net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "hci_request.h"
  36 #include "smp.h"
  37
  38 #define MGMT_VERSION    1
  39 #define MGMT_REVISION   8
  40
  41 static const u16 mgmt_commands[] = {
  42         MGMT_OP_READ_INDEX_LIST,
  43         MGMT_OP_READ_INFO,
  44         MGMT_OP_SET_POWERED,
  45         MGMT_OP_SET_DISCOVERABLE,
  46         MGMT_OP_SET_CONNECTABLE,
  47         MGMT_OP_SET_FAST_CONNECTABLE,
  48         MGMT_OP_SET_BONDABLE,
  49         MGMT_OP_SET_LINK_SECURITY,
  50         MGMT_OP_SET_SSP,
  51         MGMT_OP_SET_HS,
  52         MGMT_OP_SET_LE,
  53         MGMT_OP_SET_DEV_CLASS,
  54         MGMT_OP_SET_LOCAL_NAME,
  55         MGMT_OP_ADD_UUID,
  56         MGMT_OP_REMOVE_UUID,
  57         MGMT_OP_LOAD_LINK_KEYS,
  58         MGMT_OP_LOAD_LONG_TERM_KEYS,
  59         MGMT_OP_DISCONNECT,
  60         MGMT_OP_GET_CONNECTIONS,
  61         MGMT_OP_PIN_CODE_REPLY,
  62         MGMT_OP_PIN_CODE_NEG_REPLY,
  63         MGMT_OP_SET_IO_CAPABILITY,
  64         MGMT_OP_PAIR_DEVICE,
  65         MGMT_OP_CANCEL_PAIR_DEVICE,
  66         MGMT_OP_UNPAIR_DEVICE,
  67         MGMT_OP_USER_CONFIRM_REPLY,
  68         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  69         MGMT_OP_USER_PASSKEY_REPLY,
  70         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  71         MGMT_OP_READ_LOCAL_OOB_DATA,
  72         MGMT_OP_ADD_REMOTE_OOB_DATA,
  73         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  74         MGMT_OP_START_DISCOVERY,
  75         MGMT_OP_STOP_DISCOVERY,
  76         MGMT_OP_CONFIRM_NAME,
  77         MGMT_OP_BLOCK_DEVICE,
  78         MGMT_OP_UNBLOCK_DEVICE,
  79         MGMT_OP_SET_DEVICE_ID,
  80         MGMT_OP_SET_ADVERTISING,
  81         MGMT_OP_SET_BREDR,
  82         MGMT_OP_SET_STATIC_ADDRESS,
  83         MGMT_OP_SET_SCAN_PARAMS,
  84         MGMT_OP_SET_SECURE_CONN,
  85         MGMT_OP_SET_DEBUG_KEYS,
  86         MGMT_OP_SET_PRIVACY,
  87         MGMT_OP_LOAD_IRKS,
  88         MGMT_OP_GET_CONN_INFO,
  89         MGMT_OP_GET_CLOCK_INFO,
  90         MGMT_OP_ADD_DEVICE,
  91         MGMT_OP_REMOVE_DEVICE,
  92         MGMT_OP_LOAD_CONN_PARAM,
  93         MGMT_OP_READ_UNCONF_INDEX_LIST,
  94         MGMT_OP_READ_CONFIG_INFO,
  95         MGMT_OP_SET_EXTERNAL_CONFIG,
  96         MGMT_OP_SET_PUBLIC_ADDRESS,
  97         MGMT_OP_START_SERVICE_DISCOVERY,
  98 };
  99
 100 static const u16 mgmt_events[] = {
 101         MGMT_EV_CONTROLLER_ERROR,
 102         MGMT_EV_INDEX_ADDED,
 103         MGMT_EV_INDEX_REMOVED,
 104         MGMT_EV_NEW_SETTINGS,
 105         MGMT_EV_CLASS_OF_DEV_CHANGED,
 106         MGMT_EV_LOCAL_NAME_CHANGED,
 107         MGMT_EV_NEW_LINK_KEY,
 108         MGMT_EV_NEW_LONG_TERM_KEY,
 109         MGMT_EV_DEVICE_CONNECTED,
 110         MGMT_EV_DEVICE_DISCONNECTED,
 111         MGMT_EV_CONNECT_FAILED,
 112         MGMT_EV_PIN_CODE_REQUEST,
 113         MGMT_EV_USER_CONFIRM_REQUEST,
 114         MGMT_EV_USER_PASSKEY_REQUEST,
 115         MGMT_EV_AUTH_FAILED,
 116         MGMT_EV_DEVICE_FOUND,
 117         MGMT_EV_DISCOVERING,
 118         MGMT_EV_DEVICE_BLOCKED,
 119         MGMT_EV_DEVICE_UNBLOCKED,
 120         MGMT_EV_DEVICE_UNPAIRED,
 121         MGMT_EV_PASSKEY_NOTIFY,
 122         MGMT_EV_NEW_IRK,
 123         MGMT_EV_NEW_CSRK,
 124         MGMT_EV_DEVICE_ADDED,
 125         MGMT_EV_DEVICE_REMOVED,
 126         MGMT_EV_NEW_CONN_PARAM,
 127         MGMT_EV_UNCONF_INDEX_ADDED,
 128         MGMT_EV_UNCONF_INDEX_REMOVED,
 129         MGMT_EV_NEW_CONFIG_OPTIONS,
 130 };
 131
 132 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 133
 134 struct pending_cmd {
 135         struct list_head list;
 136         u16 opcode;
 137         int index;
 138         void *param;
 139         size_t param_len;
 140         struct sock *sk;
 141         void *user_data;
 142         int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 143 };
 144
 145 /* HCI to MGMT error code conversion table */
 146 static u8 mgmt_status_table[] = {
 147         MGMT_STATUS_SUCCESS,
 148         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 149         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 150         MGMT_STATUS_FAILED,             /* Hardware Failure */
 151         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 152         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 153         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 154         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 155         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 157         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 158         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 159         MGMT_STATUS_BUSY,               /* Command Disallowed */
 160         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 161         MGMT_STATUS_REJECTED,           /* Rejected Security */
 162         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 163         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 166         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 167         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 168         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 169         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 170         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 171         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 172         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 174         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 175         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 176         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 178         MGMT_STATUS_FAILED,             /* Unspecified Error */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 180         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 181         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 182         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 183         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 184         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 185         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 187         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 189         MGMT_STATUS_FAILED,             /* Transaction Collision */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 191         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 193         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 194         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 195         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 196         MGMT_STATUS_FAILED,             /* Slot Violation */
 197         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 198         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 200         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 201         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 202         MGMT_STATUS_BUSY,               /* Controller Busy */
 203         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 204         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 205         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 206         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 207         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 208 };
 209
 210 static u8 mgmt_status(u8 hci_status)
 211 {
 212         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 213                 return mgmt_status_table[hci_status];
 214
 215         return MGMT_STATUS_FAILED;
 216 }
 217
 218 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 219                       struct sock *skip_sk)
 220 {
 221         struct sk_buff *skb;
 222         struct mgmt_hdr *hdr;
 223
 224         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 225         if (!skb)
 226                 return -ENOMEM;
 227
 228         hdr = (void *) skb_put(skb, sizeof(*hdr));
 229         hdr->opcode = cpu_to_le16(event);
 230         if (hdev)
 231                 hdr->index = cpu_to_le16(hdev->id);
 232         else
 233                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 234         hdr->len = cpu_to_le16(data_len);
 235
 236         if (data)
 237                 memcpy(skb_put(skb, data_len), data, data_len);
 238
 239         /* Time stamp */
 240         __net_timestamp(skb);
 241
 242         hci_send_to_control(skb, skip_sk);
 243         kfree_skb(skb);
 244
 245         return 0;
 246 }
 247
 248 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 249 {
 250         struct sk_buff *skb;
 251         struct mgmt_hdr *hdr;
 252         struct mgmt_ev_cmd_status *ev;
 253         int err;
 254
 255         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 256
 257         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 258         if (!skb)
 259                 return -ENOMEM;
 260
 261         hdr = (void *) skb_put(skb, sizeof(*hdr));
 262
 263         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 264         hdr->index = cpu_to_le16(index);
 265         hdr->len = cpu_to_le16(sizeof(*ev));
 266
 267         ev = (void *) skb_put(skb, sizeof(*ev));
 268         ev->status = status;
 269         ev->opcode = cpu_to_le16(cmd);
 270
 271         err = sock_queue_rcv_skb(sk, skb);
 272         if (err < 0)
 273                 kfree_skb(skb);
 274
 275         return err;
 276 }
 277
 278 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 279                         void *rp, size_t rp_len)
 280 {
 281         struct sk_buff *skb;
 282         struct mgmt_hdr *hdr;
 283         struct mgmt_ev_cmd_complete *ev;
 284         int err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 289         if (!skb)
 290                 return -ENOMEM;
 291
 292         hdr = (void *) skb_put(skb, sizeof(*hdr));
 293
 294         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 295         hdr->index = cpu_to_le16(index);
 296         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 297
 298         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 299         ev->opcode = cpu_to_le16(cmd);
 300         ev->status = status;
 301
 302         if (rp)
 303                 memcpy(ev->data, rp, rp_len);
 304
 305         err = sock_queue_rcv_skb(sk, skb);
 306         if (err < 0)
 307                 kfree_skb(skb);
 308
 309         return err;
 310 }
 311
 312 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 313                         u16 data_len)
 314 {
 315         struct mgmt_rp_read_version rp;
 316
 317         BT_DBG("sock %p", sk);
 318
 319         rp.version = MGMT_VERSION;
 320         rp.revision = cpu_to_le16(MGMT_REVISION);
 321
 322         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 323                             sizeof(rp));
 324 }
 325
 326 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 327                          u16 data_len)
 328 {
 329         struct mgmt_rp_read_commands *rp;
 330         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 331         const u16 num_events = ARRAY_SIZE(mgmt_events);
 332         __le16 *opcode;
 333         size_t rp_size;
 334         int i, err;
 335
 336         BT_DBG("sock %p", sk);
 337
 338         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 339
 340         rp = kmalloc(rp_size, GFP_KERNEL);
 341         if (!rp)
 342                 return -ENOMEM;
 343
 344         rp->num_commands = cpu_to_le16(num_commands);
 345         rp->num_events = cpu_to_le16(num_events);
 346
 347         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 348                 put_unaligned_le16(mgmt_commands[i], opcode);
 349
 350         for (i = 0; i < num_events; i++, opcode++)
 351                 put_unaligned_le16(mgmt_events[i], opcode);
 352
 353         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 354                            rp_size);
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 361                            u16 data_len)
 362 {
 363         struct mgmt_rp_read_index_list *rp;
 364         struct hci_dev *d;
 365         size_t rp_len;
 366         u16 count;
 367         int err;
 368
 369         BT_DBG("sock %p", sk);
 370
 371         read_lock(&hci_dev_list_lock);
 372
 373         count = 0;
 374         list_for_each_entry(d, &hci_dev_list, list) {
 375                 if (d->dev_type == HCI_BREDR &&
 376                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 377                         count++;
 378         }
 379
 380         rp_len = sizeof(*rp) + (2 * count);
 381         rp = kmalloc(rp_len, GFP_ATOMIC);
 382         if (!rp) {
 383                 read_unlock(&hci_dev_list_lock);
 384                 return -ENOMEM;
 385         }
 386
 387         count = 0;
 388         list_for_each_entry(d, &hci_dev_list, list) {
 389                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 390                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 391                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 392                         continue;
 393
 394                 /* Devices marked as raw-only are neither configured
 395                  * nor unconfigured controllers.
 396                  */
 397                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 398                         continue;
 399
 400                 if (d->dev_type == HCI_BREDR &&
 401                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 402                         rp->index[count++] = cpu_to_le16(d->id);
 403                         BT_DBG("Added hci%u", d->id);
 404                 }
 405         }
 406
 407         rp->num_controllers = cpu_to_le16(count);
 408         rp_len = sizeof(*rp) + (2 * count);
 409
 410         read_unlock(&hci_dev_list_lock);
 411
 412         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 413                            rp_len);
 414
 415         kfree(rp);
 416
 417         return err;
 418 }
 419
 420 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 421                                   void *data, u16 data_len)
 422 {
 423         struct mgmt_rp_read_unconf_index_list *rp;
 424         struct hci_dev *d;
 425         size_t rp_len;
 426         u16 count;
 427         int err;
 428
 429         BT_DBG("sock %p", sk);
 430
 431         read_lock(&hci_dev_list_lock);
 432
 433         count = 0;
 434         list_for_each_entry(d, &hci_dev_list, list) {
 435                 if (d->dev_type == HCI_BREDR &&
 436                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 437                         count++;
 438         }
 439
 440         rp_len = sizeof(*rp) + (2 * count);
 441         rp = kmalloc(rp_len, GFP_ATOMIC);
 442         if (!rp) {
 443                 read_unlock(&hci_dev_list_lock);
 444                 return -ENOMEM;
 445         }
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 450                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 451                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 452                         continue;
 453
 454                 /* Devices marked as raw-only are neither configured
 455                  * nor unconfigured controllers.
 456                  */
 457                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 458                         continue;
 459
 460                 if (d->dev_type == HCI_BREDR &&
 461                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 462                         rp->index[count++] = cpu_to_le16(d->id);
 463                         BT_DBG("Added hci%u", d->id);
 464                 }
 465         }
 466
 467         rp->num_controllers = cpu_to_le16(count);
 468         rp_len = sizeof(*rp) + (2 * count);
 469
 470         read_unlock(&hci_dev_list_lock);
 471
 472         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 473                            0, rp, rp_len);
 474
 475         kfree(rp);
 476
 477         return err;
 478 }
 479
 480 static bool is_configured(struct hci_dev *hdev)
 481 {
 482         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 483             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 484                 return false;
 485
 486         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 487             !bacmp(&hdev->public_addr, BDADDR_ANY))
 488                 return false;
 489
 490         return true;
 491 }
 492
 493 static __le32 get_missing_options(struct hci_dev *hdev)
 494 {
 495         u32 options = 0;
 496
 497         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 498             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 499                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 500
 501         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 502             !bacmp(&hdev->public_addr, BDADDR_ANY))
 503                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 504
 505         return cpu_to_le32(options);
 506 }
 507
 508 static int new_options(struct hci_dev *hdev, struct sock *skip)
 509 {
 510         __le32 options = get_missing_options(hdev);
 511
 512         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 513                           sizeof(options), skip);
 514 }
 515
 516 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 517 {
 518         __le32 options = get_missing_options(hdev);
 519
 520         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 521                             sizeof(options));
 522 }
 523
 524 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 525                             void *data, u16 data_len)
 526 {
 527         struct mgmt_rp_read_config_info rp;
 528         u32 options = 0;
 529
 530         BT_DBG("sock %p %s", sk, hdev->name);
 531
 532         hci_dev_lock(hdev);
 533
 534         memset(&rp, 0, sizeof(rp));
 535         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 536
 537         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 538                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 539
 540         if (hdev->set_bdaddr)
 541                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 542
 543         rp.supported_options = cpu_to_le32(options);
 544         rp.missing_options = get_missing_options(hdev);
 545
 546         hci_dev_unlock(hdev);
 547
 548         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 549                             sizeof(rp));
 550 }
 551
 552 static u32 get_supported_settings(struct hci_dev *hdev)
 553 {
 554         u32 settings = 0;
 555
 556         settings |= MGMT_SETTING_POWERED;
 557         settings |= MGMT_SETTING_BONDABLE;
 558         settings |= MGMT_SETTING_DEBUG_KEYS;
 559         settings |= MGMT_SETTING_CONNECTABLE;
 560         settings |= MGMT_SETTING_DISCOVERABLE;
 561
 562         if (lmp_bredr_capable(hdev)) {
 563                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 564                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 565                 settings |= MGMT_SETTING_BREDR;
 566                 settings |= MGMT_SETTING_LINK_SECURITY;
 567
 568                 if (lmp_ssp_capable(hdev)) {
 569                         settings |= MGMT_SETTING_SSP;
 570                         settings |= MGMT_SETTING_HS;
 571                 }
 572
 573                 if (lmp_sc_capable(hdev))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_SECURE_CONN;
 581                 settings |= MGMT_SETTING_PRIVACY;
 582         }
 583
 584         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 585             hdev->set_bdaddr)
 586                 settings |= MGMT_SETTING_CONFIGURATION;
 587
 588         return settings;
 589 }
 590
 591 static u32 get_current_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         if (hdev_is_powered(hdev))
 596                 settings |= MGMT_SETTING_POWERED;
 597
 598         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 599                 settings |= MGMT_SETTING_CONNECTABLE;
 600
 601         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 602                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 603
 604         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 605                 settings |= MGMT_SETTING_DISCOVERABLE;
 606
 607         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 608                 settings |= MGMT_SETTING_BONDABLE;
 609
 610         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 611                 settings |= MGMT_SETTING_BREDR;
 612
 613         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 614                 settings |= MGMT_SETTING_LE;
 615
 616         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 617                 settings |= MGMT_SETTING_LINK_SECURITY;
 618
 619         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 620                 settings |= MGMT_SETTING_SSP;
 621
 622         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 623                 settings |= MGMT_SETTING_HS;
 624
 625         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 626                 settings |= MGMT_SETTING_ADVERTISING;
 627
 628         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 629                 settings |= MGMT_SETTING_SECURE_CONN;
 630
 631         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 632                 settings |= MGMT_SETTING_DEBUG_KEYS;
 633
 634         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 635                 settings |= MGMT_SETTING_PRIVACY;
 636
 637         return settings;
 638 }
 639
 640 #define PNP_INFO_SVCLASS_ID             0x1200
 641
 642 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 643 {
 644         u8 *ptr = data, *uuids_start = NULL;
 645         struct bt_uuid *uuid;
 646
 647         if (len < 4)
 648                 return ptr;
 649
 650         list_for_each_entry(uuid, &hdev->uuids, list) {
 651                 u16 uuid16;
 652
 653                 if (uuid->size != 16)
 654                         continue;
 655
 656                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 657                 if (uuid16 < 0x1100)
 658                         continue;
 659
 660                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 661                         continue;
 662
 663                 if (!uuids_start) {
 664                         uuids_start = ptr;
 665                         uuids_start[0] = 1;
 666                         uuids_start[1] = EIR_UUID16_ALL;
 667                         ptr += 2;
 668                 }
 669
 670                 /* Stop if not enough space to put next UUID */
 671                 if ((ptr - data) + sizeof(u16) > len) {
 672                         uuids_start[1] = EIR_UUID16_SOME;
 673                         break;
 674                 }
 675
 676                 *ptr++ = (uuid16 & 0x00ff);
 677                 *ptr++ = (uuid16 & 0xff00) >> 8;
 678                 uuids_start[0] += sizeof(uuid16);
 679         }
 680
 681         return ptr;
 682 }
 683
 684 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 685 {
 686         u8 *ptr = data, *uuids_start = NULL;
 687         struct bt_uuid *uuid;
 688
 689         if (len < 6)
 690                 return ptr;
 691
 692         list_for_each_entry(uuid, &hdev->uuids, list) {
 693                 if (uuid->size != 32)
 694                         continue;
 695
 696                 if (!uuids_start) {
 697                         uuids_start = ptr;
 698                         uuids_start[0] = 1;
 699                         uuids_start[1] = EIR_UUID32_ALL;
 700                         ptr += 2;
 701                 }
 702
 703                 /* Stop if not enough space to put next UUID */
 704                 if ((ptr - data) + sizeof(u32) > len) {
 705                         uuids_start[1] = EIR_UUID32_SOME;
 706                         break;
 707                 }
 708
 709                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 710                 ptr += sizeof(u32);
 711                 uuids_start[0] += sizeof(u32);
 712         }
 713
 714         return ptr;
 715 }
 716
 717 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 718 {
 719         u8 *ptr = data, *uuids_start = NULL;
 720         struct bt_uuid *uuid;
 721
 722         if (len < 18)
 723                 return ptr;
 724
 725         list_for_each_entry(uuid, &hdev->uuids, list) {
 726                 if (uuid->size != 128)
 727                         continue;
 728
 729                 if (!uuids_start) {
 730                         uuids_start = ptr;
 731                         uuids_start[0] = 1;
 732                         uuids_start[1] = EIR_UUID128_ALL;
 733                         ptr += 2;
 734                 }
 735
 736                 /* Stop if not enough space to put next UUID */
 737                 if ((ptr - data) + 16 > len) {
 738                         uuids_start[1] = EIR_UUID128_SOME;
 739                         break;
 740                 }
 741
 742                 memcpy(ptr, uuid->uuid, 16);
 743                 ptr += 16;
 744                 uuids_start[0] += 16;
 745         }
 746
 747         return ptr;
 748 }
 749
 750 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 751 {
 752         struct pending_cmd *cmd;
 753
 754         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 755                 if (cmd->opcode == opcode)
 756                         return cmd;
 757         }
 758
 759         return NULL;
 760 }
 761
 762 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 763                                                   struct hci_dev *hdev,
 764                                                   const void *data)
 765 {
 766         struct pending_cmd *cmd;
 767
 768         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 769                 if (cmd->user_data != data)
 770                         continue;
 771                 if (cmd->opcode == opcode)
 772                         return cmd;
 773         }
 774
 775         return NULL;
 776 }
 777
 778 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 779 {
 780         u8 ad_len = 0;
 781         size_t name_len;
 782
 783         name_len = strlen(hdev->dev_name);
 784         if (name_len > 0) {
 785                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 786
 787                 if (name_len > max_len) {
 788                         name_len = max_len;
 789                         ptr[1] = EIR_NAME_SHORT;
 790                 } else
 791                         ptr[1] = EIR_NAME_COMPLETE;
 792
 793                 ptr[0] = name_len + 1;
 794
 795                 memcpy(ptr + 2, hdev->dev_name, name_len);
 796
 797                 ad_len += (name_len + 2);
 798                 ptr += (name_len + 2);
 799         }
 800
 801         return ad_len;
 802 }
 803
 804 static void update_scan_rsp_data(struct hci_request *req)
 805 {
 806         struct hci_dev *hdev = req->hdev;
 807         struct hci_cp_le_set_scan_rsp_data cp;
 808         u8 len;
 809
 810         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 811                 return;
 812
 813         memset(&cp, 0, sizeof(cp));
 814
 815         len = create_scan_rsp_data(hdev, cp.data);
 816
 817         if (hdev->scan_rsp_data_len == len &&
 818             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 819                 return;
 820
 821         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 822         hdev->scan_rsp_data_len = len;
 823
 824         cp.length = len;
 825
 826         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 827 }
 828
 829 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 830 {
 831         struct pending_cmd *cmd;
 832
 833         /* If there's a pending mgmt command the flags will not yet have
 834          * their final values, so check for this first.
