev, HCI_ADVERTISING))
1613                 return;
1614
1615         if (next_instance)
1616                 schedule_adv_instance(req, next_instance->instance, false);
1617 }
1618
1619 static int clean_up_hci_state(struct hci_dev *hdev)
1620 {
1621         struct hci_request req;
1622         struct hci_conn *conn;
1623         bool discov_stopped;
1624         int err;
1625
1626         hci_req_init(&req, hdev);
1627
1628         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1629             test_bit(HCI_PSCAN, &hdev->flags)) {
1630                 u8 scan = 0x00;
1631                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1632         }
1633
1634         clear_adv_instance(hdev, NULL, 0x00, false);
1635
1636         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1637                 disable_advertising(&req);
1638
1639         discov_stopped = hci_stop_discovery(&req);
1640
1641         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1642                 /* 0x15 == Terminated due to Power Off */
1643                 __hci_abort_conn(&req, conn, 0x15);
1644         }
1645
1646         err = hci_req_run(&req, clean_up_hci_complete);
1647         if (!err && discov_stopped)
1648                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1649
1650         return err;
1651 }
1652
1653 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1654                        u16 len)
1655 {
1656         struct mgmt_mode *cp = data;
1657         struct mgmt_pending_cmd *cmd;
1658         int err;
1659
1660         BT_DBG("request for %s", hdev->name);
1661
1662         if (cp->val != 0x00 && cp->val != 0x01)
1663                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1664                                        MGMT_STATUS_INVALID_PARAMS);
1665
1666         hci_dev_lock(hdev);
1667
1668         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1669                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1670                                       MGMT_STATUS_BUSY);
1671                 goto failed;
1672         }
1673
1674         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1675                 cancel_delayed_work(&hdev->power_off);
1676
1677                 if (cp->val) {
1678                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1679                                          data, len);
1680                         err = mgmt_powered(hdev, 1);
1681                         goto failed;
1682                 }
1683         }
1684
1685         if (!!cp->val == hdev_is_powered(hdev)) {
1686                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1687                 goto failed;
1688         }
1689
1690         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1691         if (!cmd) {
1692                 err = -ENOMEM;
1693                 goto failed;
1694         }
1695
1696         if (cp->val) {
1697                 queue_work(hdev->req_workqueue, &hdev->power_on);
1698                 err = 0;
1699         } else {
1700                 /* Disconnect connections, stop scans, etc */
1701                 err = clean_up_hci_state(hdev);
1702                 if (!err)
1703                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1704                                            HCI_POWER_OFF_TIMEOUT);
1705
1706                 /* ENODATA means there were no HCI commands queued */
1707                 if (err == -ENODATA) {
1708                         cancel_delayed_work(&hdev->power_off);
1709                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1710                         err = 0;
1711                 }
1712         }
1713
1714 failed:
1715         hci_dev_unlock(hdev);
1716         return err;
1717 }
1718
1719 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1720 {
1721         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1722
1723         return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1724                                   sizeof(ev), skip);
1725 }
1726
1727 int mgmt_new_settings(struct hci_dev *hdev)
1728 {
1729         return new_settings(hdev, NULL);
1730 }
1731
1732 struct cmd_lookup {
1733         struct sock *sk;
1734         struct hci_dev *hdev;
1735         u8 mgmt_status;
1736 };
1737
1738 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1739 {
1740         struct cmd_lookup *match = data;
1741
1742         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1743
1744         list_del(&cmd->list);
1745
1746         if (match->sk == NULL) {
1747                 match->sk = cmd->sk;
1748                 sock_hold(match->sk);
1749         }
1750
1751         mgmt_pending_free(cmd);
1752 }
1753
1754 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1755 {
1756         u8 *status = data;
1757
1758         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1759         mgmt_pending_remove(cmd);
1760 }
1761
1762 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1763 {
1764         if (cmd->cmd_complete) {
1765                 u8 *status = data;
1766
1767                 cmd->cmd_complete(cmd, *status);
1768                 mgmt_pending_remove(cmd);
1769
1770                 return;
1771         }
1772
1773         cmd_status_rsp(cmd, data);
1774 }
1775
1776 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1777 {
1778         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1779                                  cmd->param, cmd->param_len);
1780 }
1781
1782 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1783 {
1784         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1785                                  cmd->param, sizeof(struct mgmt_addr_info));
1786 }
1787
1788 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1789 {
1790         if (!lmp_bredr_capable(hdev))
1791                 return MGMT_STATUS_NOT_SUPPORTED;
1792         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1793                 return MGMT_STATUS_REJECTED;
1794         else
1795                 return MGMT_STATUS_SUCCESS;
1796 }
1797
1798 static u8 mgmt_le_support(struct hci_dev *hdev)
1799 {
1800         if (!lmp_le_capable(hdev))
1801                 return MGMT_STATUS_NOT_SUPPORTED;
1802         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1803                 return MGMT_STATUS_REJECTED;
1804         else
1805                 return MGMT_STATUS_SUCCESS;
1806 }
1807
1808 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1809                                       u16 opcode)
1810 {
1811         struct mgmt_pending_cmd *cmd;
1812         struct mgmt_mode *cp;
1813         struct hci_request req;
1814         bool changed;
1815
1816         BT_DBG("status 0x%02x", status);
1817
1818         hci_dev_lock(hdev);
1819
1820         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1821         if (!cmd)
1822                 goto unlock;
1823
1824         if (status) {
1825                 u8 mgmt_err = mgmt_status(status);
1826                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1827                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1828                 goto remove_cmd;
1829         }
1830
1831         cp = cmd->param;
1832         if (cp->val) {
1833                 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
1834
1835                 if (hdev->discov_timeout > 0) {
1836                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1837                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1838                                            to);
1839                 }
1840         } else {
1841                 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
1842         }
1843
1844         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1845
1846         if (changed)
1847                 new_settings(hdev, cmd->sk);
1848
1849         /* When the discoverable mode gets changed, make sure
1850          * that class of device has the limited discoverable
1851          * bit correctly set. Also update page scan based on whitelist
1852          * entries.
1853          */
1854         hci_req_init(&req, hdev);
1855         __hci_update_page_scan(&req);
1856         update_class(&req);
1857         hci_req_run(&req, NULL);
1858
1859 remove_cmd:
1860         mgmt_pending_remove(cmd);
1861
1862 unlock:
1863         hci_dev_unlock(hdev);
1864 }
1865
1866 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1867                             u16 len)
1868 {
1869         struct mgmt_cp_set_discoverable *cp = data;
1870         struct mgmt_pending_cmd *cmd;
1871         struct hci_request req;
1872         u16 timeout;
1873         u8 scan;
1874         int err;
1875
1876         BT_DBG("request for %s", hdev->name);
1877
1878         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1879             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1880                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1881                                        MGMT_STATUS_REJECTED);
1882
1883         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1884                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1885                                        MGMT_STATUS_INVALID_PARAMS);
1886
1887         timeout = __le16_to_cpu(cp->timeout);
1888
1889         /* Disabling discoverable requires that no timeout is set,
1890          * and enabling limited discoverable requires a timeout.
1891          */
1892         if ((cp->val == 0x00 && timeout > 0) ||
1893             (cp->val == 0x02 && timeout == 0))
1894                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1895                                        MGMT_STATUS_INVALID_PARAMS);
1896
1897         hci_dev_lock(hdev);
1898
1899         if (!hdev_is_powered(hdev) && timeout > 0) {
1900                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1901                                       MGMT_STATUS_NOT_POWERED);
1902                 goto failed;
1903         }
1904
1905         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1906             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1907                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1908                                       MGMT_STATUS_BUSY);
1909                 goto failed;
1910         }
1911
1912         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1913                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1914                                       MGMT_STATUS_REJECTED);
1915                 goto failed;
1916         }
1917
1918         if (!hdev_is_powered(hdev)) {
1919                 bool changed = false;
1920
1921                 /* Setting limited discoverable when powered off is
1922                  * not a valid operation since it requires a timeout
1923                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1924                  */
1925                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1926                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1927                         changed = true;
1928                 }
1929
1930                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1931                 if (err < 0)
1932                         goto failed;
1933
1934                 if (changed)
1935                         err = new_settings(hdev, sk);
1936
1937                 goto failed;
1938         }
1939
1940         /* If the current mode is the same, then just update the timeout
1941          * value with the new value. And if only the timeout gets updated,
1942          * then no need for any HCI transactions.
1943          */
1944         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1945             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1946                                                    HCI_LIMITED_DISCOVERABLE)) {
1947                 cancel_delayed_work(&hdev->discov_off);
1948                 hdev->discov_timeout = timeout;
1949
1950                 if (cp->val && hdev->discov_timeout > 0) {
1951                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1952                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1953                                            to);
1954                 }
1955
1956                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1957                 goto failed;
1958         }
1959
1960         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1961         if (!cmd) {
1962                 err = -ENOMEM;
1963                 goto failed;
1964         }
1965
1966         /* Cancel any potential discoverable timeout that might be
1967          * still active and store new timeout value. The arming of
1968          * the timeout happens in the complete handler.
1969          */
1970         cancel_delayed_work(&hdev->discov_off);
1971         hdev->discov_timeout = timeout;
1972
1973         /* Limited discoverable mode */
1974         if (cp->val == 0x02)
1975                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1976         else
1977                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1978
1979         hci_req_init(&req, hdev);
1980
1981         /* The procedure for LE-only controllers is much simpler - just
1982          * update the advertising data.
1983          */
1984         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1985                 goto update_ad;
1986
1987         scan = SCAN_PAGE;
1988
1989         if (cp->val) {
1990                 struct hci_cp_write_current_iac_lap hci_cp;
1991
1992                 if (cp->val == 0x02) {
1993                         /* Limited discoverable mode */
1994                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1995                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1996                         hci_cp.iac_lap[1] = 0x8b;
1997                         hci_cp.iac_lap[2] = 0x9e;
1998                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1999                         hci_cp.iac_lap[4] = 0x8b;
2000                         hci_cp.iac_lap[5] = 0x9e;
2001                 } else {
2002                         /* General discoverable mode */
2003                         hci_cp.num_iac = 1;
2004                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
2005                         hci_cp.iac_lap[1] = 0x8b;
2006                         hci_cp.iac_lap[2] = 0x9e;
2007                 }
2008
2009                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2010                             (hci_cp.num_iac * 3) + 1, &hci_cp);
2011
2012                 scan |= SCAN_INQUIRY;
2013         } else {
2014                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2015         }
2016
2017         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
2018
2019 update_ad:
2020         update_adv_data(&req);
2021
2022         err = hci_req_run(&req, set_discoverable_complete);
2023         if (err < 0)
2024                 mgmt_pending_remove(cmd);
2025
2026 failed:
2027         hci_dev_unlock(hdev);
2028         return err;
2029 }
2030
2031 static void write_fast_connectable(struct hci_request *req, bool enable)
2032 {
2033         struct hci_dev *hdev = req->hdev;
2034         struct hci_cp_write_page_scan_activity acp;
2035         u8 type;
2036
2037         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2038                 return;
2039
2040         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2041                 return;
2042
2043         if (enable) {
2044                 type = PAGE_SCAN_TYPE_INTERLACED;
2045
2046                 /* 160 msec page scan interval */
2047                 acp.interval = cpu_to_le16(0x0100);
2048         } else {
2049                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2050
2051                 /* default 1.28 sec page scan */
2052                 acp.interval = cpu_to_le16(0x0800);
2053         }
2054
2055         acp.window = cpu_to_le16(0x0012);
2056
2057         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2058             __cpu_to_le16(hdev->page_scan_window) != acp.window)
2059                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2060                             sizeof(acp), &acp);
2061
2062         if (hdev->page_scan_type != type)
2063                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2064 }
2065
2066 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2067                                      u16 opcode)
2068 {
2069         struct mgmt_pending_cmd *cmd;
2070         struct mgmt_mode *cp;
2071         bool conn_changed, discov_changed;
2072
2073         BT_DBG("status 0x%02x", status);
2074
2075         hci_dev_lock(hdev);
2076
2077         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2078         if (!cmd)
2079                 goto unlock;
2080
2081         if (status) {
2082                 u8 mgmt_err = mgmt_status(status);
2083                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
2084                 goto remove_cmd;
2085         }
2086
2087         cp = cmd->param;
2088         if (cp->val) {
2089                 conn_changed = !hci_dev_test_and_set_flag(hdev,
2090                                                           HCI_CONNECTABLE);
2091                 discov_changed = false;
2092         } else {
2093                 conn_changed = hci_dev_test_and_clear_flag(hdev,
2094                                                            HCI_CONNECTABLE);
2095                 discov_changed = hci_dev_test_and_clear_flag(hdev,
2096                                                              HCI_DISCOVERABLE);
2097         }
2098
2099         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2100
2101         if (conn_changed || discov_changed) {
2102                 new_settings(hdev, cmd->sk);
2103                 hci_update_page_scan(hdev);
2104                 if (discov_changed)
2105                         mgmt_update_adv_data(hdev);
2106                 hci_update_background_scan(hdev);
2107         }
2108
2109 remove_cmd:
2110         mgmt_pending_remove(cmd);
2111
2112 unlock:
2113         hci_dev_unlock(hdev);
2114 }
2115
2116 static int set_connectable_update_settings(struct hci_dev *hdev,
2117                                            struct sock *sk, u8 val)
2118 {
2119         bool changed = false;
2120         int err;
2121
2122         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
2123                 changed = true;
2124
2125         if (val) {
2126                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
2127         } else {
2128                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2129                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2130         }
2131
2132         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2133         if (err < 0)
2134                 return err;
2135
2136         if (changed) {
2137                 hci_update_page_scan(hdev);
2138                 hci_update_background_scan(hdev);
2139                 return new_settings(hdev, sk);
2140         }
2141
2142         return 0;
2143 }
2144
2145 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
2146                            u16 len)
2147 {
2148         struct mgmt_mode *cp = data;
2149         struct mgmt_pending_cmd *cmd;
2150         struct hci_request req;
2151         u8 scan;
2152         int err;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2157             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2158                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2159                                        MGMT_STATUS_REJECTED);
2160
2161         if (cp->val != 0x00 && cp->val != 0x01)
2162                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2163                                        MGMT_STATUS_INVALID_PARAMS);
2164
2165         hci_dev_lock(hdev);
2166
2167         if (!hdev_is_powered(hdev)) {
2168                 err = set_connectable_update_settings(hdev, sk, cp->val);
2169                 goto failed;
2170         }
2171
2172         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2173             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
2174                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2175                                       MGMT_STATUS_BUSY);
2176                 goto failed;
2177         }
2178
2179         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
2180         if (!cmd) {
2181                 err = -ENOMEM;
2182                 goto failed;
2183         }
2184
2185         hci_req_init(&req, hdev);
2186
2187         /* If BR/EDR is not enabled and we disable advertising as a
2188          * by-product of disabling connectable, we need to update the
2189          * advertising flags.
2190          */
2191         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2192                 if (!cp->val) {
2193                         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2194                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2195                 }
2196                 update_adv_data(&req);
2197         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2198                 if (cp->val) {
2199                         scan = SCAN_PAGE;
2200                 } else {
2201                         /* If we don't have any whitelist entries just
2202                          * disable all scanning. If there are entries
2203                          * and we had both page and inquiry scanning
2204                          * enabled then fall back to only page scanning.
2205                          * Otherwise no changes are needed.
2206                          */
2207                         if (list_empty(&hdev->whitelist))
2208                                 scan = SCAN_DISABLED;
2209                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2210                                 scan = SCAN_PAGE;
2211                         else
2212                                 goto no_scan_update;
2213
2214                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2215                             hdev->discov_timeout > 0)
2216                                 cancel_delayed_work(&hdev->discov_off);
2217                 }
2218
2219                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2220         }
2221
2222 no_scan_update:
2223         /* Update the advertising parameters if necessary */
2224         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2225             hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
2226                 enable_advertising(&req);
2227
2228         err = hci_req_run(&req, set_connectable_complete);
2229         if (err < 0) {
2230                 mgmt_pending_remove(cmd);
2231                 if (err == -ENODATA)
2232                         err = set_connectable_update_settings(hdev, sk,
2233                                                               cp->val);
2234                 goto failed;
2235         }
2236
2237 failed:
2238         hci_dev_unlock(hdev);
2239         return err;
2240 }
2241
2242 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2243                         u16 len)
2244 {
2245         struct mgmt_mode *cp = data;
2246         bool changed;
2247         int err;
2248
2249         BT_DBG("request for %s", hdev->name);
2250
2251         if (cp->val != 0x00 && cp->val != 0x01)
2252                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2253                                        MGMT_STATUS_INVALID_PARAMS);
2254
2255         hci_dev_lock(hdev);
2256
2257         if (cp->val)
2258                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
2259         else
2260                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
2261
2262         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2263         if (err < 0)
2264                 goto unlock;
2265
2266         if (changed)
2267                 err = new_settings(hdev, sk);
2268
2269 unlock:
2270         hci_dev_unlock(hdev);
2271         return err;
2272 }
2273
2274 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2275                              u16 len)
2276 {
2277         struct mgmt_mode *cp = data;
2278         struct mgmt_pending_cmd *cmd;
2279         u8 val, status;
2280         int err;
2281
2282         BT_DBG("request for %s", hdev->name);
2283
2284         status = mgmt_bredr_support(hdev);
2285         if (status)
2286                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2287                                        status);
2288
2289         if (cp->val != 0x00 && cp->val != 0x01)
2290                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2291                                        MGMT_STATUS_INVALID_PARAMS);
2292
2293         hci_dev_lock(hdev);
2294
2295         if (!hdev_is_powered(hdev)) {
2296                 bool changed = false;
2297
2298                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2299                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
2300                         changed = true;
2301                 }
2302
2303                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2304                 if (err < 0)
2305                         goto failed;
2306
2307                 if (changed)
2308                         err = new_settings(hdev, sk);
2309
2310                 goto failed;
2311         }
2312
2313         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2314                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2315                                       MGMT_STATUS_BUSY);
2316                 goto failed;
2317         }
2318
2319         val = !!cp->val;
2320
2321         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2322                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2323                 goto failed;
2324         }
2325
2326         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2327         if (!cmd) {
2328                 err = -ENOMEM;
2329                 goto failed;
2330         }
2331
2332         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2333         if (err < 0) {
2334                 mgmt_pending_remove(cmd);
2335                 goto failed;
2336         }
2337
2338 failed:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2344 {
2345         struct mgmt_mode *cp = data;
2346         struct mgmt_pending_cmd *cmd;
2347         u8 status;
2348         int err;
2349
2350         BT_DBG("request for %s", hdev->name);
2351
2352         status = mgmt_bredr_support(hdev);
2353         if (status)
2354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2355
2356         if (!lmp_ssp_capable(hdev))
2357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2358                                        MGMT_STATUS_NOT_SUPPORTED);
2359
2360         if (cp->val != 0x00 && cp->val != 0x01)
2361                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2362                                        MGMT_STATUS_INVALID_PARAMS);
2363
2364         hci_dev_lock(hdev);
2365
2366         if (!hdev_is_powered(hdev)) {
2367                 bool changed;
2368
2369                 if (cp->val) {
2370                         changed = !hci_dev_test_and_set_flag(hdev,
2371                                                              HCI_SSP_ENABLED);
2372                 } else {
2373                         changed = hci_dev_test_and_clear_flag(hdev,
2374                                                               HCI_SSP_ENABLED);
2375                         if (!changed)
2376                                 changed = hci_dev_test_and_clear_flag(hdev,
2377                                                                       HCI_HS_ENABLED);
2378                         else
2379                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2380                 }
2381
2382                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2383                 if (err < 0)
2384                         goto failed;
2385
2386                 if (changed)
2387                         err = new_settings(hdev, sk);
2388
2389                 goto failed;
2390         }
2391
2392         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2393                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2394                                       MGMT_STATUS_BUSY);
2395                 goto failed;
2396         }
2397
2398         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2399                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2400                 goto failed;
2401         }
2402
2403         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2404         if (!cmd) {
2405                 err = -ENOMEM;
2406                 goto failed;
2407         }
2408
2409         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
2410                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2411                              sizeof(cp->val), &cp->val);
2412
2413         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2414         if (err < 0) {
2415                 mgmt_pending_remove(cmd);
2416                 goto failed;
2417         }
2418
2419 failed:
2420         hci_dev_unlock(hdev);
2421         return err;
2422 }
2423
2424 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2425 {
2426         struct mgmt_mode *cp = data;
2427         bool changed;
2428         u8 status;
2429         int err;
2430
2431         BT_DBG("request for %s", hdev->name);
2432
2433         status = mgmt_bredr_support(hdev);
2434         if (status)
2435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2436
2437         if (!lmp_ssp_capable(hdev))
2438                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2439                                        MGMT_STATUS_NOT_SUPPORTED);
2440
2441         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2443                                        MGMT_STATUS_REJECTED);
2444
2445         if (cp->val != 0x00 && cp->val != 0x01)
2446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2447                                        MGMT_STATUS_INVALID_PARAMS);
2448
2449         hci_dev_lock(hdev);
2450
2451         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2452                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2453                                       MGMT_STATUS_BUSY);
2454                 goto unlock;
2455         }
2456
2457         if (cp->val) {
2458                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2459         } else {
2460                 if (hdev_is_powered(hdev)) {
2461                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2462                                               MGMT_STATUS_REJECTED);
2463                         goto unlock;
2464                 }
2465
2466                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2467         }
2468
2469         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2470         if (err < 0)
2471                 goto unlock;
2472
2473         if (changed)
2474                 err = new_settings(hdev, sk);
2475
2476 unlock:
2477         hci_dev_unlock(hdev);
2478         return err;
2479 }
2480
2481 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2482 {
2483         struct cmd_lookup match = { NULL, hdev };
2484
2485         hci_dev_lock(hdev);
2486
2487         if (status) {
2488                 u8 mgmt_err = mgmt_status(status);
2489
2490                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2491                                      &mgmt_err);
2492                 goto unlock;
2493         }
2494
2495         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2496
2497         new_settings(hdev, match.sk);
2498
2499         if (match.sk)
2500                 sock_put(match.sk);
2501
2502         /* Make sure the controller has a good default for
2503          * advertising data. Restrict the update to when LE
2504          * has actually been enabled. During power on, the
2505          * update in powered_update_hci will take care of it.
2506          */
2507         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2508                 struct hci_request req;
2509
2510                 hci_req_init(&req, hdev);
2511                 update_adv_data(&req);
2512                 update_scan_rsp_data(&req);
2513                 __hci_update_background_scan(&req);
2514                 hci_req_run(&req, NULL);
2515         }
2516
2517 unlock:
2518         hci_dev_unlock(hdev);
2519 }
2520
2521 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2522 {
2523         struct mgmt_mode *cp = data;
2524         struct hci_cp_write_le_host_supported hci_cp;
2525         struct mgmt_pending_cmd *cmd;
2526         struct hci_request req;
2527         int err;
2528         u8 val, enabled;
2529
2530         BT_DBG("request for %s", hdev->name);
2531
2532         if (!lmp_le_capable(hdev))
2533                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2534                                        MGMT_STATUS_NOT_SUPPORTED);
2535
2536         if (cp->val != 0x00 && cp->val != 0x01)
2537                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2538                                        MGMT_STATUS_INVALID_PARAMS);
2539
2540         /* Bluetooth single mode LE only controllers or dual-mode
2541          * controllers configured as LE only devices, do not allow
2542          * switching LE off. These have either LE enabled explicitly
2543          * or BR/EDR has been previously switched off.
