net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   8
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_BONDABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96         MGMT_OP_START_SERVICE_DISCOVERY,
  97 };
  98
  99 static const u16 mgmt_events[] = {
 100         MGMT_EV_CONTROLLER_ERROR,
 101         MGMT_EV_INDEX_ADDED,
 102         MGMT_EV_INDEX_REMOVED,
 103         MGMT_EV_NEW_SETTINGS,
 104         MGMT_EV_CLASS_OF_DEV_CHANGED,
 105         MGMT_EV_LOCAL_NAME_CHANGED,
 106         MGMT_EV_NEW_LINK_KEY,
 107         MGMT_EV_NEW_LONG_TERM_KEY,
 108         MGMT_EV_DEVICE_CONNECTED,
 109         MGMT_EV_DEVICE_DISCONNECTED,
 110         MGMT_EV_CONNECT_FAILED,
 111         MGMT_EV_PIN_CODE_REQUEST,
 112         MGMT_EV_USER_CONFIRM_REQUEST,
 113         MGMT_EV_USER_PASSKEY_REQUEST,
 114         MGMT_EV_AUTH_FAILED,
 115         MGMT_EV_DEVICE_FOUND,
 116         MGMT_EV_DISCOVERING,
 117         MGMT_EV_DEVICE_BLOCKED,
 118         MGMT_EV_DEVICE_UNBLOCKED,
 119         MGMT_EV_DEVICE_UNPAIRED,
 120         MGMT_EV_PASSKEY_NOTIFY,
 121         MGMT_EV_NEW_IRK,
 122         MGMT_EV_NEW_CSRK,
 123         MGMT_EV_DEVICE_ADDED,
 124         MGMT_EV_DEVICE_REMOVED,
 125         MGMT_EV_NEW_CONN_PARAM,
 126         MGMT_EV_UNCONF_INDEX_ADDED,
 127         MGMT_EV_UNCONF_INDEX_REMOVED,
 128         MGMT_EV_NEW_CONFIG_OPTIONS,
 129 };
 130
 131 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 132
 133 struct pending_cmd {
 134         struct list_head list;
 135         u16 opcode;
 136         int index;
 137         void *param;
 138         size_t param_len;
 139         struct sock *sk;
 140         void *user_data;
 141         void (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 142 };
 143
 144 /* HCI to MGMT error code conversion table */
 145 static u8 mgmt_status_table[] = {
 146         MGMT_STATUS_SUCCESS,
 147         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 148         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 149         MGMT_STATUS_FAILED,             /* Hardware Failure */
 150         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 151         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 152         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 153         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 154         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 157         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 158         MGMT_STATUS_BUSY,               /* Command Disallowed */
 159         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 160         MGMT_STATUS_REJECTED,           /* Rejected Security */
 161         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 162         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 165         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 166         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 167         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 168         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 169         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 170         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 171         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 173         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 174         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 175         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 177         MGMT_STATUS_FAILED,             /* Unspecified Error */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 179         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 180         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 181         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 182         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 183         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 184         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 186         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 188         MGMT_STATUS_FAILED,             /* Transaction Collision */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 190         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 192         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 194         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 195         MGMT_STATUS_FAILED,             /* Slot Violation */
 196         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 197         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 199         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 200         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 201         MGMT_STATUS_BUSY,               /* Controller Busy */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 203         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 204         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 205         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 206         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 207 };
 208
 209 static u8 mgmt_status(u8 hci_status)
 210 {
 211         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 212                 return mgmt_status_table[hci_status];
 213
 214         return MGMT_STATUS_FAILED;
 215 }