 835          */
 836         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 837         if (cmd) {
 838                 struct mgmt_mode *cp = cmd->param;
 839                 if (cp->val == 0x01)
 840                         return LE_AD_GENERAL;
 841                 else if (cp->val == 0x02)
 842                         return LE_AD_LIMITED;
 843         } else {
 844                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 845                         return LE_AD_LIMITED;
 846                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 847                         return LE_AD_GENERAL;
 848         }
 849
 850         return 0;
 851 }
 852
 853 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 854 {
 855         u8 ad_len = 0, flags = 0;
 856
 857         flags |= get_adv_discov_flags(hdev);
 858
 859         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 860                 flags |= LE_AD_NO_BREDR;
 861
 862         if (flags) {
 863                 BT_DBG("adv flags 0x%02x", flags);
 864
 865                 ptr[0] = 2;
 866                 ptr[1] = EIR_FLAGS;
 867                 ptr[2] = flags;
 868
 869                 ad_len += 3;
 870                 ptr += 3;
 871         }
 872
 873         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 874                 ptr[0] = 2;
 875                 ptr[1] = EIR_TX_POWER;
 876                 ptr[2] = (u8) hdev->adv_tx_power;
 877
 878                 ad_len += 3;
 879                 ptr += 3;
 880         }
 881
 882         return ad_len;
 883 }
 884
 885 static void update_adv_data(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         struct hci_cp_le_set_adv_data cp;
 889         u8 len;
 890
 891         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 892                 return;
 893
 894         memset(&cp, 0, sizeof(cp));
 895
 896         len = create_adv_data(hdev, cp.data);
 897
 898         if (hdev->adv_data_len == len &&
 899             memcmp(cp.data, hdev->adv_data, len) == 0)
 900                 return;
 901
 902         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 903         hdev->adv_data_len = len;
 904
 905         cp.length = len;
 906
 907         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 908 }
 909
 910 int mgmt_update_adv_data(struct hci_dev *hdev)
 911 {
 912         struct hci_request req;
 913
 914         hci_req_init(&req, hdev);
 915         update_adv_data(&req);
 916
 917         return hci_req_run(&req, NULL);
 918 }
 919
 920 static void create_eir(struct hci_dev *hdev, u8 *data)
 921 {
 922         u8 *ptr = data;
 923         size_t name_len;
 924
 925         name_len = strlen(hdev->dev_name);
 926
 927         if (name_len > 0) {
 928                 /* EIR Data type */
 929                 if (name_len > 48) {
 930                         name_len = 48;
 931                         ptr[1] = EIR_NAME_SHORT;
 932                 } else
 933                         ptr[1] = EIR_NAME_COMPLETE;
 934
 935                 /* EIR Data length */
 936                 ptr[0] = name_len + 1;
 937
 938                 memcpy(ptr + 2, hdev->dev_name, name_len);
 939
 940                 ptr += (name_len + 2);
 941         }
 942
 943         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 944                 ptr[0] = 2;
 945                 ptr[1] = EIR_TX_POWER;
 946                 ptr[2] = (u8) hdev->inq_tx_power;
 947
 948                 ptr += 3;
 949         }
 950
 951         if (hdev->devid_source > 0) {
 952                 ptr[0] = 9;
 953                 ptr[1] = EIR_DEVICE_ID;
 954
 955                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 956                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 957                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 958                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 959
 960                 ptr += 10;
 961         }
 962
 963         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 964         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 965         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 966 }
 967
 968 static void update_eir(struct hci_request *req)
 969 {
 970         struct hci_dev *hdev = req->hdev;
 971         struct hci_cp_write_eir cp;
 972
 973         if (!hdev_is_powered(hdev))
 974                 return;
 975
 976         if (!lmp_ext_inq_capable(hdev))
 977                 return;
 978
 979         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 980                 return;
 981
 982         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 983                 return;
 984
 985         memset(&cp, 0, sizeof(cp));
 986
 987         create_eir(hdev, cp.data);
 988
 989         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 990                 return;
 991
 992         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 993
 994         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 995 }
 996
 997 static u8 get_service_classes(struct hci_dev *hdev)
 998 {
 999         struct bt_uuid *uuid;
1000         u8 val = 0;
1001
1002         list_for_each_entry(uuid, &hdev->uuids, list)
1003                 val |= uuid->svc_hint;
1004
1005         return val;
1006 }
1007
1008 static void update_class(struct hci_request *req)
1009 {
1010         struct hci_dev *hdev = req->hdev;
1011         u8 cod[3];
1012
1013         BT_DBG("%s", hdev->name);
1014
1015         if (!hdev_is_powered(hdev))
1016                 return;
1017
1018         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1019                 return;
1020
1021         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1022                 return;
1023
1024         cod[0] = hdev->minor_class;
1025         cod[1] = hdev->major_class;
1026         cod[2] = get_service_classes(hdev);
1027
1028         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1029                 cod[1] |= 0x20;
1030
1031         if (memcmp(cod, hdev->dev_class, 3) == 0)
1032                 return;
1033
1034         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1035 }
1036
1037 static bool get_connectable(struct hci_dev *hdev)
1038 {
1039         struct pending_cmd *cmd;
1040
1041         /* If there's a pending mgmt command the flag will not yet have
1042          * it's final value, so check for this first.
1043          */
1044         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1045         if (cmd) {
1046                 struct mgmt_mode *cp = cmd->param;
1047                 return cp->val;
1048         }
1049
1050         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1051 }
1052
1053 static void disable_advertising(struct hci_request *req)
1054 {
1055         u8 enable = 0x00;
1056
1057         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1058 }
1059
1060 static void enable_advertising(struct hci_request *req)
1061 {
1062         struct hci_dev *hdev = req->hdev;
1063         struct hci_cp_le_set_adv_param cp;
1064         u8 own_addr_type, enable = 0x01;
1065         bool connectable;
1066
1067         if (hci_conn_num(hdev, LE_LINK) > 0)
1068                 return;
1069
1070         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1071                 disable_advertising(req);
1072
1073         /* Clear the HCI_LE_ADV bit temporarily so that the
1074          * hci_update_random_address knows that it's safe to go ahead
1075          * and write a new random address. The flag will be set back on
1076          * as soon as the SET_ADV_ENABLE HCI command completes.
1077          */
1078         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1079
1080         connectable = get_connectable(hdev);
1081
1082         /* Set require_privacy to true only when non-connectable
1083          * advertising is used. In that case it is fine to use a
1084          * non-resolvable private address.
1085          */
1086         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1087                 return;
1088
1089         memset(&cp, 0, sizeof(cp));
1090         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1091         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1092         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1093         cp.own_address_type = own_addr_type;
1094         cp.channel_map = hdev->le_adv_channel_map;
1095
1096         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1097
1098         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1099 }
1100
1101 static void service_cache_off(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             service_cache.work);
1105         struct hci_request req;
1106
1107         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1108                 return;
1109
1110         hci_req_init(&req, hdev);
1111
1112         hci_dev_lock(hdev);
1113
1114         update_eir(&req);
1115         update_class(&req);
1116
1117         hci_dev_unlock(hdev);
1118
1119         hci_req_run(&req, NULL);
1120 }
1121
1122 static void rpa_expired(struct work_struct *work)
1123 {
1124         struct hci_dev *hdev = container_of(work, struct hci_dev,
1125                                             rpa_expired.work);
1126         struct hci_request req;
1127
1128         BT_DBG("");
1129
1130         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1131
1132         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1133                 return;
1134
1135         /* The generation of a new RPA and programming it into the
1136          * controller happens in the enable_advertising() function.
1137          */
1138         hci_req_init(&req, hdev);
1139         enable_advertising(&req);
1140         hci_req_run(&req, NULL);
1141 }
1142
1143 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1144 {
1145         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1146                 return;
1147
1148         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1149         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1150
1151         /* Non-mgmt controlled devices get this bit set
1152          * implicitly so that pairing works for them, however
1153          * for mgmt we require user-space to explicitly enable
1154          * it
1155          */
1156         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1157 }
1158
1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160                                 void *data, u16 data_len)
1161 {
1162         struct mgmt_rp_read_info rp;
1163
1164         BT_DBG("sock %p %s", sk, hdev->name);
1165
1166         hci_dev_lock(hdev);
1167
1168         memset(&rp, 0, sizeof(rp));
1169
1170         bacpy(&rp.bdaddr, &hdev->bdaddr);
1171
1172         rp.version = hdev->hci_ver;
1173         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1174
1175         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1177
1178         memcpy(rp.dev_class, hdev->dev_class, 3);
1179
1180         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1182
1183         hci_dev_unlock(hdev);
1184
1185         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1186                             sizeof(rp));
1187 }
1188
1189 static void mgmt_pending_free(struct pending_cmd *cmd)
1190 {
1191         sock_put(cmd->sk);
1192         kfree(cmd->param);
1193         kfree(cmd);
1194 }
1195
1196 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1197                                             struct hci_dev *hdev, void *data,
1198                                             u16 len)
1199 {
1200         struct pending_cmd *cmd;
1201
1202         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1203         if (!cmd)
1204                 return NULL;
1205
1206         cmd->opcode = opcode;
1207         cmd->index = hdev->id;
1208
1209         cmd->param = kmemdup(data, len, GFP_KERNEL);
1210         if (!cmd->param) {
1211                 kfree(cmd);
1212                 return NULL;
1213         }
1214
1215         cmd->param_len = len;
1216
1217         cmd->sk = sk;
1218         sock_hold(sk);
1219
1220         list_add(&cmd->list, &hdev->mgmt_pending);
1221
1222         return cmd;
1223 }
1224
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226                                  void (*cb)(struct pending_cmd *cmd,
1227                                             void *data),
1228                                  void *data)
1229 {
1230         struct pending_cmd *cmd, *tmp;
1231
1232         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233                 if (opcode > 0 && cmd->opcode != opcode)
1234                         continue;
1235
1236                 cb(cmd, data);
1237         }
1238 }
1239
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1241 {
1242         list_del(&cmd->list);
1243         mgmt_pending_free(cmd);
1244 }
1245
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1247 {
1248         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1249
1250         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1251                             sizeof(settings));
1252 }
1253
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1255 {
1256         BT_DBG("%s status 0x%02x", hdev->name, status);
1257
1258         if (hci_conn_count(hdev) == 0) {
1259                 cancel_delayed_work(&hdev->power_off);
1260                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1261         }
1262 }
1263
1264 static bool hci_stop_discovery(struct hci_request *req)
1265 {
1266         struct hci_dev *hdev = req->hdev;
1267         struct hci_cp_remote_name_req_cancel cp;
1268         struct inquiry_entry *e;
1269
1270         switch (hdev->discovery.state) {
1271         case DISCOVERY_FINDING:
1272                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1274                 } else {
1275                         cancel_delayed_work(&hdev->le_scan_disable);
1276                         hci_req_add_le_scan_disable(req);
1277                 }
1278
1279                 return true;
1280
1281         case DISCOVERY_RESOLVING:
1282                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1283                                                      NAME_PENDING);
1284                 if (!e)
1285                         break;
1286
1287                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1289                             &cp);
1290
1291                 return true;
1292
1293         default:
1294                 /* Passive scanning */
1295                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296                         hci_req_add_le_scan_disable(req);
1297                         return true;
1298                 }
1299
1300                 break;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1307 {
1308         struct hci_request req;
1309         struct hci_conn *conn;
1310         bool discov_stopped;
1311         int err;
1312
1313         hci_req_init(&req, hdev);
1314
1315         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316             test_bit(HCI_PSCAN, &hdev->flags)) {
1317                 u8 scan = 0x00;
1318                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1319         }
1320
1321         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322                 disable_advertising(&req);
1323
1324         discov_stopped = hci_stop_discovery(&req);
1325
1326         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327                 struct hci_cp_disconnect dc;
1328                 struct hci_cp_reject_conn_req rej;
1329
1330                 switch (conn->state) {
1331                 case BT_CONNECTED:
1332                 case BT_CONFIG:
1333                         dc.handle = cpu_to_le16(conn->handle);
1334                         dc.reason = 0x15; /* Terminated due to Power Off */
1335                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1336                         break;
1337                 case BT_CONNECT:
1338                         if (conn->type == LE_LINK)
1339                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1340                                             0, NULL);
1341                         else if (conn->type == ACL_LINK)
1342                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1343                                             6, &conn->dst);
1344                         break;
1345                 case BT_CONNECT2:
1346                         bacpy(&rej.bdaddr, &conn->dst);
1347                         rej.reason = 0x15; /* Terminated due to Power Off */
1348                         if (conn->type == ACL_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         else if (conn->type == SCO_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         break;
1355                 }
1356         }
1357
1358         err = hci_req_run(&req, clean_up_hci_complete);
1359         if (!err && discov_stopped)
1360                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1361
1362         return err;
1363 }
1364
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1366                        u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         struct pending_cmd *cmd;
1370         int err;
1371
1372         BT_DBG("request for %s", hdev->name);
1373
1374         if (cp->val != 0x00 && cp->val != 0x01)
1375                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376                                   MGMT_STATUS_INVALID_PARAMS);
1377
1378         hci_dev_lock(hdev);
1379
1380         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1382                                  MGMT_STATUS_BUSY);
1383                 goto failed;
1384         }
1385
1386         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387                 cancel_delayed_work(&hdev->power_off);
1388
1389                 if (cp->val) {
1390                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1391                                          data, len);
1392                         err = mgmt_powered(hdev, 1);
1393                         goto failed;
1394                 }
1395         }
1396
1397         if (!!cp->val == hdev_is_powered(hdev)) {
1398                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1399                 goto failed;
1400         }
1401
1402         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1403         if (!cmd) {
1404                 err = -ENOMEM;
1405                 goto failed;
1406         }
1407
1408         if (cp->val) {
1409                 queue_work(hdev->req_workqueue, &hdev->power_on);
1410                 err = 0;
1411         } else {
1412                 /* Disconnect connections, stop scans, etc */
1413                 err = clean_up_hci_state(hdev);
1414                 if (!err)
1415                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416                                            HCI_POWER_OFF_TIMEOUT);
1417
1418                 /* ENODATA means there were no HCI commands queued */
1419                 if (err == -ENODATA) {
1420                         cancel_delayed_work(&hdev->power_off);
1421                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1422                         err = 0;
1423                 }
1424         }
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1432 {
1433         __le32 ev;
1434
1435         ev = cpu_to_le32(get_current_settings(hdev));
1436
1437         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1438 }
1439
1440 int mgmt_new_settings(struct hci_dev *hdev)
1441 {
1442         return new_settings(hdev, NULL);
1443 }
1444
1445 struct cmd_lookup {
1446         struct sock *sk;
1447         struct hci_dev *hdev;
1448         u8 mgmt_status;
1449 };
1450
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1452 {
1453         struct cmd_lookup *match = data;
1454
1455         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1456
1457         list_del(&cmd->list);
1458
1459         if (match->sk == NULL) {
1460                 match->sk = cmd->sk;
1461                 sock_hold(match->sk);
1462         }
1463
1464         mgmt_pending_free(cmd);
1465 }
1466
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1468 {
1469         u8 *status = data;
1470
1471         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472         mgmt_pending_remove(cmd);
1473 }
1474
1475 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1476 {
1477         if (cmd->cmd_complete) {
1478                 u8 *status = data;
1479
1480                 cmd->cmd_complete(cmd, *status);
1481                 mgmt_pending_remove(cmd);
1482
1483                 return;
1484         }
1485
1486         cmd_status_rsp(cmd, data);
1487 }
1488
1489 static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1490 {
1491         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1492                             cmd->param, cmd->param_len);
1493 }
1494
1495 static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1496 {
1497         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1498                             sizeof(struct mgmt_addr_info));
1499 }
1500
1501 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1502 {
1503         if (!lmp_bredr_capable(hdev))
1504                 return MGMT_STATUS_NOT_SUPPORTED;
1505         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1506                 return MGMT_STATUS_REJECTED;
1507         else
1508                 return MGMT_STATUS_SUCCESS;
1509 }
1510
1511 static u8 mgmt_le_support(struct hci_dev *hdev)
1512 {
1513         if (!lmp_le_capable(hdev))
1514                 return MGMT_STATUS_NOT_SUPPORTED;
1515         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1516                 return MGMT_STATUS_REJECTED;
1517         else
1518                 return MGMT_STATUS_SUCCESS;
1519 }
1520
1521 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1522 {
1523         struct pending_cmd *cmd;
1524         struct mgmt_mode *cp;
1525         struct hci_request req;
1526         bool changed;
1527
1528         BT_DBG("status 0x%02x", status);
1529
1530         hci_dev_lock(hdev);
1531
1532         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1533         if (!cmd)
1534                 goto unlock;
1535
1536         if (status) {
1537                 u8 mgmt_err = mgmt_status(status);
1538                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1539                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1540                 goto remove_cmd;
1541         }
1542
1543         cp = cmd->param;
1544         if (cp->val) {
1545                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1546                                             &hdev->dev_flags);
1547
1548                 if (hdev->discov_timeout > 0) {
1549                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1550                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1551                                            to);
1552                 }
1553         } else {
1554                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1555                                              &hdev->dev_flags);
1556         }
1557
1558         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1559
1560         if (changed)
1561                 new_settings(hdev, cmd->sk);
1562
1563         /* When the discoverable mode gets changed, make sure
1564          * that class of device has the limited discoverable
1565          * bit correctly set. Also update page scan based on whitelist
1566          * entries.
1567          */
1568         hci_req_init(&req, hdev);
1569         __hci_update_page_scan(&req);
1570         update_class(&req);
1571         hci_req_run(&req, NULL);
1572
1573 remove_cmd:
1574         mgmt_pending_remove(cmd);
1575
1576 unlock:
1577         hci_dev_unlock(hdev);
1578 }
1579
1580 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1581                             u16 len)
1582 {
1583         struct mgmt_cp_set_discoverable *cp = data;
1584         struct pending_cmd *cmd;
1585         struct hci_request req;
1586         u16 timeout;
1587         u8 scan;
1588         int err;
1589
1590         BT_DBG("request for %s", hdev->name);
1591
1592         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1595                                   MGMT_STATUS_REJECTED);
1596
1597         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                   MGMT_STATUS_INVALID_PARAMS);
1600
1601         timeout = __le16_to_cpu(cp->timeout);
1602
1603         /* Disabling discoverable requires that no timeout is set,
1604          * and enabling limited discoverable requires a timeout.
1605          */
1606         if ((cp->val == 0x00 && timeout > 0) ||
1607             (cp->val == 0x02 && timeout == 0))
1608                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1609                                   MGMT_STATUS_INVALID_PARAMS);
1610
1611         hci_dev_lock(hdev);
1612
1613         if (!hdev_is_powered(hdev) && timeout > 0) {
1614                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1615                                  MGMT_STATUS_NOT_POWERED);
1616                 goto failed;
1617         }
1618
1619         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1620             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1628                                  MGMT_STATUS_REJECTED);
1629                 goto failed;
1630         }
1631
1632         if (!hdev_is_powered(hdev)) {
1633                 bool changed = false;
1634
1635                 /* Setting limited discoverable when powered off is
1636                  * not a valid operation since it requires a timeout
1637                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1638                  */
1639                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1640                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1641                         changed = true;
1642                 }
1643
1644                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1645                 if (err < 0)
1646                         goto failed;
1647
1648                 if (changed)
1649                         err = new_settings(hdev, sk);
1650
1651                 goto failed;
1652         }
1653
1654         /* If the current mode is the same, then just update the timeout
1655          * value with the new value. And if only the timeout gets updated,
1656          * then no need for any HCI transactions.
1657          */
1658         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1659             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1660                                           &hdev->dev_flags)) {
1661                 cancel_delayed_work(&hdev->discov_off);
1662                 hdev->discov_timeout = timeout;
1663
1664                 if (cp->val && hdev->discov_timeout > 0) {
1665                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1666                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1667                                            to);
1668                 }
1669
1670                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1671                 goto failed;
1672         }
1673
1674         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1675         if (!cmd) {
1676                 err = -ENOMEM;
1677                 goto failed;
1678         }
1679
1680         /* Cancel any potential discoverable timeout that might be
1681          * still active and store new timeout value. The arming of
1682          * the timeout happens in the complete handler.
1683          */
1684         cancel_delayed_work(&hdev->discov_off);
1685         hdev->discov_timeout = timeout;
1686
1687         /* Limited discoverable mode */
1688         if (cp->val == 0x02)
1689                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1690         else
1691                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1692
1693         hci_req_init(&req, hdev);
1694
1695         /* The procedure for LE-only controllers is much simpler - just
1696          * update the advertising data.
1697          */
1698         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1699                 goto update_ad;
1700
1701         scan = SCAN_PAGE;
1702
1703         if (cp->val) {
1704                 struct hci_cp_write_current_iac_lap hci_cp;
1705
1706                 if (cp->val == 0x02) {
1707                         /* Limited discoverable mode */
1708                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1709                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1710                         hci_cp.iac_lap[1] = 0x8b;
1711                         hci_cp.iac_lap[2] = 0x9e;
1712                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1713                         hci_cp.iac_lap[4] = 0x8b;
1714                         hci_cp.iac_lap[5] = 0x9e;
1715                 } else {
1716                         /* General discoverable mode */
1717                         hci_cp.num_iac = 1;
1718                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1719                         hci_cp.iac_lap[1] = 0x8b;
1720                         hci_cp.iac_lap[2] = 0x9e;
1721                 }
1722
1723                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1724                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1725
1726                 scan |= SCAN_INQUIRY;
1727         } else {
1728                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1729         }
1730
1731         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1732
1733 update_ad:
1734         update_adv_data(&req);
1735
1736         err = hci_req_run(&req, set_discoverable_complete);
1737         if (err < 0)
1738                 mgmt_pending_remove(cmd);
1739
1740 failed:
1741         hci_dev_unlock(hdev);
1742         return err;
1743 }
1744
1745 static void write_fast_connectable(struct hci_request *req, bool enable)
1746 {
1747         struct hci_dev *hdev = req->hdev;
1748         struct hci_cp_write_page_scan_activity acp;
1749         u8 type;
1750
1751         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1752                 return;
1753
1754         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1755                 return;
1756
1757         if (enable) {
1758                 type = PAGE_SCAN_TYPE_INTERLACED;
1759
1760                 /* 160 msec page scan interval */
1761                 acp.interval = cpu_to_le16(0x0100);
1762         } else {
1763                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1764
1765                 /* default 1.28 sec page scan */
1766                 acp.interval = cpu_to_le16(0x0800);
1767         }
1768
1769         acp.window = cpu_to_le16(0x0012);
1770
1771         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1772             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1773                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1774                             sizeof(acp), &acp);
1775
1776         if (hdev->page_scan_type != type)
1777                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1778 }
1779
1780 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1781 {
1782         struct pending_cmd *cmd;
1783         struct mgmt_mode *cp;
1784         bool conn_changed, discov_changed;
1785
1786         BT_DBG("status 0x%02x", status);
1787
1788         hci_dev_lock(hdev);
1789
1790         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1791         if (!cmd)
1792                 goto unlock;
1793
1794         if (status) {
1795                 u8 mgmt_err = mgmt_status(status);
1796                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1797                 goto remove_cmd;
1798         }
1799
1800         cp = cmd->param;
1801         if (cp->val) {
1802                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1803                                                  &hdev->dev_flags);
1804                 discov_changed = false;
1805         } else {
1806                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1807                                                   &hdev->dev_flags);
1808                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1809                                                     &hdev->dev_flags);
1810         }
1811
1812         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1813
1814         if (conn_changed || discov_changed) {
1815                 new_settings(hdev, cmd->sk);
1816                 hci_update_page_scan(hdev);
1817                 if (discov_changed)
1818                         mgmt_update_adv_data(hdev);
1819                 hci_update_background_scan(hdev);
1820         }
1821
1822 remove_cmd:
1823         mgmt_pending_remove(cmd);
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827 }
1828
1829 static int set_connectable_update_settings(struct hci_dev *hdev,
1830                                            struct sock *sk, u8 val)
1831 {
1832         bool changed = false;
1833         int err;
1834
1835         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1836                 changed = true;
1837
1838         if (val) {
1839                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1840         } else {
1841                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1842                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1843         }
1844
1845         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1846         if (err < 0)
1847                 return err;
1848
1849         if (changed) {
1850                 hci_update_page_scan(hdev);
1851                 hci_update_background_scan(hdev);
1852                 return new_settings(hdev, sk);
1853         }
1854
1855         return 0;
1856 }
1857
1858 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1859                            u16 len)
1860 {
1861         struct mgmt_mode *cp = data;
1862         struct pending_cmd *cmd;
1863         struct hci_request req;
1864         u8 scan;
1865         int err;
1866
1867         BT_DBG("request for %s", hdev->name);
1868
1869         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1870             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1872                                   MGMT_STATUS_REJECTED);
1873
1874         if (cp->val != 0x00 && cp->val != 0x01)
1875                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1876                                   MGMT_STATUS_INVALID_PARAMS);
1877
1878         hci_dev_lock(hdev);
1879
1880         if (!hdev_is_powered(hdev)) {
1881                 err = set_connectable_update_settings(hdev, sk, cp->val);
1882                 goto failed;
1883         }
1884
1885         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1886             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1888                                  MGMT_STATUS_BUSY);
1889                 goto failed;
1890         }
1891
1892         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1893         if (!cmd) {
1894                 err = -ENOMEM;
1895                 goto failed;
1896         }
1897
1898         hci_req_init(&req, hdev);
1899
1900         /* If BR/EDR is not enabled and we disable advertising as a
1901          * by-product of disabling connectable, we need to update the
1902          * advertising flags.