2544          *
2545          * When trying to enable an already enabled LE, then gracefully
2546          * send a positive response. Trying to disable it however will
2547          * result into rejection.
2548          */
2549         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2550                 if (cp->val == 0x01)
2551                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2552
2553                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2554                                        MGMT_STATUS_REJECTED);
2555         }
2556
2557         hci_dev_lock(hdev);
2558
2559         val = !!cp->val;
2560         enabled = lmp_host_le_capable(hdev);
2561
2562         if (!val)
2563                 clear_adv_instance(hdev, NULL, 0x00, true);
2564
2565         if (!hdev_is_powered(hdev) || val == enabled) {
2566                 bool changed = false;
2567
2568                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2569                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2570                         changed = true;
2571                 }
2572
2573                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2574                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2575                         changed = true;
2576                 }
2577
2578                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2579                 if (err < 0)
2580                         goto unlock;
2581
2582                 if (changed)
2583                         err = new_settings(hdev, sk);
2584
2585                 goto unlock;
2586         }
2587
2588         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2589             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2590                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2591                                       MGMT_STATUS_BUSY);
2592                 goto unlock;
2593         }
2594
2595         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2596         if (!cmd) {
2597                 err = -ENOMEM;
2598                 goto unlock;
2599         }
2600
2601         hci_req_init(&req, hdev);
2602
2603         memset(&hci_cp, 0, sizeof(hci_cp));
2604
2605         if (val) {
2606                 hci_cp.le = val;
2607                 hci_cp.simul = 0x00;
2608         } else {
2609                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2610                         disable_advertising(&req);
2611         }
2612
2613         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2614                     &hci_cp);
2615
2616         err = hci_req_run(&req, le_enable_complete);
2617         if (err < 0)
2618                 mgmt_pending_remove(cmd);
2619
2620 unlock:
2621         hci_dev_unlock(hdev);
2622         return err;
2623 }
2624
2625 /* This is a helper function to test for pending mgmt commands that can
2626  * cause CoD or EIR HCI commands. We can only allow one such pending
2627  * mgmt command at a time since otherwise we cannot easily track what
2628  * the current values are, will be, and based on that calculate if a new
2629  * HCI command needs to be sent and if yes with what value.
2630  */
2631 static bool pending_eir_or_class(struct hci_dev *hdev)
2632 {
2633         struct mgmt_pending_cmd *cmd;
2634
2635         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2636                 switch (cmd->opcode) {
2637                 case MGMT_OP_ADD_UUID:
2638                 case MGMT_OP_REMOVE_UUID:
2639                 case MGMT_OP_SET_DEV_CLASS:
2640                 case MGMT_OP_SET_POWERED:
2641                         return true;
2642                 }
2643         }
2644
2645         return false;
2646 }
2647
2648 static const u8 bluetooth_base_uuid[] = {
2649                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2650                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2651 };
2652
2653 static u8 get_uuid_size(const u8 *uuid)
2654 {
2655         u32 val;
2656
2657         if (memcmp(uuid, bluetooth_base_uuid, 12))
2658                 return 128;
2659
2660         val = get_unaligned_le32(&uuid[12]);
2661         if (val > 0xffff)
2662                 return 32;
2663
2664         return 16;
2665 }
2666
2667 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2668 {
2669         struct mgmt_pending_cmd *cmd;
2670
2671         hci_dev_lock(hdev);
2672
2673         cmd = pending_find(mgmt_op, hdev);
2674         if (!cmd)
2675                 goto unlock;
2676
2677         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2678                           mgmt_status(status), hdev->dev_class, 3);
2679
2680         mgmt_pending_remove(cmd);
2681
2682 unlock:
2683         hci_dev_unlock(hdev);
2684 }
2685
2686 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2687 {
2688         BT_DBG("status 0x%02x", status);
2689
2690         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2691 }
2692
2693 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2694 {
2695         struct mgmt_cp_add_uuid *cp = data;
2696         struct mgmt_pending_cmd *cmd;
2697         struct hci_request req;
2698         struct bt_uuid *uuid;
2699         int err;
2700
2701         BT_DBG("request for %s", hdev->name);
2702
2703         hci_dev_lock(hdev);
2704
2705         if (pending_eir_or_class(hdev)) {
2706                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2707                                       MGMT_STATUS_BUSY);
2708                 goto failed;
2709         }
2710
2711         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2712         if (!uuid) {
2713                 err = -ENOMEM;
2714                 goto failed;
2715         }
2716
2717         memcpy(uuid->uuid, cp->uuid, 16);
2718         uuid->svc_hint = cp->svc_hint;
2719         uuid->size = get_uuid_size(cp->uuid);
2720
2721         list_add_tail(&uuid->list, &hdev->uuids);
2722
2723         hci_req_init(&req, hdev);
2724
2725         update_class(&req);
2726         update_eir(&req);
2727
2728         err = hci_req_run(&req, add_uuid_complete);
2729         if (err < 0) {
2730                 if (err != -ENODATA)
2731                         goto failed;
2732
2733                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2734                                         hdev->dev_class, 3);
2735                 goto failed;
2736         }
2737
2738         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2739         if (!cmd) {
2740                 err = -ENOMEM;
2741                 goto failed;
2742         }
2743
2744         err = 0;
2745
2746 failed:
2747         hci_dev_unlock(hdev);
2748         return err;
2749 }
2750
2751 static bool enable_service_cache(struct hci_dev *hdev)
2752 {
2753         if (!hdev_is_powered(hdev))
2754                 return false;
2755
2756         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2757                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2758                                    CACHE_TIMEOUT);
2759                 return true;
2760         }
2761
2762         return false;
2763 }
2764
2765 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2766 {
2767         BT_DBG("status 0x%02x", status);
2768
2769         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2770 }
2771
2772 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2773                        u16 len)
2774 {
2775         struct mgmt_cp_remove_uuid *cp = data;
2776         struct mgmt_pending_cmd *cmd;
2777         struct bt_uuid *match, *tmp;
2778         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2779         struct hci_request req;
2780         int err, found;
2781
2782         BT_DBG("request for %s", hdev->name);
2783
2784         hci_dev_lock(hdev);
2785
2786         if (pending_eir_or_class(hdev)) {
2787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2788                                       MGMT_STATUS_BUSY);
2789                 goto unlock;
2790         }
2791
2792         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2793                 hci_uuids_clear(hdev);
2794
2795                 if (enable_service_cache(hdev)) {
2796                         err = mgmt_cmd_complete(sk, hdev->id,
2797                                                 MGMT_OP_REMOVE_UUID,
2798                                                 0, hdev->dev_class, 3);
2799                         goto unlock;
2800                 }
2801
2802                 goto update_class;
2803         }
2804
2805         found = 0;
2806
2807         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2808                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2809                         continue;
2810
2811                 list_del(&match->list);
2812                 kfree(match);
2813                 found++;
2814         }
2815
2816         if (found == 0) {
2817                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2818                                       MGMT_STATUS_INVALID_PARAMS);
2819                 goto unlock;
2820         }
2821
2822 update_class:
2823         hci_req_init(&req, hdev);
2824
2825         update_class(&req);
2826         update_eir(&req);
2827
2828         err = hci_req_run(&req, remove_uuid_complete);
2829         if (err < 0) {
2830                 if (err != -ENODATA)
2831                         goto unlock;
2832
2833                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2834                                         hdev->dev_class, 3);
2835                 goto unlock;
2836         }
2837
2838         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2839         if (!cmd) {
2840                 err = -ENOMEM;
2841                 goto unlock;
2842         }
2843
2844         err = 0;
2845
2846 unlock:
2847         hci_dev_unlock(hdev);
2848         return err;
2849 }
2850
2851 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2852 {
2853         BT_DBG("status 0x%02x", status);
2854
2855         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2856 }
2857
2858 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2859                          u16 len)
2860 {
2861         struct mgmt_cp_set_dev_class *cp = data;
2862         struct mgmt_pending_cmd *cmd;
2863         struct hci_request req;
2864         int err;
2865
2866         BT_DBG("request for %s", hdev->name);
2867
2868         if (!lmp_bredr_capable(hdev))
2869                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2870                                        MGMT_STATUS_NOT_SUPPORTED);
2871
2872         hci_dev_lock(hdev);
2873
2874         if (pending_eir_or_class(hdev)) {
2875                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2876                                       MGMT_STATUS_BUSY);
2877                 goto unlock;
2878         }
2879
2880         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2881                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2882                                       MGMT_STATUS_INVALID_PARAMS);
2883                 goto unlock;
2884         }
2885
2886         hdev->major_class = cp->major;
2887         hdev->minor_class = cp->minor;
2888
2889         if (!hdev_is_powered(hdev)) {
2890                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2891                                         hdev->dev_class, 3);
2892                 goto unlock;
2893         }
2894
2895         hci_req_init(&req, hdev);
2896
2897         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2898                 hci_dev_unlock(hdev);
2899                 cancel_delayed_work_sync(&hdev->service_cache);
2900                 hci_dev_lock(hdev);
2901                 update_eir(&req);
2902         }
2903
2904         update_class(&req);
2905
2906         err = hci_req_run(&req, set_class_complete);
2907         if (err < 0) {
2908                 if (err != -ENODATA)
2909                         goto unlock;
2910
2911                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2912                                         hdev->dev_class, 3);
2913                 goto unlock;
2914         }
2915
2916         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2917         if (!cmd) {
2918                 err = -ENOMEM;
2919                 goto unlock;
2920         }
2921
2922         err = 0;
2923
2924 unlock:
2925         hci_dev_unlock(hdev);
2926         return err;
2927 }
2928
2929 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2930                           u16 len)
2931 {
2932         struct mgmt_cp_load_link_keys *cp = data;
2933         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2934                                    sizeof(struct mgmt_link_key_info));
2935         u16 key_count, expected_len;
2936         bool changed;
2937         int i;
2938
2939         BT_DBG("request for %s", hdev->name);
2940
2941         if (!lmp_bredr_capable(hdev))
2942                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2943                                        MGMT_STATUS_NOT_SUPPORTED);
2944
2945         key_count = __le16_to_cpu(cp->key_count);
2946         if (key_count > max_key_count) {
2947                 BT_ERR("load_link_keys: too big key_count value %u",
2948                        key_count);
2949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2950                                        MGMT_STATUS_INVALID_PARAMS);
2951         }
2952
2953         expected_len = sizeof(*cp) + key_count *
2954                                         sizeof(struct mgmt_link_key_info);
2955         if (expected_len != len) {
2956                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2957                        expected_len, len);
2958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2959                                        MGMT_STATUS_INVALID_PARAMS);
2960         }
2961
2962         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2964                                        MGMT_STATUS_INVALID_PARAMS);
2965
2966         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2967                key_count);
2968
2969         for (i = 0; i < key_count; i++) {
2970                 struct mgmt_link_key_info *key = &cp->keys[i];
2971
2972                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2973                         return mgmt_cmd_status(sk, hdev->id,
2974                                                MGMT_OP_LOAD_LINK_KEYS,
2975                                                MGMT_STATUS_INVALID_PARAMS);
2976         }
2977
2978         hci_dev_lock(hdev);
2979
2980         hci_link_keys_clear(hdev);
2981
2982         if (cp->debug_keys)
2983                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2984         else
2985                 changed = hci_dev_test_and_clear_flag(hdev,
2986                                                       HCI_KEEP_DEBUG_KEYS);
2987
2988         if (changed)
2989                 new_settings(hdev, NULL);
2990
2991         for (i = 0; i < key_count; i++) {
2992                 struct mgmt_link_key_info *key = &cp->keys[i];
2993
2994                 /* Always ignore debug keys and require a new pairing if
2995                  * the user wants to use them.
2996                  */
2997                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2998                         continue;
2999
3000                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3001                                  key->type, key->pin_len, NULL);
3002         }
3003
3004         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
3005
3006         hci_dev_unlock(hdev);
3007
3008         return 0;
3009 }
3010
3011 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
3012                            u8 addr_type, struct sock *skip_sk)
3013 {
3014         struct mgmt_ev_device_unpaired ev;
3015
3016         bacpy(&ev.addr.bdaddr, bdaddr);
3017         ev.addr.type = addr_type;
3018
3019         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
3020                           skip_sk);
3021 }
3022
3023 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3024                          u16 len)
3025 {
3026         struct mgmt_cp_unpair_device *cp = data;
3027         struct mgmt_rp_unpair_device rp;
3028         struct hci_conn_params *params;
3029         struct mgmt_pending_cmd *cmd;
3030         struct hci_conn *conn;
3031         u8 addr_type;
3032         int err;
3033
3034         memset(&rp, 0, sizeof(rp));
3035         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3036         rp.addr.type = cp->addr.type;
3037
3038         if (!bdaddr_type_is_valid(cp->addr.type))
3039                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3040                                          MGMT_STATUS_INVALID_PARAMS,
3041                                          &rp, sizeof(rp));
3042
3043         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3044                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3045                                          MGMT_STATUS_INVALID_PARAMS,
3046                                          &rp, sizeof(rp));
3047
3048         hci_dev_lock(hdev);
3049
3050         if (!hdev_is_powered(hdev)) {
3051                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3052                                         MGMT_STATUS_NOT_POWERED, &rp,
3053                                         sizeof(rp));
3054                 goto unlock;
3055         }
3056
3057         if (cp->addr.type == BDADDR_BREDR) {
3058                 /* If disconnection is requested, then look up the
3059                  * connection. If the remote device is connected, it
3060                  * will be later used to terminate the link.
3061                  *
3062                  * Setting it to NULL explicitly will cause no
3063                  * termination of the link.
3064                  */
3065                 if (cp->disconnect)
3066                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3067                                                        &cp->addr.bdaddr);
3068                 else
3069                         conn = NULL;
3070
3071                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3072                 if (err < 0) {
3073                         err = mgmt_cmd_complete(sk, hdev->id,
3074                                                 MGMT_OP_UNPAIR_DEVICE,
3075                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3076                                                 sizeof(rp));
3077                         goto unlock;
3078                 }
3079
3080                 goto done;
3081         }
3082
3083         /* LE address type */
3084         addr_type = le_addr_type(cp->addr.type);
3085
3086         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3087         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3088         if (err < 0) {
3089                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3090                                         MGMT_STATUS_NOT_PAIRED, &rp,
3091                                         sizeof(rp));
3092                 goto unlock;
3093         }
3094
3095         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3096         if (!conn) {
3097                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3098                 goto done;
3099         }
3100
3101
3102         /* Defer clearing up the connection parameters until closing to
3103          * give a chance of keeping them if a repairing happens.
3104          */
3105         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3106
3107         /* Disable auto-connection parameters if present */
3108         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3109         if (params) {
3110                 if (params->explicit_connect)
3111                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3112                 else
3113                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3114         }
3115
3116         /* If disconnection is not requested, then clear the connection
3117          * variable so that the link is not terminated.
3118          */
3119         if (!cp->disconnect)
3120                 conn = NULL;
3121
3122 done:
3123         /* If the connection variable is set, then termination of the
3124          * link is requested.
3125          */
3126         if (!conn) {
3127                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3128                                         &rp, sizeof(rp));
3129                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3130                 goto unlock;
3131         }
3132
3133         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3134                                sizeof(*cp));
3135         if (!cmd) {
3136                 err = -ENOMEM;
3137                 goto unlock;
3138         }
3139
3140         cmd->cmd_complete = addr_cmd_complete;
3141
3142         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3143         if (err < 0)
3144                 mgmt_pending_remove(cmd);
3145
3146 unlock:
3147         hci_dev_unlock(hdev);
3148         return err;
3149 }
3150
3151 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3152                       u16 len)
3153 {
3154         struct mgmt_cp_disconnect *cp = data;
3155         struct mgmt_rp_disconnect rp;
3156         struct mgmt_pending_cmd *cmd;
3157         struct hci_conn *conn;
3158         int err;
3159
3160         BT_DBG("");
3161
3162         memset(&rp, 0, sizeof(rp));
3163         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3164         rp.addr.type = cp->addr.type;
3165
3166         if (!bdaddr_type_is_valid(cp->addr.type))
3167                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3168                                          MGMT_STATUS_INVALID_PARAMS,
3169                                          &rp, sizeof(rp));
3170
3171         hci_dev_lock(hdev);
3172
3173         if (!test_bit(HCI_UP, &hdev->flags)) {
3174                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3175                                         MGMT_STATUS_NOT_POWERED, &rp,
3176                                         sizeof(rp));
3177                 goto failed;
3178         }
3179
3180         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3181                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3182                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3183                 goto failed;
3184         }
3185
3186         if (cp->addr.type == BDADDR_BREDR)
3187                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3188                                                &cp->addr.bdaddr);
3189         else
3190                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3191                                                le_addr_type(cp->addr.type));
3192
3193         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3194                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3195                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3196                                         sizeof(rp));
3197                 goto failed;
3198         }
3199
3200         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3201         if (!cmd) {
3202                 err = -ENOMEM;
3203                 goto failed;
3204         }
3205
3206         cmd->cmd_complete = generic_cmd_complete;
3207
3208         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3209         if (err < 0)
3210                 mgmt_pending_remove(cmd);
3211
3212 failed:
3213         hci_dev_unlock(hdev);
3214         return err;
3215 }
3216
3217 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3218 {
3219         switch (link_type) {
3220         case LE_LINK:
3221                 switch (addr_type) {
3222                 case ADDR_LE_DEV_PUBLIC:
3223                         return BDADDR_LE_PUBLIC;
3224
3225                 default:
3226                         /* Fallback to LE Random address type */
3227                         return BDADDR_LE_RANDOM;
3228                 }
3229
3230         default:
3231                 /* Fallback to BR/EDR type */
3232                 return BDADDR_BREDR;
3233         }
3234 }
3235
3236 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3237                            u16 data_len)
3238 {
3239         struct mgmt_rp_get_connections *rp;
3240         struct hci_conn *c;
3241         size_t rp_len;
3242         int err;
3243         u16 i;
3244
3245         BT_DBG("");
3246
3247         hci_dev_lock(hdev);
3248
3249         if (!hdev_is_powered(hdev)) {
3250                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3251                                       MGMT_STATUS_NOT_POWERED);
3252                 goto unlock;
3253         }
3254
3255         i = 0;
3256         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3257                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3258                         i++;
3259         }
3260
3261         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3262         rp = kmalloc(rp_len, GFP_KERNEL);
3263         if (!rp) {
3264                 err = -ENOMEM;
3265                 goto unlock;
3266         }
3267
3268         i = 0;
3269         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3270                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3271                         continue;
3272                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3273                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3274                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3275                         continue;
3276                 i++;
3277         }
3278
3279         rp->conn_count = cpu_to_le16(i);
3280
3281         /* Recalculate length in case of filtered SCO connections, etc */
3282         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3283
3284         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3285                                 rp_len);
3286
3287         kfree(rp);
3288
3289 unlock:
3290         hci_dev_unlock(hdev);
3291         return err;
3292 }
3293
3294 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3295                                    struct mgmt_cp_pin_code_neg_reply *cp)
3296 {
3297         struct mgmt_pending_cmd *cmd;
3298         int err;
3299
3300         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3301                                sizeof(*cp));
3302         if (!cmd)
3303                 return -ENOMEM;
3304
3305         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3306                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3307         if (err < 0)
3308                 mgmt_pending_remove(cmd);
3309
3310         return err;
3311 }
3312
3313 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3314                           u16 len)
3315 {
3316         struct hci_conn *conn;
3317         struct mgmt_cp_pin_code_reply *cp = data;
3318         struct hci_cp_pin_code_reply reply;
3319         struct mgmt_pending_cmd *cmd;
3320         int err;
3321
3322         BT_DBG("");
3323
3324         hci_dev_lock(hdev);
3325
3326         if (!hdev_is_powered(hdev)) {
3327                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3328                                       MGMT_STATUS_NOT_POWERED);
3329                 goto failed;
3330         }
3331
3332         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3333         if (!conn) {
3334                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3335                                       MGMT_STATUS_NOT_CONNECTED);
3336                 goto failed;
3337         }
3338
3339         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3340                 struct mgmt_cp_pin_code_neg_reply ncp;
3341
3342                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3343
3344                 BT_ERR("PIN code is not 16 bytes long");
3345
3346                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3347                 if (err >= 0)
3348                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3349                                               MGMT_STATUS_INVALID_PARAMS);
3350
3351                 goto failed;
3352         }
3353
3354         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3355         if (!cmd) {
3356                 err = -ENOMEM;
3357                 goto failed;
3358         }
3359
3360         cmd->cmd_complete = addr_cmd_complete;
3361
3362         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3363         reply.pin_len = cp->pin_len;
3364         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3365
3366         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3367         if (err < 0)
3368                 mgmt_pending_remove(cmd);
3369
3370 failed:
3371         hci_dev_unlock(hdev);
3372         return err;
3373 }
3374
3375 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3376                              u16 len)
3377 {
3378         struct mgmt_cp_set_io_capability *cp = data;
3379
3380         BT_DBG("");
3381
3382         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3383                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3384                                          MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3385
3386         hci_dev_lock(hdev);
3387
3388         hdev->io_capability = cp->io_capability;
3389
3390         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3391                hdev->io_capability);
3392
3393         hci_dev_unlock(hdev);
3394
3395         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3396                                  NULL, 0);
3397 }
3398
3399 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3400 {
3401         struct hci_dev *hdev = conn->hdev;
3402         struct mgmt_pending_cmd *cmd;
3403
3404         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3405                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3406                         continue;
3407
3408                 if (cmd->user_data != conn)
3409                         continue;
3410
3411                 return cmd;
3412         }
3413
3414         return NULL;
3415 }
3416
3417 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3418 {
3419         struct mgmt_rp_pair_device rp;
3420         struct hci_conn *conn = cmd->user_data;
3421         int err;
3422
3423         bacpy(&rp.addr.bdaddr, &conn->dst);
3424         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3425
3426         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3427                                 status, &rp, sizeof(rp));
3428
3429         /* So we don't get further callbacks for this connection */
3430         conn->connect_cfm_cb = NULL;
3431         conn->security_cfm_cb = NULL;
3432         conn->disconn_cfm_cb = NULL;
3433
3434         hci_conn_drop(conn);
3435
3436         /* The device is paired so there is no need to remove
3437          * its connection parameters anymore.