 216
 217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 218                       struct sock *skip_sk)
 219 {
 220         struct sk_buff *skb;
 221         struct mgmt_hdr *hdr;
 222
 223         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228         hdr->opcode = cpu_to_le16(event);
 229         if (hdev)
 230                 hdr->index = cpu_to_le16(hdev->id);
 231         else
 232                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 233         hdr->len = cpu_to_le16(data_len);
 234
 235         if (data)
 236                 memcpy(skb_put(skb, data_len), data, data_len);
 237
 238         /* Time stamp */
 239         __net_timestamp(skb);
 240
 241         hci_send_to_control(skb, skip_sk);
 242         kfree_skb(skb);
 243
 244         return 0;
 245 }
 246
 247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 248 {
 249         struct sk_buff *skb;
 250         struct mgmt_hdr *hdr;
 251         struct mgmt_ev_cmd_status *ev;
 252         int err;
 253
 254         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 255
 256         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 257         if (!skb)
 258                 return -ENOMEM;
 259
 260         hdr = (void *) skb_put(skb, sizeof(*hdr));
 261
 262         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 263         hdr->index = cpu_to_le16(index);
 264         hdr->len = cpu_to_le16(sizeof(*ev));
 265
 266         ev = (void *) skb_put(skb, sizeof(*ev));
 267         ev->status = status;
 268         ev->opcode = cpu_to_le16(cmd);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 278                         void *rp, size_t rp_len)
 279 {
 280         struct sk_buff *skb;
 281         struct mgmt_hdr *hdr;
 282         struct mgmt_ev_cmd_complete *ev;
 283         int err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 288         if (!skb)
 289                 return -ENOMEM;
 290
 291         hdr = (void *) skb_put(skb, sizeof(*hdr));
 292
 293         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 294         hdr->index = cpu_to_le16(index);
 295         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 296
 297         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 298         ev->opcode = cpu_to_le16(cmd);
 299         ev->status = status;
 300
 301         if (rp)
 302                 memcpy(ev->data, rp, rp_len);
 303
 304         err = sock_queue_rcv_skb(sk, skb);
 305         if (err < 0)
 306                 kfree_skb(skb);
 307
 308         return err;
 309 }
 310
 311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 312                         u16 data_len)
 313 {
 314         struct mgmt_rp_read_version rp;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         rp.version = MGMT_VERSION;
 319         rp.revision = cpu_to_le16(MGMT_REVISION);
 320
 321         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 322                             sizeof(rp));
 323 }
 324
 325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 326                          u16 data_len)
 327 {
 328         struct mgmt_rp_read_commands *rp;
 329         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 330         const u16 num_events = ARRAY_SIZE(mgmt_events);
 331         __le16 *opcode;
 332         size_t rp_size;
 333         int i, err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 338
 339         rp = kmalloc(rp_size, GFP_KERNEL);
 340         if (!rp)
 341                 return -ENOMEM;
 342
 343         rp->num_commands = cpu_to_le16(num_commands);
 344         rp->num_events = cpu_to_le16(num_events);
 345
 346         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 347                 put_unaligned_le16(mgmt_commands[i], opcode);
 348
 349         for (i = 0; i < num_events; i++, opcode++)
 350                 put_unaligned_le16(mgmt_events[i], opcode);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 353                            rp_size);
 354         kfree(rp);
 355
 356         return err;
 357 }
 358
 359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 360                            u16 data_len)
 361 {
 362         struct mgmt_rp_read_index_list *rp;
 363         struct hci_dev *d;
 364         size_t rp_len;
 365         u16 count;
 366         int err;
 367
 368         BT_DBG("sock %p", sk);
 369
 370         read_lock(&hci_dev_list_lock);
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (d->dev_type == HCI_BREDR &&
 375                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 376                         count++;
 377         }
 378
 379         rp_len = sizeof(*rp) + (2 * count);
 380         rp = kmalloc(rp_len, GFP_ATOMIC);
 381         if (!rp) {
 382                 read_unlock(&hci_dev_list_lock);
 383                 return -ENOMEM;
 384         }
 385
 386         count = 0;
 387         list_for_each_entry(d, &hci_dev_list, list) {
 388                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 389                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 390                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 391                         continue;
 392
 393                 /* Devices marked as raw-only are neither configured
 394                  * nor unconfigured controllers.