1903          */
1904         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1905                 if (!cp->val) {
1906                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1907                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1908                 }
1909                 update_adv_data(&req);
1910         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1911                 if (cp->val) {
1912                         scan = SCAN_PAGE;
1913                 } else {
1914                         /* If we don't have any whitelist entries just
1915                          * disable all scanning. If there are entries
1916                          * and we had both page and inquiry scanning
1917                          * enabled then fall back to only page scanning.
1918                          * Otherwise no changes are needed.
1919                          */
1920                         if (list_empty(&hdev->whitelist))
1921                                 scan = SCAN_DISABLED;
1922                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1923                                 scan = SCAN_PAGE;
1924                         else
1925                                 goto no_scan_update;
1926
1927                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1928                             hdev->discov_timeout > 0)
1929                                 cancel_delayed_work(&hdev->discov_off);
1930                 }
1931
1932                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1933         }
1934
1935 no_scan_update:
1936         /* If we're going from non-connectable to connectable or
1937          * vice-versa when fast connectable is enabled ensure that fast
1938          * connectable gets disabled. write_fast_connectable won't do
1939          * anything if the page scan parameters are already what they
1940          * should be.
1941          */
1942         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1943                 write_fast_connectable(&req, false);
1944
1945         /* Update the advertising parameters if necessary */
1946         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1947                 enable_advertising(&req);
1948
1949         err = hci_req_run(&req, set_connectable_complete);
1950         if (err < 0) {
1951                 mgmt_pending_remove(cmd);
1952                 if (err == -ENODATA)
1953                         err = set_connectable_update_settings(hdev, sk,
1954                                                               cp->val);
1955                 goto failed;
1956         }
1957
1958 failed:
1959         hci_dev_unlock(hdev);
1960         return err;
1961 }
1962
1963 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1964                         u16 len)
1965 {
1966         struct mgmt_mode *cp = data;
1967         bool changed;
1968         int err;
1969
1970         BT_DBG("request for %s", hdev->name);
1971
1972         if (cp->val != 0x00 && cp->val != 0x01)
1973                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1974                                   MGMT_STATUS_INVALID_PARAMS);
1975
1976         hci_dev_lock(hdev);
1977
1978         if (cp->val)
1979                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1980         else
1981                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1982
1983         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1984         if (err < 0)
1985                 goto unlock;
1986
1987         if (changed)
1988                 err = new_settings(hdev, sk);
1989
1990 unlock:
1991         hci_dev_unlock(hdev);
1992         return err;
1993 }
1994
1995 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1996                              u16 len)
1997 {
1998         struct mgmt_mode *cp = data;
1999         struct pending_cmd *cmd;
2000         u8 val, status;
2001         int err;
2002
2003         BT_DBG("request for %s", hdev->name);
2004
2005         status = mgmt_bredr_support(hdev);
2006         if (status)
2007                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2008                                   status);
2009
2010         if (cp->val != 0x00 && cp->val != 0x01)
2011                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2012                                   MGMT_STATUS_INVALID_PARAMS);
2013
2014         hci_dev_lock(hdev);
2015
2016         if (!hdev_is_powered(hdev)) {
2017                 bool changed = false;
2018
2019                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2020                                           &hdev->dev_flags)) {
2021                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2022                         changed = true;
2023                 }
2024
2025                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2026                 if (err < 0)
2027                         goto failed;
2028
2029                 if (changed)
2030                         err = new_settings(hdev, sk);
2031
2032                 goto failed;
2033         }
2034
2035         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2036                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2037                                  MGMT_STATUS_BUSY);
2038                 goto failed;
2039         }
2040
2041         val = !!cp->val;
2042
2043         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2044                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2045                 goto failed;
2046         }
2047
2048         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2049         if (!cmd) {
2050                 err = -ENOMEM;
2051                 goto failed;
2052         }
2053
2054         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2055         if (err < 0) {
2056                 mgmt_pending_remove(cmd);
2057                 goto failed;
2058         }
2059
2060 failed:
2061         hci_dev_unlock(hdev);
2062         return err;
2063 }
2064
2065 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         struct pending_cmd *cmd;
2069         u8 status;
2070         int err;
2071
2072         BT_DBG("request for %s", hdev->name);
2073
2074         status = mgmt_bredr_support(hdev);
2075         if (status)
2076                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2077
2078         if (!lmp_ssp_capable(hdev))
2079                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2080                                   MGMT_STATUS_NOT_SUPPORTED);
2081
2082         if (cp->val != 0x00 && cp->val != 0x01)
2083                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2084                                   MGMT_STATUS_INVALID_PARAMS);
2085
2086         hci_dev_lock(hdev);
2087
2088         if (!hdev_is_powered(hdev)) {
2089                 bool changed;
2090
2091                 if (cp->val) {
2092                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2093                                                     &hdev->dev_flags);
2094                 } else {
2095                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2096                                                      &hdev->dev_flags);
2097                         if (!changed)
2098                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2099                                                              &hdev->dev_flags);
2100                         else
2101                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2102                 }
2103
2104                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2105                 if (err < 0)
2106                         goto failed;
2107
2108                 if (changed)
2109                         err = new_settings(hdev, sk);
2110
2111                 goto failed;
2112         }
2113
2114         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2115             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2116                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2117                                  MGMT_STATUS_BUSY);
2118                 goto failed;
2119         }
2120
2121         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2122                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2123                 goto failed;
2124         }
2125
2126         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2127         if (!cmd) {
2128                 err = -ENOMEM;
2129                 goto failed;
2130         }
2131
2132         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2133                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2134                              sizeof(cp->val), &cp->val);
2135
2136         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2137         if (err < 0) {
2138                 mgmt_pending_remove(cmd);
2139                 goto failed;
2140         }
2141
2142 failed:
2143         hci_dev_unlock(hdev);
2144         return err;
2145 }
2146
2147 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2148 {
2149         struct mgmt_mode *cp = data;
2150         bool changed;
2151         u8 status;
2152         int err;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         status = mgmt_bredr_support(hdev);
2157         if (status)
2158                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2159
2160         if (!lmp_ssp_capable(hdev))
2161                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2162                                   MGMT_STATUS_NOT_SUPPORTED);
2163
2164         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2165                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2166                                   MGMT_STATUS_REJECTED);
2167
2168         if (cp->val != 0x00 && cp->val != 0x01)
2169                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2170                                   MGMT_STATUS_INVALID_PARAMS);
2171
2172         hci_dev_lock(hdev);
2173
2174         if (cp->val) {
2175                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2176         } else {
2177                 if (hdev_is_powered(hdev)) {
2178                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2179                                          MGMT_STATUS_REJECTED);
2180                         goto unlock;
2181                 }
2182
2183                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2184         }
2185
2186         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2187         if (err < 0)
2188                 goto unlock;
2189
2190         if (changed)
2191                 err = new_settings(hdev, sk);
2192
2193 unlock:
2194         hci_dev_unlock(hdev);
2195         return err;
2196 }
2197
2198 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2199 {
2200         struct cmd_lookup match = { NULL, hdev };
2201
2202         hci_dev_lock(hdev);
2203
2204         if (status) {
2205                 u8 mgmt_err = mgmt_status(status);
2206
2207                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2208                                      &mgmt_err);
2209                 goto unlock;
2210         }
2211
2212         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2213
2214         new_settings(hdev, match.sk);
2215
2216         if (match.sk)
2217                 sock_put(match.sk);
2218
2219         /* Make sure the controller has a good default for
2220          * advertising data. Restrict the update to when LE
2221          * has actually been enabled. During power on, the
2222          * update in powered_update_hci will take care of it.
2223          */
2224         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2225                 struct hci_request req;
2226
2227                 hci_req_init(&req, hdev);
2228                 update_adv_data(&req);
2229                 update_scan_rsp_data(&req);
2230                 __hci_update_background_scan(&req);
2231                 hci_req_run(&req, NULL);
2232         }
2233
2234 unlock:
2235         hci_dev_unlock(hdev);
2236 }
2237
2238 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2239 {
2240         struct mgmt_mode *cp = data;
2241         struct hci_cp_write_le_host_supported hci_cp;
2242         struct pending_cmd *cmd;
2243         struct hci_request req;
2244         int err;
2245         u8 val, enabled;
2246
2247         BT_DBG("request for %s", hdev->name);
2248
2249         if (!lmp_le_capable(hdev))
2250                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2251                                   MGMT_STATUS_NOT_SUPPORTED);
2252
2253         if (cp->val != 0x00 && cp->val != 0x01)
2254                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2255                                   MGMT_STATUS_INVALID_PARAMS);
2256
2257         /* LE-only devices do not allow toggling LE on/off */
2258         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2260                                   MGMT_STATUS_REJECTED);
2261
2262         hci_dev_lock(hdev);
2263
2264         val = !!cp->val;
2265         enabled = lmp_host_le_capable(hdev);
2266
2267         if (!hdev_is_powered(hdev) || val == enabled) {
2268                 bool changed = false;
2269
2270                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2271                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2272                         changed = true;
2273                 }
2274
2275                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2276                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2277                         changed = true;
2278                 }
2279
2280                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2281                 if (err < 0)
2282                         goto unlock;
2283
2284                 if (changed)
2285                         err = new_settings(hdev, sk);
2286
2287                 goto unlock;
2288         }
2289
2290         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2291             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2292                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2293                                  MGMT_STATUS_BUSY);
2294                 goto unlock;
2295         }
2296
2297         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2298         if (!cmd) {
2299                 err = -ENOMEM;
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         memset(&hci_cp, 0, sizeof(hci_cp));
2306
2307         if (val) {
2308                 hci_cp.le = val;
2309                 hci_cp.simul = 0x00;
2310         } else {
2311                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2312                         disable_advertising(&req);
2313         }
2314
2315         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2316                     &hci_cp);
2317
2318         err = hci_req_run(&req, le_enable_complete);
2319         if (err < 0)
2320                 mgmt_pending_remove(cmd);
2321
2322 unlock:
2323         hci_dev_unlock(hdev);
2324         return err;
2325 }
2326
2327 /* This is a helper function to test for pending mgmt commands that can
2328  * cause CoD or EIR HCI commands. We can only allow one such pending
2329  * mgmt command at a time since otherwise we cannot easily track what
2330  * the current values are, will be, and based on that calculate if a new
2331  * HCI command needs to be sent and if yes with what value.
2332  */
2333 static bool pending_eir_or_class(struct hci_dev *hdev)
2334 {
2335         struct pending_cmd *cmd;
2336
2337         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2338                 switch (cmd->opcode) {
2339                 case MGMT_OP_ADD_UUID:
2340                 case MGMT_OP_REMOVE_UUID:
2341                 case MGMT_OP_SET_DEV_CLASS:
2342                 case MGMT_OP_SET_POWERED:
2343                         return true;
2344                 }
2345         }
2346
2347         return false;
2348 }
2349
2350 static const u8 bluetooth_base_uuid[] = {
2351                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2352                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2353 };
2354
2355 static u8 get_uuid_size(const u8 *uuid)
2356 {
2357         u32 val;
2358
2359         if (memcmp(uuid, bluetooth_base_uuid, 12))
2360                 return 128;
2361
2362         val = get_unaligned_le32(&uuid[12]);
2363         if (val > 0xffff)
2364                 return 32;
2365
2366         return 16;
2367 }
2368
2369 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2370 {
2371         struct pending_cmd *cmd;
2372
2373         hci_dev_lock(hdev);
2374
2375         cmd = mgmt_pending_find(mgmt_op, hdev);
2376         if (!cmd)
2377                 goto unlock;
2378
2379         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2380                      hdev->dev_class, 3);
2381
2382         mgmt_pending_remove(cmd);
2383
2384 unlock:
2385         hci_dev_unlock(hdev);
2386 }
2387
2388 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2389 {
2390         BT_DBG("status 0x%02x", status);
2391
2392         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2393 }
2394
2395 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2396 {
2397         struct mgmt_cp_add_uuid *cp = data;
2398         struct pending_cmd *cmd;
2399         struct hci_request req;
2400         struct bt_uuid *uuid;
2401         int err;
2402
2403         BT_DBG("request for %s", hdev->name);
2404
2405         hci_dev_lock(hdev);
2406
2407         if (pending_eir_or_class(hdev)) {
2408                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2409                                  MGMT_STATUS_BUSY);
2410                 goto failed;
2411         }
2412
2413         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2414         if (!uuid) {
2415                 err = -ENOMEM;
2416                 goto failed;
2417         }
2418
2419         memcpy(uuid->uuid, cp->uuid, 16);
2420         uuid->svc_hint = cp->svc_hint;
2421         uuid->size = get_uuid_size(cp->uuid);
2422
2423         list_add_tail(&uuid->list, &hdev->uuids);
2424
2425         hci_req_init(&req, hdev);
2426
2427         update_class(&req);
2428         update_eir(&req);
2429
2430         err = hci_req_run(&req, add_uuid_complete);
2431         if (err < 0) {
2432                 if (err != -ENODATA)
2433                         goto failed;
2434
2435                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2436                                    hdev->dev_class, 3);
2437                 goto failed;
2438         }
2439
2440         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2441         if (!cmd) {
2442                 err = -ENOMEM;
2443                 goto failed;
2444         }
2445
2446         err = 0;
2447
2448 failed:
2449         hci_dev_unlock(hdev);
2450         return err;
2451 }
2452
2453 static bool enable_service_cache(struct hci_dev *hdev)
2454 {
2455         if (!hdev_is_powered(hdev))
2456                 return false;
2457
2458         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2459                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2460                                    CACHE_TIMEOUT);
2461                 return true;
2462         }
2463
2464         return false;
2465 }
2466
2467 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2468 {
2469         BT_DBG("status 0x%02x", status);
2470
2471         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2472 }
2473
2474 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2475                        u16 len)
2476 {
2477         struct mgmt_cp_remove_uuid *cp = data;
2478         struct pending_cmd *cmd;
2479         struct bt_uuid *match, *tmp;
2480         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2481         struct hci_request req;
2482         int err, found;
2483
2484         BT_DBG("request for %s", hdev->name);
2485
2486         hci_dev_lock(hdev);
2487
2488         if (pending_eir_or_class(hdev)) {
2489                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2490                                  MGMT_STATUS_BUSY);
2491                 goto unlock;
2492         }
2493
2494         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2495                 hci_uuids_clear(hdev);
2496
2497                 if (enable_service_cache(hdev)) {
2498                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2499                                            0, hdev->dev_class, 3);
2500                         goto unlock;
2501                 }
2502
2503                 goto update_class;
2504         }
2505
2506         found = 0;
2507
2508         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2509                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2510                         continue;
2511
2512                 list_del(&match->list);
2513                 kfree(match);
2514                 found++;
2515         }
2516
2517         if (found == 0) {
2518                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2519                                  MGMT_STATUS_INVALID_PARAMS);
2520                 goto unlock;
2521         }
2522
2523 update_class:
2524         hci_req_init(&req, hdev);
2525
2526         update_class(&req);
2527         update_eir(&req);
2528
2529         err = hci_req_run(&req, remove_uuid_complete);
2530         if (err < 0) {
2531                 if (err != -ENODATA)
2532                         goto unlock;
2533
2534                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2535                                    hdev->dev_class, 3);
2536                 goto unlock;
2537         }
2538
2539         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2540         if (!cmd) {
2541                 err = -ENOMEM;
2542                 goto unlock;
2543         }
2544
2545         err = 0;
2546
2547 unlock:
2548         hci_dev_unlock(hdev);
2549         return err;
2550 }
2551
2552 static void set_class_complete(struct hci_dev *hdev, u8 status)
2553 {
2554         BT_DBG("status 0x%02x", status);
2555
2556         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2557 }
2558
2559 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2560                          u16 len)
2561 {
2562         struct mgmt_cp_set_dev_class *cp = data;
2563         struct pending_cmd *cmd;
2564         struct hci_request req;
2565         int err;
2566
2567         BT_DBG("request for %s", hdev->name);
2568
2569         if (!lmp_bredr_capable(hdev))
2570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2571                                   MGMT_STATUS_NOT_SUPPORTED);
2572
2573         hci_dev_lock(hdev);
2574
2575         if (pending_eir_or_class(hdev)) {
2576                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2577                                  MGMT_STATUS_BUSY);
2578                 goto unlock;
2579         }
2580
2581         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2582                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2583                                  MGMT_STATUS_INVALID_PARAMS);
2584                 goto unlock;
2585         }
2586
2587         hdev->major_class = cp->major;
2588         hdev->minor_class = cp->minor;
2589
2590         if (!hdev_is_powered(hdev)) {
2591                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2592                                    hdev->dev_class, 3);
2593                 goto unlock;
2594         }
2595
2596         hci_req_init(&req, hdev);
2597
2598         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2599                 hci_dev_unlock(hdev);
2600                 cancel_delayed_work_sync(&hdev->service_cache);
2601                 hci_dev_lock(hdev);
2602                 update_eir(&req);
2603         }
2604
2605         update_class(&req);
2606
2607         err = hci_req_run(&req, set_class_complete);
2608         if (err < 0) {
2609                 if (err != -ENODATA)
2610                         goto unlock;
2611
2612                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2613                                    hdev->dev_class, 3);
2614                 goto unlock;
2615         }
2616
2617         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2618         if (!cmd) {
2619                 err = -ENOMEM;
2620                 goto unlock;
2621         }
2622
2623         err = 0;
2624
2625 unlock:
2626         hci_dev_unlock(hdev);
2627         return err;
2628 }
2629
2630 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2631                           u16 len)
2632 {
2633         struct mgmt_cp_load_link_keys *cp = data;
2634         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2635                                    sizeof(struct mgmt_link_key_info));
2636         u16 key_count, expected_len;
2637         bool changed;
2638         int i;
2639
2640         BT_DBG("request for %s", hdev->name);
2641
2642         if (!lmp_bredr_capable(hdev))
2643                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2644                                   MGMT_STATUS_NOT_SUPPORTED);
2645
2646         key_count = __le16_to_cpu(cp->key_count);
2647         if (key_count > max_key_count) {
2648                 BT_ERR("load_link_keys: too big key_count value %u",
2649                        key_count);
2650                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2651                                   MGMT_STATUS_INVALID_PARAMS);
2652         }
2653
2654         expected_len = sizeof(*cp) + key_count *
2655                                         sizeof(struct mgmt_link_key_info);
2656         if (expected_len != len) {
2657                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2658                        expected_len, len);
2659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2660                                   MGMT_STATUS_INVALID_PARAMS);
2661         }
2662
2663         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2664                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2665                                   MGMT_STATUS_INVALID_PARAMS);
2666
2667         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2668                key_count);
2669
2670         for (i = 0; i < key_count; i++) {
2671                 struct mgmt_link_key_info *key = &cp->keys[i];
2672
2673                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2674                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2675                                           MGMT_STATUS_INVALID_PARAMS);
2676         }
2677
2678         hci_dev_lock(hdev);
2679
2680         hci_link_keys_clear(hdev);
2681
2682         if (cp->debug_keys)
2683                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2684                                             &hdev->dev_flags);
2685         else
2686                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2687                                              &hdev->dev_flags);
2688
2689         if (changed)
2690                 new_settings(hdev, NULL);
2691
2692         for (i = 0; i < key_count; i++) {
2693                 struct mgmt_link_key_info *key = &cp->keys[i];
2694
2695                 /* Always ignore debug keys and require a new pairing if
2696                  * the user wants to use them.
2697                  */
2698                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2699                         continue;
2700
2701                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2702                                  key->type, key->pin_len, NULL);
2703         }
2704
2705         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2706
2707         hci_dev_unlock(hdev);
2708
2709         return 0;
2710 }
2711
2712 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2713                            u8 addr_type, struct sock *skip_sk)
2714 {
2715         struct mgmt_ev_device_unpaired ev;
2716
2717         bacpy(&ev.addr.bdaddr, bdaddr);
2718         ev.addr.type = addr_type;
2719
2720         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2721                           skip_sk);
2722 }
2723
2724 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2725                          u16 len)
2726 {
2727         struct mgmt_cp_unpair_device *cp = data;
2728         struct mgmt_rp_unpair_device rp;
2729         struct hci_cp_disconnect dc;
2730         struct pending_cmd *cmd;
2731         struct hci_conn *conn;
2732         int err;
2733
2734         memset(&rp, 0, sizeof(rp));
2735         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2736         rp.addr.type = cp->addr.type;
2737
2738         if (!bdaddr_type_is_valid(cp->addr.type))
2739                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2740                                     MGMT_STATUS_INVALID_PARAMS,
2741                                     &rp, sizeof(rp));
2742
2743         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2744                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2745                                     MGMT_STATUS_INVALID_PARAMS,
2746                                     &rp, sizeof(rp));
2747
2748         hci_dev_lock(hdev);
2749
2750         if (!hdev_is_powered(hdev)) {
2751                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2752                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2753                 goto unlock;
2754         }
2755
2756         if (cp->addr.type == BDADDR_BREDR) {
2757                 /* If disconnection is requested, then look up the
2758                  * connection. If the remote device is connected, it
2759                  * will be later used to terminate the link.
2760                  *
2761                  * Setting it to NULL explicitly will cause no
2762                  * termination of the link.
2763                  */
2764                 if (cp->disconnect)
2765                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2766                                                        &cp->addr.bdaddr);
2767                 else
2768                         conn = NULL;
2769
2770                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2771         } else {
2772                 u8 addr_type;
2773
2774                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2775                                                &cp->addr.bdaddr);
2776                 if (conn) {
2777                         /* Defer clearing up the connection parameters
2778                          * until closing to give a chance of keeping
2779                          * them if a repairing happens.
2780                          */
2781                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2782
2783                         /* If disconnection is not requested, then
2784                          * clear the connection variable so that the
2785                          * link is not terminated.
2786                          */
2787                         if (!cp->disconnect)
2788                                 conn = NULL;
2789                 }
2790
2791                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2792                         addr_type = ADDR_LE_DEV_PUBLIC;
2793                 else
2794                         addr_type = ADDR_LE_DEV_RANDOM;
2795
2796                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2797
2798                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2799         }
2800
2801         if (err < 0) {
2802                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2803                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2804                 goto unlock;
2805         }
2806
2807         /* If the connection variable is set, then termination of the
2808          * link is requested.