3438          */
3439         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3440
3441         hci_conn_put(conn);
3442
3443         return err;
3444 }
3445
3446 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3447 {
3448         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3449         struct mgmt_pending_cmd *cmd;
3450
3451         cmd = find_pairing(conn);
3452         if (cmd) {
3453                 cmd->cmd_complete(cmd, status);
3454                 mgmt_pending_remove(cmd);
3455         }
3456 }
3457
3458 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3459 {
3460         struct mgmt_pending_cmd *cmd;
3461
3462         BT_DBG("status %u", status);
3463
3464         cmd = find_pairing(conn);
3465         if (!cmd) {
3466                 BT_DBG("Unable to find a pending command");
3467                 return;
3468         }
3469
3470         cmd->cmd_complete(cmd, mgmt_status(status));
3471         mgmt_pending_remove(cmd);
3472 }
3473
3474 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3475 {
3476         struct mgmt_pending_cmd *cmd;
3477
3478         BT_DBG("status %u", status);
3479
3480         if (!status)
3481                 return;
3482
3483         cmd = find_pairing(conn);
3484         if (!cmd) {
3485                 BT_DBG("Unable to find a pending command");
3486                 return;
3487         }
3488
3489         cmd->cmd_complete(cmd, mgmt_status(status));
3490         mgmt_pending_remove(cmd);
3491 }
3492
3493 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3494                        u16 len)
3495 {
3496         struct mgmt_cp_pair_device *cp = data;
3497         struct mgmt_rp_pair_device rp;
3498         struct mgmt_pending_cmd *cmd;
3499         u8 sec_level, auth_type;
3500         struct hci_conn *conn;
3501         int err;
3502
3503         BT_DBG("");
3504
3505         memset(&rp, 0, sizeof(rp));
3506         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3507         rp.addr.type = cp->addr.type;
3508
3509         if (!bdaddr_type_is_valid(cp->addr.type))
3510                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3511                                          MGMT_STATUS_INVALID_PARAMS,
3512                                          &rp, sizeof(rp));
3513
3514         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3515                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3516                                          MGMT_STATUS_INVALID_PARAMS,
3517                                          &rp, sizeof(rp));
3518
3519         hci_dev_lock(hdev);
3520
3521         if (!hdev_is_powered(hdev)) {
3522                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3523                                         MGMT_STATUS_NOT_POWERED, &rp,
3524                                         sizeof(rp));
3525                 goto unlock;
3526         }
3527
3528         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3529                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3530                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3531                                         sizeof(rp));
3532                 goto unlock;
3533         }
3534
3535         sec_level = BT_SECURITY_MEDIUM;
3536         auth_type = HCI_AT_DEDICATED_BONDING;
3537
3538         if (cp->addr.type == BDADDR_BREDR) {
3539                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3540                                        auth_type);
3541         } else {
3542                 u8 addr_type = le_addr_type(cp->addr.type);
3543                 struct hci_conn_params *p;
3544
3545                 /* When pairing a new device, it is expected to remember
3546                  * this device for future connections. Adding the connection
3547                  * parameter information ahead of time allows tracking
3548                  * of the slave preferred values and will speed up any
3549                  * further connection establishment.
3550                  *
3551                  * If connection parameters already exist, then they
3552                  * will be kept and this function does nothing.
3553                  */
3554                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3555
3556                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3557                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3558
3559                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
3560                                            addr_type, sec_level,
3561                                            HCI_LE_CONN_TIMEOUT,
3562                                            HCI_ROLE_MASTER);
3563         }
3564
3565         if (IS_ERR(conn)) {
3566                 int status;
3567
3568                 if (PTR_ERR(conn) == -EBUSY)
3569                         status = MGMT_STATUS_BUSY;
3570                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3571                         status = MGMT_STATUS_NOT_SUPPORTED;
3572                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3573                         status = MGMT_STATUS_REJECTED;
3574                 else
3575                         status = MGMT_STATUS_CONNECT_FAILED;
3576
3577                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3578                                         status, &rp, sizeof(rp));
3579                 goto unlock;
3580         }
3581
3582         if (conn->connect_cfm_cb) {
3583                 hci_conn_drop(conn);
3584                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3585                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3586                 goto unlock;
3587         }
3588
3589         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3590         if (!cmd) {
3591                 err = -ENOMEM;
3592                 hci_conn_drop(conn);
3593                 goto unlock;
3594         }
3595
3596         cmd->cmd_complete = pairing_complete;
3597
3598         /* For LE, just connecting isn't a proof that the pairing finished */
3599         if (cp->addr.type == BDADDR_BREDR) {
3600                 conn->connect_cfm_cb = pairing_complete_cb;
3601                 conn->security_cfm_cb = pairing_complete_cb;
3602                 conn->disconn_cfm_cb = pairing_complete_cb;
3603         } else {
3604                 conn->connect_cfm_cb = le_pairing_complete_cb;
3605                 conn->security_cfm_cb = le_pairing_complete_cb;
3606                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3607         }
3608
3609         conn->io_capability = cp->io_cap;
3610         cmd->user_data = hci_conn_get(conn);
3611
3612         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3613             hci_conn_security(conn, sec_level, auth_type, true)) {
3614                 cmd->cmd_complete(cmd, 0);
3615                 mgmt_pending_remove(cmd);
3616         }
3617
3618         err = 0;
3619
3620 unlock:
3621         hci_dev_unlock(hdev);
3622         return err;
3623 }
3624
3625 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3626                               u16 len)
3627 {
3628         struct mgmt_addr_info *addr = data;
3629         struct mgmt_pending_cmd *cmd;
3630         struct hci_conn *conn;
3631         int err;
3632
3633         BT_DBG("");
3634
3635         hci_dev_lock(hdev);
3636
3637         if (!hdev_is_powered(hdev)) {
3638                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3639                                       MGMT_STATUS_NOT_POWERED);
3640                 goto unlock;
3641         }
3642
3643         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3644         if (!cmd) {
3645                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3646                                       MGMT_STATUS_INVALID_PARAMS);
3647                 goto unlock;
3648         }
3649
3650         conn = cmd->user_data;
3651
3652         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3654                                       MGMT_STATUS_INVALID_PARAMS);
3655                 goto unlock;
3656         }
3657
3658         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3659         mgmt_pending_remove(cmd);
3660
3661         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3662                                 addr, sizeof(*addr));
3663 unlock:
3664         hci_dev_unlock(hdev);
3665         return err;
3666 }
3667
3668 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3669                              struct mgmt_addr_info *addr, u16 mgmt_op,
3670                              u16 hci_op, __le32 passkey)
3671 {
3672         struct mgmt_pending_cmd *cmd;
3673         struct hci_conn *conn;
3674         int err;
3675
3676         hci_dev_lock(hdev);
3677
3678         if (!hdev_is_powered(hdev)) {
3679                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3680                                         MGMT_STATUS_NOT_POWERED, addr,
3681                                         sizeof(*addr));
3682                 goto done;
3683         }
3684
3685         if (addr->type == BDADDR_BREDR)
3686                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3687         else
3688                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3689                                                le_addr_type(addr->type));
3690
3691         if (!conn) {
3692                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3693                                         MGMT_STATUS_NOT_CONNECTED, addr,
3694                                         sizeof(*addr));
3695                 goto done;
3696         }
3697
3698         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3699                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3700                 if (!err)
3701                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3702                                                 MGMT_STATUS_SUCCESS, addr,
3703                                                 sizeof(*addr));
3704                 else
3705                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3706                                                 MGMT_STATUS_FAILED, addr,
3707                                                 sizeof(*addr));
3708
3709                 goto done;
3710         }
3711
3712         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3713         if (!cmd) {
3714                 err = -ENOMEM;
3715                 goto done;
3716         }
3717
3718         cmd->cmd_complete = addr_cmd_complete;
3719
3720         /* Continue with pairing via HCI */
3721         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3722                 struct hci_cp_user_passkey_reply cp;
3723
3724                 bacpy(&cp.bdaddr, &addr->bdaddr);
3725                 cp.passkey = passkey;
3726                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3727         } else
3728                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3729                                    &addr->bdaddr);
3730
3731         if (err < 0)
3732                 mgmt_pending_remove(cmd);
3733
3734 done:
3735         hci_dev_unlock(hdev);
3736         return err;
3737 }
3738
3739 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3740                               void *data, u16 len)
3741 {
3742         struct mgmt_cp_pin_code_neg_reply *cp = data;
3743
3744         BT_DBG("");
3745
3746         return user_pairing_resp(sk, hdev, &cp->addr,
3747                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3748                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3749 }
3750
3751 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3752                               u16 len)
3753 {
3754         struct mgmt_cp_user_confirm_reply *cp = data;
3755
3756         BT_DBG("");
3757
3758         if (len != sizeof(*cp))
3759                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3760                                        MGMT_STATUS_INVALID_PARAMS);
3761
3762         return user_pairing_resp(sk, hdev, &cp->addr,
3763                                  MGMT_OP_USER_CONFIRM_REPLY,
3764                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3765 }
3766
3767 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3768                                   void *data, u16 len)
3769 {
3770         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3771
3772         BT_DBG("");
3773
3774         return user_pairing_resp(sk, hdev, &cp->addr,
3775                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3776                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3777 }
3778
3779 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3780                               u16 len)
3781 {
3782         struct mgmt_cp_user_passkey_reply *cp = data;
3783
3784         BT_DBG("");
3785
3786         return user_pairing_resp(sk, hdev, &cp->addr,
3787                                  MGMT_OP_USER_PASSKEY_REPLY,
3788                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3789 }
3790
3791 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3792                                   void *data, u16 len)
3793 {
3794         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3795
3796         BT_DBG("");
3797
3798         return user_pairing_resp(sk, hdev, &cp->addr,
3799                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3800                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3801 }
3802
3803 static void update_name(struct hci_request *req)
3804 {
3805         struct hci_dev *hdev = req->hdev;
3806         struct hci_cp_write_local_name cp;
3807
3808         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3809
3810         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3811 }
3812
3813 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3814 {
3815         struct mgmt_cp_set_local_name *cp;
3816         struct mgmt_pending_cmd *cmd;
3817
3818         BT_DBG("status 0x%02x", status);
3819
3820         hci_dev_lock(hdev);
3821
3822         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3823         if (!cmd)
3824                 goto unlock;
3825
3826         cp = cmd->param;
3827
3828         if (status)
3829                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3830                                 mgmt_status(status));
3831         else
3832                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3833                                   cp, sizeof(*cp));
3834
3835         mgmt_pending_remove(cmd);
3836
3837 unlock:
3838         hci_dev_unlock(hdev);
3839 }
3840
3841 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3842                           u16 len)
3843 {
3844         struct mgmt_cp_set_local_name *cp = data;
3845         struct mgmt_pending_cmd *cmd;
3846         struct hci_request req;
3847         int err;
3848
3849         BT_DBG("");
3850
3851         hci_dev_lock(hdev);
3852
3853         /* If the old values are the same as the new ones just return a
3854          * direct command complete event.
3855          */
3856         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3857             !memcmp(hdev->short_name, cp->short_name,
3858                     sizeof(hdev->short_name))) {
3859                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3860                                         data, len);
3861                 goto failed;
3862         }
3863
3864         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3865
3866         if (!hdev_is_powered(hdev)) {
3867                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3868
3869                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3870                                         data, len);
3871                 if (err < 0)
3872                         goto failed;
3873
3874                 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3875                                          data, len, sk);
3876
3877                 goto failed;
3878         }
3879
3880         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3881         if (!cmd) {
3882                 err = -ENOMEM;
3883                 goto failed;
3884         }
3885
3886         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3887
3888         hci_req_init(&req, hdev);
3889
3890         if (lmp_bredr_capable(hdev)) {
3891                 update_name(&req);
3892                 update_eir(&req);
3893         }
3894
3895         /* The name is stored in the scan response data and so
3896          * no need to udpate the advertising data here.
3897          */
3898         if (lmp_le_capable(hdev))
3899                 update_scan_rsp_data(&req);
3900
3901         err = hci_req_run(&req, set_name_complete);
3902         if (err < 0)
3903                 mgmt_pending_remove(cmd);
3904
3905 failed:
3906         hci_dev_unlock(hdev);
3907         return err;
3908 }
3909
3910 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3911                                          u16 opcode, struct sk_buff *skb)
3912 {
3913         struct mgmt_rp_read_local_oob_data mgmt_rp;
3914         size_t rp_size = sizeof(mgmt_rp);
3915         struct mgmt_pending_cmd *cmd;
3916
3917         BT_DBG("%s status %u", hdev->name, status);
3918
3919         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3920         if (!cmd)
3921                 return;
3922
3923         if (status || !skb) {
3924                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3925                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3926                 goto remove;
3927         }
3928
3929         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3930
3931         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3932                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3933
3934                 if (skb->len < sizeof(*rp)) {
3935                         mgmt_cmd_status(cmd->sk, hdev->id,
3936                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3937                                         MGMT_STATUS_FAILED);
3938                         goto remove;
3939                 }
3940
3941                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3942                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3943
3944                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3945         } else {
3946                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3947
3948                 if (skb->len < sizeof(*rp)) {
3949                         mgmt_cmd_status(cmd->sk, hdev->id,
3950                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3951                                         MGMT_STATUS_FAILED);
3952                         goto remove;
3953                 }
3954
3955                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3956                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3957
3958                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3959                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3960         }
3961
3962         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3963                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3964
3965 remove:
3966         mgmt_pending_remove(cmd);
3967 }
3968
3969 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3970                                void *data, u16 data_len)
3971 {
3972         struct mgmt_pending_cmd *cmd;
3973         struct hci_request req;
3974         int err;
3975
3976         BT_DBG("%s", hdev->name);
3977
3978         hci_dev_lock(hdev);
3979
3980         if (!hdev_is_powered(hdev)) {
3981                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3982                                       MGMT_STATUS_NOT_POWERED);
3983                 goto unlock;
3984         }
3985
3986         if (!lmp_ssp_capable(hdev)) {
3987                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3988                                       MGMT_STATUS_NOT_SUPPORTED);
3989                 goto unlock;
3990         }
3991
3992         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3994                                       MGMT_STATUS_BUSY);
3995                 goto unlock;
3996         }
3997
3998         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3999         if (!cmd) {
4000                 err = -ENOMEM;
4001                 goto unlock;
4002         }
4003
4004         hci_req_init(&req, hdev);
4005
4006         if (bredr_sc_enabled(hdev))
4007                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4008         else
4009                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4010
4011         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4012         if (err < 0)
4013                 mgmt_pending_remove(cmd);
4014
4015 unlock:
4016         hci_dev_unlock(hdev);
4017         return err;
4018 }
4019
4020 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4021                                void *data, u16 len)
4022 {
4023         struct mgmt_addr_info *addr = data;
4024         int err;
4025
4026         BT_DBG("%s ", hdev->name);
4027
4028         if (!bdaddr_type_is_valid(addr->type))
4029                 return mgmt_cmd_complete(sk, hdev->id,
4030                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4031                                          MGMT_STATUS_INVALID_PARAMS,
4032                                          addr, sizeof(*addr));
4033
4034         hci_dev_lock(hdev);
4035
4036         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4037                 struct mgmt_cp_add_remote_oob_data *cp = data;
4038                 u8 status;
4039
4040                 if (cp->addr.type != BDADDR_BREDR) {
4041                         err = mgmt_cmd_complete(sk, hdev->id,
4042                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4043                                                 MGMT_STATUS_INVALID_PARAMS,
4044                                                 &cp->addr, sizeof(cp->addr));
4045                         goto unlock;
4046                 }
4047
4048                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4049                                               cp->addr.type, cp->hash,
4050                                               cp->rand, NULL, NULL);
4051                 if (err < 0)
4052                         status = MGMT_STATUS_FAILED;
4053                 else
4054                         status = MGMT_STATUS_SUCCESS;
4055
4056                 err = mgmt_cmd_complete(sk, hdev->id,
4057                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4058                                         &cp->addr, sizeof(cp->addr));
4059         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4060                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4061                 u8 *rand192, *hash192, *rand256, *hash256;
4062                 u8 status;
4063
4064                 if (bdaddr_type_is_le(cp->addr.type)) {
4065                         /* Enforce zero-valued 192-bit parameters as
4066                          * long as legacy SMP OOB isn't implemented.
4067                          */
4068                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4069                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4070                                 err = mgmt_cmd_complete(sk, hdev->id,
4071                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4072                                                         MGMT_STATUS_INVALID_PARAMS,
4073                                                         addr, sizeof(*addr));
4074                                 goto unlock;
4075                         }
4076
4077                         rand192 = NULL;
4078                         hash192 = NULL;
4079                 } else {
4080                         /* In case one of the P-192 values is set to zero,
4081                          * then just disable OOB data for P-192.
4082                          */
4083                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4084                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4085                                 rand192 = NULL;
4086                                 hash192 = NULL;
4087                         } else {
4088                                 rand192 = cp->rand192;
4089                                 hash192 = cp->hash192;
4090                         }
4091                 }
4092
4093                 /* In case one of the P-256 values is set to zero, then just
4094                  * disable OOB data for P-256.
4095                  */
4096                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4097                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4098                         rand256 = NULL;
4099                         hash256 = NULL;
4100                 } else {
4101                         rand256 = cp->rand256;
4102                         hash256 = cp->hash256;
4103                 }
4104
4105                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4106                                               cp->addr.type, hash192, rand192,
4107                                               hash256, rand256);
4108                 if (err < 0)
4109                         status = MGMT_STATUS_FAILED;
4110                 else
4111                         status = MGMT_STATUS_SUCCESS;
4112
4113                 err = mgmt_cmd_complete(sk, hdev->id,
4114                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4115                                         status, &cp->addr, sizeof(cp->addr));
4116         } else {
4117                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
4118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4119                                       MGMT_STATUS_INVALID_PARAMS);
4120         }
4121
4122 unlock:
4123         hci_dev_unlock(hdev);
4124         return err;
4125 }
4126
4127 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4128                                   void *data, u16 len)
4129 {
4130         struct mgmt_cp_remove_remote_oob_data *cp = data;
4131         u8 status;
4132         int err;
4133
4134         BT_DBG("%s", hdev->name);
4135
4136         if (cp->addr.type != BDADDR_BREDR)
4137                 return mgmt_cmd_complete(sk, hdev->id,
4138                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4139                                          MGMT_STATUS_INVALID_PARAMS,
4140                                          &cp->addr, sizeof(cp->addr));
4141
4142         hci_dev_lock(hdev);
4143
4144         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4145                 hci_remote_oob_data_clear(hdev);
4146                 status = MGMT_STATUS_SUCCESS;
4147                 goto done;
4148         }
4149
4150         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4151         if (err < 0)
4152                 status = MGMT_STATUS_INVALID_PARAMS;
4153         else
4154                 status = MGMT_STATUS_SUCCESS;
4155
4156 done:
4157         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4158                                 status, &cp->addr, sizeof(cp->addr));
4159
4160         hci_dev_unlock(hdev);
4161         return err;
4162 }
4163
4164 static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
4165 {
4166         struct hci_dev *hdev = req->hdev;
4167         struct hci_cp_inquiry cp;
4168         /* General inquiry access code (GIAC) */
4169         u8 lap[3] = { 0x33, 0x8b, 0x9e };
4170
4171         *status = mgmt_bredr_support(hdev);
4172         if (*status)
4173                 return false;
4174
4175         if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4176                 *status = MGMT_STATUS_BUSY;
4177                 return false;
4178         }
4179
4180         hci_inquiry_cache_flush(hdev);
4181
4182         memset(&cp, 0, sizeof(cp));
4183         memcpy(&cp.lap, lap, sizeof(cp.lap));
4184         cp.length = DISCOV_BREDR_INQUIRY_LEN;
4185
4186         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4187
4188         return true;
4189 }
4190
4191 static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4192 {
4193         struct hci_dev *hdev = req->hdev;
4194         struct hci_cp_le_set_scan_param param_cp;
4195         struct hci_cp_le_set_scan_enable enable_cp;
4196         u8 own_addr_type;
4197         int err;
4198
4199         *status = mgmt_le_support(hdev);
4200         if (*status)
4201                 return false;
4202
4203         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4204                 /* Don't let discovery abort an outgoing connection attempt
4205                  * that's using directed advertising.
4206                  */
4207                 if (hci_lookup_le_connect(hdev)) {
4208                         *status = MGMT_STATUS_REJECTED;
4209                         return false;
4210                 }
4211
4212                 cancel_adv_timeout(hdev);
4213                 disable_advertising(req);
4214         }
4215
4216         /* If controller is scanning, it means the background scanning is
4217          * running. Thus, we should temporarily stop it in order to set the
4218          * discovery scanning parameters.
4219          */
4220         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4221                 hci_req_add_le_scan_disable(req);
4222
4223         /* All active scans will be done with either a resolvable private
4224          * address (when privacy feature has been enabled) or non-resolvable
4225          * private address.
4226          */
4227         err = hci_update_random_address(req, true, &own_addr_type);
4228         if (err < 0) {
4229                 *status = MGMT_STATUS_FAILED;
4230                 return false;
4231         }
4232
4233         memset(&param_cp, 0, sizeof(param_cp));
4234         param_cp.type = LE_SCAN_ACTIVE;
4235         param_cp.interval = cpu_to_le16(interval);
4236         param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4237         param_cp.own_address_type = own_addr_type;
4238
4239         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4240                     &param_cp);
4241
4242         memset(&enable_cp, 0, sizeof(enable_cp));
4243         enable_cp.enable = LE_SCAN_ENABLE;
4244         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
4245
4246         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4247                     &enable_cp);
4248
4249         return true;
4250 }
4251
4252 static bool trigger_discovery(struct hci_request *req, u8 *status)
4253 {
4254         struct hci_dev *hdev = req->hdev;
4255
4256         switch (hdev->discovery.type) {
4257         case DISCOV_TYPE_BREDR:
4258                 if (!trigger_bredr_inquiry(req, status))
4259                         return false;
4260                 break;
4261
4262         case DISCOV_TYPE_INTERLEAVED:
4263                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4264                              &hdev->quirks)) {
4265                         /* During simultaneous discovery, we double LE scan
4266                          * interval. We must leave some time for the controller
4267                          * to do BR/EDR inquiry.
4268                          */
4269                         if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4270                                              status))
4271                                 return false;
4272
4273                         if (!trigger_bredr_inquiry(req, status))
4274                                 return false;
4275
4276                         return true;
4277                 }
4278
4279                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4280                         *status = MGMT_STATUS_NOT_SUPPORTED;
4281                         return false;
4282                 }
4283                 /* fall through */
4284
4285         case DISCOV_TYPE_LE:
4286                 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4287                         return false;
4288                 break;
4289
4290         default:
4291                 *status = MGMT_STATUS_INVALID_PARAMS;
4292                 return false;
4293         }
4294
4295         return true;
4296 }
4297
4298 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4299                                      u16 opcode)
4300 {
4301         struct mgmt_pending_cmd *cmd;
4302         unsigned long timeout;
4303
4304         BT_DBG("status %d", status);
4305
4306         hci_dev_lock(hdev);
4307
4308         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4309         if (!cmd)
4310                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4311
4312         if (cmd) {
4313                 cmd->cmd_complete(cmd, mgmt_status(status));
4314                 mgmt_pending_remove(cmd);
4315         }
4316
4317         if (status) {
4318                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4319                 goto unlock;
4320         }
4321
4322         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
4323
4324         /* If the scan involves LE scan, pick proper timeout to schedule
4325          * hdev->le_scan_disable that will stop it.
4326          */
4327         switch (hdev->discovery.type) {
4328         case DISCOV_TYPE_LE:
4329                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4330                 break;
4331         case DISCOV_TYPE_INTERLEAVED:
4332                  /* When running simultaneous discovery, the LE scanning time
4333                  * should occupy the whole discovery time sine BR/EDR inquiry
4334                  * and LE scanning are scheduled by the controller.
4335                  *
4336                  * For interleaving discovery in comparison, BR/EDR inquiry
4337                  * and LE scanning are done sequentially with separate
4338                  * timeouts.
4339                  */
4340                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4341                         timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4342                 else
4343                         timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
4344                 break;
4345         case DISCOV_TYPE_BREDR:
4346                 timeout = 0;
4347                 break;
4348         default:
4349                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
4350                 timeout = 0;
4351                 break;
4352         }
4353
4354         if (timeout) {
4355                 /* When service discovery is used and the controller has
4356                  * a strict duplicate filter, it is important to remember
4357                  * the start and duration of the scan. This is required
4358                  * for restarting scanning during the discovery phase.