 395                  */
 396                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 397                         continue;
 398
 399                 if (d->dev_type == HCI_BREDR &&
 400                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 401                         rp->index[count++] = cpu_to_le16(d->id);
 402                         BT_DBG("Added hci%u", d->id);
 403                 }
 404         }
 405
 406         rp->num_controllers = cpu_to_le16(count);
 407         rp_len = sizeof(*rp) + (2 * count);
 408
 409         read_unlock(&hci_dev_list_lock);
 410
 411         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 412                            rp_len);
 413
 414         kfree(rp);
 415
 416         return err;
 417 }
 418
 419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 420                                   void *data, u16 data_len)
 421 {
 422         struct mgmt_rp_read_unconf_index_list *rp;
 423         struct hci_dev *d;
 424         size_t rp_len;
 425         u16 count;
 426         int err;
 427
 428         BT_DBG("sock %p", sk);
 429
 430         read_lock(&hci_dev_list_lock);
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (d->dev_type == HCI_BREDR &&
 435                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 436                         count++;
 437         }
 438
 439         rp_len = sizeof(*rp) + (2 * count);
 440         rp = kmalloc(rp_len, GFP_ATOMIC);
 441         if (!rp) {
 442                 read_unlock(&hci_dev_list_lock);
 443                 return -ENOMEM;
 444         }
 445
 446         count = 0;
 447         list_for_each_entry(d, &hci_dev_list, list) {
 448                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 449                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 450                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 451                         continue;
 452
 453                 /* Devices marked as raw-only are neither configured
 454                  * nor unconfigured controllers.
 455                  */
 456                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 457                         continue;
 458
 459                 if (d->dev_type == HCI_BREDR &&
 460                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 461                         rp->index[count++] = cpu_to_le16(d->id);
 462                         BT_DBG("Added hci%u", d->id);
 463                 }
 464         }
 465
 466         rp->num_controllers = cpu_to_le16(count);
 467         rp_len = sizeof(*rp) + (2 * count);
 468
 469         read_unlock(&hci_dev_list_lock);
 470
 471         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 472                            0, rp, rp_len);
 473
 474         kfree(rp);
 475
 476         return err;
 477 }
 478
 479 static bool is_configured(struct hci_dev *hdev)
 480 {
 481         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 482             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 483                 return false;
 484
 485         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 486             !bacmp(&hdev->public_addr, BDADDR_ANY))
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 static __le32 get_missing_options(struct hci_dev *hdev)
 493 {
 494         u32 options = 0;
 495
 496         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 497             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 498                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 499
 500         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 501             !bacmp(&hdev->public_addr, BDADDR_ANY))
 502                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 503
 504         return cpu_to_le32(options);
 505 }
 506
 507 static int new_options(struct hci_dev *hdev, struct sock *skip)
 508 {
 509         __le32 options = get_missing_options(hdev);
 510
 511         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 512                           sizeof(options), skip);
 513 }
 514
 515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 516 {
 517         __le32 options = get_missing_options(hdev);
 518
 519         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 520                             sizeof(options));
 521 }
 522
 523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 524                             void *data, u16 data_len)
 525 {
 526         struct mgmt_rp_read_config_info rp;
 527         u32 options = 0;
 528
 529         BT_DBG("sock %p %s", sk, hdev->name);
 530
 531         hci_dev_lock(hdev);
 532
 533         memset(&rp, 0, sizeof(rp));
 534         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 537                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 538
 539         if (hdev->set_bdaddr)