2809          */
2810         if (!conn) {
2811                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2812                                    &rp, sizeof(rp));
2813                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2814                 goto unlock;
2815         }
2816
2817         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2818                                sizeof(*cp));
2819         if (!cmd) {
2820                 err = -ENOMEM;
2821                 goto unlock;
2822         }
2823
2824         cmd->cmd_complete = addr_cmd_complete;
2825
2826         dc.handle = cpu_to_le16(conn->handle);
2827         dc.reason = 0x13; /* Remote User Terminated Connection */
2828         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2829         if (err < 0)
2830                 mgmt_pending_remove(cmd);
2831
2832 unlock:
2833         hci_dev_unlock(hdev);
2834         return err;
2835 }
2836
2837 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2838                       u16 len)
2839 {
2840         struct mgmt_cp_disconnect *cp = data;
2841         struct mgmt_rp_disconnect rp;
2842         struct pending_cmd *cmd;
2843         struct hci_conn *conn;
2844         int err;
2845
2846         BT_DBG("");
2847
2848         memset(&rp, 0, sizeof(rp));
2849         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2850         rp.addr.type = cp->addr.type;
2851
2852         if (!bdaddr_type_is_valid(cp->addr.type))
2853                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2854                                     MGMT_STATUS_INVALID_PARAMS,
2855                                     &rp, sizeof(rp));
2856
2857         hci_dev_lock(hdev);
2858
2859         if (!test_bit(HCI_UP, &hdev->flags)) {
2860                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2861                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2862                 goto failed;
2863         }
2864
2865         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2866                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2867                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2868                 goto failed;
2869         }
2870
2871         if (cp->addr.type == BDADDR_BREDR)
2872                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2873                                                &cp->addr.bdaddr);
2874         else
2875                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2876
2877         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2878                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2879                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2880                 goto failed;
2881         }
2882
2883         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2884         if (!cmd) {
2885                 err = -ENOMEM;
2886                 goto failed;
2887         }
2888
2889         cmd->cmd_complete = generic_cmd_complete;
2890
2891         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2892         if (err < 0)
2893                 mgmt_pending_remove(cmd);
2894
2895 failed:
2896         hci_dev_unlock(hdev);
2897         return err;
2898 }
2899
2900 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2901 {
2902         switch (link_type) {
2903         case LE_LINK:
2904                 switch (addr_type) {
2905                 case ADDR_LE_DEV_PUBLIC:
2906                         return BDADDR_LE_PUBLIC;
2907
2908                 default:
2909                         /* Fallback to LE Random address type */
2910                         return BDADDR_LE_RANDOM;
2911                 }
2912
2913         default:
2914                 /* Fallback to BR/EDR type */
2915                 return BDADDR_BREDR;
2916         }
2917 }
2918
2919 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2920                            u16 data_len)
2921 {
2922         struct mgmt_rp_get_connections *rp;
2923         struct hci_conn *c;
2924         size_t rp_len;
2925         int err;
2926         u16 i;
2927
2928         BT_DBG("");
2929
2930         hci_dev_lock(hdev);
2931
2932         if (!hdev_is_powered(hdev)) {
2933                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2934                                  MGMT_STATUS_NOT_POWERED);
2935                 goto unlock;
2936         }
2937
2938         i = 0;
2939         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2940                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2941                         i++;
2942         }
2943
2944         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2945         rp = kmalloc(rp_len, GFP_KERNEL);
2946         if (!rp) {
2947                 err = -ENOMEM;
2948                 goto unlock;
2949         }
2950
2951         i = 0;
2952         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2953                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2954                         continue;
2955                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2956                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2957                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2958                         continue;
2959                 i++;
2960         }
2961
2962         rp->conn_count = cpu_to_le16(i);
2963
2964         /* Recalculate length in case of filtered SCO connections, etc */
2965         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2966
2967         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2968                            rp_len);
2969
2970         kfree(rp);
2971
2972 unlock:
2973         hci_dev_unlock(hdev);
2974         return err;
2975 }
2976
2977 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2978                                    struct mgmt_cp_pin_code_neg_reply *cp)
2979 {
2980         struct pending_cmd *cmd;
2981         int err;
2982
2983         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2984                                sizeof(*cp));
2985         if (!cmd)
2986                 return -ENOMEM;
2987
2988         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2989                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2990         if (err < 0)
2991                 mgmt_pending_remove(cmd);
2992
2993         return err;
2994 }
2995
2996 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2997                           u16 len)
2998 {
2999         struct hci_conn *conn;
3000         struct mgmt_cp_pin_code_reply *cp = data;
3001         struct hci_cp_pin_code_reply reply;
3002         struct pending_cmd *cmd;
3003         int err;
3004
3005         BT_DBG("");
3006
3007         hci_dev_lock(hdev);
3008
3009         if (!hdev_is_powered(hdev)) {
3010                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3011                                  MGMT_STATUS_NOT_POWERED);
3012                 goto failed;
3013         }
3014
3015         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3016         if (!conn) {
3017                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3018                                  MGMT_STATUS_NOT_CONNECTED);
3019                 goto failed;
3020         }
3021
3022         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3023                 struct mgmt_cp_pin_code_neg_reply ncp;
3024
3025                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3026
3027                 BT_ERR("PIN code is not 16 bytes long");
3028
3029                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3030                 if (err >= 0)
3031                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3032                                          MGMT_STATUS_INVALID_PARAMS);
3033
3034                 goto failed;
3035         }
3036
3037         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3038         if (!cmd) {
3039                 err = -ENOMEM;
3040                 goto failed;
3041         }
3042
3043         cmd->cmd_complete = addr_cmd_complete;
3044
3045         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3046         reply.pin_len = cp->pin_len;
3047         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3048
3049         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3050         if (err < 0)
3051                 mgmt_pending_remove(cmd);
3052
3053 failed:
3054         hci_dev_unlock(hdev);
3055         return err;
3056 }
3057
3058 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3059                              u16 len)
3060 {
3061         struct mgmt_cp_set_io_capability *cp = data;
3062
3063         BT_DBG("");
3064
3065         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3066                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3067                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3068
3069         hci_dev_lock(hdev);
3070
3071         hdev->io_capability = cp->io_capability;
3072
3073         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3074                hdev->io_capability);
3075
3076         hci_dev_unlock(hdev);
3077
3078         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3079                             0);
3080 }
3081
3082 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3083 {
3084         struct hci_dev *hdev = conn->hdev;
3085         struct pending_cmd *cmd;
3086
3087         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3088                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3089                         continue;
3090
3091                 if (cmd->user_data != conn)
3092                         continue;
3093
3094                 return cmd;
3095         }
3096
3097         return NULL;
3098 }
3099
3100 static int pairing_complete(struct pending_cmd *cmd, u8 status)
3101 {
3102         struct mgmt_rp_pair_device rp;
3103         struct hci_conn *conn = cmd->user_data;
3104         int err;
3105
3106         bacpy(&rp.addr.bdaddr, &conn->dst);
3107         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3108
3109         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3110                            &rp, sizeof(rp));
3111
3112         /* So we don't get further callbacks for this connection */
3113         conn->connect_cfm_cb = NULL;
3114         conn->security_cfm_cb = NULL;
3115         conn->disconn_cfm_cb = NULL;
3116
3117         hci_conn_drop(conn);
3118
3119         /* The device is paired so there is no need to remove
3120          * its connection parameters anymore.
3121          */
3122         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3123
3124         hci_conn_put(conn);
3125
3126         return err;
3127 }
3128
3129 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3130 {
3131         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3132         struct pending_cmd *cmd;
3133
3134         cmd = find_pairing(conn);
3135         if (cmd) {
3136                 cmd->cmd_complete(cmd, status);
3137                 mgmt_pending_remove(cmd);
3138         }
3139 }
3140
3141 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3142 {
3143         struct pending_cmd *cmd;
3144
3145         BT_DBG("status %u", status);
3146
3147         cmd = find_pairing(conn);
3148         if (!cmd) {
3149                 BT_DBG("Unable to find a pending command");
3150                 return;
3151         }
3152
3153         cmd->cmd_complete(cmd, mgmt_status(status));
3154         mgmt_pending_remove(cmd);
3155 }
3156
3157 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3158 {
3159         struct pending_cmd *cmd;
3160
3161         BT_DBG("status %u", status);
3162
3163         if (!status)
3164                 return;
3165
3166         cmd = find_pairing(conn);
3167         if (!cmd) {
3168                 BT_DBG("Unable to find a pending command");
3169                 return;
3170         }
3171
3172         cmd->cmd_complete(cmd, mgmt_status(status));
3173         mgmt_pending_remove(cmd);
3174 }
3175
3176 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3177                        u16 len)
3178 {
3179         struct mgmt_cp_pair_device *cp = data;
3180         struct mgmt_rp_pair_device rp;
3181         struct pending_cmd *cmd;
3182         u8 sec_level, auth_type;
3183         struct hci_conn *conn;
3184         int err;
3185
3186         BT_DBG("");
3187
3188         memset(&rp, 0, sizeof(rp));
3189         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3190         rp.addr.type = cp->addr.type;
3191
3192         if (!bdaddr_type_is_valid(cp->addr.type))
3193                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3194                                     MGMT_STATUS_INVALID_PARAMS,
3195                                     &rp, sizeof(rp));
3196
3197         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3198                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3199                                     MGMT_STATUS_INVALID_PARAMS,
3200                                     &rp, sizeof(rp));
3201
3202         hci_dev_lock(hdev);
3203
3204         if (!hdev_is_powered(hdev)) {
3205                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3206                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3207                 goto unlock;
3208         }
3209
3210         sec_level = BT_SECURITY_MEDIUM;
3211         auth_type = HCI_AT_DEDICATED_BONDING;
3212
3213         if (cp->addr.type == BDADDR_BREDR) {
3214                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3215                                        auth_type);
3216         } else {
3217                 u8 addr_type;
3218
3219                 /* Convert from L2CAP channel address type to HCI address type
3220                  */
3221                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3222                         addr_type = ADDR_LE_DEV_PUBLIC;
3223                 else
3224                         addr_type = ADDR_LE_DEV_RANDOM;
3225
3226                 /* When pairing a new device, it is expected to remember
3227                  * this device for future connections. Adding the connection
3228                  * parameter information ahead of time allows tracking
3229                  * of the slave preferred values and will speed up any
3230                  * further connection establishment.
3231                  *
3232                  * If connection parameters already exist, then they
3233                  * will be kept and this function does nothing.
3234                  */
3235                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3236
3237                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3238                                       sec_level, HCI_LE_CONN_TIMEOUT,
3239                                       HCI_ROLE_MASTER);
3240         }
3241
3242         if (IS_ERR(conn)) {
3243                 int status;
3244
3245                 if (PTR_ERR(conn) == -EBUSY)
3246                         status = MGMT_STATUS_BUSY;
3247                 else
3248                         status = MGMT_STATUS_CONNECT_FAILED;
3249
3250                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3251                                    status, &rp,
3252                                    sizeof(rp));
3253                 goto unlock;
3254         }
3255
3256         if (conn->connect_cfm_cb) {
3257                 hci_conn_drop(conn);
3258                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3259                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3260                 goto unlock;
3261         }
3262
3263         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3264         if (!cmd) {
3265                 err = -ENOMEM;
3266                 hci_conn_drop(conn);
3267                 goto unlock;
3268         }
3269
3270         cmd->cmd_complete = pairing_complete;
3271
3272         /* For LE, just connecting isn't a proof that the pairing finished */
3273         if (cp->addr.type == BDADDR_BREDR) {
3274                 conn->connect_cfm_cb = pairing_complete_cb;
3275                 conn->security_cfm_cb = pairing_complete_cb;
3276                 conn->disconn_cfm_cb = pairing_complete_cb;
3277         } else {
3278                 conn->connect_cfm_cb = le_pairing_complete_cb;
3279                 conn->security_cfm_cb = le_pairing_complete_cb;
3280                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3281         }
3282
3283         conn->io_capability = cp->io_cap;
3284         cmd->user_data = hci_conn_get(conn);
3285
3286         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3287             hci_conn_security(conn, sec_level, auth_type, true)) {
3288                 cmd->cmd_complete(cmd, 0);
3289                 mgmt_pending_remove(cmd);
3290         }
3291
3292         err = 0;
3293
3294 unlock:
3295         hci_dev_unlock(hdev);
3296         return err;
3297 }
3298
3299 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3300                               u16 len)
3301 {
3302         struct mgmt_addr_info *addr = data;
3303         struct pending_cmd *cmd;
3304         struct hci_conn *conn;
3305         int err;
3306
3307         BT_DBG("");
3308
3309         hci_dev_lock(hdev);
3310
3311         if (!hdev_is_powered(hdev)) {
3312                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3313                                  MGMT_STATUS_NOT_POWERED);
3314                 goto unlock;
3315         }
3316
3317         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3318         if (!cmd) {
3319                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3320                                  MGMT_STATUS_INVALID_PARAMS);
3321                 goto unlock;
3322         }
3323
3324         conn = cmd->user_data;
3325
3326         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3327                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3328                                  MGMT_STATUS_INVALID_PARAMS);
3329                 goto unlock;
3330         }
3331
3332         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3333         mgmt_pending_remove(cmd);
3334
3335         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3336                            addr, sizeof(*addr));
3337 unlock:
3338         hci_dev_unlock(hdev);
3339         return err;
3340 }
3341
3342 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3343                              struct mgmt_addr_info *addr, u16 mgmt_op,
3344                              u16 hci_op, __le32 passkey)
3345 {
3346         struct pending_cmd *cmd;
3347         struct hci_conn *conn;
3348         int err;
3349
3350         hci_dev_lock(hdev);
3351
3352         if (!hdev_is_powered(hdev)) {
3353                 err = cmd_complete(sk, hdev->id, mgmt_op,
3354                                    MGMT_STATUS_NOT_POWERED, addr,
3355                                    sizeof(*addr));
3356                 goto done;
3357         }
3358
3359         if (addr->type == BDADDR_BREDR)
3360                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3361         else
3362                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3363
3364         if (!conn) {
3365                 err = cmd_complete(sk, hdev->id, mgmt_op,
3366                                    MGMT_STATUS_NOT_CONNECTED, addr,
3367                                    sizeof(*addr));
3368                 goto done;
3369         }
3370
3371         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3372                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3373                 if (!err)
3374                         err = cmd_complete(sk, hdev->id, mgmt_op,
3375                                            MGMT_STATUS_SUCCESS, addr,
3376                                            sizeof(*addr));
3377                 else
3378                         err = cmd_complete(sk, hdev->id, mgmt_op,
3379                                            MGMT_STATUS_FAILED, addr,
3380                                            sizeof(*addr));
3381
3382                 goto done;
3383         }
3384
3385         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3386         if (!cmd) {
3387                 err = -ENOMEM;
3388                 goto done;
3389         }
3390
3391         cmd->cmd_complete = addr_cmd_complete;
3392
3393         /* Continue with pairing via HCI */
3394         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3395                 struct hci_cp_user_passkey_reply cp;
3396
3397                 bacpy(&cp.bdaddr, &addr->bdaddr);
3398                 cp.passkey = passkey;
3399                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3400         } else
3401                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3402                                    &addr->bdaddr);
3403
3404         if (err < 0)
3405                 mgmt_pending_remove(cmd);
3406
3407 done:
3408         hci_dev_unlock(hdev);
3409         return err;
3410 }
3411
3412 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3413                               void *data, u16 len)
3414 {
3415         struct mgmt_cp_pin_code_neg_reply *cp = data;
3416
3417         BT_DBG("");
3418
3419         return user_pairing_resp(sk, hdev, &cp->addr,
3420                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3421                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3422 }
3423
3424 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3425                               u16 len)
3426 {
3427         struct mgmt_cp_user_confirm_reply *cp = data;
3428
3429         BT_DBG("");
3430
3431         if (len != sizeof(*cp))
3432                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3433                                   MGMT_STATUS_INVALID_PARAMS);
3434
3435         return user_pairing_resp(sk, hdev, &cp->addr,
3436                                  MGMT_OP_USER_CONFIRM_REPLY,
3437                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3438 }
3439
3440 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3441                                   void *data, u16 len)
3442 {
3443         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3444
3445         BT_DBG("");
3446
3447         return user_pairing_resp(sk, hdev, &cp->addr,
3448                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3449                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3450 }
3451
3452 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3453                               u16 len)
3454 {
3455         struct mgmt_cp_user_passkey_reply *cp = data;
3456
3457         BT_DBG("");
3458
3459         return user_pairing_resp(sk, hdev, &cp->addr,
3460                                  MGMT_OP_USER_PASSKEY_REPLY,
3461                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3462 }
3463
3464 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3465                                   void *data, u16 len)
3466 {
3467         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3468
3469         BT_DBG("");
3470
3471         return user_pairing_resp(sk, hdev, &cp->addr,
3472                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3473                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3474 }
3475
3476 static void update_name(struct hci_request *req)
3477 {
3478         struct hci_dev *hdev = req->hdev;
3479         struct hci_cp_write_local_name cp;
3480
3481         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3482
3483         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3484 }
3485
3486 static void set_name_complete(struct hci_dev *hdev, u8 status)
3487 {
3488         struct mgmt_cp_set_local_name *cp;
3489         struct pending_cmd *cmd;
3490
3491         BT_DBG("status 0x%02x", status);
3492
3493         hci_dev_lock(hdev);
3494
3495         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3496         if (!cmd)
3497                 goto unlock;
3498
3499         cp = cmd->param;
3500
3501         if (status)
3502                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3503                            mgmt_status(status));
3504         else
3505                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3506                              cp, sizeof(*cp));
3507
3508         mgmt_pending_remove(cmd);
3509
3510 unlock:
3511         hci_dev_unlock(hdev);
3512 }
3513
3514 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3515                           u16 len)
3516 {
3517         struct mgmt_cp_set_local_name *cp = data;
3518         struct pending_cmd *cmd;
3519         struct hci_request req;
3520         int err;
3521
3522         BT_DBG("");
3523
3524         hci_dev_lock(hdev);
3525
3526         /* If the old values are the same as the new ones just return a
3527          * direct command complete event.
3528          */
3529         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3530             !memcmp(hdev->short_name, cp->short_name,
3531                     sizeof(hdev->short_name))) {
3532                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3533                                    data, len);
3534                 goto failed;
3535         }
3536
3537         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3538
3539         if (!hdev_is_powered(hdev)) {
3540                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3541
3542                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3543                                    data, len);
3544                 if (err < 0)
3545                         goto failed;
3546
3547                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3548                                  sk);
3549
3550                 goto failed;
3551         }
3552
3553         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3554         if (!cmd) {
3555                 err = -ENOMEM;
3556                 goto failed;
3557         }
3558
3559         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3560
3561         hci_req_init(&req, hdev);
3562
3563         if (lmp_bredr_capable(hdev)) {
3564                 update_name(&req);
3565                 update_eir(&req);
3566         }
3567
3568         /* The name is stored in the scan response data and so
3569          * no need to udpate the advertising data here.
3570          */
3571         if (lmp_le_capable(hdev))
3572                 update_scan_rsp_data(&req);
3573
3574         err = hci_req_run(&req, set_name_complete);
3575         if (err < 0)
3576                 mgmt_pending_remove(cmd);
3577
3578 failed:
3579         hci_dev_unlock(hdev);
3580         return err;
3581 }
3582
3583 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3584                                void *data, u16 data_len)
3585 {
3586         struct pending_cmd *cmd;
3587         int err;
3588
3589         BT_DBG("%s", hdev->name);
3590
3591         hci_dev_lock(hdev);
3592
3593         if (!hdev_is_powered(hdev)) {
3594                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3595                                  MGMT_STATUS_NOT_POWERED);
3596                 goto unlock;
3597         }
3598
3599         if (!lmp_ssp_capable(hdev)) {
3600                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3601                                  MGMT_STATUS_NOT_SUPPORTED);
3602                 goto unlock;
3603         }
3604
3605         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3606                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3607                                  MGMT_STATUS_BUSY);
3608                 goto unlock;
3609         }
3610
3611         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3612         if (!cmd) {
3613                 err = -ENOMEM;
3614                 goto unlock;
3615         }
3616
3617         if (bredr_sc_enabled(hdev))
3618                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3619                                    0, NULL);
3620         else
3621                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3622
3623         if (err < 0)
3624                 mgmt_pending_remove(cmd);
3625
3626 unlock:
3627         hci_dev_unlock(hdev);
3628         return err;
3629 }
3630
3631 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3632                                void *data, u16 len)
3633 {
3634         int err;
3635
3636         BT_DBG("%s ", hdev->name);
3637
3638         hci_dev_lock(hdev);
3639
3640         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3641                 struct mgmt_cp_add_remote_oob_data *cp = data;
3642                 u8 status;
3643
3644                 if (cp->addr.type != BDADDR_BREDR) {
3645                         err = cmd_complete(sk, hdev->id,
3646                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3647                                            MGMT_STATUS_INVALID_PARAMS,
3648                                            &cp->addr, sizeof(cp->addr));
3649                         goto unlock;
3650                 }
3651
3652                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3653                                               cp->addr.type, cp->hash,
3654                                               cp->rand, NULL, NULL);
3655                 if (err < 0)
3656                         status = MGMT_STATUS_FAILED;
3657                 else
3658                         status = MGMT_STATUS_SUCCESS;
3659
3660                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3661                                    status, &cp->addr, sizeof(cp->addr));
3662         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3663                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3664                 u8 *rand192, *hash192;
3665                 u8 status;
3666
3667                 if (cp->addr.type != BDADDR_BREDR) {
3668                         err = cmd_complete(sk, hdev->id,
3669                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3670                                            MGMT_STATUS_INVALID_PARAMS,
3671                                            &cp->addr, sizeof(cp->addr));
3672                         goto unlock;
3673                 }
3674
3675                 if (bdaddr_type_is_le(cp->addr.type)) {
3676                         rand192 = NULL;
3677                         hash192 = NULL;
3678                 } else {
3679                         rand192 = cp->rand192;
3680                         hash192 = cp->hash192;
3681                 }
3682
3683                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3684                                               cp->addr.type, hash192, rand192,
3685                                               cp->hash256, cp->rand256);
3686                 if (err < 0)
3687                         status = MGMT_STATUS_FAILED;
3688                 else
3689                         status = MGMT_STATUS_SUCCESS;
3690
3691                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3692                                    status, &cp->addr, sizeof(cp->addr));
3693         } else {
3694                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3695                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3696                                  MGMT_STATUS_INVALID_PARAMS);
3697         }
3698
3699 unlock:
3700         hci_dev_unlock(hdev);
3701         return err;
3702 }
3703
3704 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3705                                   void *data, u16 len)
3706 {
3707         struct mgmt_cp_remove_remote_oob_data *cp = data;
3708         u8 status;
3709         int err;
3710
3711         BT_DBG("%s", hdev->name);
3712
3713         if (cp->addr.type != BDADDR_BREDR)
3714                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3715                                     MGMT_STATUS_INVALID_PARAMS,
3716                                     &cp->addr, sizeof(cp->addr));
3717
3718         hci_dev_lock(hdev);
3719
3720         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3721                 hci_remote_oob_data_clear(hdev);
3722                 status = MGMT_STATUS_SUCCESS;
3723                 goto done;
3724         }
3725
3726         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3727         if (err < 0)
3728                 status = MGMT_STATUS_INVALID_PARAMS;
3729         else
3730                 status = MGMT_STATUS_SUCCESS;
3731
3732 done:
3733         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3734                            status, &cp->addr, sizeof(cp->addr));
3735
3736         hci_dev_unlock(hdev);
3737         return err;
3738 }
3739
3740 static bool trigger_discovery(struct hci_request *req, u8 *status)
3741 {
3742         struct hci_dev *hdev = req->hdev;
3743         struct hci_cp_le_set_scan_param param_cp;
3744         struct hci_cp_le_set_scan_enable enable_cp;
3745         struct hci_cp_inquiry inq_cp;
3746         /* General inquiry access code (GIAC) */
3747         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3748         u8 own_addr_type;
3749         int err;
3750
3751         switch (hdev->discovery.type) {
3752         case DISCOV_TYPE_BREDR:
3753                 *status = mgmt_bredr_support(hdev);
3754                 if (*status)
3755                         return false;
3756
3757                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3758                         *status = MGMT_STATUS_BUSY;
3759                         return false;
3760                 }
3761
3762                 hci_inquiry_cache_flush(hdev);
3763
3764                 memset(&inq_cp, 0, sizeof(inq_cp));
3765                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3766                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3767                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3768                 break;
3769
3770         case DISCOV_TYPE_LE:
3771         case DISCOV_TYPE_INTERLEAVED:
3772                 *status = mgmt_le_support(hdev);
3773                 if (*status)
3774                         return false;
3775
3776                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3777                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3778                         *status = MGMT_STATUS_NOT_SUPPORTED;
3779                         return false;
3780                 }
3781
3782                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3783                         /* Don't let discovery abort an outgoing
3784                          * connection attempt that's using directed
3785                          * advertising.