4359                  */
4360                 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4361                              &hdev->quirks) &&
4362                     hdev->discovery.result_filtering) {
4363                         hdev->discovery.scan_start = jiffies;
4364                         hdev->discovery.scan_duration = timeout;
4365                 }
4366
4367                 queue_delayed_work(hdev->workqueue,
4368                                    &hdev->le_scan_disable, timeout);
4369         }
4370
4371 unlock:
4372         hci_dev_unlock(hdev);
4373 }
4374
4375 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4376                            void *data, u16 len)
4377 {
4378         struct mgmt_cp_start_discovery *cp = data;
4379         struct mgmt_pending_cmd *cmd;
4380         struct hci_request req;
4381         u8 status;
4382         int err;
4383
4384         BT_DBG("%s", hdev->name);
4385
4386         hci_dev_lock(hdev);
4387
4388         if (!hdev_is_powered(hdev)) {
4389                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4390                                         MGMT_STATUS_NOT_POWERED,
4391                                         &cp->type, sizeof(cp->type));
4392                 goto failed;
4393         }
4394
4395         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4396             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4397                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4398                                         MGMT_STATUS_BUSY, &cp->type,
4399                                         sizeof(cp->type));
4400                 goto failed;
4401         }
4402
4403         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4404         if (!cmd) {
4405                 err = -ENOMEM;
4406                 goto failed;
4407         }
4408
4409         cmd->cmd_complete = generic_cmd_complete;
4410
4411         /* Clear the discovery filter first to free any previously
4412          * allocated memory for the UUID list.
4413          */
4414         hci_discovery_filter_clear(hdev);
4415
4416         hdev->discovery.type = cp->type;
4417         hdev->discovery.report_invalid_rssi = false;
4418
4419         hci_req_init(&req, hdev);
4420
4421         if (!trigger_discovery(&req, &status)) {
4422                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4423                                         status, &cp->type, sizeof(cp->type));
4424                 mgmt_pending_remove(cmd);
4425                 goto failed;
4426         }
4427
4428         err = hci_req_run(&req, start_discovery_complete);
4429         if (err < 0) {
4430                 mgmt_pending_remove(cmd);
4431                 goto failed;
4432         }
4433
4434         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4435
4436 failed:
4437         hci_dev_unlock(hdev);
4438         return err;
4439 }
4440
4441 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4442                                           u8 status)
4443 {
4444         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4445                                  cmd->param, 1);
4446 }
4447
4448 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4449                                    void *data, u16 len)
4450 {
4451         struct mgmt_cp_start_service_discovery *cp = data;
4452         struct mgmt_pending_cmd *cmd;
4453         struct hci_request req;
4454         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4455         u16 uuid_count, expected_len;
4456         u8 status;
4457         int err;
4458
4459         BT_DBG("%s", hdev->name);
4460
4461         hci_dev_lock(hdev);
4462
4463         if (!hdev_is_powered(hdev)) {
4464                 err = mgmt_cmd_complete(sk, hdev->id,
4465                                         MGMT_OP_START_SERVICE_DISCOVERY,
4466                                         MGMT_STATUS_NOT_POWERED,
4467                                         &cp->type, sizeof(cp->type));
4468                 goto failed;
4469         }
4470
4471         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4472             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4473                 err = mgmt_cmd_complete(sk, hdev->id,
4474                                         MGMT_OP_START_SERVICE_DISCOVERY,
4475                                         MGMT_STATUS_BUSY, &cp->type,
4476                                         sizeof(cp->type));
4477                 goto failed;
4478         }
4479
4480         uuid_count = __le16_to_cpu(cp->uuid_count);
4481         if (uuid_count > max_uuid_count) {
4482                 BT_ERR("service_discovery: too big uuid_count value %u",
4483                        uuid_count);
4484                 err = mgmt_cmd_complete(sk, hdev->id,
4485                                         MGMT_OP_START_SERVICE_DISCOVERY,
4486                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4487                                         sizeof(cp->type));
4488                 goto failed;
4489         }
4490
4491         expected_len = sizeof(*cp) + uuid_count * 16;
4492         if (expected_len != len) {
4493                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4494                        expected_len, len);
4495                 err = mgmt_cmd_complete(sk, hdev->id,
4496                                         MGMT_OP_START_SERVICE_DISCOVERY,
4497                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4498                                         sizeof(cp->type));
4499                 goto failed;
4500         }
4501
4502         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4503                                hdev, data, len);
4504         if (!cmd) {
4505                 err = -ENOMEM;
4506                 goto failed;
4507         }
4508
4509         cmd->cmd_complete = service_discovery_cmd_complete;
4510
4511         /* Clear the discovery filter first to free any previously
4512          * allocated memory for the UUID list.
4513          */
4514         hci_discovery_filter_clear(hdev);
4515
4516         hdev->discovery.result_filtering = true;
4517         hdev->discovery.type = cp->type;
4518         hdev->discovery.rssi = cp->rssi;
4519         hdev->discovery.uuid_count = uuid_count;
4520
4521         if (uuid_count > 0) {
4522                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4523                                                 GFP_KERNEL);
4524                 if (!hdev->discovery.uuids) {
4525                         err = mgmt_cmd_complete(sk, hdev->id,
4526                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4527                                                 MGMT_STATUS_FAILED,
4528                                                 &cp->type, sizeof(cp->type));
4529                         mgmt_pending_remove(cmd);
4530                         goto failed;
4531                 }
4532         }
4533
4534         hci_req_init(&req, hdev);
4535
4536         if (!trigger_discovery(&req, &status)) {
4537                 err = mgmt_cmd_complete(sk, hdev->id,
4538                                         MGMT_OP_START_SERVICE_DISCOVERY,
4539                                         status, &cp->type, sizeof(cp->type));
4540                 mgmt_pending_remove(cmd);
4541                 goto failed;
4542         }
4543
4544         err = hci_req_run(&req, start_discovery_complete);
4545         if (err < 0) {
4546                 mgmt_pending_remove(cmd);
4547                 goto failed;
4548         }
4549
4550         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4551
4552 failed:
4553         hci_dev_unlock(hdev);
4554         return err;
4555 }
4556
4557 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4558 {
4559         struct mgmt_pending_cmd *cmd;
4560
4561         BT_DBG("status %d", status);
4562
4563         hci_dev_lock(hdev);
4564
4565         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4566         if (cmd) {
4567                 cmd->cmd_complete(cmd, mgmt_status(status));
4568                 mgmt_pending_remove(cmd);
4569         }
4570
4571         if (!status)
4572                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4573
4574         hci_dev_unlock(hdev);
4575 }
4576
4577 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4578                           u16 len)
4579 {
4580         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4581         struct mgmt_pending_cmd *cmd;
4582         struct hci_request req;
4583         int err;
4584
4585         BT_DBG("%s", hdev->name);
4586
4587         hci_dev_lock(hdev);
4588
4589         if (!hci_discovery_active(hdev)) {
4590                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4591                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4592                                         sizeof(mgmt_cp->type));
4593                 goto unlock;
4594         }
4595
4596         if (hdev->discovery.type != mgmt_cp->type) {
4597                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4598                                         MGMT_STATUS_INVALID_PARAMS,
4599                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4600                 goto unlock;
4601         }
4602
4603         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4604         if (!cmd) {
4605                 err = -ENOMEM;
4606                 goto unlock;
4607         }
4608
4609         cmd->cmd_complete = generic_cmd_complete;
4610
4611         hci_req_init(&req, hdev);
4612
4613         hci_stop_discovery(&req);
4614
4615         err = hci_req_run(&req, stop_discovery_complete);
4616         if (!err) {
4617                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4618                 goto unlock;
4619         }
4620
4621         mgmt_pending_remove(cmd);
4622
4623         /* If no HCI commands were sent we're done */
4624         if (err == -ENODATA) {
4625                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4626                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4627                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4628         }
4629
4630 unlock:
4631         hci_dev_unlock(hdev);
4632         return err;
4633 }
4634
4635 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4636                         u16 len)
4637 {
4638         struct mgmt_cp_confirm_name *cp = data;
4639         struct inquiry_entry *e;
4640         int err;
4641
4642         BT_DBG("%s", hdev->name);
4643
4644         hci_dev_lock(hdev);
4645
4646         if (!hci_discovery_active(hdev)) {
4647                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4648                                         MGMT_STATUS_FAILED, &cp->addr,
4649                                         sizeof(cp->addr));
4650                 goto failed;
4651         }
4652
4653         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4654         if (!e) {
4655                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4656                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4657                                         sizeof(cp->addr));
4658                 goto failed;
4659         }
4660
4661         if (cp->name_known) {
4662                 e->name_state = NAME_KNOWN;
4663                 list_del(&e->list);
4664         } else {
4665                 e->name_state = NAME_NEEDED;
4666                 hci_inquiry_cache_update_resolve(hdev, e);
4667         }
4668
4669         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4670                                 &cp->addr, sizeof(cp->addr));
4671
4672 failed:
4673         hci_dev_unlock(hdev);
4674         return err;
4675 }
4676
4677 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4678                         u16 len)
4679 {
4680         struct mgmt_cp_block_device *cp = data;
4681         u8 status;
4682         int err;
4683
4684         BT_DBG("%s", hdev->name);
4685
4686         if (!bdaddr_type_is_valid(cp->addr.type))
4687                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4688                                          MGMT_STATUS_INVALID_PARAMS,
4689                                          &cp->addr, sizeof(cp->addr));
4690
4691         hci_dev_lock(hdev);
4692
4693         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4694                                   cp->addr.type);
4695         if (err < 0) {
4696                 status = MGMT_STATUS_FAILED;
4697                 goto done;
4698         }
4699
4700         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4701                    sk);
4702         status = MGMT_STATUS_SUCCESS;
4703
4704 done:
4705         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4706                                 &cp->addr, sizeof(cp->addr));
4707
4708         hci_dev_unlock(hdev);
4709
4710         return err;
4711 }
4712
4713 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4714                           u16 len)
4715 {
4716         struct mgmt_cp_unblock_device *cp = data;
4717         u8 status;
4718         int err;
4719
4720         BT_DBG("%s", hdev->name);
4721
4722         if (!bdaddr_type_is_valid(cp->addr.type))
4723                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4724                                          MGMT_STATUS_INVALID_PARAMS,
4725                                          &cp->addr, sizeof(cp->addr));
4726
4727         hci_dev_lock(hdev);
4728
4729         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4730                                   cp->addr.type);
4731         if (err < 0) {
4732                 status = MGMT_STATUS_INVALID_PARAMS;
4733                 goto done;
4734         }
4735
4736         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4737                    sk);
4738         status = MGMT_STATUS_SUCCESS;
4739
4740 done:
4741         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4742                                 &cp->addr, sizeof(cp->addr));
4743
4744         hci_dev_unlock(hdev);
4745
4746         return err;
4747 }
4748
4749 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4750                          u16 len)
4751 {
4752         struct mgmt_cp_set_device_id *cp = data;
4753         struct hci_request req;
4754         int err;
4755         __u16 source;
4756
4757         BT_DBG("%s", hdev->name);
4758
4759         source = __le16_to_cpu(cp->source);
4760
4761         if (source > 0x0002)
4762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4763                                        MGMT_STATUS_INVALID_PARAMS);
4764
4765         hci_dev_lock(hdev);
4766
4767         hdev->devid_source = source;
4768         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4769         hdev->devid_product = __le16_to_cpu(cp->product);
4770         hdev->devid_version = __le16_to_cpu(cp->version);
4771
4772         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4773                                 NULL, 0);
4774
4775         hci_req_init(&req, hdev);
4776         update_eir(&req);
4777         hci_req_run(&req, NULL);
4778
4779         hci_dev_unlock(hdev);
4780
4781         return err;
4782 }
4783
4784 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4785                                         u16 opcode)
4786 {
4787         BT_DBG("status %d", status);
4788 }
4789
4790 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4791                                      u16 opcode)
4792 {
4793         struct cmd_lookup match = { NULL, hdev };
4794         struct hci_request req;
4795         u8 instance;
4796         struct adv_info *adv_instance;
4797         int err;
4798
4799         hci_dev_lock(hdev);
4800
4801         if (status) {
4802                 u8 mgmt_err = mgmt_status(status);
4803
4804                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4805                                      cmd_status_rsp, &mgmt_err);
4806                 goto unlock;
4807         }
4808
4809         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4810                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4811         else
4812                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4813
4814         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4815                              &match);
4816
4817         new_settings(hdev, match.sk);
4818
4819         if (match.sk)
4820                 sock_put(match.sk);
4821
4822         /* If "Set Advertising" was just disabled and instance advertising was
4823          * set up earlier, then re-enable multi-instance advertising.
4824          */
4825         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4826             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4827             list_empty(&hdev->adv_instances))
4828                 goto unlock;
4829
4830         instance = hdev->cur_adv_instance;
4831         if (!instance) {
4832                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4833                                                         struct adv_info, list);
4834                 if (!adv_instance)
4835                         goto unlock;
4836
4837                 instance = adv_instance->instance;
4838         }
4839
4840         hci_req_init(&req, hdev);
4841
4842         err = schedule_adv_instance(&req, instance, true);
4843
4844         if (!err)
4845                 err = hci_req_run(&req, enable_advertising_instance);
4846
4847         if (err)
4848                 BT_ERR("Failed to re-configure advertising");
4849
4850 unlock:
4851         hci_dev_unlock(hdev);
4852 }
4853
4854 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4855                            u16 len)
4856 {
4857         struct mgmt_mode *cp = data;
4858         struct mgmt_pending_cmd *cmd;
4859         struct hci_request req;
4860         u8 val, status;
4861         int err;
4862
4863         BT_DBG("request for %s", hdev->name);
4864
4865         status = mgmt_le_support(hdev);
4866         if (status)
4867                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4868                                        status);
4869
4870         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4871                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4872                                        MGMT_STATUS_INVALID_PARAMS);
4873
4874         hci_dev_lock(hdev);
4875
4876         val = !!cp->val;
4877
4878         /* The following conditions are ones which mean that we should
4879          * not do any HCI communication but directly send a mgmt
4880          * response to user space (after toggling the flag if
4881          * necessary).
4882          */
4883         if (!hdev_is_powered(hdev) ||
4884             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4885              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4886             hci_conn_num(hdev, LE_LINK) > 0 ||
4887             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4888              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4889                 bool changed;
4890
4891                 if (cp->val) {
4892                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4893                         if (cp->val == 0x02)
4894                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4895                         else
4896                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4897                 } else {
4898                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4899                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4900                 }
4901
4902                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4903                 if (err < 0)
4904                         goto unlock;
4905
4906                 if (changed)
4907                         err = new_settings(hdev, sk);
4908
4909                 goto unlock;
4910         }
4911
4912         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4913             pending_find(MGMT_OP_SET_LE, hdev)) {
4914                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4915                                       MGMT_STATUS_BUSY);
4916                 goto unlock;
4917         }
4918
4919         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4920         if (!cmd) {
4921                 err = -ENOMEM;
4922                 goto unlock;
4923         }
4924
4925         hci_req_init(&req, hdev);
4926
4927         if (cp->val == 0x02)
4928                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4929         else
4930                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4931
4932         cancel_adv_timeout(hdev);
4933
4934         if (val) {
4935                 /* Switch to instance "0" for the Set Advertising setting.
4936                  * We cannot use update_[adv|scan_rsp]_data() here as the
4937                  * HCI_ADVERTISING flag is not yet set.
4938                  */
4939                 update_inst_adv_data(&req, 0x00);
4940                 update_inst_scan_rsp_data(&req, 0x00);
4941                 enable_advertising(&req);
4942         } else {
4943                 disable_advertising(&req);
4944         }
4945
4946         err = hci_req_run(&req, set_advertising_complete);
4947         if (err < 0)
4948                 mgmt_pending_remove(cmd);
4949
4950 unlock:
4951         hci_dev_unlock(hdev);
4952         return err;
4953 }
4954
4955 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4956                               void *data, u16 len)
4957 {
4958         struct mgmt_cp_set_static_address *cp = data;
4959         int err;
4960
4961         BT_DBG("%s", hdev->name);
4962
4963         if (!lmp_le_capable(hdev))
4964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4965                                        MGMT_STATUS_NOT_SUPPORTED);
4966
4967         if (hdev_is_powered(hdev))
4968                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4969                                        MGMT_STATUS_REJECTED);
4970
4971         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4972                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4973                         return mgmt_cmd_status(sk, hdev->id,
4974                                                MGMT_OP_SET_STATIC_ADDRESS,
4975                                                MGMT_STATUS_INVALID_PARAMS);
4976
4977                 /* Two most significant bits shall be set */
4978                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4979                         return mgmt_cmd_status(sk, hdev->id,
4980                                                MGMT_OP_SET_STATIC_ADDRESS,
4981                                                MGMT_STATUS_INVALID_PARAMS);
4982         }
4983
4984         hci_dev_lock(hdev);
4985
4986         bacpy(&hdev->static_addr, &cp->bdaddr);
4987
4988         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4989         if (err < 0)
4990                 goto unlock;
4991
4992         err = new_settings(hdev, sk);
4993
4994 unlock:
4995         hci_dev_unlock(hdev);
4996         return err;
4997 }
4998
4999 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5000                            void *data, u16 len)
5001 {
5002         struct mgmt_cp_set_scan_params *cp = data;
5003         __u16 interval, window;
5004         int err;
5005
5006         BT_DBG("%s", hdev->name);
5007
5008         if (!lmp_le_capable(hdev))
5009                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5010                                        MGMT_STATUS_NOT_SUPPORTED);
5011
5012         interval = __le16_to_cpu(cp->interval);
5013
5014         if (interval < 0x0004 || interval > 0x4000)
5015                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5016                                        MGMT_STATUS_INVALID_PARAMS);
5017
5018         window = __le16_to_cpu(cp->window);
5019
5020         if (window < 0x0004 || window > 0x4000)
5021                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5022                                        MGMT_STATUS_INVALID_PARAMS);
5023
5024         if (window > interval)
5025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5026                                        MGMT_STATUS_INVALID_PARAMS);
5027
5028         hci_dev_lock(hdev);
5029
5030         hdev->le_scan_interval = interval;
5031         hdev->le_scan_window = window;
5032
5033         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5034                                 NULL, 0);
5035
5036         /* If background scan is running, restart it so new parameters are
5037          * loaded.
5038          */
5039         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5040             hdev->discovery.state == DISCOVERY_STOPPED) {
5041                 struct hci_request req;
5042
5043                 hci_req_init(&req, hdev);
5044
5045                 hci_req_add_le_scan_disable(&req);
5046                 hci_req_add_le_passive_scan(&req);
5047
5048                 hci_req_run(&req, NULL);
5049         }
5050
5051         hci_dev_unlock(hdev);
5052
5053         return err;
5054 }
5055
5056 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5057                                       u16 opcode)
5058 {
5059         struct mgmt_pending_cmd *cmd;
5060
5061         BT_DBG("status 0x%02x", status);
5062
5063         hci_dev_lock(hdev);
5064
5065         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5066         if (!cmd)
5067                 goto unlock;
5068
5069         if (status) {
5070                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5071                                 mgmt_status(status));
5072         } else {
5073                 struct mgmt_mode *cp = cmd->param;
5074
5075                 if (cp->val)
5076                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5077                 else
5078                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5079
5080                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5081                 new_settings(hdev, cmd->sk);
5082         }
5083
5084         mgmt_pending_remove(cmd);
5085
5086 unlock:
5087         hci_dev_unlock(hdev);
5088 }
5089
5090 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5091                                 void *data, u16 len)
5092 {
5093         struct mgmt_mode *cp = data;
5094         struct mgmt_pending_cmd *cmd;
5095         struct hci_request req;
5096         int err;
5097
5098         BT_DBG("%s", hdev->name);
5099
5100         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5101             hdev->hci_ver < BLUETOOTH_VER_1_2)
5102                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5103                                        MGMT_STATUS_NOT_SUPPORTED);
5104
5105         if (cp->val != 0x00 && cp->val != 0x01)
5106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5107                                        MGMT_STATUS_INVALID_PARAMS);
5108
5109         hci_dev_lock(hdev);
5110
5111         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5113                                       MGMT_STATUS_BUSY);
5114                 goto unlock;
5115         }
5116
5117         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5118                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5119                                         hdev);
5120                 goto unlock;
5121         }
5122
5123         if (!hdev_is_powered(hdev)) {
5124                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5125                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5126                                         hdev);
5127                 new_settings(hdev, sk);
5128                 goto unlock;
5129         }
5130
5131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5132                                data, len);
5133         if (!cmd) {
5134                 err = -ENOMEM;
5135                 goto unlock;
5136         }
5137
5138         hci_req_init(&req, hdev);
5139
5140         write_fast_connectable(&req, cp->val);
5141
5142         err = hci_req_run(&req, fast_connectable_complete);
5143         if (err < 0) {
5144                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5145                                       MGMT_STATUS_FAILED);
5146                 mgmt_pending_remove(cmd);
5147         }
5148
5149 unlock:
5150         hci_dev_unlock(hdev);
5151
5152         return err;
5153 }
5154
5155 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5156 {
5157         struct mgmt_pending_cmd *cmd;
5158
5159         BT_DBG("status 0x%02x", status);
5160
5161         hci_dev_lock(hdev);
5162
5163         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5164         if (!cmd)
5165                 goto unlock;
5166
5167         if (status) {
5168                 u8 mgmt_err = mgmt_status(status);
5169
5170                 /* We need to restore the flag if related HCI commands
5171                  * failed.
5172                  */
5173                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5174
5175                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5176         } else {
5177                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5178                 new_settings(hdev, cmd->sk);
5179         }
5180
5181         mgmt_pending_remove(cmd);
5182
5183 unlock:
5184         hci_dev_unlock(hdev);
5185 }
5186
5187 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5188 {
5189         struct mgmt_mode *cp = data;
5190         struct mgmt_pending_cmd *cmd;
5191         struct hci_request req;
5192         int err;
5193
5194         BT_DBG("request for %s", hdev->name);
5195
5196         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5197                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5198                                        MGMT_STATUS_NOT_SUPPORTED);
5199
5200         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5202                                        MGMT_STATUS_REJECTED);
5203
5204         if (cp->val != 0x00 && cp->val != 0x01)
5205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5206                                        MGMT_STATUS_INVALID_PARAMS);
5207
5208         hci_dev_lock(hdev);
5209
5210         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5211                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5212                 goto unlock;
5213         }
5214
5215         if (!hdev_is_powered(hdev)) {
5216                 if (!cp->val) {
5217                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5218                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5219                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5220                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5221                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5222                 }
5223
5224                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5225
5226                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5227                 if (err < 0)
5228                         goto unlock;
5229
5230                 err = new_settings(hdev, sk);
5231                 goto unlock;
5232         }
5233
5234         /* Reject disabling when powered on */
5235         if (!cp->val) {
5236                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5237                                       MGMT_STATUS_REJECTED);
5238                 goto unlock;
5239         } else {
5240                 /* When configuring a dual-mode controller to operate
5241                  * with LE only and using a static address, then switching
5242                  * BR/EDR back on is not allowed.
5243                  *
5244                  * Dual-mode controllers shall operate with the public
5245                  * address as its identity address for BR/EDR and LE. So
5246                  * reject the attempt to create an invalid configuration.
5247                  *
5248                  * The same restrictions applies when secure connections
5249                  * has been enabled. For BR/EDR this is a controller feature
5250                  * while for LE it is a host stack feature. This means that
5251                  * switching BR/EDR back on when secure connections has been
5252                  * enabled is not a supported transaction.