 540                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 541
 542         rp.supported_options = cpu_to_le32(options);
 543         rp.missing_options = get_missing_options(hdev);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 548                             sizeof(rp));
 549 }
 550
 551 static u32 get_supported_settings(struct hci_dev *hdev)
 552 {
 553         u32 settings = 0;
 554
 555         settings |= MGMT_SETTING_POWERED;
 556         settings |= MGMT_SETTING_BONDABLE;
 557         settings |= MGMT_SETTING_DEBUG_KEYS;
 558         settings |= MGMT_SETTING_CONNECTABLE;
 559         settings |= MGMT_SETTING_DISCOVERABLE;
 560
 561         if (lmp_bredr_capable(hdev)) {
 562                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 563                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 564                 settings |= MGMT_SETTING_BREDR;
 565                 settings |= MGMT_SETTING_LINK_SECURITY;
 566
 567                 if (lmp_ssp_capable(hdev)) {
 568                         settings |= MGMT_SETTING_SSP;
 569                         settings |= MGMT_SETTING_HS;
 570                 }
 571
 572                 if (lmp_sc_capable(hdev) ||
 573                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_SECURE_CONN;
 581                 settings |= MGMT_SETTING_PRIVACY;
 582         }
 583
 584         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 585             hdev->set_bdaddr)
 586                 settings |= MGMT_SETTING_CONFIGURATION;
 587
 588         return settings;
 589 }
 590
 591 static u32 get_current_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         if (hdev_is_powered(hdev))
 596                 settings |= MGMT_SETTING_POWERED;
 597
 598         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 599                 settings |= MGMT_SETTING_CONNECTABLE;
 600
 601         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 602                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 603
 604         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 605                 settings |= MGMT_SETTING_DISCOVERABLE;
 606
 607         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 608                 settings |= MGMT_SETTING_BONDABLE;
 609
 610         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 611                 settings |= MGMT_SETTING_BREDR;
 612
 613         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 614                 settings |= MGMT_SETTING_LE;
 615
 616         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 617                 settings |= MGMT_SETTING_LINK_SECURITY;
 618
 619         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 620                 settings |= MGMT_SETTING_SSP;
 621
 622         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 623                 settings |= MGMT_SETTING_HS;
 624
 625         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 626                 settings |= MGMT_SETTING_ADVERTISING;
 627
 628         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 629                 settings |= MGMT_SETTING_SECURE_CONN;
 630
 631         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 632                 settings |= MGMT_SETTING_DEBUG_KEYS;
 633
 634         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 635                 settings |= MGMT_SETTING_PRIVACY;
 636
 637         return settings;
 638 }
 639
 640 #define PNP_INFO_SVCLASS_ID             0x1200
 641
 642 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 643 {
 644         u8 *ptr = data, *uuids_start = NULL;
 645         struct bt_uuid *uuid;
 646
 647         if (len < 4)
 648                 return ptr;
 649
 650         list_for_each_entry(uuid, &hdev->uuids, list) {
 651                 u16 uuid16;
 652
 653                 if (uuid->size != 16)
 654                         continue;
 655
 656                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 657                 if (uuid16 < 0x1100)
 658                         continue;
 659
 660                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 661                         continue;
 662
 663                 if (!uuids_start) {
 664                         uuids_start = ptr;
 665                         uuids_start[0] = 1;
 666                         uuids_start[1] = EIR_UUID16_ALL;
 667                         ptr += 2;
 668                 }
 669
 670                 /* Stop if not enough space to put next UUID */
 671                 if ((ptr - data) + sizeof(u16) > len) {
 672                         uuids_start[1] = EIR_UUID16_SOME;
 673                         break;
 674                 }
 675
 676                 *ptr++ = (uuid16 & 0x00ff);
 677                 *ptr++ = (uuid16 & 0xff00) >> 8;
 678                 uuids_start[0] += sizeof(uuid16);
 679         }
 680
 681         return ptr;