3786                          */
3787                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3788                                                        BT_CONNECT)) {
3789                                 *status = MGMT_STATUS_REJECTED;
3790                                 return false;
3791                         }
3792
3793                         disable_advertising(req);
3794                 }
3795
3796                 /* If controller is scanning, it means the background scanning
3797                  * is running. Thus, we should temporarily stop it in order to
3798                  * set the discovery scanning parameters.
3799                  */
3800                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3801                         hci_req_add_le_scan_disable(req);
3802
3803                 memset(&param_cp, 0, sizeof(param_cp));
3804
3805                 /* All active scans will be done with either a resolvable
3806                  * private address (when privacy feature has been enabled)
3807                  * or non-resolvable private address.
3808                  */
3809                 err = hci_update_random_address(req, true, &own_addr_type);
3810                 if (err < 0) {
3811                         *status = MGMT_STATUS_FAILED;
3812                         return false;
3813                 }
3814
3815                 param_cp.type = LE_SCAN_ACTIVE;
3816                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3817                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3818                 param_cp.own_address_type = own_addr_type;
3819                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3820                             &param_cp);
3821
3822                 memset(&enable_cp, 0, sizeof(enable_cp));
3823                 enable_cp.enable = LE_SCAN_ENABLE;
3824                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3825                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3826                             &enable_cp);
3827                 break;
3828
3829         default:
3830                 *status = MGMT_STATUS_INVALID_PARAMS;
3831                 return false;
3832         }
3833
3834         return true;
3835 }
3836
3837 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3838 {
3839         struct pending_cmd *cmd;
3840         unsigned long timeout;
3841
3842         BT_DBG("status %d", status);
3843
3844         hci_dev_lock(hdev);
3845
3846         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3847         if (!cmd)
3848                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3849
3850         if (cmd) {
3851                 cmd->cmd_complete(cmd, mgmt_status(status));
3852                 mgmt_pending_remove(cmd);
3853         }
3854
3855         if (status) {
3856                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3857                 goto unlock;
3858         }
3859
3860         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3861
3862         switch (hdev->discovery.type) {
3863         case DISCOV_TYPE_LE:
3864                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3865                 break;
3866         case DISCOV_TYPE_INTERLEAVED:
3867                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3868                 break;
3869         case DISCOV_TYPE_BREDR:
3870                 timeout = 0;
3871                 break;
3872         default:
3873                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3874                 timeout = 0;
3875                 break;
3876         }
3877
3878         if (timeout)
3879                 queue_delayed_work(hdev->workqueue,
3880                                    &hdev->le_scan_disable, timeout);
3881
3882 unlock:
3883         hci_dev_unlock(hdev);
3884 }
3885
3886 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3887                            void *data, u16 len)
3888 {
3889         struct mgmt_cp_start_discovery *cp = data;
3890         struct pending_cmd *cmd;
3891         struct hci_request req;
3892         u8 status;
3893         int err;
3894
3895         BT_DBG("%s", hdev->name);
3896
3897         hci_dev_lock(hdev);
3898
3899         if (!hdev_is_powered(hdev)) {
3900                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3901                                    MGMT_STATUS_NOT_POWERED,
3902                                    &cp->type, sizeof(cp->type));
3903                 goto failed;
3904         }
3905
3906         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3907             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3908                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3909                                    MGMT_STATUS_BUSY, &cp->type,
3910                                    sizeof(cp->type));
3911                 goto failed;
3912         }
3913
3914         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3915         if (!cmd) {
3916                 err = -ENOMEM;
3917                 goto failed;
3918         }
3919
3920         cmd->cmd_complete = generic_cmd_complete;
3921
3922         /* Clear the discovery filter first to free any previously
3923          * allocated memory for the UUID list.
3924          */
3925         hci_discovery_filter_clear(hdev);
3926
3927         hdev->discovery.type = cp->type;
3928         hdev->discovery.report_invalid_rssi = false;
3929
3930         hci_req_init(&req, hdev);
3931
3932         if (!trigger_discovery(&req, &status)) {
3933                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3934                                    status, &cp->type, sizeof(cp->type));
3935                 mgmt_pending_remove(cmd);
3936                 goto failed;
3937         }
3938
3939         err = hci_req_run(&req, start_discovery_complete);
3940         if (err < 0) {
3941                 mgmt_pending_remove(cmd);
3942                 goto failed;
3943         }
3944
3945         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3946
3947 failed:
3948         hci_dev_unlock(hdev);
3949         return err;
3950 }
3951
3952 static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
3953 {
3954         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3955                             cmd->param, 1);
3956 }
3957
3958 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3959                                    void *data, u16 len)
3960 {
3961         struct mgmt_cp_start_service_discovery *cp = data;
3962         struct pending_cmd *cmd;
3963         struct hci_request req;
3964         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3965         u16 uuid_count, expected_len;
3966         u8 status;
3967         int err;
3968
3969         BT_DBG("%s", hdev->name);
3970
3971         hci_dev_lock(hdev);
3972
3973         if (!hdev_is_powered(hdev)) {
3974                 err = cmd_complete(sk, hdev->id,
3975                                    MGMT_OP_START_SERVICE_DISCOVERY,
3976                                    MGMT_STATUS_NOT_POWERED,
3977                                    &cp->type, sizeof(cp->type));
3978                 goto failed;
3979         }
3980
3981         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3982             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3983                 err = cmd_complete(sk, hdev->id,
3984                                    MGMT_OP_START_SERVICE_DISCOVERY,
3985                                    MGMT_STATUS_BUSY, &cp->type,
3986                                    sizeof(cp->type));
3987                 goto failed;
3988         }
3989
3990         uuid_count = __le16_to_cpu(cp->uuid_count);
3991         if (uuid_count > max_uuid_count) {
3992                 BT_ERR("service_discovery: too big uuid_count value %u",
3993                        uuid_count);
3994                 err = cmd_complete(sk, hdev->id,
3995                                    MGMT_OP_START_SERVICE_DISCOVERY,
3996                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
3997                                    sizeof(cp->type));
3998                 goto failed;
3999         }
4000
4001         expected_len = sizeof(*cp) + uuid_count * 16;
4002         if (expected_len != len) {
4003                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4004                        expected_len, len);
4005                 err = cmd_complete(sk, hdev->id,
4006                                    MGMT_OP_START_SERVICE_DISCOVERY,
4007                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4008                                    sizeof(cp->type));
4009                 goto failed;
4010         }
4011
4012         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4013                                hdev, data, len);
4014         if (!cmd) {
4015                 err = -ENOMEM;
4016                 goto failed;
4017         }
4018
4019         cmd->cmd_complete = service_discovery_cmd_complete;
4020
4021         /* Clear the discovery filter first to free any previously
4022          * allocated memory for the UUID list.
4023          */
4024         hci_discovery_filter_clear(hdev);
4025
4026         hdev->discovery.type = cp->type;
4027         hdev->discovery.rssi = cp->rssi;
4028         hdev->discovery.uuid_count = uuid_count;
4029
4030         if (uuid_count > 0) {
4031                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4032                                                 GFP_KERNEL);
4033                 if (!hdev->discovery.uuids) {
4034                         err = cmd_complete(sk, hdev->id,
4035                                            MGMT_OP_START_SERVICE_DISCOVERY,
4036                                            MGMT_STATUS_FAILED,
4037                                            &cp->type, sizeof(cp->type));
4038                         mgmt_pending_remove(cmd);
4039                         goto failed;
4040                 }
4041         }
4042
4043         hci_req_init(&req, hdev);
4044
4045         if (!trigger_discovery(&req, &status)) {
4046                 err = cmd_complete(sk, hdev->id,
4047                                    MGMT_OP_START_SERVICE_DISCOVERY,
4048                                    status, &cp->type, sizeof(cp->type));
4049                 mgmt_pending_remove(cmd);
4050                 goto failed;
4051         }
4052
4053         err = hci_req_run(&req, start_discovery_complete);
4054         if (err < 0) {
4055                 mgmt_pending_remove(cmd);
4056                 goto failed;
4057         }
4058
4059         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4060
4061 failed:
4062         hci_dev_unlock(hdev);
4063         return err;
4064 }
4065
4066 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
4067 {
4068         struct pending_cmd *cmd;
4069
4070         BT_DBG("status %d", status);
4071
4072         hci_dev_lock(hdev);
4073
4074         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4075         if (cmd) {
4076                 cmd->cmd_complete(cmd, mgmt_status(status));
4077                 mgmt_pending_remove(cmd);
4078         }
4079
4080         if (!status)
4081                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4082
4083         hci_dev_unlock(hdev);
4084 }
4085
4086 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4087                           u16 len)
4088 {
4089         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4090         struct pending_cmd *cmd;
4091         struct hci_request req;
4092         int err;
4093
4094         BT_DBG("%s", hdev->name);
4095
4096         hci_dev_lock(hdev);
4097
4098         if (!hci_discovery_active(hdev)) {
4099                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4100                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4101                                    sizeof(mgmt_cp->type));
4102                 goto unlock;
4103         }
4104
4105         if (hdev->discovery.type != mgmt_cp->type) {
4106                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4107                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4108                                    sizeof(mgmt_cp->type));
4109                 goto unlock;
4110         }
4111
4112         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4113         if (!cmd) {
4114                 err = -ENOMEM;
4115                 goto unlock;
4116         }
4117
4118         cmd->cmd_complete = generic_cmd_complete;
4119
4120         hci_req_init(&req, hdev);
4121
4122         hci_stop_discovery(&req);
4123
4124         err = hci_req_run(&req, stop_discovery_complete);
4125         if (!err) {
4126                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4127                 goto unlock;
4128         }
4129
4130         mgmt_pending_remove(cmd);
4131
4132         /* If no HCI commands were sent we're done */
4133         if (err == -ENODATA) {
4134                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4135                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4136                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4137         }
4138
4139 unlock:
4140         hci_dev_unlock(hdev);
4141         return err;
4142 }
4143
4144 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4145                         u16 len)
4146 {
4147         struct mgmt_cp_confirm_name *cp = data;
4148         struct inquiry_entry *e;
4149         int err;
4150
4151         BT_DBG("%s", hdev->name);
4152
4153         hci_dev_lock(hdev);
4154
4155         if (!hci_discovery_active(hdev)) {
4156                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4157                                    MGMT_STATUS_FAILED, &cp->addr,
4158                                    sizeof(cp->addr));
4159                 goto failed;
4160         }
4161
4162         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4163         if (!e) {
4164                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4165                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4166                                    sizeof(cp->addr));
4167                 goto failed;
4168         }
4169
4170         if (cp->name_known) {
4171                 e->name_state = NAME_KNOWN;
4172                 list_del(&e->list);
4173         } else {
4174                 e->name_state = NAME_NEEDED;
4175                 hci_inquiry_cache_update_resolve(hdev, e);
4176         }
4177
4178         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4179                            sizeof(cp->addr));
4180
4181 failed:
4182         hci_dev_unlock(hdev);
4183         return err;
4184 }
4185
4186 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4187                         u16 len)
4188 {
4189         struct mgmt_cp_block_device *cp = data;
4190         u8 status;
4191         int err;
4192
4193         BT_DBG("%s", hdev->name);
4194
4195         if (!bdaddr_type_is_valid(cp->addr.type))
4196                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4197                                     MGMT_STATUS_INVALID_PARAMS,
4198                                     &cp->addr, sizeof(cp->addr));
4199
4200         hci_dev_lock(hdev);
4201
4202         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4203                                   cp->addr.type);
4204         if (err < 0) {
4205                 status = MGMT_STATUS_FAILED;
4206                 goto done;
4207         }
4208
4209         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4210                    sk);
4211         status = MGMT_STATUS_SUCCESS;
4212
4213 done:
4214         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4215                            &cp->addr, sizeof(cp->addr));
4216
4217         hci_dev_unlock(hdev);
4218
4219         return err;
4220 }
4221
4222 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4223                           u16 len)
4224 {
4225         struct mgmt_cp_unblock_device *cp = data;
4226         u8 status;
4227         int err;
4228
4229         BT_DBG("%s", hdev->name);
4230
4231         if (!bdaddr_type_is_valid(cp->addr.type))
4232                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4233                                     MGMT_STATUS_INVALID_PARAMS,
4234                                     &cp->addr, sizeof(cp->addr));
4235
4236         hci_dev_lock(hdev);
4237
4238         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4239                                   cp->addr.type);
4240         if (err < 0) {
4241                 status = MGMT_STATUS_INVALID_PARAMS;
4242                 goto done;
4243         }
4244
4245         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4246                    sk);
4247         status = MGMT_STATUS_SUCCESS;
4248
4249 done:
4250         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4251                            &cp->addr, sizeof(cp->addr));
4252
4253         hci_dev_unlock(hdev);
4254
4255         return err;
4256 }
4257
4258 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4259                          u16 len)
4260 {
4261         struct mgmt_cp_set_device_id *cp = data;
4262         struct hci_request req;
4263         int err;
4264         __u16 source;
4265
4266         BT_DBG("%s", hdev->name);
4267
4268         source = __le16_to_cpu(cp->source);
4269
4270         if (source > 0x0002)
4271                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4272                                   MGMT_STATUS_INVALID_PARAMS);
4273
4274         hci_dev_lock(hdev);
4275
4276         hdev->devid_source = source;
4277         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4278         hdev->devid_product = __le16_to_cpu(cp->product);
4279         hdev->devid_version = __le16_to_cpu(cp->version);
4280
4281         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4282
4283         hci_req_init(&req, hdev);
4284         update_eir(&req);
4285         hci_req_run(&req, NULL);
4286
4287         hci_dev_unlock(hdev);
4288
4289         return err;
4290 }
4291
4292 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4293 {
4294         struct cmd_lookup match = { NULL, hdev };
4295
4296         hci_dev_lock(hdev);
4297
4298         if (status) {
4299                 u8 mgmt_err = mgmt_status(status);
4300
4301                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4302                                      cmd_status_rsp, &mgmt_err);
4303                 goto unlock;
4304         }
4305
4306         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4307                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4308         else
4309                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4310
4311         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4312                              &match);
4313
4314         new_settings(hdev, match.sk);
4315
4316         if (match.sk)
4317                 sock_put(match.sk);
4318
4319 unlock:
4320         hci_dev_unlock(hdev);
4321 }
4322
4323 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4324                            u16 len)
4325 {
4326         struct mgmt_mode *cp = data;
4327         struct pending_cmd *cmd;
4328         struct hci_request req;
4329         u8 val, enabled, status;
4330         int err;
4331
4332         BT_DBG("request for %s", hdev->name);
4333
4334         status = mgmt_le_support(hdev);
4335         if (status)
4336                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4337                                   status);
4338
4339         if (cp->val != 0x00 && cp->val != 0x01)
4340                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4341                                   MGMT_STATUS_INVALID_PARAMS);
4342
4343         hci_dev_lock(hdev);
4344
4345         val = !!cp->val;
4346         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4347
4348         /* The following conditions are ones which mean that we should
4349          * not do any HCI communication but directly send a mgmt
4350          * response to user space (after toggling the flag if
4351          * necessary).
4352          */
4353         if (!hdev_is_powered(hdev) || val == enabled ||
4354             hci_conn_num(hdev, LE_LINK) > 0 ||
4355             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4356              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4357                 bool changed = false;
4358
4359                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4360                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4361                         changed = true;
4362                 }
4363
4364                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4365                 if (err < 0)
4366                         goto unlock;
4367
4368                 if (changed)
4369                         err = new_settings(hdev, sk);
4370
4371                 goto unlock;
4372         }
4373
4374         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4375             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4376                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4377                                  MGMT_STATUS_BUSY);
4378                 goto unlock;
4379         }
4380
4381         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4382         if (!cmd) {
4383                 err = -ENOMEM;
4384                 goto unlock;
4385         }
4386
4387         hci_req_init(&req, hdev);
4388
4389         if (val)
4390                 enable_advertising(&req);
4391         else
4392                 disable_advertising(&req);
4393
4394         err = hci_req_run(&req, set_advertising_complete);
4395         if (err < 0)
4396                 mgmt_pending_remove(cmd);
4397
4398 unlock:
4399         hci_dev_unlock(hdev);
4400         return err;
4401 }
4402
4403 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4404                               void *data, u16 len)
4405 {
4406         struct mgmt_cp_set_static_address *cp = data;
4407         int err;
4408
4409         BT_DBG("%s", hdev->name);
4410
4411         if (!lmp_le_capable(hdev))
4412                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4413                                   MGMT_STATUS_NOT_SUPPORTED);
4414
4415         if (hdev_is_powered(hdev))
4416                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4417                                   MGMT_STATUS_REJECTED);
4418
4419         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4420                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4421                         return cmd_status(sk, hdev->id,
4422                                           MGMT_OP_SET_STATIC_ADDRESS,
4423                                           MGMT_STATUS_INVALID_PARAMS);
4424
4425                 /* Two most significant bits shall be set */
4426                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4427                         return cmd_status(sk, hdev->id,
4428                                           MGMT_OP_SET_STATIC_ADDRESS,
4429                                           MGMT_STATUS_INVALID_PARAMS);
4430         }
4431
4432         hci_dev_lock(hdev);
4433
4434         bacpy(&hdev->static_addr, &cp->bdaddr);
4435
4436         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4437
4438         hci_dev_unlock(hdev);
4439
4440         return err;
4441 }
4442
4443 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4444                            void *data, u16 len)
4445 {
4446         struct mgmt_cp_set_scan_params *cp = data;
4447         __u16 interval, window;
4448         int err;
4449
4450         BT_DBG("%s", hdev->name);
4451
4452         if (!lmp_le_capable(hdev))
4453                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4454                                   MGMT_STATUS_NOT_SUPPORTED);
4455
4456         interval = __le16_to_cpu(cp->interval);
4457
4458         if (interval < 0x0004 || interval > 0x4000)
4459                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4460                                   MGMT_STATUS_INVALID_PARAMS);
4461
4462         window = __le16_to_cpu(cp->window);
4463
4464         if (window < 0x0004 || window > 0x4000)
4465                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4466                                   MGMT_STATUS_INVALID_PARAMS);
4467
4468         if (window > interval)
4469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4470                                   MGMT_STATUS_INVALID_PARAMS);
4471
4472         hci_dev_lock(hdev);
4473
4474         hdev->le_scan_interval = interval;
4475         hdev->le_scan_window = window;
4476
4477         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4478
4479         /* If background scan is running, restart it so new parameters are
4480          * loaded.
4481          */
4482         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4483             hdev->discovery.state == DISCOVERY_STOPPED) {
4484                 struct hci_request req;
4485
4486                 hci_req_init(&req, hdev);
4487
4488                 hci_req_add_le_scan_disable(&req);
4489                 hci_req_add_le_passive_scan(&req);
4490
4491                 hci_req_run(&req, NULL);
4492         }
4493
4494         hci_dev_unlock(hdev);
4495
4496         return err;
4497 }
4498
4499 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4500 {
4501         struct pending_cmd *cmd;
4502
4503         BT_DBG("status 0x%02x", status);
4504
4505         hci_dev_lock(hdev);
4506
4507         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4508         if (!cmd)
4509                 goto unlock;
4510
4511         if (status) {
4512                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4513                            mgmt_status(status));
4514         } else {
4515                 struct mgmt_mode *cp = cmd->param;
4516
4517                 if (cp->val)
4518                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4519                 else
4520                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4521
4522                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4523                 new_settings(hdev, cmd->sk);
4524         }
4525
4526         mgmt_pending_remove(cmd);
4527
4528 unlock:
4529         hci_dev_unlock(hdev);
4530 }
4531
4532 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4533                                 void *data, u16 len)
4534 {
4535         struct mgmt_mode *cp = data;
4536         struct pending_cmd *cmd;
4537         struct hci_request req;
4538         int err;
4539
4540         BT_DBG("%s", hdev->name);
4541
4542         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4543             hdev->hci_ver < BLUETOOTH_VER_1_2)
4544                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4545                                   MGMT_STATUS_NOT_SUPPORTED);
4546
4547         if (cp->val != 0x00 && cp->val != 0x01)
4548                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4549                                   MGMT_STATUS_INVALID_PARAMS);
4550
4551         if (!hdev_is_powered(hdev))
4552                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4553                                   MGMT_STATUS_NOT_POWERED);
4554
4555         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4556                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4557                                   MGMT_STATUS_REJECTED);
4558
4559         hci_dev_lock(hdev);
4560
4561         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4562                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4563                                  MGMT_STATUS_BUSY);
4564                 goto unlock;
4565         }
4566
4567         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4568                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4569                                         hdev);
4570                 goto unlock;
4571         }
4572
4573         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4574                                data, len);
4575         if (!cmd) {
4576                 err = -ENOMEM;
4577                 goto unlock;
4578         }
4579
4580         hci_req_init(&req, hdev);
4581
4582         write_fast_connectable(&req, cp->val);
4583
4584         err = hci_req_run(&req, fast_connectable_complete);
4585         if (err < 0) {
4586                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4587                                  MGMT_STATUS_FAILED);
4588                 mgmt_pending_remove(cmd);
4589         }
4590
4591 unlock:
4592         hci_dev_unlock(hdev);
4593
4594         return err;
4595 }
4596
4597 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4598 {
4599         struct pending_cmd *cmd;
4600
4601         BT_DBG("status 0x%02x", status);
4602
4603         hci_dev_lock(hdev);
4604
4605         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4606         if (!cmd)
4607                 goto unlock;
4608
4609         if (status) {
4610                 u8 mgmt_err = mgmt_status(status);
4611
4612                 /* We need to restore the flag if related HCI commands
4613                  * failed.
4614                  */
4615                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4616
4617                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4618         } else {
4619                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4620                 new_settings(hdev, cmd->sk);
4621         }
4622
4623         mgmt_pending_remove(cmd);
4624
4625 unlock:
4626         hci_dev_unlock(hdev);
4627 }
4628
4629 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4630 {
4631         struct mgmt_mode *cp = data;
4632         struct pending_cmd *cmd;
4633         struct hci_request req;
4634         int err;
4635
4636         BT_DBG("request for %s", hdev->name);
4637
4638         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4639                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4640                                   MGMT_STATUS_NOT_SUPPORTED);
4641
4642         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4643                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4644                                   MGMT_STATUS_REJECTED);
4645
4646         if (cp->val != 0x00 && cp->val != 0x01)
4647                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4648                                   MGMT_STATUS_INVALID_PARAMS);
4649
4650         hci_dev_lock(hdev);
4651
4652         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4653                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4654                 goto unlock;
4655         }
4656
4657         if (!hdev_is_powered(hdev)) {
4658                 if (!cp->val) {
4659                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4660                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4661                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4662                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4663                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4664                 }
4665
4666                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4667
4668                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4669                 if (err < 0)
4670                         goto unlock;
4671
4672                 err = new_settings(hdev, sk);
4673                 goto unlock;
4674         }
4675
4676         /* Reject disabling when powered on */
4677         if (!cp->val) {
4678                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4679                                  MGMT_STATUS_REJECTED);
4680                 goto unlock;
4681         }
4682
4683         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4684                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4685                                  MGMT_STATUS_BUSY);
4686                 goto unlock;
4687         }
4688
4689         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4690         if (!cmd) {
4691                 err = -ENOMEM;
4692                 goto unlock;
4693         }
4694
4695         /* We need to flip the bit already here so that update_adv_data
4696          * generates the correct flags.