5253                  */
5254                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5255                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5256                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5257                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5258                                               MGMT_STATUS_REJECTED);
5259                         goto unlock;
5260                 }
5261         }
5262
5263         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5264                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5265                                       MGMT_STATUS_BUSY);
5266                 goto unlock;
5267         }
5268
5269         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5270         if (!cmd) {
5271                 err = -ENOMEM;
5272                 goto unlock;
5273         }
5274
5275         /* We need to flip the bit already here so that update_adv_data
5276          * generates the correct flags.
5277          */
5278         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5279
5280         hci_req_init(&req, hdev);
5281
5282         write_fast_connectable(&req, false);
5283         __hci_update_page_scan(&req);
5284
5285         /* Since only the advertising data flags will change, there
5286          * is no need to update the scan response data.
5287          */
5288         update_adv_data(&req);
5289
5290         err = hci_req_run(&req, set_bredr_complete);
5291         if (err < 0)
5292                 mgmt_pending_remove(cmd);
5293
5294 unlock:
5295         hci_dev_unlock(hdev);
5296         return err;
5297 }
5298
5299 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5300 {
5301         struct mgmt_pending_cmd *cmd;
5302         struct mgmt_mode *cp;
5303
5304         BT_DBG("%s status %u", hdev->name, status);
5305
5306         hci_dev_lock(hdev);
5307
5308         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5309         if (!cmd)
5310                 goto unlock;
5311
5312         if (status) {
5313                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5314                                 mgmt_status(status));
5315                 goto remove;
5316         }
5317
5318         cp = cmd->param;
5319
5320         switch (cp->val) {
5321         case 0x00:
5322                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5323                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5324                 break;
5325         case 0x01:
5326                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5327                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5328                 break;
5329         case 0x02:
5330                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5331                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5332                 break;
5333         }
5334
5335         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5336         new_settings(hdev, cmd->sk);
5337
5338 remove:
5339         mgmt_pending_remove(cmd);
5340 unlock:
5341         hci_dev_unlock(hdev);
5342 }
5343
5344 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5345                            void *data, u16 len)
5346 {
5347         struct mgmt_mode *cp = data;
5348         struct mgmt_pending_cmd *cmd;
5349         struct hci_request req;
5350         u8 val;
5351         int err;
5352
5353         BT_DBG("request for %s", hdev->name);
5354
5355         if (!lmp_sc_capable(hdev) &&
5356             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5358                                        MGMT_STATUS_NOT_SUPPORTED);
5359
5360         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5361             lmp_sc_capable(hdev) &&
5362             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5364                                        MGMT_STATUS_REJECTED);
5365
5366         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5367                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5368                                   MGMT_STATUS_INVALID_PARAMS);
5369
5370         hci_dev_lock(hdev);
5371
5372         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5373             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5374                 bool changed;
5375
5376                 if (cp->val) {
5377                         changed = !hci_dev_test_and_set_flag(hdev,
5378                                                              HCI_SC_ENABLED);
5379                         if (cp->val == 0x02)
5380                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5381                         else
5382                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5383                 } else {
5384                         changed = hci_dev_test_and_clear_flag(hdev,
5385                                                               HCI_SC_ENABLED);
5386                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5387                 }
5388
5389                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5390                 if (err < 0)
5391                         goto failed;
5392
5393                 if (changed)
5394                         err = new_settings(hdev, sk);
5395
5396                 goto failed;
5397         }
5398
5399         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5400                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5401                                       MGMT_STATUS_BUSY);
5402                 goto failed;
5403         }
5404
5405         val = !!cp->val;
5406
5407         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5408             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5409                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5410                 goto failed;
5411         }
5412
5413         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5414         if (!cmd) {
5415                 err = -ENOMEM;
5416                 goto failed;
5417         }
5418
5419         hci_req_init(&req, hdev);
5420         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5421         err = hci_req_run(&req, sc_enable_complete);
5422         if (err < 0) {
5423                 mgmt_pending_remove(cmd);
5424                 goto failed;
5425         }
5426
5427 failed:
5428         hci_dev_unlock(hdev);
5429         return err;
5430 }
5431
5432 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5433                           void *data, u16 len)
5434 {
5435         struct mgmt_mode *cp = data;
5436         bool changed, use_changed;
5437         int err;
5438
5439         BT_DBG("request for %s", hdev->name);
5440
5441         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5443                                        MGMT_STATUS_INVALID_PARAMS);
5444
5445         hci_dev_lock(hdev);
5446
5447         if (cp->val)
5448                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5449         else
5450                 changed = hci_dev_test_and_clear_flag(hdev,
5451                                                       HCI_KEEP_DEBUG_KEYS);
5452
5453         if (cp->val == 0x02)
5454                 use_changed = !hci_dev_test_and_set_flag(hdev,
5455                                                          HCI_USE_DEBUG_KEYS);
5456         else
5457                 use_changed = hci_dev_test_and_clear_flag(hdev,
5458                                                           HCI_USE_DEBUG_KEYS);
5459
5460         if (hdev_is_powered(hdev) && use_changed &&
5461             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5462                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5463                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5464                              sizeof(mode), &mode);
5465         }
5466
5467         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5468         if (err < 0)
5469                 goto unlock;
5470
5471         if (changed)
5472                 err = new_settings(hdev, sk);
5473
5474 unlock:
5475         hci_dev_unlock(hdev);
5476         return err;
5477 }
5478
5479 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5480                        u16 len)
5481 {
5482         struct mgmt_cp_set_privacy *cp = cp_data;
5483         bool changed;
5484         int err;
5485
5486         BT_DBG("request for %s", hdev->name);
5487
5488         if (!lmp_le_capable(hdev))
5489                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5490                                        MGMT_STATUS_NOT_SUPPORTED);
5491
5492         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5493                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5494                                        MGMT_STATUS_INVALID_PARAMS);
5495
5496         if (hdev_is_powered(hdev))
5497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5498                                        MGMT_STATUS_REJECTED);
5499
5500         hci_dev_lock(hdev);
5501
5502         /* If user space supports this command it is also expected to
5503          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5504          */
5505         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5506
5507         if (cp->privacy) {
5508                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5509                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5510                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5511         } else {
5512                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5513                 memset(hdev->irk, 0, sizeof(hdev->irk));
5514                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5515         }
5516
5517         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5518         if (err < 0)
5519                 goto unlock;
5520
5521         if (changed)
5522                 err = new_settings(hdev, sk);
5523
5524 unlock:
5525         hci_dev_unlock(hdev);
5526         return err;
5527 }
5528
5529 static bool irk_is_valid(struct mgmt_irk_info *irk)
5530 {
5531         switch (irk->addr.type) {
5532         case BDADDR_LE_PUBLIC:
5533                 return true;
5534
5535         case BDADDR_LE_RANDOM:
5536                 /* Two most significant bits shall be set */
5537                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5538                         return false;
5539                 return true;
5540         }
5541
5542         return false;
5543 }
5544
5545 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5546                      u16 len)
5547 {
5548         struct mgmt_cp_load_irks *cp = cp_data;
5549         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5550                                    sizeof(struct mgmt_irk_info));
5551         u16 irk_count, expected_len;
5552         int i, err;
5553
5554         BT_DBG("request for %s", hdev->name);
5555
5556         if (!lmp_le_capable(hdev))
5557                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5558                                        MGMT_STATUS_NOT_SUPPORTED);
5559
5560         irk_count = __le16_to_cpu(cp->irk_count);
5561         if (irk_count > max_irk_count) {
5562                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5563                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5564                                        MGMT_STATUS_INVALID_PARAMS);
5565         }
5566
5567         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5568         if (expected_len != len) {
5569                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5570                        expected_len, len);
5571                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5572                                        MGMT_STATUS_INVALID_PARAMS);
5573         }
5574
5575         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5576
5577         for (i = 0; i < irk_count; i++) {
5578                 struct mgmt_irk_info *key = &cp->irks[i];
5579
5580                 if (!irk_is_valid(key))
5581                         return mgmt_cmd_status(sk, hdev->id,
5582                                                MGMT_OP_LOAD_IRKS,
5583                                                MGMT_STATUS_INVALID_PARAMS);
5584         }
5585
5586         hci_dev_lock(hdev);
5587
5588         hci_smp_irks_clear(hdev);
5589
5590         for (i = 0; i < irk_count; i++) {
5591                 struct mgmt_irk_info *irk = &cp->irks[i];
5592
5593                 hci_add_irk(hdev, &irk->addr.bdaddr,
5594                             le_addr_type(irk->addr.type), irk->val,
5595                             BDADDR_ANY);
5596         }
5597
5598         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5599
5600         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5601
5602         hci_dev_unlock(hdev);
5603
5604         return err;
5605 }
5606
5607 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5608 {
5609         if (key->master != 0x00 && key->master != 0x01)
5610                 return false;
5611
5612         switch (key->addr.type) {
5613         case BDADDR_LE_PUBLIC:
5614                 return true;
5615
5616         case BDADDR_LE_RANDOM:
5617                 /* Two most significant bits shall be set */
5618                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5619                         return false;
5620                 return true;
5621         }
5622
5623         return false;
5624 }
5625
5626 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5627                                void *cp_data, u16 len)
5628 {
5629         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5630         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5631                                    sizeof(struct mgmt_ltk_info));
5632         u16 key_count, expected_len;
5633         int i, err;
5634
5635         BT_DBG("request for %s", hdev->name);
5636
5637         if (!lmp_le_capable(hdev))
5638                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5639                                        MGMT_STATUS_NOT_SUPPORTED);
5640
5641         key_count = __le16_to_cpu(cp->key_count);
5642         if (key_count > max_key_count) {
5643                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5644                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5645                                        MGMT_STATUS_INVALID_PARAMS);
5646         }
5647
5648         expected_len = sizeof(*cp) + key_count *
5649                                         sizeof(struct mgmt_ltk_info);
5650         if (expected_len != len) {
5651                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5652                        expected_len, len);
5653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5654                                        MGMT_STATUS_INVALID_PARAMS);
5655         }
5656
5657         BT_DBG("%s key_count %u", hdev->name, key_count);
5658
5659         for (i = 0; i < key_count; i++) {
5660                 struct mgmt_ltk_info *key = &cp->keys[i];
5661
5662                 if (!ltk_is_valid(key))
5663                         return mgmt_cmd_status(sk, hdev->id,
5664                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5665                                                MGMT_STATUS_INVALID_PARAMS);
5666         }
5667
5668         hci_dev_lock(hdev);
5669
5670         hci_smp_ltks_clear(hdev);
5671
5672         for (i = 0; i < key_count; i++) {
5673                 struct mgmt_ltk_info *key = &cp->keys[i];
5674                 u8 type, authenticated;
5675
5676                 switch (key->type) {
5677                 case MGMT_LTK_UNAUTHENTICATED:
5678                         authenticated = 0x00;
5679                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5680                         break;
5681                 case MGMT_LTK_AUTHENTICATED:
5682                         authenticated = 0x01;
5683                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5684                         break;
5685                 case MGMT_LTK_P256_UNAUTH:
5686                         authenticated = 0x00;
5687                         type = SMP_LTK_P256;
5688                         break;
5689                 case MGMT_LTK_P256_AUTH:
5690                         authenticated = 0x01;
5691                         type = SMP_LTK_P256;
5692                         break;
5693                 case MGMT_LTK_P256_DEBUG:
5694                         authenticated = 0x00;
5695                         type = SMP_LTK_P256_DEBUG;
5696                 default:
5697                         continue;
5698                 }
5699
5700                 hci_add_ltk(hdev, &key->addr.bdaddr,
5701                             le_addr_type(key->addr.type), type, authenticated,
5702                             key->val, key->enc_size, key->ediv, key->rand);
5703         }
5704
5705         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5706                            NULL, 0);
5707
5708         hci_dev_unlock(hdev);
5709
5710         return err;
5711 }
5712
5713 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5714 {
5715         struct hci_conn *conn = cmd->user_data;
5716         struct mgmt_rp_get_conn_info rp;
5717         int err;
5718
5719         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5720
5721         if (status == MGMT_STATUS_SUCCESS) {
5722                 rp.rssi = conn->rssi;
5723                 rp.tx_power = conn->tx_power;
5724                 rp.max_tx_power = conn->max_tx_power;
5725         } else {
5726                 rp.rssi = HCI_RSSI_INVALID;
5727                 rp.tx_power = HCI_TX_POWER_INVALID;
5728                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5729         }
5730
5731         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5732                                 status, &rp, sizeof(rp));
5733
5734         hci_conn_drop(conn);
5735         hci_conn_put(conn);
5736
5737         return err;
5738 }
5739
5740 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5741                                        u16 opcode)
5742 {
5743         struct hci_cp_read_rssi *cp;
5744         struct mgmt_pending_cmd *cmd;
5745         struct hci_conn *conn;
5746         u16 handle;
5747         u8 status;
5748
5749         BT_DBG("status 0x%02x", hci_status);
5750
5751         hci_dev_lock(hdev);
5752
5753         /* Commands sent in request are either Read RSSI or Read Transmit Power
5754          * Level so we check which one was last sent to retrieve connection
5755          * handle.  Both commands have handle as first parameter so it's safe to
5756          * cast data on the same command struct.
5757          *
5758          * First command sent is always Read RSSI and we fail only if it fails.
5759          * In other case we simply override error to indicate success as we
5760          * already remembered if TX power value is actually valid.
5761          */
5762         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5763         if (!cp) {
5764                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5765                 status = MGMT_STATUS_SUCCESS;
5766         } else {
5767                 status = mgmt_status(hci_status);
5768         }
5769
5770         if (!cp) {
5771                 BT_ERR("invalid sent_cmd in conn_info response");
5772                 goto unlock;
5773         }
5774
5775         handle = __le16_to_cpu(cp->handle);
5776         conn = hci_conn_hash_lookup_handle(hdev, handle);
5777         if (!conn) {
5778                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5779                 goto unlock;
5780         }
5781
5782         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5783         if (!cmd)
5784                 goto unlock;
5785
5786         cmd->cmd_complete(cmd, status);
5787         mgmt_pending_remove(cmd);
5788
5789 unlock:
5790         hci_dev_unlock(hdev);
5791 }
5792
5793 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5794                          u16 len)
5795 {
5796         struct mgmt_cp_get_conn_info *cp = data;
5797         struct mgmt_rp_get_conn_info rp;
5798         struct hci_conn *conn;
5799         unsigned long conn_info_age;
5800         int err = 0;
5801
5802         BT_DBG("%s", hdev->name);
5803
5804         memset(&rp, 0, sizeof(rp));
5805         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5806         rp.addr.type = cp->addr.type;
5807
5808         if (!bdaddr_type_is_valid(cp->addr.type))
5809                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5810                                          MGMT_STATUS_INVALID_PARAMS,
5811                                          &rp, sizeof(rp));
5812
5813         hci_dev_lock(hdev);
5814
5815         if (!hdev_is_powered(hdev)) {
5816                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5817                                         MGMT_STATUS_NOT_POWERED, &rp,
5818                                         sizeof(rp));
5819                 goto unlock;
5820         }
5821
5822         if (cp->addr.type == BDADDR_BREDR)
5823                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5824                                                &cp->addr.bdaddr);
5825         else
5826                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5827
5828         if (!conn || conn->state != BT_CONNECTED) {
5829                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5830                                         MGMT_STATUS_NOT_CONNECTED, &rp,
5831                                         sizeof(rp));
5832                 goto unlock;
5833         }
5834
5835         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5836                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5837                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
5838                 goto unlock;
5839         }
5840
5841         /* To avoid client trying to guess when to poll again for information we
5842          * calculate conn info age as random value between min/max set in hdev.
5843          */
5844         conn_info_age = hdev->conn_info_min_age +
5845                         prandom_u32_max(hdev->conn_info_max_age -
5846                                         hdev->conn_info_min_age);
5847
5848         /* Query controller to refresh cached values if they are too old or were
5849          * never read.
5850          */
5851         if (time_after(jiffies, conn->conn_info_timestamp +
5852                        msecs_to_jiffies(conn_info_age)) ||
5853             !conn->conn_info_timestamp) {
5854                 struct hci_request req;
5855                 struct hci_cp_read_tx_power req_txp_cp;
5856                 struct hci_cp_read_rssi req_rssi_cp;
5857                 struct mgmt_pending_cmd *cmd;
5858
5859                 hci_req_init(&req, hdev);
5860                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5861                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5862                             &req_rssi_cp);
5863
5864                 /* For LE links TX power does not change thus we don't need to
5865                  * query for it once value is known.
5866                  */
5867                 if (!bdaddr_type_is_le(cp->addr.type) ||
5868                     conn->tx_power == HCI_TX_POWER_INVALID) {
5869                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5870                         req_txp_cp.type = 0x00;
5871                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5872                                     sizeof(req_txp_cp), &req_txp_cp);
5873                 }
5874
5875                 /* Max TX power needs to be read only once per connection */
5876                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5877                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5878                         req_txp_cp.type = 0x01;
5879                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5880                                     sizeof(req_txp_cp), &req_txp_cp);
5881                 }
5882
5883                 err = hci_req_run(&req, conn_info_refresh_complete);
5884                 if (err < 0)
5885                         goto unlock;
5886
5887                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5888                                        data, len);
5889                 if (!cmd) {
5890                         err = -ENOMEM;
5891                         goto unlock;
5892                 }
5893
5894                 hci_conn_hold(conn);
5895                 cmd->user_data = hci_conn_get(conn);
5896                 cmd->cmd_complete = conn_info_cmd_complete;
5897
5898                 conn->conn_info_timestamp = jiffies;
5899         } else {
5900                 /* Cache is valid, just reply with values cached in hci_conn */
5901                 rp.rssi = conn->rssi;
5902                 rp.tx_power = conn->tx_power;
5903                 rp.max_tx_power = conn->max_tx_power;
5904
5905                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5906                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5907         }
5908
5909 unlock:
5910         hci_dev_unlock(hdev);
5911         return err;
5912 }
5913
5914 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5915 {
5916         struct hci_conn *conn = cmd->user_data;
5917         struct mgmt_rp_get_clock_info rp;
5918         struct hci_dev *hdev;
5919         int err;
5920
5921         memset(&rp, 0, sizeof(rp));
5922         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5923
5924         if (status)
5925                 goto complete;
5926
5927         hdev = hci_dev_get(cmd->index);
5928         if (hdev) {
5929                 rp.local_clock = cpu_to_le32(hdev->clock);
5930                 hci_dev_put(hdev);
5931         }
5932
5933         if (conn) {
5934                 rp.piconet_clock = cpu_to_le32(conn->clock);
5935                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5936         }
5937
5938 complete:
5939         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5940                                 sizeof(rp));
5941
5942         if (conn) {
5943                 hci_conn_drop(conn);
5944                 hci_conn_put(conn);
5945         }
5946
5947         return err;
5948 }
5949
5950 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5951 {
5952         struct hci_cp_read_clock *hci_cp;
5953         struct mgmt_pending_cmd *cmd;
5954         struct hci_conn *conn;
5955
5956         BT_DBG("%s status %u", hdev->name, status);
5957
5958         hci_dev_lock(hdev);
5959
5960         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5961         if (!hci_cp)
5962                 goto unlock;
5963
5964         if (hci_cp->which) {
5965                 u16 handle = __le16_to_cpu(hci_cp->handle);
5966                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5967         } else {
5968                 conn = NULL;
5969         }
5970
5971         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5972         if (!cmd)
5973                 goto unlock;
5974
5975         cmd->cmd_complete(cmd, mgmt_status(status));
5976         mgmt_pending_remove(cmd);
5977
5978 unlock:
5979         hci_dev_unlock(hdev);
5980 }
5981
5982 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5983                          u16 len)
5984 {
5985         struct mgmt_cp_get_clock_info *cp = data;
5986         struct mgmt_rp_get_clock_info rp;
5987         struct hci_cp_read_clock hci_cp;
5988         struct mgmt_pending_cmd *cmd;
5989         struct hci_request req;
5990         struct hci_conn *conn;
5991         int err;
5992
5993         BT_DBG("%s", hdev->name);
5994
5995         memset(&rp, 0, sizeof(rp));
5996         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5997         rp.addr.type = cp->addr.type;
5998
5999         if (cp->addr.type != BDADDR_BREDR)
6000                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6001                                          MGMT_STATUS_INVALID_PARAMS,
6002                                          &rp, sizeof(rp));
6003
6004         hci_dev_lock(hdev);
6005
6006         if (!hdev_is_powered(hdev)) {
6007                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6008                                         MGMT_STATUS_NOT_POWERED, &rp,
6009                                         sizeof(rp));
6010                 goto unlock;
6011         }
6012
6013         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6014                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6015                                                &cp->addr.bdaddr);
6016                 if (!conn || conn->state != BT_CONNECTED) {
6017                         err = mgmt_cmd_complete(sk, hdev->id,
6018                                                 MGMT_OP_GET_CLOCK_INFO,
6019                                                 MGMT_STATUS_NOT_CONNECTED,
6020                                                 &rp, sizeof(rp));
6021                         goto unlock;
6022                 }
6023         } else {
6024                 conn = NULL;
6025         }
6026
6027         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6028         if (!cmd) {
6029                 err = -ENOMEM;
6030                 goto unlock;
6031         }
6032
6033         cmd->cmd_complete = clock_info_cmd_complete;
6034
6035         hci_req_init(&req, hdev);
6036
6037         memset(&hci_cp, 0, sizeof(hci_cp));
6038         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6039
6040         if (conn) {
6041                 hci_conn_hold(conn);
6042                 cmd->user_data = hci_conn_get(conn);
6043
6044                 hci_cp.handle = cpu_to_le16(conn->handle);
6045                 hci_cp.which = 0x01; /* Piconet clock */
6046                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6047         }
6048
6049         err = hci_req_run(&req, get_clock_info_complete);
6050         if (err < 0)
6051                 mgmt_pending_remove(cmd);
6052
6053 unlock:
6054         hci_dev_unlock(hdev);
6055         return err;
6056 }
6057
6058 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6059 {
6060         struct hci_conn *conn;
6061
6062         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6063         if (!conn)
6064                 return false;
6065
6066         if (conn->dst_type != type)
6067                 return false;
6068
6069         if (conn->state != BT_CONNECTED)
6070                 return false;
6071
6072         return true;
6073 }
6074
6075 /* This function requires the caller holds hdev->lock */
6076 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6077                                u8 addr_type, u8 auto_connect)
6078 {
6079         struct hci_dev *hdev = req->hdev;
6080         struct hci_conn_params *params;
6081
6082         params = hci_conn_params_add(hdev, addr, addr_type);
6083         if (!params)
6084                 return -EIO;
6085
6086         if (params->auto_connect == auto_connect)
6087                 return 0;
6088
6089         list_del_init(&params->action);
6090
6091         switch (auto_connect) {
6092         case HCI_AUTO_CONN_DISABLED:
6093         case HCI_AUTO_CONN_LINK_LOSS:
6094                 /* If auto connect is being disabled when we're trying to
6095                  * connect to device, keep connecting.
6096                  */
6097                 if (params->explicit_connect)
6098                         list_add(&params->action, &hdev->pend_le_conns);
6099
6100                 __hci_update_background_scan(req);
6101                 break;
6102         case HCI_AUTO_CONN_REPORT:
6103                 if (params->explicit_connect)
6104                         list_add(&params->action, &hdev->pend_le_conns);
6105                 else
6106                         list_add(&params->action, &hdev->pend_le_reports);
6107                 __hci_update_background_scan(req);
6108                 break;
6109         case HCI_AUTO_CONN_DIRECT:
6110         case HCI_AUTO_CONN_ALWAYS:
6111                 if (!is_connected(hdev, addr, addr_type)) {
6112                         list_add(&params->action, &hdev->pend_le_conns);
6113                         /* If we are in scan phase of connecting, we were
6114                          * already added to pend_le_conns and scanning.