 682 }
 683
 684 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 685 {
 686         u8 *ptr = data, *uuids_start = NULL;
 687         struct bt_uuid *uuid;
 688
 689         if (len < 6)
 690                 return ptr;
 691
 692         list_for_each_entry(uuid, &hdev->uuids, list) {
 693                 if (uuid->size != 32)
 694                         continue;
 695
 696                 if (!uuids_start) {
 697                         uuids_start = ptr;
 698                         uuids_start[0] = 1;
 699                         uuids_start[1] = EIR_UUID32_ALL;
 700                         ptr += 2;
 701                 }
 702
 703                 /* Stop if not enough space to put next UUID */
 704                 if ((ptr - data) + sizeof(u32) > len) {
 705                         uuids_start[1] = EIR_UUID32_SOME;
 706                         break;
 707                 }
 708
 709                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 710                 ptr += sizeof(u32);
 711                 uuids_start[0] += sizeof(u32);
 712         }
 713
 714         return ptr;
 715 }
 716
 717 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 718 {
 719         u8 *ptr = data, *uuids_start = NULL;
 720         struct bt_uuid *uuid;
 721
 722         if (len < 18)
 723                 return ptr;
 724
 725         list_for_each_entry(uuid, &hdev->uuids, list) {
 726                 if (uuid->size != 128)
 727                         continue;
 728
 729                 if (!uuids_start) {
 730                         uuids_start = ptr;
 731                         uuids_start[0] = 1;
 732                         uuids_start[1] = EIR_UUID128_ALL;
 733                         ptr += 2;
 734                 }
 735
 736                 /* Stop if not enough space to put next UUID */
 737                 if ((ptr - data) + 16 > len) {
 738                         uuids_start[1] = EIR_UUID128_SOME;
 739                         break;
 740                 }
 741
 742                 memcpy(ptr, uuid->uuid, 16);
 743                 ptr += 16;
 744                 uuids_start[0] += 16;
 745         }
 746
 747         return ptr;
 748 }
 749
 750 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 751 {
 752         struct pending_cmd *cmd;
 753
 754         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 755                 if (cmd->opcode == opcode)
 756                         return cmd;
 757         }
 758
 759         return NULL;
 760 }
 761
 762 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 763                                                   struct hci_dev *hdev,
 764                                                   const void *data)
 765 {
 766         struct pending_cmd *cmd;
 767
 768         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 769                 if (cmd->user_data != data)
 770                         continue;
 771                 if (cmd->opcode == opcode)
 772                         return cmd;
 773         }
 774
 775         return NULL;
 776 }
 777
 778 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 779 {
 780         u8 ad_len = 0;
 781         size_t name_len;
 782
 783         name_len = strlen(hdev->dev_name);
 784         if (name_len > 0) {
 785                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 786
 787                 if (name_len > max_len) {
 788                         name_len = max_len;
 789                         ptr[1] = EIR_NAME_SHORT;
 790                 } else
 791                         ptr[1] = EIR_NAME_COMPLETE;
 792
 793                 ptr[0] = name_len + 1;
 794
 795                 memcpy(ptr + 2, hdev->dev_name, name_len);
 796
 797                 ad_len += (name_len + 2);
 798                 ptr += (name_len + 2);
 799         }
 800
 801         return ad_len;
 802 }
 803
 804 static void update_scan_rsp_data(struct hci_request *req)
 805 {
 806         struct hci_dev *hdev = req->hdev;
 807         struct hci_cp_le_set_scan_rsp_data cp;
 808         u8 len;
 809
 810         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 811                 return;
 812
 813         memset(&cp, 0, sizeof(cp));
 814
 815         len = create_scan_rsp_data(hdev, cp.data);
 816
 817         if (hdev->scan_rsp_data_len == len &&
 818             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 819                 return;
 820
 821         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 822         hdev->scan_rsp_data_len = len;
 823
 824         cp.length = len;
 825
 826         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 827 }
 828
 829 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 830 {
 831         struct pending_cmd *cmd;
 832
 833         /* If there's a pending mgmt command the flags will not yet have
 834          * their final values, so check for this first.