4697          */
4698         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4699
4700         hci_req_init(&req, hdev);
4701
4702         write_fast_connectable(&req, false);
4703         __hci_update_page_scan(&req);
4704
4705         /* Since only the advertising data flags will change, there
4706          * is no need to update the scan response data.
4707          */
4708         update_adv_data(&req);
4709
4710         err = hci_req_run(&req, set_bredr_complete);
4711         if (err < 0)
4712                 mgmt_pending_remove(cmd);
4713
4714 unlock:
4715         hci_dev_unlock(hdev);
4716         return err;
4717 }
4718
4719 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4720                            void *data, u16 len)
4721 {
4722         struct mgmt_mode *cp = data;
4723         struct pending_cmd *cmd;
4724         u8 val;
4725         int err;
4726
4727         BT_DBG("request for %s", hdev->name);
4728
4729         if (!lmp_sc_capable(hdev) &&
4730             !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4731                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4732                                   MGMT_STATUS_NOT_SUPPORTED);
4733
4734         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4735                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4736                                   MGMT_STATUS_INVALID_PARAMS);
4737
4738         hci_dev_lock(hdev);
4739
4740         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4741             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4742                 bool changed;
4743
4744                 if (cp->val) {
4745                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4746                                                     &hdev->dev_flags);
4747                         if (cp->val == 0x02)
4748                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4749                         else
4750                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4751                 } else {
4752                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4753                                                      &hdev->dev_flags);
4754                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4755                 }
4756
4757                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4758                 if (err < 0)
4759                         goto failed;
4760
4761                 if (changed)
4762                         err = new_settings(hdev, sk);
4763
4764                 goto failed;
4765         }
4766
4767         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4768                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4769                                  MGMT_STATUS_BUSY);
4770                 goto failed;
4771         }
4772
4773         val = !!cp->val;
4774
4775         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4776             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4777                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4778                 goto failed;
4779         }
4780
4781         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4782         if (!cmd) {
4783                 err = -ENOMEM;
4784                 goto failed;
4785         }
4786
4787         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4788         if (err < 0) {
4789                 mgmt_pending_remove(cmd);
4790                 goto failed;
4791         }
4792
4793         if (cp->val == 0x02)
4794                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4795         else
4796                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4797
4798 failed:
4799         hci_dev_unlock(hdev);
4800         return err;
4801 }
4802
4803 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4804                           void *data, u16 len)
4805 {
4806         struct mgmt_mode *cp = data;
4807         bool changed, use_changed;
4808         int err;
4809
4810         BT_DBG("request for %s", hdev->name);
4811
4812         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4813                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4814                                   MGMT_STATUS_INVALID_PARAMS);
4815
4816         hci_dev_lock(hdev);
4817
4818         if (cp->val)
4819                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4820                                             &hdev->dev_flags);
4821         else
4822                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4823                                              &hdev->dev_flags);
4824
4825         if (cp->val == 0x02)
4826                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4827                                                 &hdev->dev_flags);
4828         else
4829                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4830                                                  &hdev->dev_flags);
4831
4832         if (hdev_is_powered(hdev) && use_changed &&
4833             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4834                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4835                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4836                              sizeof(mode), &mode);
4837         }
4838
4839         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4840         if (err < 0)
4841                 goto unlock;
4842
4843         if (changed)
4844                 err = new_settings(hdev, sk);
4845
4846 unlock:
4847         hci_dev_unlock(hdev);
4848         return err;
4849 }
4850
4851 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4852                        u16 len)
4853 {
4854         struct mgmt_cp_set_privacy *cp = cp_data;
4855         bool changed;
4856         int err;
4857
4858         BT_DBG("request for %s", hdev->name);
4859
4860         if (!lmp_le_capable(hdev))
4861                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4862                                   MGMT_STATUS_NOT_SUPPORTED);
4863
4864         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4865                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4866                                   MGMT_STATUS_INVALID_PARAMS);
4867
4868         if (hdev_is_powered(hdev))
4869                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4870                                   MGMT_STATUS_REJECTED);
4871
4872         hci_dev_lock(hdev);
4873
4874         /* If user space supports this command it is also expected to
4875          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4876          */
4877         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4878
4879         if (cp->privacy) {
4880                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4881                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4882                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4883         } else {
4884                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4885                 memset(hdev->irk, 0, sizeof(hdev->irk));
4886                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4887         }
4888
4889         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4890         if (err < 0)
4891                 goto unlock;
4892
4893         if (changed)
4894                 err = new_settings(hdev, sk);
4895
4896 unlock:
4897         hci_dev_unlock(hdev);
4898         return err;
4899 }
4900
4901 static bool irk_is_valid(struct mgmt_irk_info *irk)
4902 {
4903         switch (irk->addr.type) {
4904         case BDADDR_LE_PUBLIC:
4905                 return true;
4906
4907         case BDADDR_LE_RANDOM:
4908                 /* Two most significant bits shall be set */
4909                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4910                         return false;
4911                 return true;
4912         }
4913
4914         return false;
4915 }
4916
4917 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4918                      u16 len)
4919 {
4920         struct mgmt_cp_load_irks *cp = cp_data;
4921         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4922                                    sizeof(struct mgmt_irk_info));
4923         u16 irk_count, expected_len;
4924         int i, err;
4925
4926         BT_DBG("request for %s", hdev->name);
4927
4928         if (!lmp_le_capable(hdev))
4929                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4930                                   MGMT_STATUS_NOT_SUPPORTED);
4931
4932         irk_count = __le16_to_cpu(cp->irk_count);
4933         if (irk_count > max_irk_count) {
4934                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4935                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4936                                   MGMT_STATUS_INVALID_PARAMS);
4937         }
4938
4939         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4940         if (expected_len != len) {
4941                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4942                        expected_len, len);
4943                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4944                                   MGMT_STATUS_INVALID_PARAMS);
4945         }
4946
4947         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4948
4949         for (i = 0; i < irk_count; i++) {
4950                 struct mgmt_irk_info *key = &cp->irks[i];
4951
4952                 if (!irk_is_valid(key))
4953                         return cmd_status(sk, hdev->id,
4954                                           MGMT_OP_LOAD_IRKS,
4955                                           MGMT_STATUS_INVALID_PARAMS);
4956         }
4957
4958         hci_dev_lock(hdev);
4959
4960         hci_smp_irks_clear(hdev);
4961
4962         for (i = 0; i < irk_count; i++) {
4963                 struct mgmt_irk_info *irk = &cp->irks[i];
4964                 u8 addr_type;
4965
4966                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4967                         addr_type = ADDR_LE_DEV_PUBLIC;
4968                 else
4969                         addr_type = ADDR_LE_DEV_RANDOM;
4970
4971                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4972                             BDADDR_ANY);
4973         }
4974
4975         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4976
4977         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4978
4979         hci_dev_unlock(hdev);
4980
4981         return err;
4982 }
4983
4984 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4985 {
4986         if (key->master != 0x00 && key->master != 0x01)
4987                 return false;
4988
4989         switch (key->addr.type) {
4990         case BDADDR_LE_PUBLIC:
4991                 return true;
4992
4993         case BDADDR_LE_RANDOM:
4994                 /* Two most significant bits shall be set */
4995                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4996                         return false;
4997                 return true;
4998         }
4999
5000         return false;
5001 }
5002
5003 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5004                                void *cp_data, u16 len)
5005 {
5006         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5007         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5008                                    sizeof(struct mgmt_ltk_info));
5009         u16 key_count, expected_len;
5010         int i, err;
5011
5012         BT_DBG("request for %s", hdev->name);
5013
5014         if (!lmp_le_capable(hdev))
5015                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5016                                   MGMT_STATUS_NOT_SUPPORTED);
5017
5018         key_count = __le16_to_cpu(cp->key_count);
5019         if (key_count > max_key_count) {
5020                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5021                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5022                                   MGMT_STATUS_INVALID_PARAMS);
5023         }
5024
5025         expected_len = sizeof(*cp) + key_count *
5026                                         sizeof(struct mgmt_ltk_info);
5027         if (expected_len != len) {
5028                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5029                        expected_len, len);
5030                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5031                                   MGMT_STATUS_INVALID_PARAMS);
5032         }
5033
5034         BT_DBG("%s key_count %u", hdev->name, key_count);
5035
5036         for (i = 0; i < key_count; i++) {
5037                 struct mgmt_ltk_info *key = &cp->keys[i];
5038
5039                 if (!ltk_is_valid(key))
5040                         return cmd_status(sk, hdev->id,
5041                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
5042                                           MGMT_STATUS_INVALID_PARAMS);
5043         }
5044
5045         hci_dev_lock(hdev);
5046
5047         hci_smp_ltks_clear(hdev);
5048
5049         for (i = 0; i < key_count; i++) {
5050                 struct mgmt_ltk_info *key = &cp->keys[i];
5051                 u8 type, addr_type, authenticated;
5052
5053                 if (key->addr.type == BDADDR_LE_PUBLIC)
5054                         addr_type = ADDR_LE_DEV_PUBLIC;
5055                 else
5056                         addr_type = ADDR_LE_DEV_RANDOM;
5057
5058                 switch (key->type) {
5059                 case MGMT_LTK_UNAUTHENTICATED:
5060                         authenticated = 0x00;
5061                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5062                         break;
5063                 case MGMT_LTK_AUTHENTICATED:
5064                         authenticated = 0x01;
5065                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5066                         break;
5067                 case MGMT_LTK_P256_UNAUTH:
5068                         authenticated = 0x00;
5069                         type = SMP_LTK_P256;
5070                         break;
5071                 case MGMT_LTK_P256_AUTH:
5072                         authenticated = 0x01;
5073                         type = SMP_LTK_P256;
5074                         break;
5075                 case MGMT_LTK_P256_DEBUG:
5076                         authenticated = 0x00;
5077                         type = SMP_LTK_P256_DEBUG;
5078                 default:
5079                         continue;
5080                 }
5081
5082                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5083                             authenticated, key->val, key->enc_size, key->ediv,
5084                             key->rand);
5085         }
5086
5087         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5088                            NULL, 0);
5089
5090         hci_dev_unlock(hdev);
5091
5092         return err;
5093 }
5094
5095 static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5096 {
5097         struct hci_conn *conn = cmd->user_data;
5098         struct mgmt_rp_get_conn_info rp;
5099         int err;
5100
5101         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5102
5103         if (status == MGMT_STATUS_SUCCESS) {
5104                 rp.rssi = conn->rssi;
5105                 rp.tx_power = conn->tx_power;
5106                 rp.max_tx_power = conn->max_tx_power;
5107         } else {
5108                 rp.rssi = HCI_RSSI_INVALID;
5109                 rp.tx_power = HCI_TX_POWER_INVALID;
5110                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5111         }
5112
5113         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5114                            &rp, sizeof(rp));
5115
5116         hci_conn_drop(conn);
5117         hci_conn_put(conn);
5118
5119         return err;
5120 }
5121
5122 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status)
5123 {
5124         struct hci_cp_read_rssi *cp;
5125         struct pending_cmd *cmd;
5126         struct hci_conn *conn;
5127         u16 handle;
5128         u8 status;
5129
5130         BT_DBG("status 0x%02x", hci_status);
5131
5132         hci_dev_lock(hdev);
5133
5134         /* Commands sent in request are either Read RSSI or Read Transmit Power
5135          * Level so we check which one was last sent to retrieve connection
5136          * handle.  Both commands have handle as first parameter so it's safe to
5137          * cast data on the same command struct.
5138          *
5139          * First command sent is always Read RSSI and we fail only if it fails.
5140          * In other case we simply override error to indicate success as we
5141          * already remembered if TX power value is actually valid.
5142          */
5143         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5144         if (!cp) {
5145                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5146                 status = MGMT_STATUS_SUCCESS;
5147         } else {
5148                 status = mgmt_status(hci_status);
5149         }
5150
5151         if (!cp) {
5152                 BT_ERR("invalid sent_cmd in conn_info response");
5153                 goto unlock;
5154         }
5155
5156         handle = __le16_to_cpu(cp->handle);
5157         conn = hci_conn_hash_lookup_handle(hdev, handle);
5158         if (!conn) {
5159                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5160                 goto unlock;
5161         }
5162
5163         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5164         if (!cmd)
5165                 goto unlock;
5166
5167         cmd->cmd_complete(cmd, status);
5168         mgmt_pending_remove(cmd);
5169
5170 unlock:
5171         hci_dev_unlock(hdev);
5172 }
5173
5174 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5175                          u16 len)
5176 {
5177         struct mgmt_cp_get_conn_info *cp = data;
5178         struct mgmt_rp_get_conn_info rp;
5179         struct hci_conn *conn;
5180         unsigned long conn_info_age;
5181         int err = 0;
5182
5183         BT_DBG("%s", hdev->name);
5184
5185         memset(&rp, 0, sizeof(rp));
5186         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5187         rp.addr.type = cp->addr.type;
5188
5189         if (!bdaddr_type_is_valid(cp->addr.type))
5190                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5191                                     MGMT_STATUS_INVALID_PARAMS,
5192                                     &rp, sizeof(rp));
5193
5194         hci_dev_lock(hdev);
5195
5196         if (!hdev_is_powered(hdev)) {
5197                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5198                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5199                 goto unlock;
5200         }
5201
5202         if (cp->addr.type == BDADDR_BREDR)
5203                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5204                                                &cp->addr.bdaddr);
5205         else
5206                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5207
5208         if (!conn || conn->state != BT_CONNECTED) {
5209                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5210                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5211                 goto unlock;
5212         }
5213
5214         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5215                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5216                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
5217                 goto unlock;
5218         }
5219
5220         /* To avoid client trying to guess when to poll again for information we
5221          * calculate conn info age as random value between min/max set in hdev.
5222          */
5223         conn_info_age = hdev->conn_info_min_age +
5224                         prandom_u32_max(hdev->conn_info_max_age -
5225                                         hdev->conn_info_min_age);
5226
5227         /* Query controller to refresh cached values if they are too old or were
5228          * never read.
5229          */
5230         if (time_after(jiffies, conn->conn_info_timestamp +
5231                        msecs_to_jiffies(conn_info_age)) ||
5232             !conn->conn_info_timestamp) {
5233                 struct hci_request req;
5234                 struct hci_cp_read_tx_power req_txp_cp;
5235                 struct hci_cp_read_rssi req_rssi_cp;
5236                 struct pending_cmd *cmd;
5237
5238                 hci_req_init(&req, hdev);
5239                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5240                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5241                             &req_rssi_cp);
5242
5243                 /* For LE links TX power does not change thus we don't need to
5244                  * query for it once value is known.
5245                  */
5246                 if (!bdaddr_type_is_le(cp->addr.type) ||
5247                     conn->tx_power == HCI_TX_POWER_INVALID) {
5248                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5249                         req_txp_cp.type = 0x00;
5250                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5251                                     sizeof(req_txp_cp), &req_txp_cp);
5252                 }
5253
5254                 /* Max TX power needs to be read only once per connection */
5255                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5256                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5257                         req_txp_cp.type = 0x01;
5258                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5259                                     sizeof(req_txp_cp), &req_txp_cp);
5260                 }
5261
5262                 err = hci_req_run(&req, conn_info_refresh_complete);
5263                 if (err < 0)
5264                         goto unlock;
5265
5266                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5267                                        data, len);
5268                 if (!cmd) {
5269                         err = -ENOMEM;
5270                         goto unlock;
5271                 }
5272
5273                 hci_conn_hold(conn);
5274                 cmd->user_data = hci_conn_get(conn);
5275                 cmd->cmd_complete = conn_info_cmd_complete;
5276
5277                 conn->conn_info_timestamp = jiffies;
5278         } else {
5279                 /* Cache is valid, just reply with values cached in hci_conn */
5280                 rp.rssi = conn->rssi;
5281                 rp.tx_power = conn->tx_power;
5282                 rp.max_tx_power = conn->max_tx_power;
5283
5284                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5285                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5286         }
5287
5288 unlock:
5289         hci_dev_unlock(hdev);
5290         return err;
5291 }
5292
5293 static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5294 {
5295         struct hci_conn *conn = cmd->user_data;
5296         struct mgmt_rp_get_clock_info rp;
5297         struct hci_dev *hdev;
5298         int err;
5299
5300         memset(&rp, 0, sizeof(rp));
5301         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5302
5303         if (status)
5304                 goto complete;
5305
5306         hdev = hci_dev_get(cmd->index);
5307         if (hdev) {
5308                 rp.local_clock = cpu_to_le32(hdev->clock);
5309                 hci_dev_put(hdev);
5310         }
5311
5312         if (conn) {
5313                 rp.piconet_clock = cpu_to_le32(conn->clock);
5314                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5315         }
5316
5317 complete:
5318         err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5319                            sizeof(rp));
5320
5321         if (conn) {
5322                 hci_conn_drop(conn);
5323                 hci_conn_put(conn);
5324         }
5325
5326         return err;
5327 }
5328
5329 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5330 {
5331         struct hci_cp_read_clock *hci_cp;
5332         struct pending_cmd *cmd;
5333         struct hci_conn *conn;
5334
5335         BT_DBG("%s status %u", hdev->name, status);
5336
5337         hci_dev_lock(hdev);
5338
5339         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5340         if (!hci_cp)
5341                 goto unlock;
5342
5343         if (hci_cp->which) {
5344                 u16 handle = __le16_to_cpu(hci_cp->handle);
5345                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5346         } else {
5347                 conn = NULL;
5348         }
5349
5350         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5351         if (!cmd)
5352                 goto unlock;
5353
5354         cmd->cmd_complete(cmd, mgmt_status(status));
5355         mgmt_pending_remove(cmd);
5356
5357 unlock:
5358         hci_dev_unlock(hdev);
5359 }
5360
5361 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5362                          u16 len)
5363 {
5364         struct mgmt_cp_get_clock_info *cp = data;
5365         struct mgmt_rp_get_clock_info rp;
5366         struct hci_cp_read_clock hci_cp;
5367         struct pending_cmd *cmd;
5368         struct hci_request req;
5369         struct hci_conn *conn;
5370         int err;
5371
5372         BT_DBG("%s", hdev->name);
5373
5374         memset(&rp, 0, sizeof(rp));
5375         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5376         rp.addr.type = cp->addr.type;
5377
5378         if (cp->addr.type != BDADDR_BREDR)
5379                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5380                                     MGMT_STATUS_INVALID_PARAMS,
5381                                     &rp, sizeof(rp));
5382
5383         hci_dev_lock(hdev);
5384
5385         if (!hdev_is_powered(hdev)) {
5386                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5387                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5388                 goto unlock;
5389         }
5390
5391         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5392                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5393                                                &cp->addr.bdaddr);
5394                 if (!conn || conn->state != BT_CONNECTED) {
5395                         err = cmd_complete(sk, hdev->id,
5396                                            MGMT_OP_GET_CLOCK_INFO,
5397                                            MGMT_STATUS_NOT_CONNECTED,
5398                                            &rp, sizeof(rp));
5399                         goto unlock;
5400                 }
5401         } else {
5402                 conn = NULL;
5403         }
5404
5405         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5406         if (!cmd) {
5407                 err = -ENOMEM;
5408                 goto unlock;
5409         }
5410
5411         cmd->cmd_complete = clock_info_cmd_complete;
5412
5413         hci_req_init(&req, hdev);
5414
5415         memset(&hci_cp, 0, sizeof(hci_cp));
5416         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5417
5418         if (conn) {
5419                 hci_conn_hold(conn);
5420                 cmd->user_data = hci_conn_get(conn);
5421
5422                 hci_cp.handle = cpu_to_le16(conn->handle);
5423                 hci_cp.which = 0x01; /* Piconet clock */
5424                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5425         }
5426
5427         err = hci_req_run(&req, get_clock_info_complete);
5428         if (err < 0)
5429                 mgmt_pending_remove(cmd);
5430
5431 unlock:
5432         hci_dev_unlock(hdev);
5433         return err;
5434 }
5435
5436 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5437 {
5438         struct hci_conn *conn;
5439
5440         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5441         if (!conn)
5442                 return false;
5443
5444         if (conn->dst_type != type)
5445                 return false;
5446
5447         if (conn->state != BT_CONNECTED)
5448                 return false;
5449
5450         return true;
5451 }
5452
5453 /* This function requires the caller holds hdev->lock */
5454 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5455                                u8 addr_type, u8 auto_connect)
5456 {
5457         struct hci_dev *hdev = req->hdev;
5458         struct hci_conn_params *params;
5459
5460         params = hci_conn_params_add(hdev, addr, addr_type);
5461         if (!params)
5462                 return -EIO;
5463
5464         if (params->auto_connect == auto_connect)
5465                 return 0;
5466
5467         list_del_init(&params->action);
5468
5469         switch (auto_connect) {
5470         case HCI_AUTO_CONN_DISABLED:
5471         case HCI_AUTO_CONN_LINK_LOSS:
5472                 __hci_update_background_scan(req);
5473                 break;
5474         case HCI_AUTO_CONN_REPORT:
5475                 list_add(&params->action, &hdev->pend_le_reports);
5476                 __hci_update_background_scan(req);
5477                 break;
5478         case HCI_AUTO_CONN_DIRECT:
5479         case HCI_AUTO_CONN_ALWAYS:
5480                 if (!is_connected(hdev, addr, addr_type)) {
5481                         list_add(&params->action, &hdev->pend_le_conns);
5482                         __hci_update_background_scan(req);
5483                 }
5484                 break;
5485         }
5486
5487         params->auto_connect = auto_connect;
5488
5489         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5490                auto_connect);
5491
5492         return 0;
5493 }
5494
5495 static void device_added(struct sock *sk, struct hci_dev *hdev,
5496                          bdaddr_t *bdaddr, u8 type, u8 action)
5497 {
5498         struct mgmt_ev_device_added ev;
5499
5500         bacpy(&ev.addr.bdaddr, bdaddr);
5501         ev.addr.type = type;
5502         ev.action = action;
5503
5504         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5505 }
5506
5507 static void add_device_complete(struct hci_dev *hdev, u8 status)
5508 {
5509         struct pending_cmd *cmd;
5510
5511         BT_DBG("status 0x%02x", status);
5512
5513         hci_dev_lock(hdev);
5514
5515         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5516         if (!cmd)
5517                 goto unlock;
5518
5519         cmd->cmd_complete(cmd, mgmt_status(status));
5520         mgmt_pending_remove(cmd);
5521
5522 unlock:
5523         hci_dev_unlock(hdev);
5524 }
5525
5526 static int add_device(struct sock *sk, struct hci_dev *hdev,
5527                       void *data, u16 len)
5528 {
5529         struct mgmt_cp_add_device *cp = data;
5530         struct pending_cmd *cmd;
5531         struct hci_request req;
5532         u8 auto_conn, addr_type;
5533         int err;
5534
5535         BT_DBG("%s", hdev->name);
5536
5537         if (!bdaddr_type_is_valid(cp->addr.type) ||
5538             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5539                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5540                                     MGMT_STATUS_INVALID_PARAMS,
5541                                     &cp->addr, sizeof(cp->addr));
5542
5543         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5544                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5545                                     MGMT_STATUS_INVALID_PARAMS,
5546                                     &cp->addr, sizeof(cp->addr));
5547
5548         hci_req_init(&req, hdev);
5549
5550         hci_dev_lock(hdev);
5551
5552         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5553         if (!cmd) {
5554                 err = -ENOMEM;
5555                 goto unlock;
5556         }
5557
5558         cmd->cmd_complete = addr_cmd_complete;
5559
5560         if (cp->addr.type == BDADDR_BREDR) {
5561                 /* Only incoming connections action is supported for now */
5562                 if (cp->action != 0x01) {
5563                         err = cmd->cmd_complete(cmd,
5564                                                 MGMT_STATUS_INVALID_PARAMS);
5565                         mgmt_pending_remove(cmd);
5566                         goto unlock;
5567                 }
5568
5569                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5570                                           cp->addr.type);
5571                 if (err)
5572                         goto unlock;
5573
5574                 __hci_update_page_scan(&req);
5575
5576                 goto added;
5577         }
5578
5579         if (cp->addr.type == BDADDR_LE_PUBLIC)
5580                 addr_type = ADDR_LE_DEV_PUBLIC;
5581         else
5582                 addr_type = ADDR_LE_DEV_RANDOM;
5583
5584         if (cp->action == 0x02)
5585                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5586         else if (cp->action == 0x01)
5587                 auto_conn = HCI_AUTO_CONN_DIRECT;
5588         else
5589                 auto_conn = HCI_AUTO_CONN_REPORT;
5590
5591         /* If the connection parameters don't exist for this device,
5592          * they will be created and configured with defaults.