6115                          */
6116                         if (params->auto_connect != HCI_AUTO_CONN_EXPLICIT)
6117                                 __hci_update_background_scan(req);
6118                 }
6119                 break;
6120         }
6121
6122         params->auto_connect = auto_connect;
6123
6124         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6125                auto_connect);
6126
6127         return 0;
6128 }
6129
6130 static void device_added(struct sock *sk, struct hci_dev *hdev,
6131                          bdaddr_t *bdaddr, u8 type, u8 action)
6132 {
6133         struct mgmt_ev_device_added ev;
6134
6135         bacpy(&ev.addr.bdaddr, bdaddr);
6136         ev.addr.type = type;
6137         ev.action = action;
6138
6139         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6140 }
6141
6142 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6143 {
6144         struct mgmt_pending_cmd *cmd;
6145
6146         BT_DBG("status 0x%02x", status);
6147
6148         hci_dev_lock(hdev);
6149
6150         cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
6151         if (!cmd)
6152                 goto unlock;
6153
6154         cmd->cmd_complete(cmd, mgmt_status(status));
6155         mgmt_pending_remove(cmd);
6156
6157 unlock:
6158         hci_dev_unlock(hdev);
6159 }
6160
6161 static int add_device(struct sock *sk, struct hci_dev *hdev,
6162                       void *data, u16 len)
6163 {
6164         struct mgmt_cp_add_device *cp = data;
6165         struct mgmt_pending_cmd *cmd;
6166         struct hci_request req;
6167         u8 auto_conn, addr_type;
6168         int err;
6169
6170         BT_DBG("%s", hdev->name);
6171
6172         if (!bdaddr_type_is_valid(cp->addr.type) ||
6173             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6174                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6175                                          MGMT_STATUS_INVALID_PARAMS,
6176                                          &cp->addr, sizeof(cp->addr));
6177
6178         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6179                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6180                                          MGMT_STATUS_INVALID_PARAMS,
6181                                          &cp->addr, sizeof(cp->addr));
6182
6183         hci_req_init(&req, hdev);
6184
6185         hci_dev_lock(hdev);
6186
6187         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6188         if (!cmd) {
6189                 err = -ENOMEM;
6190                 goto unlock;
6191         }
6192
6193         cmd->cmd_complete = addr_cmd_complete;
6194
6195         if (cp->addr.type == BDADDR_BREDR) {
6196                 /* Only incoming connections action is supported for now */
6197                 if (cp->action != 0x01) {
6198                         err = cmd->cmd_complete(cmd,
6199                                                 MGMT_STATUS_INVALID_PARAMS);
6200                         mgmt_pending_remove(cmd);
6201                         goto unlock;
6202                 }
6203
6204                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6205                                           cp->addr.type);
6206                 if (err)
6207                         goto unlock;
6208
6209                 __hci_update_page_scan(&req);
6210
6211                 goto added;
6212         }
6213
6214         addr_type = le_addr_type(cp->addr.type);
6215
6216         if (cp->action == 0x02)
6217                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6218         else if (cp->action == 0x01)
6219                 auto_conn = HCI_AUTO_CONN_DIRECT;
6220         else
6221                 auto_conn = HCI_AUTO_CONN_REPORT;
6222
6223         /* Kernel internally uses conn_params with resolvable private
6224          * address, but Add Device allows only identity addresses.
6225          * Make sure it is enforced before calling
6226          * hci_conn_params_lookup.
6227          */
6228         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6229                 err = cmd->cmd_complete(cmd, MGMT_STATUS_INVALID_PARAMS);
6230                 mgmt_pending_remove(cmd);
6231                 goto unlock;
6232         }
6233
6234         /* If the connection parameters don't exist for this device,
6235          * they will be created and configured with defaults.
6236          */
6237         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
6238                                 auto_conn) < 0) {
6239                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
6240                 mgmt_pending_remove(cmd);
6241                 goto unlock;
6242         }
6243
6244 added:
6245         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6246
6247         err = hci_req_run(&req, add_device_complete);
6248         if (err < 0) {
6249                 /* ENODATA means no HCI commands were needed (e.g. if
6250                  * the adapter is powered off).
6251                  */
6252                 if (err == -ENODATA)
6253                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6254                 mgmt_pending_remove(cmd);
6255         }
6256
6257 unlock:
6258         hci_dev_unlock(hdev);
6259         return err;
6260 }
6261
6262 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6263                            bdaddr_t *bdaddr, u8 type)
6264 {
6265         struct mgmt_ev_device_removed ev;
6266
6267         bacpy(&ev.addr.bdaddr, bdaddr);
6268         ev.addr.type = type;
6269
6270         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6271 }
6272
6273 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6274 {
6275         struct mgmt_pending_cmd *cmd;
6276
6277         BT_DBG("status 0x%02x", status);
6278
6279         hci_dev_lock(hdev);
6280
6281         cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
6282         if (!cmd)
6283                 goto unlock;
6284
6285         cmd->cmd_complete(cmd, mgmt_status(status));
6286         mgmt_pending_remove(cmd);
6287
6288 unlock:
6289         hci_dev_unlock(hdev);
6290 }
6291
6292 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6293                          void *data, u16 len)
6294 {
6295         struct mgmt_cp_remove_device *cp = data;
6296         struct mgmt_pending_cmd *cmd;
6297         struct hci_request req;
6298         int err;
6299
6300         BT_DBG("%s", hdev->name);
6301
6302         hci_req_init(&req, hdev);
6303
6304         hci_dev_lock(hdev);
6305
6306         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6307         if (!cmd) {
6308                 err = -ENOMEM;
6309                 goto unlock;
6310         }
6311
6312         cmd->cmd_complete = addr_cmd_complete;
6313
6314         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6315                 struct hci_conn_params *params;
6316                 u8 addr_type;
6317
6318                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6319                         err = cmd->cmd_complete(cmd,
6320                                                 MGMT_STATUS_INVALID_PARAMS);
6321                         mgmt_pending_remove(cmd);
6322                         goto unlock;
6323                 }
6324
6325                 if (cp->addr.type == BDADDR_BREDR) {
6326                         err = hci_bdaddr_list_del(&hdev->whitelist,
6327                                                   &cp->addr.bdaddr,
6328                                                   cp->addr.type);
6329                         if (err) {
6330                                 err = cmd->cmd_complete(cmd,
6331                                                         MGMT_STATUS_INVALID_PARAMS);
6332                                 mgmt_pending_remove(cmd);
6333                                 goto unlock;
6334                         }
6335
6336                         __hci_update_page_scan(&req);
6337
6338                         device_removed(sk, hdev, &cp->addr.bdaddr,
6339                                        cp->addr.type);
6340                         goto complete;
6341                 }
6342
6343                 addr_type = le_addr_type(cp->addr.type);
6344
6345                 /* Kernel internally uses conn_params with resolvable private
6346                  * address, but Remove Device allows only identity addresses.
6347                  * Make sure it is enforced before calling
6348                  * hci_conn_params_lookup.
6349                  */
6350                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6351                         err = cmd->cmd_complete(cmd,
6352                                                 MGMT_STATUS_INVALID_PARAMS);
6353                         mgmt_pending_remove(cmd);
6354                         goto unlock;
6355                 }
6356
6357                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6358                                                 addr_type);
6359                 if (!params) {
6360                         err = cmd->cmd_complete(cmd,
6361                                                 MGMT_STATUS_INVALID_PARAMS);
6362                         mgmt_pending_remove(cmd);
6363                         goto unlock;
6364                 }
6365
6366                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6367                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6368                         err = cmd->cmd_complete(cmd,
6369                                                 MGMT_STATUS_INVALID_PARAMS);
6370                         mgmt_pending_remove(cmd);
6371                         goto unlock;
6372                 }
6373
6374                 list_del(&params->action);
6375                 list_del(&params->list);
6376                 kfree(params);
6377                 __hci_update_background_scan(&req);
6378
6379                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6380         } else {
6381                 struct hci_conn_params *p, *tmp;
6382                 struct bdaddr_list *b, *btmp;
6383
6384                 if (cp->addr.type) {
6385                         err = cmd->cmd_complete(cmd,
6386                                                 MGMT_STATUS_INVALID_PARAMS);
6387                         mgmt_pending_remove(cmd);
6388                         goto unlock;
6389                 }
6390
6391                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6392                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6393                         list_del(&b->list);
6394                         kfree(b);
6395                 }
6396
6397                 __hci_update_page_scan(&req);
6398
6399                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6400                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6401                                 continue;
6402                         device_removed(sk, hdev, &p->addr, p->addr_type);
6403                         if (p->explicit_connect) {
6404                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6405                                 continue;
6406                         }
6407                         list_del(&p->action);
6408                         list_del(&p->list);
6409                         kfree(p);
6410                 }
6411
6412                 BT_DBG("All LE connection parameters were removed");
6413
6414                 __hci_update_background_scan(&req);
6415         }
6416
6417 complete:
6418         err = hci_req_run(&req, remove_device_complete);
6419         if (err < 0) {
6420                 /* ENODATA means no HCI commands were needed (e.g. if
6421                  * the adapter is powered off).
6422                  */
6423                 if (err == -ENODATA)
6424                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
6425                 mgmt_pending_remove(cmd);
6426         }
6427
6428 unlock:
6429         hci_dev_unlock(hdev);
6430         return err;
6431 }
6432
6433 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6434                            u16 len)
6435 {
6436         struct mgmt_cp_load_conn_param *cp = data;
6437         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6438                                      sizeof(struct mgmt_conn_param));
6439         u16 param_count, expected_len;
6440         int i;
6441
6442         if (!lmp_le_capable(hdev))
6443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6444                                        MGMT_STATUS_NOT_SUPPORTED);
6445
6446         param_count = __le16_to_cpu(cp->param_count);
6447         if (param_count > max_param_count) {
6448                 BT_ERR("load_conn_param: too big param_count value %u",
6449                        param_count);
6450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6451                                        MGMT_STATUS_INVALID_PARAMS);
6452         }
6453
6454         expected_len = sizeof(*cp) + param_count *
6455                                         sizeof(struct mgmt_conn_param);
6456         if (expected_len != len) {
6457                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6458                        expected_len, len);
6459                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6460                                        MGMT_STATUS_INVALID_PARAMS);
6461         }
6462
6463         BT_DBG("%s param_count %u", hdev->name, param_count);
6464
6465         hci_dev_lock(hdev);
6466
6467         hci_conn_params_clear_disabled(hdev);
6468
6469         for (i = 0; i < param_count; i++) {
6470                 struct mgmt_conn_param *param = &cp->params[i];
6471                 struct hci_conn_params *hci_param;
6472                 u16 min, max, latency, timeout;
6473                 u8 addr_type;
6474
6475                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6476                        param->addr.type);
6477
6478                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6479                         addr_type = ADDR_LE_DEV_PUBLIC;
6480                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6481                         addr_type = ADDR_LE_DEV_RANDOM;
6482                 } else {
6483                         BT_ERR("Ignoring invalid connection parameters");
6484                         continue;
6485                 }
6486
6487                 min = le16_to_cpu(param->min_interval);
6488                 max = le16_to_cpu(param->max_interval);
6489                 latency = le16_to_cpu(param->latency);
6490                 timeout = le16_to_cpu(param->timeout);
6491
6492                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6493                        min, max, latency, timeout);
6494
6495                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6496                         BT_ERR("Ignoring invalid connection parameters");
6497                         continue;
6498                 }
6499
6500                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6501                                                 addr_type);
6502                 if (!hci_param) {
6503                         BT_ERR("Failed to add connection parameters");
6504                         continue;
6505                 }
6506
6507                 hci_param->conn_min_interval = min;
6508                 hci_param->conn_max_interval = max;
6509                 hci_param->conn_latency = latency;
6510                 hci_param->supervision_timeout = timeout;
6511         }
6512
6513         hci_dev_unlock(hdev);
6514
6515         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6516                                  NULL, 0);
6517 }
6518
6519 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6520                                void *data, u16 len)
6521 {
6522         struct mgmt_cp_set_external_config *cp = data;
6523         bool changed;
6524         int err;
6525
6526         BT_DBG("%s", hdev->name);
6527
6528         if (hdev_is_powered(hdev))
6529                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6530                                        MGMT_STATUS_REJECTED);
6531
6532         if (cp->config != 0x00 && cp->config != 0x01)
6533                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6534                                          MGMT_STATUS_INVALID_PARAMS);
6535
6536         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6537                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6538                                        MGMT_STATUS_NOT_SUPPORTED);
6539
6540         hci_dev_lock(hdev);
6541
6542         if (cp->config)
6543                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6544         else
6545                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6546
6547         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6548         if (err < 0)
6549                 goto unlock;
6550
6551         if (!changed)
6552                 goto unlock;
6553
6554         err = new_options(hdev, sk);
6555
6556         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6557                 mgmt_index_removed(hdev);
6558
6559                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6560                         hci_dev_set_flag(hdev, HCI_CONFIG);
6561                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6562
6563                         queue_work(hdev->req_workqueue, &hdev->power_on);
6564                 } else {
6565                         set_bit(HCI_RAW, &hdev->flags);
6566                         mgmt_index_added(hdev);
6567                 }
6568         }
6569
6570 unlock:
6571         hci_dev_unlock(hdev);
6572         return err;
6573 }
6574
6575 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6576                               void *data, u16 len)
6577 {
6578         struct mgmt_cp_set_public_address *cp = data;
6579         bool changed;
6580         int err;
6581
6582         BT_DBG("%s", hdev->name);
6583
6584         if (hdev_is_powered(hdev))
6585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6586                                        MGMT_STATUS_REJECTED);
6587
6588         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6590                                        MGMT_STATUS_INVALID_PARAMS);
6591
6592         if (!hdev->set_bdaddr)
6593                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6594                                        MGMT_STATUS_NOT_SUPPORTED);
6595
6596         hci_dev_lock(hdev);
6597
6598         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6599         bacpy(&hdev->public_addr, &cp->bdaddr);
6600
6601         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6602         if (err < 0)
6603                 goto unlock;
6604
6605         if (!changed)
6606                 goto unlock;
6607
6608         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6609                 err = new_options(hdev, sk);
6610
6611         if (is_configured(hdev)) {
6612                 mgmt_index_removed(hdev);
6613
6614                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6615
6616                 hci_dev_set_flag(hdev, HCI_CONFIG);
6617                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6618
6619                 queue_work(hdev->req_workqueue, &hdev->power_on);
6620         }
6621
6622 unlock:
6623         hci_dev_unlock(hdev);
6624         return err;
6625 }
6626
6627 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6628                                   u8 data_len)
6629 {
6630         eir[eir_len++] = sizeof(type) + data_len;
6631         eir[eir_len++] = type;
6632         memcpy(&eir[eir_len], data, data_len);
6633         eir_len += data_len;
6634
6635         return eir_len;
6636 }
6637
6638 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6639                                              u16 opcode, struct sk_buff *skb)
6640 {
6641         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6642         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6643         u8 *h192, *r192, *h256, *r256;
6644         struct mgmt_pending_cmd *cmd;
6645         u16 eir_len;
6646         int err;
6647
6648         BT_DBG("%s status %u", hdev->name, status);
6649
6650         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6651         if (!cmd)
6652                 return;
6653
6654         mgmt_cp = cmd->param;
6655
6656         if (status) {
6657                 status = mgmt_status(status);
6658                 eir_len = 0;
6659
6660                 h192 = NULL;
6661                 r192 = NULL;
6662                 h256 = NULL;
6663                 r256 = NULL;
6664         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6665                 struct hci_rp_read_local_oob_data *rp;
6666
6667                 if (skb->len != sizeof(*rp)) {
6668                         status = MGMT_STATUS_FAILED;
6669                         eir_len = 0;
6670                 } else {
6671                         status = MGMT_STATUS_SUCCESS;
6672                         rp = (void *)skb->data;
6673
6674                         eir_len = 5 + 18 + 18;
6675                         h192 = rp->hash;
6676                         r192 = rp->rand;
6677                         h256 = NULL;
6678                         r256 = NULL;
6679                 }
6680         } else {
6681                 struct hci_rp_read_local_oob_ext_data *rp;
6682
6683                 if (skb->len != sizeof(*rp)) {
6684                         status = MGMT_STATUS_FAILED;
6685                         eir_len = 0;
6686                 } else {
6687                         status = MGMT_STATUS_SUCCESS;
6688                         rp = (void *)skb->data;
6689
6690                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6691                                 eir_len = 5 + 18 + 18;
6692                                 h192 = NULL;
6693                                 r192 = NULL;
6694                         } else {
6695                                 eir_len = 5 + 18 + 18 + 18 + 18;
6696                                 h192 = rp->hash192;
6697                                 r192 = rp->rand192;
6698                         }
6699
6700                         h256 = rp->hash256;
6701                         r256 = rp->rand256;
6702                 }
6703         }
6704
6705         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6706         if (!mgmt_rp)
6707                 goto done;
6708
6709         if (status)
6710                 goto send_rsp;
6711
6712         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6713                                   hdev->dev_class, 3);
6714
6715         if (h192 && r192) {
6716                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6717                                           EIR_SSP_HASH_C192, h192, 16);
6718                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6719                                           EIR_SSP_RAND_R192, r192, 16);
6720         }
6721
6722         if (h256 && r256) {
6723                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6724                                           EIR_SSP_HASH_C256, h256, 16);
6725                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6726                                           EIR_SSP_RAND_R256, r256, 16);
6727         }
6728
6729 send_rsp:
6730         mgmt_rp->type = mgmt_cp->type;
6731         mgmt_rp->eir_len = cpu_to_le16(eir_len);
6732
6733         err = mgmt_cmd_complete(cmd->sk, hdev->id,
6734                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6735                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6736         if (err < 0 || status)
6737                 goto done;
6738
6739         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6740
6741         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6742                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6743                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6744 done:
6745         kfree(mgmt_rp);
6746         mgmt_pending_remove(cmd);
6747 }
6748
6749 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6750                                   struct mgmt_cp_read_local_oob_ext_data *cp)
6751 {
6752         struct mgmt_pending_cmd *cmd;
6753         struct hci_request req;
6754         int err;
6755
6756         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6757                                cp, sizeof(*cp));
6758         if (!cmd)
6759                 return -ENOMEM;
6760
6761         hci_req_init(&req, hdev);
6762
6763         if (bredr_sc_enabled(hdev))
6764                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6765         else
6766                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6767
6768         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6769         if (err < 0) {
6770                 mgmt_pending_remove(cmd);
6771                 return err;
6772         }
6773
6774         return 0;
6775 }
6776
6777 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6778                                    void *data, u16 data_len)
6779 {
6780         struct mgmt_cp_read_local_oob_ext_data *cp = data;
6781         struct mgmt_rp_read_local_oob_ext_data *rp;
6782         size_t rp_len;
6783         u16 eir_len;
6784         u8 status, flags, role, addr[7], hash[16], rand[16];
6785         int err;
6786
6787         BT_DBG("%s", hdev->name);
6788
6789         if (hdev_is_powered(hdev)) {
6790                 switch (cp->type) {
6791                 case BIT(BDADDR_BREDR):
6792                         status = mgmt_bredr_support(hdev);
6793                         if (status)
6794                                 eir_len = 0;
6795                         else
6796                                 eir_len = 5;
6797                         break;
6798                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6799                         status = mgmt_le_support(hdev);
6800                         if (status)
6801                                 eir_len = 0;
6802                         else
6803                                 eir_len = 9 + 3 + 18 + 18 + 3;
6804                         break;
6805                 default:
6806                         status = MGMT_STATUS_INVALID_PARAMS;
6807                         eir_len = 0;
6808                         break;
6809                 }
6810         } else {
6811                 status = MGMT_STATUS_NOT_POWERED;
6812                 eir_len = 0;
6813         }
6814
6815         rp_len = sizeof(*rp) + eir_len;
6816         rp = kmalloc(rp_len, GFP_ATOMIC);
6817         if (!rp)
6818                 return -ENOMEM;
6819
6820         if (status)
6821                 goto complete;
6822
6823         hci_dev_lock(hdev);
6824
6825         eir_len = 0;
6826         switch (cp->type) {
6827         case BIT(BDADDR_BREDR):
6828                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6829                         err = read_local_ssp_oob_req(hdev, sk, cp);
6830                         hci_dev_unlock(hdev);
6831                         if (!err)
6832                                 goto done;
6833
6834                         status = MGMT_STATUS_FAILED;
6835                         goto complete;
6836                 } else {
6837                         eir_len = eir_append_data(rp->eir, eir_len,
6838                                                   EIR_CLASS_OF_DEV,
6839                                                   hdev->dev_class, 3);
6840                 }
6841                 break;
6842         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6843                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6844                     smp_generate_oob(hdev, hash, rand) < 0) {
6845                         hci_dev_unlock(hdev);
6846                         status = MGMT_STATUS_FAILED;
6847                         goto complete;
6848                 }
6849
6850                 /* This should return the active RPA, but since the RPA
6851                  * is only programmed on demand, it is really hard to fill
6852                  * this in at the moment. For now disallow retrieving
6853                  * local out-of-band data when privacy is in use.
6854                  *
6855                  * Returning the identity address will not help here since
6856                  * pairing happens before the identity resolving key is
6857                  * known and thus the connection establishment happens
6858                  * based on the RPA and not the identity address.