 835          */
 836         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 837         if (cmd) {
 838                 struct mgmt_mode *cp = cmd->param;
 839                 if (cp->val == 0x01)
 840                         return LE_AD_GENERAL;
 841                 else if (cp->val == 0x02)
 842                         return LE_AD_LIMITED;
 843         } else {
 844                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 845                         return LE_AD_LIMITED;
 846                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 847                         return LE_AD_GENERAL;
 848         }
 849
 850         return 0;
 851 }
 852
 853 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 854 {
 855         u8 ad_len = 0, flags = 0;
 856
 857         flags |= get_adv_discov_flags(hdev);
 858
 859         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 860                 flags |= LE_AD_NO_BREDR;
 861
 862         if (flags) {
 863                 BT_DBG("adv flags 0x%02x", flags);
 864
 865                 ptr[0] = 2;
 866                 ptr[1] = EIR_FLAGS;
 867                 ptr[2] = flags;
 868
 869                 ad_len += 3;
 870                 ptr += 3;
 871         }
 872
 873         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 874                 ptr[0] = 2;
 875                 ptr[1] = EIR_TX_POWER;
 876                 ptr[2] = (u8) hdev->adv_tx_power;
 877
 878                 ad_len += 3;
 879                 ptr += 3;
 880         }
 881
 882         return ad_len;
 883 }
 884
 885 static void update_adv_data(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         struct hci_cp_le_set_adv_data cp;
 889         u8 len;
 890
 891         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 892                 return;
 893
 894         memset(&cp, 0, sizeof(cp));
 895
 896         len = create_adv_data(hdev, cp.data);
 897
 898         if (hdev->adv_data_len == len &&
 899             memcmp(cp.data, hdev->adv_data, len) == 0)
 900                 return;
 901
 902         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 903         hdev->adv_data_len = len;
 904
 905         cp.length = len;
 906
 907         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 908 }
 909
 910 int mgmt_update_adv_data(struct hci_dev *hdev)
 911 {
 912         struct hci_request req;
 913
 914         hci_req_init(&req, hdev);
 915         update_adv_data(&req);
 916
 917         return hci_req_run(&req, NULL);
 918 }
 919
 920 static void create_eir(struct hci_dev *hdev, u8 *data)
 921 {
 922         u8 *ptr = data;
 923         size_t name_len;
 924
 925         name_len = strlen(hdev->dev_name);
 926
 927         if (name_len > 0) {
 928                 /* EIR Data type */
 929                 if (name_len > 48) {
 930                         name_len = 48;
 931                         ptr[1] = EIR_NAME_SHORT;
 932                 } else
 933                         ptr[1] = EIR_NAME_COMPLETE;
 934
 935                 /* EIR Data length */
 936                 ptr[0] = name_len + 1;
 937
 938                 memcpy(ptr + 2, hdev->dev_name, name_len);
 939
 940                 ptr += (name_len + 2);
 941         }
 942
 943         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 944                 ptr[0] = 2;
 945                 ptr[1] = EIR_TX_POWER;
 946                 ptr[2] = (u8) hdev->inq_tx_power;
 947
 948                 ptr += 3;
 949         }
 950
 951         if (hdev->devid_source > 0) {
 952                 ptr[0] = 9;
 953                 ptr[1] = EIR_DEVICE_ID;
 954
 955                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 956                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 957                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 958                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 959
 960                 ptr += 10;
 961         }
 962
 963         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 964         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 965         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 966 }
 967
 968 static void update_eir(struct hci_request *req)
 969 {
 970         struct hci_dev *hdev = req->hdev;
 971         struct hci_cp_write_eir cp;
 972
 973         if (!hdev_is_powered(hdev))
 974                 return;
 975
 976         if (!lmp_ext_inq_capable(hdev))
 977                 return;
 978
 979         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 980                 return;
 981
 982         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 983                 return;
 984
 985         memset(&cp, 0, sizeof(cp));
 986
 987         create_eir(hdev, cp.data);
 988
 989         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 990                 return;
 991
 992         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 993
 994         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 995 }
 996
 997 static u8 get_service_classes(struct hci_dev *hdev)
 998 {
 999         struct bt_uuid *uuid;
1000         u8 val = 0;
1001
1002         list_for_each_entry(uuid, &hdev->uuids, list)
1003                 val |= uuid->svc_hint;
1004
1005         return val;
1006 }
1007
1008 static void update_class(struct hci_request *req)
1009 {
1010         struct hci_dev *hdev = req->hdev;
1011         u8 cod[3];
1012
1013         BT_DBG("%s", hdev->name);
1014
1015         if (!hdev_is_powered(hdev))
1016                 return;
1017
1018         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1019                 return;
1020
1021         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1022                 return;
1023
1024         cod[0] = hdev->minor_class;
1025         cod[1] = hdev->major_class;
1026         cod[2] = get_service_classes(hdev);
1027
1028         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1029                 cod[1] |= 0x20;
1030
1031         if (memcmp(cod, hdev->dev_class, 3) == 0)
1032                 return;
1033
1034         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1035 }
1036
1037 static bool get_connectable(struct hci_dev *hdev)
1038 {
1039         struct pending_cmd *cmd;
1040
1041         /* If there's a pending mgmt command the flag will not yet have
1042          * it's final value, so check for this first.