5593          */
5594         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5595                                 auto_conn) < 0) {
5596                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5597                 mgmt_pending_remove(cmd);
5598                 goto unlock;
5599         }
5600
5601 added:
5602         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5603
5604         err = hci_req_run(&req, add_device_complete);
5605         if (err < 0) {
5606                 /* ENODATA means no HCI commands were needed (e.g. if
5607                  * the adapter is powered off).
5608                  */
5609                 if (err == -ENODATA)
5610                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5611                 mgmt_pending_remove(cmd);
5612         }
5613
5614 unlock:
5615         hci_dev_unlock(hdev);
5616         return err;
5617 }
5618
5619 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5620                            bdaddr_t *bdaddr, u8 type)
5621 {
5622         struct mgmt_ev_device_removed ev;
5623
5624         bacpy(&ev.addr.bdaddr, bdaddr);
5625         ev.addr.type = type;
5626
5627         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5628 }
5629
5630 static void remove_device_complete(struct hci_dev *hdev, u8 status)
5631 {
5632         struct pending_cmd *cmd;
5633
5634         BT_DBG("status 0x%02x", status);
5635
5636         hci_dev_lock(hdev);
5637
5638         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5639         if (!cmd)
5640                 goto unlock;
5641
5642         cmd->cmd_complete(cmd, mgmt_status(status));
5643         mgmt_pending_remove(cmd);
5644
5645 unlock:
5646         hci_dev_unlock(hdev);
5647 }
5648
5649 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5650                          void *data, u16 len)
5651 {
5652         struct mgmt_cp_remove_device *cp = data;
5653         struct pending_cmd *cmd;
5654         struct hci_request req;
5655         int err;
5656
5657         BT_DBG("%s", hdev->name);
5658
5659         hci_req_init(&req, hdev);
5660
5661         hci_dev_lock(hdev);
5662
5663         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5664         if (!cmd) {
5665                 err = -ENOMEM;
5666                 goto unlock;
5667         }
5668
5669         cmd->cmd_complete = addr_cmd_complete;
5670
5671         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5672                 struct hci_conn_params *params;
5673                 u8 addr_type;
5674
5675                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5676                         err = cmd->cmd_complete(cmd,
5677                                                 MGMT_STATUS_INVALID_PARAMS);
5678                         mgmt_pending_remove(cmd);
5679                         goto unlock;
5680                 }
5681
5682                 if (cp->addr.type == BDADDR_BREDR) {
5683                         err = hci_bdaddr_list_del(&hdev->whitelist,
5684                                                   &cp->addr.bdaddr,
5685                                                   cp->addr.type);
5686                         if (err) {
5687                                 err = cmd->cmd_complete(cmd,
5688                                                         MGMT_STATUS_INVALID_PARAMS);
5689                                 mgmt_pending_remove(cmd);
5690                                 goto unlock;
5691                         }
5692
5693                         __hci_update_page_scan(&req);
5694
5695                         device_removed(sk, hdev, &cp->addr.bdaddr,
5696                                        cp->addr.type);
5697                         goto complete;
5698                 }
5699
5700                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5701                         addr_type = ADDR_LE_DEV_PUBLIC;
5702                 else
5703                         addr_type = ADDR_LE_DEV_RANDOM;
5704
5705                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5706                                                 addr_type);
5707                 if (!params) {
5708                         err = cmd->cmd_complete(cmd,
5709                                                 MGMT_STATUS_INVALID_PARAMS);
5710                         mgmt_pending_remove(cmd);
5711                         goto unlock;
5712                 }
5713
5714                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5715                         err = cmd->cmd_complete(cmd,
5716                                                 MGMT_STATUS_INVALID_PARAMS);
5717                         mgmt_pending_remove(cmd);
5718                         goto unlock;
5719                 }
5720
5721                 list_del(&params->action);
5722                 list_del(&params->list);
5723                 kfree(params);
5724                 __hci_update_background_scan(&req);
5725
5726                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5727         } else {
5728                 struct hci_conn_params *p, *tmp;
5729                 struct bdaddr_list *b, *btmp;
5730
5731                 if (cp->addr.type) {
5732                         err = cmd->cmd_complete(cmd,
5733                                                 MGMT_STATUS_INVALID_PARAMS);
5734                         mgmt_pending_remove(cmd);
5735                         goto unlock;
5736                 }
5737
5738                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5739                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5740                         list_del(&b->list);
5741                         kfree(b);
5742                 }
5743
5744                 __hci_update_page_scan(&req);
5745
5746                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5747                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5748                                 continue;
5749                         device_removed(sk, hdev, &p->addr, p->addr_type);
5750                         list_del(&p->action);
5751                         list_del(&p->list);
5752                         kfree(p);
5753                 }
5754
5755                 BT_DBG("All LE connection parameters were removed");
5756
5757                 __hci_update_background_scan(&req);
5758         }
5759
5760 complete:
5761         err = hci_req_run(&req, remove_device_complete);
5762         if (err < 0) {
5763                 /* ENODATA means no HCI commands were needed (e.g. if
5764                  * the adapter is powered off).
5765                  */
5766                 if (err == -ENODATA)
5767                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5768                 mgmt_pending_remove(cmd);
5769         }
5770
5771 unlock:
5772         hci_dev_unlock(hdev);
5773         return err;
5774 }
5775
5776 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5777                            u16 len)
5778 {
5779         struct mgmt_cp_load_conn_param *cp = data;
5780         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5781                                      sizeof(struct mgmt_conn_param));
5782         u16 param_count, expected_len;
5783         int i;
5784
5785         if (!lmp_le_capable(hdev))
5786                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5787                                   MGMT_STATUS_NOT_SUPPORTED);
5788
5789         param_count = __le16_to_cpu(cp->param_count);
5790         if (param_count > max_param_count) {
5791                 BT_ERR("load_conn_param: too big param_count value %u",
5792                        param_count);
5793                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5794                                   MGMT_STATUS_INVALID_PARAMS);
5795         }
5796
5797         expected_len = sizeof(*cp) + param_count *
5798                                         sizeof(struct mgmt_conn_param);
5799         if (expected_len != len) {
5800                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5801                        expected_len, len);
5802                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5803                                   MGMT_STATUS_INVALID_PARAMS);
5804         }
5805
5806         BT_DBG("%s param_count %u", hdev->name, param_count);
5807
5808         hci_dev_lock(hdev);
5809
5810         hci_conn_params_clear_disabled(hdev);
5811
5812         for (i = 0; i < param_count; i++) {
5813                 struct mgmt_conn_param *param = &cp->params[i];
5814                 struct hci_conn_params *hci_param;
5815                 u16 min, max, latency, timeout;
5816                 u8 addr_type;
5817
5818                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5819                        param->addr.type);
5820
5821                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5822                         addr_type = ADDR_LE_DEV_PUBLIC;
5823                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5824                         addr_type = ADDR_LE_DEV_RANDOM;
5825                 } else {
5826                         BT_ERR("Ignoring invalid connection parameters");
5827                         continue;
5828                 }
5829
5830                 min = le16_to_cpu(param->min_interval);
5831                 max = le16_to_cpu(param->max_interval);
5832                 latency = le16_to_cpu(param->latency);
5833                 timeout = le16_to_cpu(param->timeout);
5834
5835                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5836                        min, max, latency, timeout);
5837
5838                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5839                         BT_ERR("Ignoring invalid connection parameters");
5840                         continue;
5841                 }
5842
5843                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5844                                                 addr_type);
5845                 if (!hci_param) {
5846                         BT_ERR("Failed to add connection parameters");
5847                         continue;
5848                 }
5849
5850                 hci_param->conn_min_interval = min;
5851                 hci_param->conn_max_interval = max;
5852                 hci_param->conn_latency = latency;
5853                 hci_param->supervision_timeout = timeout;
5854         }
5855
5856         hci_dev_unlock(hdev);
5857
5858         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5859 }
5860
5861 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5862                                void *data, u16 len)
5863 {
5864         struct mgmt_cp_set_external_config *cp = data;
5865         bool changed;
5866         int err;
5867
5868         BT_DBG("%s", hdev->name);
5869
5870         if (hdev_is_powered(hdev))
5871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5872                                   MGMT_STATUS_REJECTED);
5873
5874         if (cp->config != 0x00 && cp->config != 0x01)
5875                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5876                                     MGMT_STATUS_INVALID_PARAMS);
5877
5878         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5879                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5880                                   MGMT_STATUS_NOT_SUPPORTED);
5881
5882         hci_dev_lock(hdev);
5883
5884         if (cp->config)
5885                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5886                                             &hdev->dev_flags);
5887         else
5888                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5889                                              &hdev->dev_flags);
5890
5891         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5892         if (err < 0)
5893                 goto unlock;
5894
5895         if (!changed)
5896                 goto unlock;
5897
5898         err = new_options(hdev, sk);
5899
5900         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5901                 mgmt_index_removed(hdev);
5902
5903                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5904                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5905                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5906
5907                         queue_work(hdev->req_workqueue, &hdev->power_on);
5908                 } else {
5909                         set_bit(HCI_RAW, &hdev->flags);
5910                         mgmt_index_added(hdev);
5911                 }
5912         }
5913
5914 unlock:
5915         hci_dev_unlock(hdev);
5916         return err;
5917 }
5918
5919 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5920                               void *data, u16 len)
5921 {
5922         struct mgmt_cp_set_public_address *cp = data;
5923         bool changed;
5924         int err;
5925
5926         BT_DBG("%s", hdev->name);
5927
5928         if (hdev_is_powered(hdev))
5929                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5930                                   MGMT_STATUS_REJECTED);
5931
5932         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5933                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5934                                   MGMT_STATUS_INVALID_PARAMS);
5935
5936         if (!hdev->set_bdaddr)
5937                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5938                                   MGMT_STATUS_NOT_SUPPORTED);
5939
5940         hci_dev_lock(hdev);
5941
5942         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5943         bacpy(&hdev->public_addr, &cp->bdaddr);
5944
5945         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5946         if (err < 0)
5947                 goto unlock;
5948
5949         if (!changed)
5950                 goto unlock;
5951
5952         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5953                 err = new_options(hdev, sk);
5954
5955         if (is_configured(hdev)) {
5956                 mgmt_index_removed(hdev);
5957
5958                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5959
5960                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5961                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5962
5963                 queue_work(hdev->req_workqueue, &hdev->power_on);
5964         }
5965
5966 unlock:
5967         hci_dev_unlock(hdev);
5968         return err;
5969 }
5970
5971 static const struct mgmt_handler {
5972         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5973                      u16 data_len);
5974         bool var_len;
5975         size_t data_len;
5976 } mgmt_handlers[] = {
5977         { NULL }, /* 0x0000 (no command) */
5978         { read_version,           false, MGMT_READ_VERSION_SIZE },
5979         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5980         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5981         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5982         { set_powered,            false, MGMT_SETTING_SIZE },
5983         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5984         { set_connectable,        false, MGMT_SETTING_SIZE },
5985         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5986         { set_bondable,           false, MGMT_SETTING_SIZE },
5987         { set_link_security,      false, MGMT_SETTING_SIZE },
5988         { set_ssp,                false, MGMT_SETTING_SIZE },
5989         { set_hs,                 false, MGMT_SETTING_SIZE },
5990         { set_le,                 false, MGMT_SETTING_SIZE },
5991         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5992         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5993         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5994         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5995         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5996         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5997         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5998         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5999         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
6000         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6001         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
6002         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
6003         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6004         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
6005         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
6006         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6007         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
6008         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6009         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6010         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
6011         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6012         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
6013         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
6014         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
6015         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
6016         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
6017         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
6018         { set_advertising,        false, MGMT_SETTING_SIZE },
6019         { set_bredr,              false, MGMT_SETTING_SIZE },
6020         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
6021         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
6022         { set_secure_conn,        false, MGMT_SETTING_SIZE },
6023         { set_debug_keys,         false, MGMT_SETTING_SIZE },
6024         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
6025         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
6026         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
6027         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
6028         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
6029         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
6030         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
6031         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
6032         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
6033         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
6034         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
6035         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
6036 };
6037
6038 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
6039 {
6040         void *buf;
6041         u8 *cp;
6042         struct mgmt_hdr *hdr;
6043         u16 opcode, index, len;
6044         struct hci_dev *hdev = NULL;
6045         const struct mgmt_handler *handler;
6046         int err;
6047
6048         BT_DBG("got %zu bytes", msglen);
6049
6050         if (msglen < sizeof(*hdr))
6051                 return -EINVAL;
6052
6053         buf = kmalloc(msglen, GFP_KERNEL);
6054         if (!buf)
6055                 return -ENOMEM;
6056
6057         if (memcpy_from_msg(buf, msg, msglen)) {
6058                 err = -EFAULT;
6059                 goto done;
6060         }
6061
6062         hdr = buf;
6063         opcode = __le16_to_cpu(hdr->opcode);
6064         index = __le16_to_cpu(hdr->index);
6065         len = __le16_to_cpu(hdr->len);
6066
6067         if (len != msglen - sizeof(*hdr)) {
6068                 err = -EINVAL;
6069                 goto done;
6070         }
6071
6072         if (index != MGMT_INDEX_NONE) {
6073                 hdev = hci_dev_get(index);
6074                 if (!hdev) {
6075                         err = cmd_status(sk, index, opcode,
6076                                          MGMT_STATUS_INVALID_INDEX);
6077                         goto done;
6078                 }
6079
6080                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
6081                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
6082                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
6083                         err = cmd_status(sk, index, opcode,
6084                                          MGMT_STATUS_INVALID_INDEX);
6085                         goto done;
6086                 }
6087
6088                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
6089                     opcode != MGMT_OP_READ_CONFIG_INFO &&
6090                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
6091                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
6092                         err = cmd_status(sk, index, opcode,
6093                                          MGMT_STATUS_INVALID_INDEX);
6094                         goto done;
6095                 }
6096         }
6097
6098         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
6099             mgmt_handlers[opcode].func == NULL) {
6100                 BT_DBG("Unknown op %u", opcode);
6101                 err = cmd_status(sk, index, opcode,
6102                                  MGMT_STATUS_UNKNOWN_COMMAND);
6103                 goto done;
6104         }
6105
6106         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
6107                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6108                 err = cmd_status(sk, index, opcode,
6109                                  MGMT_STATUS_INVALID_INDEX);
6110                 goto done;
6111         }
6112
6113         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
6114                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6115                 err = cmd_status(sk, index, opcode,
6116                                  MGMT_STATUS_INVALID_INDEX);
6117                 goto done;
6118         }
6119
6120         handler = &mgmt_handlers[opcode];
6121
6122         if ((handler->var_len && len < handler->data_len) ||
6123             (!handler->var_len && len != handler->data_len)) {
6124                 err = cmd_status(sk, index, opcode,
6125                                  MGMT_STATUS_INVALID_PARAMS);
6126                 goto done;
6127         }
6128
6129         if (hdev)
6130                 mgmt_init_hdev(sk, hdev);
6131
6132         cp = buf + sizeof(*hdr);
6133
6134         err = handler->func(sk, hdev, cp, len);
6135         if (err < 0)
6136                 goto done;
6137
6138         err = msglen;
6139
6140 done:
6141         if (hdev)
6142                 hci_dev_put(hdev);
6143
6144         kfree(buf);
6145         return err;
6146 }
6147
6148 void mgmt_index_added(struct hci_dev *hdev)
6149 {
6150         if (hdev->dev_type != HCI_BREDR)
6151                 return;
6152
6153         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6154                 return;
6155
6156         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6157                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6158         else
6159                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6160 }
6161
6162 void mgmt_index_removed(struct hci_dev *hdev)
6163 {
6164         u8 status = MGMT_STATUS_INVALID_INDEX;
6165
6166         if (hdev->dev_type != HCI_BREDR)
6167                 return;
6168
6169         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6170                 return;
6171
6172         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6173
6174         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6175                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6176         else
6177                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6178 }
6179
6180 /* This function requires the caller holds hdev->lock */
6181 static void restart_le_actions(struct hci_request *req)
6182 {
6183         struct hci_dev *hdev = req->hdev;
6184         struct hci_conn_params *p;
6185
6186         list_for_each_entry(p, &hdev->le_conn_params, list) {
6187                 /* Needed for AUTO_OFF case where might not "really"
6188                  * have been powered off.
6189                  */
6190                 list_del_init(&p->action);
6191
6192                 switch (p->auto_connect) {
6193                 case HCI_AUTO_CONN_DIRECT:
6194                 case HCI_AUTO_CONN_ALWAYS:
6195                         list_add(&p->action, &hdev->pend_le_conns);
6196                         break;
6197                 case HCI_AUTO_CONN_REPORT:
6198                         list_add(&p->action, &hdev->pend_le_reports);
6199                         break;
6200                 default:
6201                         break;
6202                 }
6203         }
6204
6205         __hci_update_background_scan(req);
6206 }
6207
6208 static void powered_complete(struct hci_dev *hdev, u8 status)
6209 {
6210         struct cmd_lookup match = { NULL, hdev };
6211
6212         BT_DBG("status 0x%02x", status);
6213
6214         hci_dev_lock(hdev);
6215
6216         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6217
6218         new_settings(hdev, match.sk);
6219
6220         hci_dev_unlock(hdev);
6221
6222         if (match.sk)
6223                 sock_put(match.sk);
6224 }
6225
6226 static int powered_update_hci(struct hci_dev *hdev)
6227 {
6228         struct hci_request req;
6229         u8 link_sec;
6230
6231         hci_req_init(&req, hdev);
6232
6233         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6234             !lmp_host_ssp_capable(hdev)) {
6235                 u8 ssp = 1;
6236
6237                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
6238         }
6239
6240         if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6241                 u8 sc = 0x01;
6242                 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, sizeof(sc), &sc);
6243         }
6244
6245         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6246             lmp_bredr_capable(hdev)) {
6247                 struct hci_cp_write_le_host_supported cp;
6248
6249                 cp.le = 0x01;
6250                 cp.simul = 0x00;
6251
6252                 /* Check first if we already have the right
6253                  * host state (host features set)
6254                  */
6255                 if (cp.le != lmp_host_le_capable(hdev) ||
6256                     cp.simul != lmp_host_le_br_capable(hdev))
6257                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6258                                     sizeof(cp), &cp);
6259         }
6260
6261         if (lmp_le_capable(hdev)) {
6262                 /* Make sure the controller has a good default for
6263                  * advertising data. This also applies to the case
6264                  * where BR/EDR was toggled during the AUTO_OFF phase.
6265                  */
6266                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6267                         update_adv_data(&req);
6268                         update_scan_rsp_data(&req);
6269                 }
6270
6271                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6272                         enable_advertising(&req);
6273
6274                 restart_le_actions(&req);
6275         }
6276
6277         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6278         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6279                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6280                             sizeof(link_sec), &link_sec);
6281
6282         if (lmp_bredr_capable(hdev)) {
6283                 write_fast_connectable(&req, false);
6284                 __hci_update_page_scan(&req);
6285                 update_class(&req);
6286                 update_name(&req);
6287                 update_eir(&req);
6288         }
6289
6290         return hci_req_run(&req, powered_complete);
6291 }
6292
6293 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6294 {
6295         struct cmd_lookup match = { NULL, hdev };
6296         u8 status, zero_cod[] = { 0, 0, 0 };
6297         int err;
6298
6299         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6300                 return 0;
6301
6302         if (powered) {
6303                 if (powered_update_hci(hdev) == 0)
6304                         return 0;
6305
6306                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6307                                      &match);
6308                 goto new_settings;
6309         }
6310
6311         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6312
6313         /* If the power off is because of hdev unregistration let
6314          * use the appropriate INVALID_INDEX status. Otherwise use
6315          * NOT_POWERED. We cover both scenarios here since later in
6316          * mgmt_index_removed() any hci_conn callbacks will have already
6317          * been triggered, potentially causing misleading DISCONNECTED
6318          * status responses.
6319          */
6320         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6321                 status = MGMT_STATUS_INVALID_INDEX;
6322         else
6323                 status = MGMT_STATUS_NOT_POWERED;
6324
6325         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6326
6327         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6328                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6329                            zero_cod, sizeof(zero_cod), NULL);
6330
6331 new_settings:
6332         err = new_settings(hdev, match.sk);
6333
6334         if (match.sk)
6335                 sock_put(match.sk);
6336
6337         return err;
6338 }
6339
6340 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6341 {
6342         struct pending_cmd *cmd;
6343         u8 status;
6344
6345         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6346         if (!cmd)
6347                 return;
6348
6349         if (err == -ERFKILL)
6350                 status = MGMT_STATUS_RFKILLED;
6351         else
6352                 status = MGMT_STATUS_FAILED;
6353
6354         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6355
6356         mgmt_pending_remove(cmd);
6357 }
6358
6359 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6360 {
6361         struct hci_request req;
6362
6363         hci_dev_lock(hdev);
6364
6365         /* When discoverable timeout triggers, then just make sure
6366          * the limited discoverable flag is cleared. Even in the case
6367          * of a timeout triggered from general discoverable, it is
6368          * safe to unconditionally clear the flag.
6369          */
6370         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6371         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6372
6373         hci_req_init(&req, hdev);
6374         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6375                 u8 scan = SCAN_PAGE;
6376                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6377                             sizeof(scan), &scan);
6378         }
6379         update_class(&req);
6380         update_adv_data(&req);
6381         hci_req_run(&req, NULL);
6382
6383         hdev->discov_timeout = 0;
6384
6385         new_settings(hdev, NULL);
6386
6387         hci_dev_unlock(hdev);
6388 }
6389
6390 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6391                        bool persistent)
6392 {
6393         struct mgmt_ev_new_link_key ev;
6394
6395         memset(&ev, 0, sizeof(ev));
6396
6397         ev.store_hint = persistent;
6398         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6399         ev.key.addr.type = BDADDR_BREDR;
6400         ev.key.type = key->type;
6401         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6402         ev.key.pin_len = key->pin_len;
6403
6404         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6405 }
6406
6407 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6408 {
6409         switch (ltk->type) {
6410         case SMP_LTK:
6411         case SMP_LTK_SLAVE:
6412                 if (ltk->authenticated)
6413                         return MGMT_LTK_AUTHENTICATED;
6414                 return MGMT_LTK_UNAUTHENTICATED;
6415         case SMP_LTK_P256:
6416                 if (ltk->authenticated)
6417                         return MGMT_LTK_P256_AUTH;
6418                 return MGMT_LTK_P256_UNAUTH;
6419         case SMP_LTK_P256_DEBUG:
6420                 return MGMT_LTK_P256_DEBUG;
6421         }
6422
6423         return MGMT_LTK_UNAUTHENTICATED;
6424 }
6425
6426 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6427 {
6428         struct mgmt_ev_new_long_term_key ev;
6429
6430         memset(&ev, 0, sizeof(ev));
6431
6432         /* Devices using resolvable or non-resolvable random addresses
6433          * without providing an indentity resolving key don't require
6434          * to store long term keys. Their addresses will change the
6435          * next time around.