6859                  */
6860                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6861                         hci_dev_unlock(hdev);
6862                         status = MGMT_STATUS_REJECTED;
6863                         goto complete;
6864                 }
6865
6866                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6867                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6868                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6869                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
6870                         memcpy(addr, &hdev->static_addr, 6);
6871                         addr[6] = 0x01;
6872                 } else {
6873                         memcpy(addr, &hdev->bdaddr, 6);
6874                         addr[6] = 0x00;
6875                 }
6876
6877                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6878                                           addr, sizeof(addr));
6879
6880                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6881                         role = 0x02;
6882                 else
6883                         role = 0x01;
6884
6885                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6886                                           &role, sizeof(role));
6887
6888                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6889                         eir_len = eir_append_data(rp->eir, eir_len,
6890                                                   EIR_LE_SC_CONFIRM,
6891                                                   hash, sizeof(hash));
6892
6893                         eir_len = eir_append_data(rp->eir, eir_len,
6894                                                   EIR_LE_SC_RANDOM,
6895                                                   rand, sizeof(rand));
6896                 }
6897
6898                 flags = get_adv_discov_flags(hdev);
6899
6900                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6901                         flags |= LE_AD_NO_BREDR;
6902
6903                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6904                                           &flags, sizeof(flags));
6905                 break;
6906         }
6907
6908         hci_dev_unlock(hdev);
6909
6910         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6911
6912         status = MGMT_STATUS_SUCCESS;
6913
6914 complete:
6915         rp->type = cp->type;
6916         rp->eir_len = cpu_to_le16(eir_len);
6917
6918         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6919                                 status, rp, sizeof(*rp) + eir_len);
6920         if (err < 0 || status)
6921                 goto done;
6922
6923         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6924                                  rp, sizeof(*rp) + eir_len,
6925                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
6926
6927 done:
6928         kfree(rp);
6929
6930         return err;
6931 }
6932
6933 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6934 {
6935         u32 flags = 0;
6936
6937         flags |= MGMT_ADV_FLAG_CONNECTABLE;
6938         flags |= MGMT_ADV_FLAG_DISCOV;
6939         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6940         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6941
6942         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6943                 flags |= MGMT_ADV_FLAG_TX_POWER;
6944
6945         return flags;
6946 }
6947
6948 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6949                              void *data, u16 data_len)
6950 {
6951         struct mgmt_rp_read_adv_features *rp;
6952         size_t rp_len;
6953         int err, i;
6954         bool instance;
6955         struct adv_info *adv_instance;
6956         u32 supported_flags;
6957
6958         BT_DBG("%s", hdev->name);
6959
6960         if (!lmp_le_capable(hdev))
6961                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6962                                        MGMT_STATUS_REJECTED);
6963
6964         hci_dev_lock(hdev);
6965
6966         rp_len = sizeof(*rp);
6967
6968         instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6969         if (instance)
6970                 rp_len += hdev->adv_instance_cnt;
6971
6972         rp = kmalloc(rp_len, GFP_ATOMIC);
6973         if (!rp) {
6974                 hci_dev_unlock(hdev);
6975                 return -ENOMEM;
6976         }
6977
6978         supported_flags = get_supported_adv_flags(hdev);
6979
6980         rp->supported_flags = cpu_to_le32(supported_flags);
6981         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6982         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6983         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6984
6985         if (instance) {
6986                 i = 0;
6987                 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6988                         if (i >= hdev->adv_instance_cnt)
6989                                 break;
6990
6991                         rp->instance[i] = adv_instance->instance;
6992                         i++;
6993                 }
6994                 rp->num_instances = hdev->adv_instance_cnt;
6995         } else {
6996                 rp->num_instances = 0;
6997         }
6998
6999         hci_dev_unlock(hdev);
7000
7001         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7002                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7003
7004         kfree(rp);
7005
7006         return err;
7007 }
7008
7009 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7010                               u8 len, bool is_adv_data)
7011 {
7012         u8 max_len = HCI_MAX_AD_LENGTH;
7013         int i, cur_len;
7014         bool flags_managed = false;
7015         bool tx_power_managed = false;
7016         u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
7017                            MGMT_ADV_FLAG_MANAGED_FLAGS;
7018
7019         if (is_adv_data && (adv_flags & flags_params)) {
7020                 flags_managed = true;
7021                 max_len -= 3;
7022         }
7023
7024         if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
7025                 tx_power_managed = true;
7026                 max_len -= 3;
7027         }
7028
7029         if (len > max_len)
7030                 return false;
7031
7032         /* Make sure that the data is correctly formatted. */
7033         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7034                 cur_len = data[i];
7035
7036                 if (flags_managed && data[i + 1] == EIR_FLAGS)
7037                         return false;
7038
7039                 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
7040                         return false;
7041
7042                 /* If the current field length would exceed the total data
7043                  * length, then it's invalid.
7044                  */
7045                 if (i + cur_len >= len)
7046                         return false;
7047         }
7048
7049         return true;
7050 }
7051
7052 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7053                                      u16 opcode)
7054 {
7055         struct mgmt_pending_cmd *cmd;
7056         struct mgmt_cp_add_advertising *cp;
7057         struct mgmt_rp_add_advertising rp;
7058         struct adv_info *adv_instance, *n;
7059         u8 instance;
7060
7061         BT_DBG("status %d", status);
7062
7063         hci_dev_lock(hdev);
7064
7065         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7066
7067         if (status)
7068                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
7069
7070         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7071                 if (!adv_instance->pending)
7072                         continue;
7073
7074                 if (!status) {
7075                         adv_instance->pending = false;
7076                         continue;
7077                 }
7078
7079                 instance = adv_instance->instance;
7080
7081                 if (hdev->cur_adv_instance == instance)
7082                         cancel_adv_timeout(hdev);
7083
7084                 hci_remove_adv_instance(hdev, instance);
7085                 advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7086         }
7087
7088         if (!cmd)
7089                 goto unlock;
7090
7091         cp = cmd->param;
7092         rp.instance = cp->instance;
7093
7094         if (status)
7095                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7096                                 mgmt_status(status));
7097         else
7098                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7099                                   mgmt_status(status), &rp, sizeof(rp));
7100
7101         mgmt_pending_remove(cmd);
7102
7103 unlock:
7104         hci_dev_unlock(hdev);
7105 }
7106
7107 void mgmt_adv_timeout_expired(struct hci_dev *hdev)
7108 {
7109         u8 instance;
7110         struct hci_request req;
7111
7112         hdev->adv_instance_timeout = 0;
7113
7114         instance = get_current_adv_instance(hdev);
7115         if (instance == 0x00)
7116                 return;
7117
7118         hci_dev_lock(hdev);
7119         hci_req_init(&req, hdev);
7120
7121         clear_adv_instance(hdev, &req, instance, false);
7122
7123         if (list_empty(&hdev->adv_instances))
7124                 disable_advertising(&req);
7125
7126         if (!skb_queue_empty(&req.cmd_q))
7127                 hci_req_run(&req, NULL);
7128
7129         hci_dev_unlock(hdev);
7130 }
7131
7132 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7133                            void *data, u16 data_len)
7134 {
7135         struct mgmt_cp_add_advertising *cp = data;
7136         struct mgmt_rp_add_advertising rp;
7137         u32 flags;
7138         u32 supported_flags;
7139         u8 status;
7140         u16 timeout, duration;
7141         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7142         u8 schedule_instance = 0;
7143         struct adv_info *next_instance;
7144         int err;
7145         struct mgmt_pending_cmd *cmd;
7146         struct hci_request req;
7147
7148         BT_DBG("%s", hdev->name);
7149
7150         status = mgmt_le_support(hdev);
7151         if (status)
7152                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7153                                        status);
7154
7155         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7156                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7157                                        MGMT_STATUS_INVALID_PARAMS);
7158
7159         flags = __le32_to_cpu(cp->flags);
7160         timeout = __le16_to_cpu(cp->timeout);
7161         duration = __le16_to_cpu(cp->duration);
7162
7163         /* The current implementation only supports a subset of the specified
7164          * flags.
7165          */
7166         supported_flags = get_supported_adv_flags(hdev);
7167         if (flags & ~supported_flags)
7168                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7169                                        MGMT_STATUS_INVALID_PARAMS);
7170
7171         hci_dev_lock(hdev);
7172
7173         if (timeout && !hdev_is_powered(hdev)) {
7174                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7175                                       MGMT_STATUS_REJECTED);
7176                 goto unlock;
7177         }
7178
7179         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7180             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7181             pending_find(MGMT_OP_SET_LE, hdev)) {
7182                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7183                                       MGMT_STATUS_BUSY);
7184                 goto unlock;
7185         }
7186
7187         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7188             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7189                                cp->scan_rsp_len, false)) {
7190                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7191                                       MGMT_STATUS_INVALID_PARAMS);
7192                 goto unlock;
7193         }
7194
7195         err = hci_add_adv_instance(hdev, cp->instance, flags,
7196                                    cp->adv_data_len, cp->data,
7197                                    cp->scan_rsp_len,
7198                                    cp->data + cp->adv_data_len,
7199                                    timeout, duration);
7200         if (err < 0) {
7201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7202                                       MGMT_STATUS_FAILED);
7203                 goto unlock;
7204         }
7205
7206         /* Only trigger an advertising added event if a new instance was
7207          * actually added.
7208          */
7209         if (hdev->adv_instance_cnt > prev_instance_cnt)
7210                 advertising_added(sk, hdev, cp->instance);
7211
7212         hci_dev_set_flag(hdev, HCI_ADVERTISING_INSTANCE);
7213
7214         if (hdev->cur_adv_instance == cp->instance) {
7215                 /* If the currently advertised instance is being changed then
7216                  * cancel the current advertising and schedule the next
7217                  * instance. If there is only one instance then the overridden
7218                  * advertising data will be visible right away.
7219                  */
7220                 cancel_adv_timeout(hdev);
7221
7222                 next_instance = hci_get_next_instance(hdev, cp->instance);
7223                 if (next_instance)
7224                         schedule_instance = next_instance->instance;
7225         } else if (!hdev->adv_instance_timeout) {
7226                 /* Immediately advertise the new instance if no other
7227                  * instance is currently being advertised.
7228                  */
7229                 schedule_instance = cp->instance;
7230         }
7231
7232         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7233          * there is no instance to be advertised then we have no HCI
7234          * communication to make. Simply return.
7235          */
7236         if (!hdev_is_powered(hdev) ||
7237             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7238             !schedule_instance) {
7239                 rp.instance = cp->instance;
7240                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7241                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7242                 goto unlock;
7243         }
7244
7245         /* We're good to go, update advertising data, parameters, and start
7246          * advertising.
7247          */
7248         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7249                                data_len);
7250         if (!cmd) {
7251                 err = -ENOMEM;
7252                 goto unlock;
7253         }
7254
7255         hci_req_init(&req, hdev);
7256
7257         err = schedule_adv_instance(&req, schedule_instance, true);
7258
7259         if (!err)
7260                 err = hci_req_run(&req, add_advertising_complete);
7261
7262         if (err < 0)
7263                 mgmt_pending_remove(cmd);
7264
7265 unlock:
7266         hci_dev_unlock(hdev);
7267
7268         return err;
7269 }
7270
7271 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7272                                         u16 opcode)
7273 {
7274         struct mgmt_pending_cmd *cmd;
7275         struct mgmt_cp_remove_advertising *cp;
7276         struct mgmt_rp_remove_advertising rp;
7277
7278         BT_DBG("status %d", status);
7279
7280         hci_dev_lock(hdev);
7281
7282         /* A failure status here only means that we failed to disable
7283          * advertising. Otherwise, the advertising instance has been removed,
7284          * so report success.
7285          */
7286         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7287         if (!cmd)
7288                 goto unlock;
7289
7290         cp = cmd->param;
7291         rp.instance = cp->instance;
7292
7293         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7294                           &rp, sizeof(rp));
7295         mgmt_pending_remove(cmd);
7296
7297 unlock:
7298         hci_dev_unlock(hdev);
7299 }
7300
7301 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7302                               void *data, u16 data_len)
7303 {
7304         struct mgmt_cp_remove_advertising *cp = data;
7305         struct mgmt_rp_remove_advertising rp;
7306         struct mgmt_pending_cmd *cmd;
7307         struct hci_request req;
7308         int err;
7309
7310         BT_DBG("%s", hdev->name);
7311
7312         hci_dev_lock(hdev);
7313
7314         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
7315                 err = mgmt_cmd_status(sk, hdev->id,
7316                                       MGMT_OP_REMOVE_ADVERTISING,
7317                                       MGMT_STATUS_INVALID_PARAMS);
7318                 goto unlock;
7319         }
7320
7321         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7322             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7323             pending_find(MGMT_OP_SET_LE, hdev)) {
7324                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7325                                       MGMT_STATUS_BUSY);
7326                 goto unlock;
7327         }
7328
7329         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7330                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7331                                       MGMT_STATUS_INVALID_PARAMS);
7332                 goto unlock;
7333         }
7334
7335         hci_req_init(&req, hdev);
7336
7337         clear_adv_instance(hdev, &req, cp->instance, true);
7338
7339         if (list_empty(&hdev->adv_instances))
7340                 disable_advertising(&req);
7341
7342         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7343          * flag is set or the device isn't powered then we have no HCI
7344          * communication to make. Simply return.
7345          */
7346         if (skb_queue_empty(&req.cmd_q) ||
7347             !hdev_is_powered(hdev) ||
7348             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7349                 rp.instance = cp->instance;
7350                 err = mgmt_cmd_complete(sk, hdev->id,
7351                                         MGMT_OP_REMOVE_ADVERTISING,
7352                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7353                 goto unlock;
7354         }
7355
7356         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7357                                data_len);
7358         if (!cmd) {
7359                 err = -ENOMEM;
7360                 goto unlock;
7361         }
7362
7363         err = hci_req_run(&req, remove_advertising_complete);
7364         if (err < 0)
7365                 mgmt_pending_remove(cmd);
7366
7367 unlock:
7368         hci_dev_unlock(hdev);
7369
7370         return err;
7371 }
7372
7373 static const struct hci_mgmt_handler mgmt_handlers[] = {
7374         { NULL }, /* 0x0000 (no command) */
7375         { read_version,            MGMT_READ_VERSION_SIZE,
7376                                                 HCI_MGMT_NO_HDEV |
7377                                                 HCI_MGMT_UNTRUSTED },
7378         { read_commands,           MGMT_READ_COMMANDS_SIZE,
7379                                                 HCI_MGMT_NO_HDEV |
7380                                                 HCI_MGMT_UNTRUSTED },
7381         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
7382                                                 HCI_MGMT_NO_HDEV |
7383                                                 HCI_MGMT_UNTRUSTED },
7384         { read_controller_info,    MGMT_READ_INFO_SIZE,
7385                                                 HCI_MGMT_UNTRUSTED },
7386         { set_powered,             MGMT_SETTING_SIZE },
7387         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
7388         { set_connectable,         MGMT_SETTING_SIZE },
7389         { set_fast_connectable,    MGMT_SETTING_SIZE },
7390         { set_bondable,            MGMT_SETTING_SIZE },
7391         { set_link_security,       MGMT_SETTING_SIZE },
7392         { set_ssp,                 MGMT_SETTING_SIZE },
7393         { set_hs,                  MGMT_SETTING_SIZE },
7394         { set_le,                  MGMT_SETTING_SIZE },
7395         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
7396         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
7397         { add_uuid,                MGMT_ADD_UUID_SIZE },
7398         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
7399         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
7400                                                 HCI_MGMT_VAR_LEN },
7401         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7402                                                 HCI_MGMT_VAR_LEN },
7403         { disconnect,              MGMT_DISCONNECT_SIZE },
7404         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
7405         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
7406         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
7407         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
7408         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
7409         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
7410         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
7411         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
7412         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7413         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
7414         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7415         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
7416         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7417                                                 HCI_MGMT_VAR_LEN },
7418         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7419         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
7420         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
7421         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
7422         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
7423         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
7424         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
7425         { set_advertising,         MGMT_SETTING_SIZE },
7426         { set_bredr,               MGMT_SETTING_SIZE },
7427         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
7428         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
7429         { set_secure_conn,         MGMT_SETTING_SIZE },
7430         { set_debug_keys,          MGMT_SETTING_SIZE },
7431         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
7432         { load_irks,               MGMT_LOAD_IRKS_SIZE,
7433                                                 HCI_MGMT_VAR_LEN },
7434         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
7435         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
7436         { add_device,              MGMT_ADD_DEVICE_SIZE },
7437         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
7438         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
7439                                                 HCI_MGMT_VAR_LEN },
7440         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7441                                                 HCI_MGMT_NO_HDEV |
7442                                                 HCI_MGMT_UNTRUSTED },
7443         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
7444                                                 HCI_MGMT_UNCONFIGURED |
7445                                                 HCI_MGMT_UNTRUSTED },
7446         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
7447                                                 HCI_MGMT_UNCONFIGURED },
7448         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
7449                                                 HCI_MGMT_UNCONFIGURED },
7450         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7451                                                 HCI_MGMT_VAR_LEN },
7452         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7453         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
7454                                                 HCI_MGMT_NO_HDEV |
7455                                                 HCI_MGMT_UNTRUSTED },
7456         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
7457         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
7458                                                 HCI_MGMT_VAR_LEN },
7459         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
7460 };
7461
7462 void mgmt_index_added(struct hci_dev *hdev)
7463 {
7464         struct mgmt_ev_ext_index ev;
7465
7466         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7467                 return;
7468
7469         switch (hdev->dev_type) {
7470         case HCI_BREDR:
7471                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7472                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7473                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7474                         ev.type = 0x01;
7475                 } else {
7476                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7477                                          HCI_MGMT_INDEX_EVENTS);
7478                         ev.type = 0x00;
7479                 }
7480                 break;
7481         case HCI_AMP:
7482                 ev.type = 0x02;
7483                 break;
7484         default:
7485                 return;
7486         }
7487
7488         ev.bus = hdev->bus;
7489
7490         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7491                          HCI_MGMT_EXT_INDEX_EVENTS);
7492 }
7493
7494 void mgmt_index_removed(struct hci_dev *hdev)
7495 {
7496         struct mgmt_ev_ext_index ev;
7497         u8 status = MGMT_STATUS_INVALID_INDEX;
7498
7499         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7500                 return;
7501
7502         switch (hdev->dev_type) {
7503         case HCI_BREDR:
7504                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7505
7506                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7507                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7508                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7509                         ev.type = 0x01;
7510                 } else {
7511                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7512                                          HCI_MGMT_INDEX_EVENTS);
7513                         ev.type = 0x00;
7514                 }
7515                 break;
7516         case HCI_AMP:
7517                 ev.type = 0x02;
7518                 break;
7519         default:
7520                 return;
7521         }
7522
7523         ev.bus = hdev->bus;
7524
7525         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7526                          HCI_MGMT_EXT_INDEX_EVENTS);
7527 }
7528
7529 /* This function requires the caller holds hdev->lock */
7530 static void restart_le_actions(struct hci_request *req)
7531 {
7532         struct hci_dev *hdev = req->hdev;
7533         struct hci_conn_params *p;
7534
7535         list_for_each_entry(p, &hdev->le_conn_params, list) {
7536                 /* Needed for AUTO_OFF case where might not "really"
7537                  * have been powered off.
7538                  */
7539                 list_del_init(&p->action);
7540
7541                 switch (p->auto_connect) {
7542                 case HCI_AUTO_CONN_DIRECT:
7543                 case HCI_AUTO_CONN_ALWAYS:
7544                         list_add(&p->action, &hdev->pend_le_conns);
7545                         break;
7546                 case HCI_AUTO_CONN_REPORT:
7547                         list_add(&p->action, &hdev->pend_le_reports);
7548                         break;
7549                 default:
7550                         break;
7551                 }
7552         }
7553
7554         __hci_update_background_scan(req);
7555 }
7556
7557 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7558 {
7559         struct cmd_lookup match = { NULL, hdev };
7560
7561         BT_DBG("status 0x%02x", status);
7562
7563         if (!status) {
7564                 /* Register the available SMP channels (BR/EDR and LE) only
7565                  * when successfully powering on the controller. This late
7566                  * registration is required so that LE SMP can clearly
7567                  * decide if the public address or static address is used.
7568                  */
7569                 smp_register(hdev);
7570         }
7571
7572         hci_dev_lock(hdev);
7573
7574         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7575
7576         new_settings(hdev, match.sk);
7577
7578         hci_dev_unlock(hdev);
7579
7580         if (match.sk)
7581                 sock_put(match.sk);
7582 }
7583
7584 static int powered_update_hci(struct hci_dev *hdev)
7585 {
7586         struct hci_request req;
7587         struct adv_info *adv_instance;
7588         u8 link_sec;
7589
7590         hci_req_init(&req, hdev);
7591
7592         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
7593             !lmp_host_ssp_capable(hdev)) {
7594                 u8 mode = 0x01;
7595
7596                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7597
7598                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7599                         u8 support = 0x01;
7600
7601                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7602                                     sizeof(support), &support);
7603                 }
7604         }
7605
7606         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7607             lmp_bredr_capable(hdev)) {
7608                 struct hci_cp_write_le_host_supported cp;
7609
7610                 cp.le = 0x01;
7611                 cp.simul = 0x00;
7612
7613                 /* Check first if we already have the right
7614                  * host state (host features set)
7615                  */
7616                 if (cp.le != lmp_host_le_capable(hdev) ||
7617                     cp.simul != lmp_host_le_br_capable(hdev))
7618                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7619                                     sizeof(cp), &cp);
7620         }
7621
7622         if (lmp_le_capable(hdev)) {
7623                 /* Make sure the controller has a good default for
7624                  * advertising data. This also applies to the case
7625                  * where BR/EDR was toggled during the AUTO_OFF phase.
7626                  */
7627                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7628                     (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7629                      !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))) {
7630                         update_adv_data(&req);
7631                         update_scan_rsp_data(&req);
7632                 }
7633
7634                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7635                     hdev->cur_adv_instance == 0x00 &&
7636                     !list_empty(&hdev->adv_instances)) {
7637                         adv_instance = list_first_entry(&hdev->adv_instances,
7638                                                         struct adv_info, list);
7639                         hdev->cur_adv_instance = adv_instance->instance;
7640                 }
7641
7642                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7643                         enable_advertising(&req);
7644                 else if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7645                          hdev->cur_adv_instance)
7646                         schedule_adv_instance(&req, hdev->cur_adv_instance,
7647                                               true);
7648
7649                 restart_le_actions(&req);
7650         }
7651
7652         link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
7653         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
7654                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7655                             sizeof(link_sec), &link_sec);
7656
7657         if (lmp_bredr_capable(hdev)) {
7658                 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
7659                         write_fast_connectable(&req, true);
7660                 else
7661                         write_fast_connectable(&req, false);
7662                 __hci_update_page_scan(&req);
7663                 update_class(&req);
7664                 update_name(&req);
7665                 update_eir(&req);
7666         }
7667
7668         return hci_req_run(&req, powered_complete);
7669 }
7670
7671 int mgmt_powered(struct hci_dev *hdev, u8 powered)
7672 {
7673         struct cmd_lookup match = { NULL, hdev };
7674         u8 status, zero_cod[] = { 0, 0, 0 };
7675         int err;
7676
7677         if (!hci_dev_test_flag(hdev, HCI_MGMT))
7678                 return 0;
7679
7680         if (powered) {
7681                 if (powered_update_hci(hdev) == 0)
7682                         return 0;
7683
7684                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7685                                      &match);
7686                 goto new_settings;
7687         }
7688
7689         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7690
7691         /* If the power off is because of hdev unregistration let
7692          * use the appropriate INVALID_INDEX status. Otherwise use
7693          * NOT_POWERED. We cover both scenarios here since later in
7694          * mgmt_index_removed() any hci_conn callbacks will have already
7695          * been triggered, potentially causing misleading DISCONNECTED
7696          * status responses.
7697          */
7698         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7699                 status = MGMT_STATUS_INVALID_INDEX;
7700         else
7701                 status = MGMT_STATUS_NOT_POWERED;
7702
7703         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7704
7705         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
7706                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7707                                    zero_cod, sizeof(zero_cod), NULL);
7708
7709 new_settings:
7710         err = new_settings(hdev, match.sk);
7711
7712         if (match.sk)
7713                 sock_put(match.sk);
7714
7715         return err;
7716 }
7717
7718 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7719 {
7720         struct mgmt_pending_cmd *cmd;
7721         u8 status;
7722
7723         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7724         if (!cmd)
7725                 return;
7726
7727         if (err == -ERFKILL)
7728                 status = MGMT_STATUS_RFKILLED;
7729         else
7730                 status = MGMT_STATUS_FAILED;
7731
7732         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7733
7734         mgmt_pending_remove(cmd);
7735 }
7736
7737 void mgmt_discoverable_timeout(struct hci_dev *hdev)
7738 {
7739         struct hci_request req;
7740
7741         hci_dev_lock(hdev);
7742
7743         /* When discoverable timeout triggers, then just make sure
7744          * the limited discoverable flag is cleared. Even in the case
7745          * of a timeout triggered from general discoverable, it is
7746          * safe to unconditionally clear the flag.
7747          */
7748         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7749         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
7750
7751         hci_req_init(&req, hdev);
7752         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7753                 u8 scan = SCAN_PAGE;
7754                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7755                             sizeof(scan), &scan);
7756         }
7757         update_class(&req);
7758
7759         /* Advertising instances don't use the global discoverable setting, so
7760          * only update AD if advertising was enabled using Set Advertising.