1043          */
1044         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1045         if (cmd) {
1046                 struct mgmt_mode *cp = cmd->param;
1047                 return cp->val;
1048         }
1049
1050         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1051 }
1052
1053 static void disable_advertising(struct hci_request *req)
1054 {
1055         u8 enable = 0x00;
1056
1057         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1058 }
1059
1060 static void enable_advertising(struct hci_request *req)
1061 {
1062         struct hci_dev *hdev = req->hdev;
1063         struct hci_cp_le_set_adv_param cp;
1064         u8 own_addr_type, enable = 0x01;
1065         bool connectable;
1066
1067         if (hci_conn_num(hdev, LE_LINK) > 0)
1068                 return;
1069
1070         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1071                 disable_advertising(req);
1072
1073         /* Clear the HCI_LE_ADV bit temporarily so that the
1074          * hci_update_random_address knows that it's safe to go ahead
1075          * and write a new random address. The flag will be set back on
1076          * as soon as the SET_ADV_ENABLE HCI command completes.
1077          */
1078         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1079
1080         connectable = get_connectable(hdev);
1081
1082         /* Set require_privacy to true only when non-connectable
1083          * advertising is used. In that case it is fine to use a
1084          * non-resolvable private address.
1085          */
1086         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1087                 return;
1088
1089         memset(&cp, 0, sizeof(cp));
1090         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1091         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1092         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1093         cp.own_address_type = own_addr_type;
1094         cp.channel_map = hdev->le_adv_channel_map;
1095
1096         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1097
1098         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1099 }
1100
1101 static void service_cache_off(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             service_cache.work);
1105         struct hci_request req;
1106
1107         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1108                 return;
1109
1110         hci_req_init(&req, hdev);
1111
1112         hci_dev_lock(hdev);
1113
1114         update_eir(&req);
1115         update_class(&req);
1116
1117         hci_dev_unlock(hdev);
1118
1119         hci_req_run(&req, NULL);
1120 }
1121
1122 static void rpa_expired(struct work_struct *work)
1123 {
1124         struct hci_dev *hdev = container_of(work, struct hci_dev,
1125                                             rpa_expired.work);
1126         struct hci_request req;
1127
1128         BT_DBG("");
1129
1130         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1131
1132         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1133                 return;
1134
1135         /* The generation of a new RPA and programming it into the
1136          * controller happens in the enable_advertising() function.
1137          */
1138         hci_req_init(&req, hdev);
1139         enable_advertising(&req);
1140         hci_req_run(&req, NULL);
1141 }
1142
1143 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1144 {
1145         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1146                 return;
1147
1148         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1149         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1150
1151         /* Non-mgmt controlled devices get this bit set
1152          * implicitly so that pairing works for them, however
1153          * for mgmt we require user-space to explicitly enable
1154          * it
1155          */
1156         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1157 }
1158
1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160                                 void *data, u16 data_len)
1161 {
1162         struct mgmt_rp_read_info rp;
1163
1164         BT_DBG("sock %p %s", sk, hdev->name);
1165
1166         hci_dev_lock(hdev);
1167
1168         memset(&rp, 0, sizeof(rp));
1169
1170         bacpy(&rp.bdaddr, &hdev->bdaddr);
1171
1172         rp.version = hdev->hci_ver;
1173         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1174
1175         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1177
1178         memcpy(rp.dev_class, hdev->dev_class, 3);
1179
1180         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1182
1183         hci_dev_unlock(hdev);
1184
1185         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1186                             sizeof(rp));
1187 }
1188
1189 static void mgmt_pending_free(struct pending_cmd *cmd)
1190 {
1191         sock_put(cmd->sk);
1192         kfree(cmd->param);
1193         kfree(cmd);
1194 }
1195
1196 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1197                                             struct hci_dev *hdev, void *data,
1198                                             u16 len)
1199 {
1200         struct pending_cmd *cmd;
1201
1202         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1203         if (!cmd)
1204                 return NULL;
1205
1206         cmd->opcode = opcode;
1207         cmd->index = hdev->id;
1208
1209         cmd->param = kmemdup(data, len, GFP_KERNEL);
1210         if (!cmd->param) {
1211                 kfree(cmd);
1212                 return NULL;