6436          *
6437          * Only when a remote device provides an identity address
6438          * make sure the long term key is stored. If the remote
6439          * identity is known, the long term keys are internally
6440          * mapped to the identity address. So allow static random
6441          * and public addresses here.
6442          */
6443         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6444             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6445                 ev.store_hint = 0x00;
6446         else
6447                 ev.store_hint = persistent;
6448
6449         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6450         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6451         ev.key.type = mgmt_ltk_type(key);
6452         ev.key.enc_size = key->enc_size;
6453         ev.key.ediv = key->ediv;
6454         ev.key.rand = key->rand;
6455
6456         if (key->type == SMP_LTK)
6457                 ev.key.master = 1;
6458
6459         memcpy(ev.key.val, key->val, sizeof(key->val));
6460
6461         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6462 }
6463
6464 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6465 {
6466         struct mgmt_ev_new_irk ev;
6467
6468         memset(&ev, 0, sizeof(ev));
6469
6470         /* For identity resolving keys from devices that are already
6471          * using a public address or static random address, do not
6472          * ask for storing this key. The identity resolving key really
6473          * is only mandatory for devices using resovlable random
6474          * addresses.
6475          *
6476          * Storing all identity resolving keys has the downside that
6477          * they will be also loaded on next boot of they system. More
6478          * identity resolving keys, means more time during scanning is
6479          * needed to actually resolve these addresses.
6480          */
6481         if (bacmp(&irk->rpa, BDADDR_ANY))
6482                 ev.store_hint = 0x01;
6483         else
6484                 ev.store_hint = 0x00;
6485
6486         bacpy(&ev.rpa, &irk->rpa);
6487         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6488         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6489         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6490
6491         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6492 }
6493
6494 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6495                    bool persistent)
6496 {
6497         struct mgmt_ev_new_csrk ev;
6498
6499         memset(&ev, 0, sizeof(ev));
6500
6501         /* Devices using resolvable or non-resolvable random addresses
6502          * without providing an indentity resolving key don't require
6503          * to store signature resolving keys. Their addresses will change
6504          * the next time around.
6505          *
6506          * Only when a remote device provides an identity address
6507          * make sure the signature resolving key is stored. So allow
6508          * static random and public addresses here.
6509          */
6510         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6511             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6512                 ev.store_hint = 0x00;
6513         else
6514                 ev.store_hint = persistent;
6515
6516         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6517         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6518         ev.key.master = csrk->master;
6519         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6520
6521         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6522 }
6523
6524 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6525                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6526                          u16 max_interval, u16 latency, u16 timeout)
6527 {
6528         struct mgmt_ev_new_conn_param ev;
6529
6530         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6531                 return;
6532
6533         memset(&ev, 0, sizeof(ev));
6534         bacpy(&ev.addr.bdaddr, bdaddr);
6535         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6536         ev.store_hint = store_hint;
6537         ev.min_interval = cpu_to_le16(min_interval);
6538         ev.max_interval = cpu_to_le16(max_interval);
6539         ev.latency = cpu_to_le16(latency);
6540         ev.timeout = cpu_to_le16(timeout);
6541
6542         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6543 }
6544
6545 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6546                                   u8 data_len)
6547 {
6548         eir[eir_len++] = sizeof(type) + data_len;
6549         eir[eir_len++] = type;
6550         memcpy(&eir[eir_len], data, data_len);
6551         eir_len += data_len;
6552
6553         return eir_len;
6554 }
6555
6556 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6557                            u32 flags, u8 *name, u8 name_len)
6558 {
6559         char buf[512];
6560         struct mgmt_ev_device_connected *ev = (void *) buf;
6561         u16 eir_len = 0;
6562
6563         bacpy(&ev->addr.bdaddr, &conn->dst);
6564         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6565
6566         ev->flags = __cpu_to_le32(flags);
6567
6568         /* We must ensure that the EIR Data fields are ordered and
6569          * unique. Keep it simple for now and avoid the problem by not
6570          * adding any BR/EDR data to the LE adv.
6571          */
6572         if (conn->le_adv_data_len > 0) {
6573                 memcpy(&ev->eir[eir_len],
6574                        conn->le_adv_data, conn->le_adv_data_len);
6575                 eir_len = conn->le_adv_data_len;
6576         } else {
6577                 if (name_len > 0)
6578                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6579                                                   name, name_len);
6580
6581                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6582                         eir_len = eir_append_data(ev->eir, eir_len,
6583                                                   EIR_CLASS_OF_DEV,
6584                                                   conn->dev_class, 3);
6585         }
6586
6587         ev->eir_len = cpu_to_le16(eir_len);
6588
6589         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6590                     sizeof(*ev) + eir_len, NULL);
6591 }
6592
6593 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6594 {
6595         struct sock **sk = data;
6596
6597         cmd->cmd_complete(cmd, 0);
6598
6599         *sk = cmd->sk;
6600         sock_hold(*sk);
6601
6602         mgmt_pending_remove(cmd);
6603 }
6604
6605 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6606 {
6607         struct hci_dev *hdev = data;
6608         struct mgmt_cp_unpair_device *cp = cmd->param;
6609
6610         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6611
6612         cmd->cmd_complete(cmd, 0);
6613         mgmt_pending_remove(cmd);
6614 }
6615
6616 bool mgmt_powering_down(struct hci_dev *hdev)
6617 {
6618         struct pending_cmd *cmd;
6619         struct mgmt_mode *cp;
6620
6621         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6622         if (!cmd)
6623                 return false;
6624
6625         cp = cmd->param;
6626         if (!cp->val)
6627                 return true;
6628
6629         return false;
6630 }
6631
6632 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6633                               u8 link_type, u8 addr_type, u8 reason,
6634                               bool mgmt_connected)
6635 {
6636         struct mgmt_ev_device_disconnected ev;
6637         struct sock *sk = NULL;
6638
6639         /* The connection is still in hci_conn_hash so test for 1
6640          * instead of 0 to know if this is the last one.
6641          */
6642         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6643                 cancel_delayed_work(&hdev->power_off);
6644                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6645         }
6646
6647         if (!mgmt_connected)
6648                 return;
6649
6650         if (link_type != ACL_LINK && link_type != LE_LINK)
6651                 return;
6652
6653         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6654
6655         bacpy(&ev.addr.bdaddr, bdaddr);
6656         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6657         ev.reason = reason;
6658
6659         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6660
6661         if (sk)
6662                 sock_put(sk);
6663
6664         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6665                              hdev);
6666 }
6667
6668 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6669                             u8 link_type, u8 addr_type, u8 status)
6670 {
6671         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6672         struct mgmt_cp_disconnect *cp;
6673         struct pending_cmd *cmd;
6674
6675         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6676                              hdev);
6677
6678         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6679         if (!cmd)
6680                 return;
6681
6682         cp = cmd->param;
6683
6684         if (bacmp(bdaddr, &cp->addr.bdaddr))
6685                 return;
6686
6687         if (cp->addr.type != bdaddr_type)
6688                 return;
6689
6690         cmd->cmd_complete(cmd, mgmt_status(status));
6691         mgmt_pending_remove(cmd);
6692 }
6693
6694 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6695                          u8 addr_type, u8 status)
6696 {
6697         struct mgmt_ev_connect_failed ev;
6698
6699         /* The connection is still in hci_conn_hash so test for 1
6700          * instead of 0 to know if this is the last one.
6701          */
6702         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6703                 cancel_delayed_work(&hdev->power_off);
6704                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6705         }
6706
6707         bacpy(&ev.addr.bdaddr, bdaddr);
6708         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6709         ev.status = mgmt_status(status);
6710
6711         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6712 }
6713
6714 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6715 {
6716         struct mgmt_ev_pin_code_request ev;
6717
6718         bacpy(&ev.addr.bdaddr, bdaddr);
6719         ev.addr.type = BDADDR_BREDR;
6720         ev.secure = secure;
6721
6722         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6723 }
6724
6725 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6726                                   u8 status)
6727 {
6728         struct pending_cmd *cmd;
6729
6730         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6731         if (!cmd)
6732                 return;
6733
6734         cmd->cmd_complete(cmd, mgmt_status(status));
6735         mgmt_pending_remove(cmd);
6736 }
6737
6738 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6739                                       u8 status)
6740 {
6741         struct pending_cmd *cmd;
6742
6743         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6744         if (!cmd)
6745                 return;
6746
6747         cmd->cmd_complete(cmd, mgmt_status(status));
6748         mgmt_pending_remove(cmd);
6749 }
6750
6751 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6752                               u8 link_type, u8 addr_type, u32 value,
6753                               u8 confirm_hint)
6754 {
6755         struct mgmt_ev_user_confirm_request ev;
6756
6757         BT_DBG("%s", hdev->name);
6758
6759         bacpy(&ev.addr.bdaddr, bdaddr);
6760         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6761         ev.confirm_hint = confirm_hint;
6762         ev.value = cpu_to_le32(value);
6763
6764         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6765                           NULL);
6766 }
6767
6768 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6769                               u8 link_type, u8 addr_type)
6770 {
6771         struct mgmt_ev_user_passkey_request ev;
6772
6773         BT_DBG("%s", hdev->name);
6774
6775         bacpy(&ev.addr.bdaddr, bdaddr);
6776         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6777
6778         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6779                           NULL);
6780 }
6781
6782 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6783                                       u8 link_type, u8 addr_type, u8 status,
6784                                       u8 opcode)
6785 {
6786         struct pending_cmd *cmd;
6787
6788         cmd = mgmt_pending_find(opcode, hdev);
6789         if (!cmd)
6790                 return -ENOENT;
6791
6792         cmd->cmd_complete(cmd, mgmt_status(status));
6793         mgmt_pending_remove(cmd);
6794
6795         return 0;
6796 }
6797
6798 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6799                                      u8 link_type, u8 addr_type, u8 status)
6800 {
6801         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6802                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6803 }
6804
6805 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6806                                          u8 link_type, u8 addr_type, u8 status)
6807 {
6808         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6809                                           status,
6810                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6811 }
6812
6813 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6814                                      u8 link_type, u8 addr_type, u8 status)
6815 {
6816         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6817                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6818 }
6819
6820 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6821                                          u8 link_type, u8 addr_type, u8 status)
6822 {
6823         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6824                                           status,
6825                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6826 }
6827
6828 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6829                              u8 link_type, u8 addr_type, u32 passkey,
6830                              u8 entered)
6831 {
6832         struct mgmt_ev_passkey_notify ev;
6833
6834         BT_DBG("%s", hdev->name);
6835
6836         bacpy(&ev.addr.bdaddr, bdaddr);
6837         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6838         ev.passkey = __cpu_to_le32(passkey);
6839         ev.entered = entered;
6840
6841         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6842 }
6843
6844 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6845 {
6846         struct mgmt_ev_auth_failed ev;
6847         struct pending_cmd *cmd;
6848         u8 status = mgmt_status(hci_status);
6849
6850         bacpy(&ev.addr.bdaddr, &conn->dst);
6851         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6852         ev.status = status;
6853
6854         cmd = find_pairing(conn);
6855
6856         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6857                     cmd ? cmd->sk : NULL);
6858
6859         if (cmd) {
6860                 cmd->cmd_complete(cmd, status);
6861                 mgmt_pending_remove(cmd);
6862         }
6863 }
6864
6865 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6866 {
6867         struct cmd_lookup match = { NULL, hdev };
6868         bool changed;
6869
6870         if (status) {
6871                 u8 mgmt_err = mgmt_status(status);
6872                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6873                                      cmd_status_rsp, &mgmt_err);
6874                 return;
6875         }
6876
6877         if (test_bit(HCI_AUTH, &hdev->flags))
6878                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6879                                             &hdev->dev_flags);
6880         else
6881                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6882                                              &hdev->dev_flags);
6883
6884         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6885                              &match);
6886
6887         if (changed)
6888                 new_settings(hdev, match.sk);
6889
6890         if (match.sk)
6891                 sock_put(match.sk);
6892 }
6893
6894 static void clear_eir(struct hci_request *req)
6895 {
6896         struct hci_dev *hdev = req->hdev;
6897         struct hci_cp_write_eir cp;
6898
6899         if (!lmp_ext_inq_capable(hdev))
6900                 return;
6901
6902         memset(hdev->eir, 0, sizeof(hdev->eir));
6903
6904         memset(&cp, 0, sizeof(cp));
6905
6906         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6907 }
6908
6909 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6910 {
6911         struct cmd_lookup match = { NULL, hdev };
6912         struct hci_request req;
6913         bool changed = false;
6914
6915         if (status) {
6916                 u8 mgmt_err = mgmt_status(status);
6917
6918                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6919                                                  &hdev->dev_flags)) {
6920                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6921                         new_settings(hdev, NULL);
6922                 }
6923
6924                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6925                                      &mgmt_err);
6926                 return;
6927         }
6928
6929         if (enable) {
6930                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6931         } else {
6932                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6933                 if (!changed)
6934                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6935                                                      &hdev->dev_flags);
6936                 else
6937                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6938         }
6939
6940         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6941
6942         if (changed)
6943                 new_settings(hdev, match.sk);
6944
6945         if (match.sk)
6946                 sock_put(match.sk);
6947
6948         hci_req_init(&req, hdev);
6949
6950         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6951                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6952                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6953                                     sizeof(enable), &enable);
6954                 update_eir(&req);
6955         } else {
6956                 clear_eir(&req);
6957         }
6958
6959         hci_req_run(&req, NULL);
6960 }
6961
6962 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6963 {
6964         struct cmd_lookup match = { NULL, hdev };
6965         bool changed = false;
6966
6967         if (status) {
6968                 u8 mgmt_err = mgmt_status(status);
6969
6970                 if (enable) {
6971                         if (test_and_clear_bit(HCI_SC_ENABLED,
6972                                                &hdev->dev_flags))
6973                                 new_settings(hdev, NULL);
6974                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6975                 }
6976
6977                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6978                                      cmd_status_rsp, &mgmt_err);
6979                 return;
6980         }
6981
6982         if (enable) {
6983                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6984         } else {
6985                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6986                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6987         }
6988
6989         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6990                              settings_rsp, &match);
6991
6992         if (changed)
6993                 new_settings(hdev, match.sk);
6994
6995         if (match.sk)
6996                 sock_put(match.sk);
6997 }
6998
6999 static void sk_lookup(struct pending_cmd *cmd, void *data)
7000 {
7001         struct cmd_lookup *match = data;
7002
7003         if (match->sk == NULL) {
7004                 match->sk = cmd->sk;
7005                 sock_hold(match->sk);
7006         }
7007 }
7008
7009 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7010                                     u8 status)
7011 {
7012         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7013
7014         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7015         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7016         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7017
7018         if (!status)
7019                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7020                            NULL);
7021
7022         if (match.sk)
7023                 sock_put(match.sk);
7024 }
7025
7026 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7027 {
7028         struct mgmt_cp_set_local_name ev;
7029         struct pending_cmd *cmd;
7030
7031         if (status)
7032                 return;
7033
7034         memset(&ev, 0, sizeof(ev));
7035         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7036         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7037
7038         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7039         if (!cmd) {
7040                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7041
7042                 /* If this is a HCI command related to powering on the
7043                  * HCI dev don't send any mgmt signals.
7044                  */
7045                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7046                         return;
7047         }
7048
7049         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7050                    cmd ? cmd->sk : NULL);
7051 }
7052
7053 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7054                                        u8 *rand192, u8 *hash256, u8 *rand256,
7055                                        u8 status)
7056 {
7057         struct pending_cmd *cmd;
7058
7059         BT_DBG("%s status %u", hdev->name, status);
7060
7061         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7062         if (!cmd)
7063                 return;
7064
7065         if (status) {
7066                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7067                            mgmt_status(status));
7068         } else {
7069                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7070                         struct mgmt_rp_read_local_oob_ext_data rp;
7071
7072                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7073                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7074
7075                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7076                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7077
7078                         cmd_complete(cmd->sk, hdev->id,
7079                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7080                                      &rp, sizeof(rp));
7081                 } else {
7082                         struct mgmt_rp_read_local_oob_data rp;
7083
7084                         memcpy(rp.hash, hash192, sizeof(rp.hash));
7085                         memcpy(rp.rand, rand192, sizeof(rp.rand));
7086
7087                         cmd_complete(cmd->sk, hdev->id,
7088                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7089                                      &rp, sizeof(rp));
7090                 }
7091         }
7092
7093         mgmt_pending_remove(cmd);
7094 }
7095
7096 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7097 {
7098         int i;
7099
7100         for (i = 0; i < uuid_count; i++) {
7101                 if (!memcmp(uuid, uuids[i], 16))
7102                         return true;
7103         }
7104
7105         return false;
7106 }
7107
7108 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7109 {
7110         u16 parsed = 0;
7111
7112         while (parsed < eir_len) {
7113                 u8 field_len = eir[0];
7114                 u8 uuid[16];
7115                 int i;
7116
7117                 if (field_len == 0)
7118                         break;
7119
7120                 if (eir_len - parsed < field_len + 1)
7121                         break;
7122
7123                 switch (eir[1]) {
7124                 case EIR_UUID16_ALL:
7125                 case EIR_UUID16_SOME:
7126                         for (i = 0; i + 3 <= field_len; i += 2) {
7127                                 memcpy(uuid, bluetooth_base_uuid, 16);
7128                                 uuid[13] = eir[i + 3];
7129                                 uuid[12] = eir[i + 2];
7130                                 if (has_uuid(uuid, uuid_count, uuids))
7131                                         return true;
7132                         }
7133                         break;
7134                 case EIR_UUID32_ALL:
7135                 case EIR_UUID32_SOME:
7136                         for (i = 0; i + 5 <= field_len; i += 4) {
7137                                 memcpy(uuid, bluetooth_base_uuid, 16);
7138                                 uuid[15] = eir[i + 5];
7139                                 uuid[14] = eir[i + 4];
7140                                 uuid[13] = eir[i + 3];
7141                                 uuid[12] = eir[i + 2];
7142                                 if (has_uuid(uuid, uuid_count, uuids))
7143                                         return true;
7144                         }
7145                         break;
7146                 case EIR_UUID128_ALL:
7147                 case EIR_UUID128_SOME:
7148                         for (i = 0; i + 17 <= field_len; i += 16) {
7149                                 memcpy(uuid, eir + i + 2, 16);
7150                                 if (has_uuid(uuid, uuid_count, uuids))
7151                                         return true;
7152                         }
7153                         break;
7154                 }
7155
7156                 parsed += field_len + 1;
7157                 eir += field_len + 1;
7158         }
7159
7160         return false;
7161 }
7162
7163 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7164                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7165                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7166 {
7167         char buf[512];
7168         struct mgmt_ev_device_found *ev = (void *) buf;
7169         size_t ev_size;
7170         bool match;
7171
7172         /* Don't send events for a non-kernel initiated discovery. With
7173          * LE one exception is if we have pend_le_reports > 0 in which
7174          * case we're doing passive scanning and want these events.
7175          */
7176         if (!hci_discovery_active(hdev)) {
7177                 if (link_type == ACL_LINK)
7178                         return;
7179                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7180                         return;
7181         }
7182
7183         /* When using service discovery with a RSSI threshold, then check
7184          * if such a RSSI threshold is specified. If a RSSI threshold has
7185          * been specified, then all results with a RSSI smaller than the
7186          * RSSI threshold will be dropped.
7187          *
7188          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7189          * the results are also dropped.
7190          */
7191         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7192             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
7193                 return;
7194
7195         /* Make sure that the buffer is big enough. The 5 extra bytes
7196          * are for the potential CoD field.
7197          */
7198         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7199                 return;
7200
7201         memset(buf, 0, sizeof(buf));
7202
7203         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7204          * RSSI value was reported as 0 when not available. This behavior
7205          * is kept when using device discovery. This is required for full
7206          * backwards compatibility with the API.
7207          *
7208          * However when using service discovery, the value 127 will be
7209          * returned when the RSSI is not available.
7210          */
7211         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi)
7212                 rssi = 0;
7213
7214         bacpy(&ev->addr.bdaddr, bdaddr);
7215         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7216         ev->rssi = rssi;
7217         ev->flags = cpu_to_le32(flags);
7218
7219         if (eir_len > 0) {
7220                 /* When using service discovery and a list of UUID is
7221                  * provided, results with no matching UUID should be
7222                  * dropped. In case there is a match the result is
7223                  * kept and checking possible scan response data
7224                  * will be skipped.
7225                  */
7226                 if (hdev->discovery.uuid_count > 0)
7227                         match = eir_has_uuids(eir, eir_len,
7228                                               hdev->discovery.uuid_count,
7229                                               hdev->discovery.uuids);
7230                 else
7231                         match = true;
7232
7233                 if (!match && !scan_rsp_len)
7234                         return;
7235
7236                 /* Copy EIR or advertising data into event */
7237                 memcpy(ev->eir, eir, eir_len);
7238         } else {
7239                 /* When using service discovery and a list of UUID is
7240                  * provided, results with empty EIR or advertising data
7241                  * should be dropped since they do not match any UUID.
7242                  */
7243                 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
7244                         return;
7245
7246                 match = false;
7247         }
7248
7249         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7250                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7251                                           dev_class, 3);
7252
7253         if (scan_rsp_len > 0) {
7254                 /* When using service discovery and a list of UUID is
7255                  * provided, results with no matching UUID should be
7256                  * dropped if there is no previous match from the
7257                  * advertising data.
7258                  */
7259                 if (hdev->discovery.uuid_count > 0) {
7260                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7261                                                      hdev->discovery.uuid_count,
7262                                                      hdev->discovery.uuids))
7263                                 return;
7264                 }
7265
7266                 /* Append scan response data to event */
7267                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7268         } else {
7269                 /* When using service discovery and a list of UUID is
7270                  * provided, results with empty scan response and no
7271                  * previous matched advertising data should be dropped.
7272                  */
7273                 if (hdev->discovery.uuid_count > 0 && !match)
7274                         return;
7275         }
7276
7277         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7278         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7279
7280         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7281 }
7282
7283 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7284                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7285 {
7286         struct mgmt_ev_device_found *ev;
7287         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7288         u16 eir_len;
7289
7290         ev = (struct mgmt_ev_device_found *) buf;
7291
7292         memset(buf, 0, sizeof(buf));
7293
7294         bacpy(&ev->addr.bdaddr, bdaddr);
7295         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7296         ev->rssi = rssi;
7297
7298         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7299                                   name_len);
7300
7301         ev->eir_len = cpu_to_le16(eir_len);
7302
7303         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7304 }
7305
7306 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7307 {
7308         struct mgmt_ev_discovering ev;
7309
7310         BT_DBG("%s discovering %u", hdev->name, discovering);
7311
7312         memset(&ev, 0, sizeof(ev));
7313         ev.type = hdev->discovery.type;
7314         ev.discovering = discovering;
7315
7316         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7317 }
7318
7319 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
7320 {
7321         BT_DBG("%s status %u", hdev->name, status);
7322 }
7323
7324 void mgmt_reenable_advertising(struct hci_dev *hdev)
7325 {
7326         struct hci_request req;
7327
7328         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7329                 return;
7330
7331         hci_req_init(&req, hdev);
7332         enable_advertising(&req);
7333         hci_req_run(&req, adv_enable_complete);
7334 }