7761          */
7762         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7763                 update_adv_data(&req);
7764
7765         hci_req_run(&req, NULL);
7766
7767         hdev->discov_timeout = 0;
7768
7769         new_settings(hdev, NULL);
7770
7771         hci_dev_unlock(hdev);
7772 }
7773
7774 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7775                        bool persistent)
7776 {
7777         struct mgmt_ev_new_link_key ev;
7778
7779         memset(&ev, 0, sizeof(ev));
7780
7781         ev.store_hint = persistent;
7782         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7783         ev.key.addr.type = BDADDR_BREDR;
7784         ev.key.type = key->type;
7785         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7786         ev.key.pin_len = key->pin_len;
7787
7788         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7789 }
7790
7791 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7792 {
7793         switch (ltk->type) {
7794         case SMP_LTK:
7795         case SMP_LTK_SLAVE:
7796                 if (ltk->authenticated)
7797                         return MGMT_LTK_AUTHENTICATED;
7798                 return MGMT_LTK_UNAUTHENTICATED;
7799         case SMP_LTK_P256:
7800                 if (ltk->authenticated)
7801                         return MGMT_LTK_P256_AUTH;
7802                 return MGMT_LTK_P256_UNAUTH;
7803         case SMP_LTK_P256_DEBUG:
7804                 return MGMT_LTK_P256_DEBUG;
7805         }
7806
7807         return MGMT_LTK_UNAUTHENTICATED;
7808 }
7809
7810 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7811 {
7812         struct mgmt_ev_new_long_term_key ev;
7813
7814         memset(&ev, 0, sizeof(ev));
7815
7816         /* Devices using resolvable or non-resolvable random addresses
7817          * without providing an identity resolving key don't require
7818          * to store long term keys. Their addresses will change the
7819          * next time around.
7820          *
7821          * Only when a remote device provides an identity address
7822          * make sure the long term key is stored. If the remote
7823          * identity is known, the long term keys are internally
7824          * mapped to the identity address. So allow static random
7825          * and public addresses here.
7826          */
7827         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7828             (key->bdaddr.b[5] & 0xc0) != 0xc0)
7829                 ev.store_hint = 0x00;
7830         else
7831                 ev.store_hint = persistent;
7832
7833         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7834         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7835         ev.key.type = mgmt_ltk_type(key);
7836         ev.key.enc_size = key->enc_size;
7837         ev.key.ediv = key->ediv;
7838         ev.key.rand = key->rand;
7839
7840         if (key->type == SMP_LTK)
7841                 ev.key.master = 1;
7842
7843         /* Make sure we copy only the significant bytes based on the
7844          * encryption key size, and set the rest of the value to zeroes.
7845          */
7846         memcpy(ev.key.val, key->val, key->enc_size);
7847         memset(ev.key.val + key->enc_size, 0,
7848                sizeof(ev.key.val) - key->enc_size);
7849
7850         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7851 }
7852
7853 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7854 {
7855         struct mgmt_ev_new_irk ev;
7856
7857         memset(&ev, 0, sizeof(ev));
7858
7859         ev.store_hint = persistent;
7860
7861         bacpy(&ev.rpa, &irk->rpa);
7862         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7863         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7864         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7865
7866         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7867 }
7868
7869 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7870                    bool persistent)
7871 {
7872         struct mgmt_ev_new_csrk ev;
7873
7874         memset(&ev, 0, sizeof(ev));
7875
7876         /* Devices using resolvable or non-resolvable random addresses
7877          * without providing an identity resolving key don't require
7878          * to store signature resolving keys. Their addresses will change
7879          * the next time around.
7880          *
7881          * Only when a remote device provides an identity address
7882          * make sure the signature resolving key is stored. So allow
7883          * static random and public addresses here.
7884          */
7885         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7886             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7887                 ev.store_hint = 0x00;
7888         else
7889                 ev.store_hint = persistent;
7890
7891         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7892         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7893         ev.key.type = csrk->type;
7894         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7895
7896         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7897 }
7898
7899 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7900                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
7901                          u16 max_interval, u16 latency, u16 timeout)
7902 {
7903         struct mgmt_ev_new_conn_param ev;
7904
7905         if (!hci_is_identity_address(bdaddr, bdaddr_type))
7906                 return;
7907
7908         memset(&ev, 0, sizeof(ev));
7909         bacpy(&ev.addr.bdaddr, bdaddr);
7910         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7911         ev.store_hint = store_hint;
7912         ev.min_interval = cpu_to_le16(min_interval);
7913         ev.max_interval = cpu_to_le16(max_interval);
7914         ev.latency = cpu_to_le16(latency);
7915         ev.timeout = cpu_to_le16(timeout);
7916
7917         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7918 }
7919
7920 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7921                            u32 flags, u8 *name, u8 name_len)
7922 {
7923         char buf[512];
7924         struct mgmt_ev_device_connected *ev = (void *) buf;
7925         u16 eir_len = 0;
7926
7927         bacpy(&ev->addr.bdaddr, &conn->dst);
7928         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7929
7930         ev->flags = __cpu_to_le32(flags);
7931
7932         /* We must ensure that the EIR Data fields are ordered and
7933          * unique. Keep it simple for now and avoid the problem by not
7934          * adding any BR/EDR data to the LE adv.
7935          */
7936         if (conn->le_adv_data_len > 0) {
7937                 memcpy(&ev->eir[eir_len],
7938                        conn->le_adv_data, conn->le_adv_data_len);
7939                 eir_len = conn->le_adv_data_len;
7940         } else {
7941                 if (name_len > 0)
7942                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7943                                                   name, name_len);
7944
7945                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7946                         eir_len = eir_append_data(ev->eir, eir_len,
7947                                                   EIR_CLASS_OF_DEV,
7948                                                   conn->dev_class, 3);
7949         }
7950
7951         ev->eir_len = cpu_to_le16(eir_len);
7952
7953         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7954                     sizeof(*ev) + eir_len, NULL);
7955 }
7956
7957 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7958 {
7959         struct sock **sk = data;
7960
7961         cmd->cmd_complete(cmd, 0);
7962
7963         *sk = cmd->sk;
7964         sock_hold(*sk);
7965
7966         mgmt_pending_remove(cmd);
7967 }
7968
7969 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7970 {
7971         struct hci_dev *hdev = data;
7972         struct mgmt_cp_unpair_device *cp = cmd->param;
7973
7974         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7975
7976         cmd->cmd_complete(cmd, 0);
7977         mgmt_pending_remove(cmd);
7978 }
7979
7980 bool mgmt_powering_down(struct hci_dev *hdev)
7981 {
7982         struct mgmt_pending_cmd *cmd;
7983         struct mgmt_mode *cp;
7984
7985         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7986         if (!cmd)
7987                 return false;
7988
7989         cp = cmd->param;
7990         if (!cp->val)
7991                 return true;
7992
7993         return false;
7994 }
7995
7996 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7997                               u8 link_type, u8 addr_type, u8 reason,
7998                               bool mgmt_connected)
7999 {
8000         struct mgmt_ev_device_disconnected ev;
8001         struct sock *sk = NULL;
8002
8003         /* The connection is still in hci_conn_hash so test for 1
8004          * instead of 0 to know if this is the last one.
8005          */
8006         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8007                 cancel_delayed_work(&hdev->power_off);
8008                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8009         }
8010
8011         if (!mgmt_connected)
8012                 return;
8013
8014         if (link_type != ACL_LINK && link_type != LE_LINK)
8015                 return;
8016
8017         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8018
8019         bacpy(&ev.addr.bdaddr, bdaddr);
8020         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8021         ev.reason = reason;
8022
8023         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8024
8025         if (sk)
8026                 sock_put(sk);
8027
8028         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8029                              hdev);
8030 }
8031
8032 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8033                             u8 link_type, u8 addr_type, u8 status)
8034 {
8035         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8036         struct mgmt_cp_disconnect *cp;
8037         struct mgmt_pending_cmd *cmd;
8038
8039         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8040                              hdev);
8041
8042         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8043         if (!cmd)
8044                 return;
8045
8046         cp = cmd->param;
8047
8048         if (bacmp(bdaddr, &cp->addr.bdaddr))
8049                 return;
8050
8051         if (cp->addr.type != bdaddr_type)
8052                 return;
8053
8054         cmd->cmd_complete(cmd, mgmt_status(status));
8055         mgmt_pending_remove(cmd);
8056 }
8057
8058 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8059                          u8 addr_type, u8 status)
8060 {
8061         struct mgmt_ev_connect_failed ev;
8062
8063         /* The connection is still in hci_conn_hash so test for 1
8064          * instead of 0 to know if this is the last one.
8065          */
8066         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8067                 cancel_delayed_work(&hdev->power_off);
8068                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8069         }
8070
8071         bacpy(&ev.addr.bdaddr, bdaddr);
8072         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8073         ev.status = mgmt_status(status);
8074
8075         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8076 }
8077
8078 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8079 {
8080         struct mgmt_ev_pin_code_request ev;
8081
8082         bacpy(&ev.addr.bdaddr, bdaddr);
8083         ev.addr.type = BDADDR_BREDR;
8084         ev.secure = secure;
8085
8086         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8087 }
8088
8089 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8090                                   u8 status)
8091 {
8092         struct mgmt_pending_cmd *cmd;
8093
8094         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8095         if (!cmd)
8096                 return;
8097
8098         cmd->cmd_complete(cmd, mgmt_status(status));
8099         mgmt_pending_remove(cmd);
8100 }
8101
8102 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8103                                       u8 status)
8104 {
8105         struct mgmt_pending_cmd *cmd;
8106
8107         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8108         if (!cmd)
8109                 return;
8110
8111         cmd->cmd_complete(cmd, mgmt_status(status));
8112         mgmt_pending_remove(cmd);
8113 }
8114
8115 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8116                               u8 link_type, u8 addr_type, u32 value,
8117                               u8 confirm_hint)
8118 {
8119         struct mgmt_ev_user_confirm_request ev;
8120
8121         BT_DBG("%s", hdev->name);
8122
8123         bacpy(&ev.addr.bdaddr, bdaddr);
8124         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8125         ev.confirm_hint = confirm_hint;
8126         ev.value = cpu_to_le32(value);
8127
8128         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8129                           NULL);
8130 }
8131
8132 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8133                               u8 link_type, u8 addr_type)
8134 {
8135         struct mgmt_ev_user_passkey_request ev;
8136
8137         BT_DBG("%s", hdev->name);
8138
8139         bacpy(&ev.addr.bdaddr, bdaddr);
8140         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8141
8142         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8143                           NULL);
8144 }
8145
8146 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8147                                       u8 link_type, u8 addr_type, u8 status,
8148                                       u8 opcode)
8149 {
8150         struct mgmt_pending_cmd *cmd;
8151
8152         cmd = pending_find(opcode, hdev);
8153         if (!cmd)
8154                 return -ENOENT;
8155
8156         cmd->cmd_complete(cmd, mgmt_status(status));
8157         mgmt_pending_remove(cmd);
8158
8159         return 0;
8160 }
8161
8162 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8163                                      u8 link_type, u8 addr_type, u8 status)
8164 {
8165         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8166                                           status, MGMT_OP_USER_CONFIRM_REPLY);
8167 }
8168
8169 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8170                                          u8 link_type, u8 addr_type, u8 status)
8171 {
8172         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8173                                           status,
8174                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
8175 }
8176
8177 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8178                                      u8 link_type, u8 addr_type, u8 status)
8179 {
8180         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8181                                           status, MGMT_OP_USER_PASSKEY_REPLY);
8182 }
8183
8184 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8185                                          u8 link_type, u8 addr_type, u8 status)
8186 {
8187         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8188                                           status,
8189                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
8190 }
8191
8192 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8193                              u8 link_type, u8 addr_type, u32 passkey,
8194                              u8 entered)
8195 {
8196         struct mgmt_ev_passkey_notify ev;
8197
8198         BT_DBG("%s", hdev->name);
8199
8200         bacpy(&ev.addr.bdaddr, bdaddr);
8201         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8202         ev.passkey = __cpu_to_le32(passkey);
8203         ev.entered = entered;
8204
8205         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8206 }
8207
8208 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8209 {
8210         struct mgmt_ev_auth_failed ev;
8211         struct mgmt_pending_cmd *cmd;
8212         u8 status = mgmt_status(hci_status);
8213
8214         bacpy(&ev.addr.bdaddr, &conn->dst);
8215         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8216         ev.status = status;
8217
8218         cmd = find_pairing(conn);
8219
8220         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8221                     cmd ? cmd->sk : NULL);
8222
8223         if (cmd) {
8224                 cmd->cmd_complete(cmd, status);
8225                 mgmt_pending_remove(cmd);
8226         }
8227 }
8228
8229 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
8230 {
8231         struct cmd_lookup match = { NULL, hdev };
8232         bool changed;
8233
8234         if (status) {
8235                 u8 mgmt_err = mgmt_status(status);
8236                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8237                                      cmd_status_rsp, &mgmt_err);
8238                 return;
8239         }
8240
8241         if (test_bit(HCI_AUTH, &hdev->flags))
8242                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
8243         else
8244                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
8245
8246         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8247                              &match);
8248
8249         if (changed)
8250                 new_settings(hdev, match.sk);
8251
8252         if (match.sk)
8253                 sock_put(match.sk);
8254 }
8255
8256 static void clear_eir(struct hci_request *req)
8257 {
8258         struct hci_dev *hdev = req->hdev;
8259         struct hci_cp_write_eir cp;
8260
8261         if (!lmp_ext_inq_capable(hdev))
8262                 return;
8263
8264         memset(hdev->eir, 0, sizeof(hdev->eir));
8265
8266         memset(&cp, 0, sizeof(cp));
8267
8268         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8269 }
8270
8271 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8272 {
8273         struct cmd_lookup match = { NULL, hdev };
8274         struct hci_request req;
8275         bool changed = false;
8276
8277         if (status) {
8278                 u8 mgmt_err = mgmt_status(status);
8279
8280                 if (enable && hci_dev_test_and_clear_flag(hdev,
8281                                                           HCI_SSP_ENABLED)) {
8282                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8283                         new_settings(hdev, NULL);
8284                 }
8285
8286                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8287                                      &mgmt_err);
8288                 return;
8289         }
8290
8291         if (enable) {
8292                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
8293         } else {
8294                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
8295                 if (!changed)
8296                         changed = hci_dev_test_and_clear_flag(hdev,
8297                                                               HCI_HS_ENABLED);
8298                 else
8299                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8300         }
8301
8302         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8303
8304         if (changed)
8305                 new_settings(hdev, match.sk);
8306
8307         if (match.sk)
8308                 sock_put(match.sk);
8309
8310         hci_req_init(&req, hdev);
8311
8312         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8313                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
8314                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8315                                     sizeof(enable), &enable);
8316                 update_eir(&req);
8317         } else {
8318                 clear_eir(&req);
8319         }
8320
8321         hci_req_run(&req, NULL);
8322 }
8323
8324 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
8325 {
8326         struct cmd_lookup *match = data;
8327
8328         if (match->sk == NULL) {
8329                 match->sk = cmd->sk;
8330                 sock_hold(match->sk);
8331         }
8332 }
8333
8334 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8335                                     u8 status)
8336 {
8337         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8338
8339         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8340         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8341         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8342
8343         if (!status)
8344                 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8345                                    dev_class, 3, NULL);
8346
8347         if (match.sk)
8348                 sock_put(match.sk);
8349 }
8350
8351 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8352 {
8353         struct mgmt_cp_set_local_name ev;
8354         struct mgmt_pending_cmd *cmd;
8355
8356         if (status)
8357                 return;
8358
8359         memset(&ev, 0, sizeof(ev));
8360         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
8361         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
8362
8363         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
8364         if (!cmd) {
8365                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
8366
8367                 /* If this is a HCI command related to powering on the
8368                  * HCI dev don't send any mgmt signals.
8369                  */
8370                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
8371                         return;
8372         }
8373
8374         mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8375                            cmd ? cmd->sk : NULL);
8376 }
8377
8378 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8379 {
8380         int i;
8381
8382         for (i = 0; i < uuid_count; i++) {
8383                 if (!memcmp(uuid, uuids[i], 16))
8384                         return true;
8385         }
8386
8387         return false;
8388 }
8389
8390 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8391 {
8392         u16 parsed = 0;
8393
8394         while (parsed < eir_len) {
8395                 u8 field_len = eir[0];
8396                 u8 uuid[16];
8397                 int i;
8398
8399                 if (field_len == 0)
8400                         break;
8401
8402                 if (eir_len - parsed < field_len + 1)
8403                         break;
8404
8405                 switch (eir[1]) {
8406                 case EIR_UUID16_ALL:
8407                 case EIR_UUID16_SOME:
8408                         for (i = 0; i + 3 <= field_len; i += 2) {
8409                                 memcpy(uuid, bluetooth_base_uuid, 16);
8410                                 uuid[13] = eir[i + 3];
8411                                 uuid[12] = eir[i + 2];
8412                                 if (has_uuid(uuid, uuid_count, uuids))
8413                                         return true;
8414                         }
8415                         break;
8416                 case EIR_UUID32_ALL:
8417                 case EIR_UUID32_SOME:
8418                         for (i = 0; i + 5 <= field_len; i += 4) {
8419                                 memcpy(uuid, bluetooth_base_uuid, 16);
8420                                 uuid[15] = eir[i + 5];
8421                                 uuid[14] = eir[i + 4];
8422                                 uuid[13] = eir[i + 3];
8423                                 uuid[12] = eir[i + 2];
8424                                 if (has_uuid(uuid, uuid_count, uuids))
8425                                         return true;
8426                         }
8427                         break;
8428                 case EIR_UUID128_ALL:
8429                 case EIR_UUID128_SOME:
8430                         for (i = 0; i + 17 <= field_len; i += 16) {
8431                                 memcpy(uuid, eir + i + 2, 16);
8432                                 if (has_uuid(uuid, uuid_count, uuids))
8433                                         return true;
8434                         }
8435                         break;
8436                 }
8437
8438                 parsed += field_len + 1;
8439                 eir += field_len + 1;
8440         }
8441
8442         return false;
8443 }
8444
8445 static void restart_le_scan(struct hci_dev *hdev)
8446 {
8447         /* If controller is not scanning we are done. */
8448         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8449                 return;
8450
8451         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8452                        hdev->discovery.scan_start +
8453                        hdev->discovery.scan_duration))
8454                 return;
8455
8456         queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8457                            DISCOV_LE_RESTART_DELAY);
8458 }
8459
8460 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8461                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8462 {
8463         /* If a RSSI threshold has been specified, and
8464          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8465          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8466          * is set, let it through for further processing, as we might need to
8467          * restart the scan.
8468          *
8469          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8470          * the results are also dropped.
8471          */
8472         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8473             (rssi == HCI_RSSI_INVALID ||
8474             (rssi < hdev->discovery.rssi &&
8475              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8476                 return  false;
8477
8478         if (hdev->discovery.uuid_count != 0) {
8479                 /* If a list of UUIDs is provided in filter, results with no
8480                  * matching UUID should be dropped.
8481                  */
8482                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8483                                    hdev->discovery.uuids) &&
8484                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8485                                    hdev->discovery.uuid_count,
8486                                    hdev->discovery.uuids))
8487                         return false;
8488         }
8489
8490         /* If duplicate filtering does not report RSSI changes, then restart
8491          * scanning to ensure updated result with updated RSSI values.
8492          */
8493         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8494                 restart_le_scan(hdev);
8495
8496                 /* Validate RSSI value against the RSSI threshold once more. */
8497                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8498                     rssi < hdev->discovery.rssi)
8499                         return false;
8500         }
8501
8502         return true;
8503 }
8504
8505 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8506                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8507                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8508 {
8509         char buf[512];
8510         struct mgmt_ev_device_found *ev = (void *)buf;
8511         size_t ev_size;
8512
8513         /* Don't send events for a non-kernel initiated discovery. With
8514          * LE one exception is if we have pend_le_reports > 0 in which
8515          * case we're doing passive scanning and want these events.
8516          */
8517         if (!hci_discovery_active(hdev)) {
8518                 if (link_type == ACL_LINK)
8519                         return;
8520                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8521                         return;
8522         }
8523
8524         if (hdev->discovery.result_filtering) {
8525                 /* We are using service discovery */
8526                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8527                                      scan_rsp_len))
8528                         return;
8529         }
8530
8531         /* Make sure that the buffer is big enough. The 5 extra bytes
8532          * are for the potential CoD field.
8533          */
8534         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8535                 return;
8536
8537         memset(buf, 0, sizeof(buf));
8538
8539         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8540          * RSSI value was reported as 0 when not available. This behavior
8541          * is kept when using device discovery. This is required for full
8542          * backwards compatibility with the API.
8543          *
8544          * However when using service discovery, the value 127 will be
8545          * returned when the RSSI is not available.
8546          */
8547         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8548             link_type == ACL_LINK)
8549                 rssi = 0;
8550
8551         bacpy(&ev->addr.bdaddr, bdaddr);
8552         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8553         ev->rssi = rssi;
8554         ev->flags = cpu_to_le32(flags);
8555
8556         if (eir_len > 0)
8557                 /* Copy EIR or advertising data into event */
8558                 memcpy(ev->eir, eir, eir_len);
8559
8560         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8561                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8562                                           dev_class, 3);
8563
8564         if (scan_rsp_len > 0)
8565                 /* Append scan response data to event */
8566                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8567
8568         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8569         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8570
8571         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8572 }
8573
8574 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8575                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8576 {
8577         struct mgmt_ev_device_found *ev;
8578         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8579         u16 eir_len;
8580
8581         ev = (struct mgmt_ev_device_found *) buf;
8582
8583         memset(buf, 0, sizeof(buf));
8584
8585         bacpy(&ev->addr.bdaddr, bdaddr);
8586         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8587         ev->rssi = rssi;
8588
8589         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8590                                   name_len);
8591
8592         ev->eir_len = cpu_to_le16(eir_len);
8593
8594         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8595 }
8596
8597 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8598 {
8599         struct mgmt_ev_discovering ev;
8600
8601         BT_DBG("%s discovering %u", hdev->name, discovering);
8602
8603         memset(&ev, 0, sizeof(ev));
8604         ev.type = hdev->discovery.type;
8605         ev.discovering = discovering;
8606
8607         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8608 }
8609
8610 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8611 {
8612         BT_DBG("%s status %u", hdev->name, status);
8613 }
8614
8615 void mgmt_reenable_advertising(struct hci_dev *hdev)
8616 {
8617         struct hci_request req;
8618         u8 instance;
8619
8620         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8621             !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
8622                 return;
8623
8624         instance = get_current_adv_instance(hdev);
8625
8626         hci_req_init(&req, hdev);
8627
8628         if (instance) {
8629                 schedule_adv_instance(&req, instance, true);
8630         } else {
8631                 update_adv_data(&req);
8632                 update_scan_rsp_data(&req);
8633                 enable_advertising(&req);
8634         }
8635
8636         hci_req_run(&req, adv_enable_complete);
8637 }
8638
8639 static struct hci_mgmt_chan chan = {
8640         .channel        = HCI_CHANNEL_CONTROL,
8641         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8642         .handlers       = mgmt_handlers,
8643         .hdev_init      = mgmt_init_hdev,
8644 };
8645
8646 int mgmt_init(void)
8647 {
8648         return hci_mgmt_chan_register(&chan);
8649 }
8650
8651 void mgmt_exit(void)
8652 {
8653         hci_mgmt_chan_unregister(&chan);
8654 }