1213         }
1214
1215         cmd->param_len = len;
1216
1217         cmd->sk = sk;
1218         sock_hold(sk);
1219
1220         list_add(&cmd->list, &hdev->mgmt_pending);
1221
1222         return cmd;
1223 }
1224
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226                                  void (*cb)(struct pending_cmd *cmd,
1227                                             void *data),
1228                                  void *data)
1229 {
1230         struct pending_cmd *cmd, *tmp;
1231
1232         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233                 if (opcode > 0 && cmd->opcode != opcode)
1234                         continue;
1235
1236                 cb(cmd, data);
1237         }
1238 }
1239
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1241 {
1242         list_del(&cmd->list);
1243         mgmt_pending_free(cmd);
1244 }
1245
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1247 {
1248         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1249
1250         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1251                             sizeof(settings));
1252 }
1253
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1255 {
1256         BT_DBG("%s status 0x%02x", hdev->name, status);
1257
1258         if (hci_conn_count(hdev) == 0) {
1259                 cancel_delayed_work(&hdev->power_off);
1260                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1261         }
1262 }
1263
1264 static bool hci_stop_discovery(struct hci_request *req)
1265 {
1266         struct hci_dev *hdev = req->hdev;
1267         struct hci_cp_remote_name_req_cancel cp;
1268         struct inquiry_entry *e;
1269
1270         switch (hdev->discovery.state) {
1271         case DISCOVERY_FINDING:
1272                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1274                 } else {
1275                         cancel_delayed_work(&hdev->le_scan_disable);
1276                         hci_req_add_le_scan_disable(req);
1277                 }
1278
1279                 return true;
1280
1281         case DISCOVERY_RESOLVING:
1282                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1283                                                      NAME_PENDING);
1284                 if (!e)
1285                         break;
1286
1287                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1289                             &cp);
1290
1291                 return true;
1292
1293         default:
1294                 /* Passive scanning */
1295                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296                         hci_req_add_le_scan_disable(req);
1297                         return true;
1298                 }
1299
1300                 break;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1307 {
1308         struct hci_request req;
1309         struct hci_conn *conn;
1310         bool discov_stopped;
1311         int err;
1312
1313         hci_req_init(&req, hdev);
1314
1315         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316             test_bit(HCI_PSCAN, &hdev->flags)) {
1317                 u8 scan = 0x00;
1318                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1319         }
1320
1321         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322                 disable_advertising(&req);
1323
1324         discov_stopped = hci_stop_discovery(&req);
1325
1326         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327                 struct hci_cp_disconnect dc;
1328                 struct hci_cp_reject_conn_req rej;
1329
1330                 switch (conn->state) {
1331                 case BT_CONNECTED:
1332                 case BT_CONFIG:
1333                         dc.handle = cpu_to_le16(conn->handle);
1334                         dc.reason = 0x15; /* Terminated due to Power Off */
1335                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1336                         break;
1337                 case BT_CONNECT:
1338                         if (conn->type == LE_LINK)
1339                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1340                                             0, NULL);
1341                         else if (conn->type == ACL_LINK)
1342                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1343                                             6, &conn->dst);
1344                         break;
1345                 case BT_CONNECT2:
1346                         bacpy(&rej.bdaddr, &conn->dst);
1347                         rej.reason = 0x15; /* Terminated due to Power Off */
1348                         if (conn->type == ACL_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         else if (conn->type == SCO_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         break;
1355                 }
1356         }
1357
1358         err = hci_req_run(&req, clean_up_hci_complete);
1359         if (!err && discov_stopped)
1360                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1361
1362         return err;
1363 }
1364
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1366                        u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         struct pending_cmd *cmd;
1370         int err;
1371
1372         BT_DBG("request for %s", hdev->name);
1373
1374         if (cp->val != 0x00 && cp->val != 0x01)
1375                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376                                   MGMT_STATUS_INVALID_PARAMS);
1377
1378         hci_dev_lock(hdev);
1379
1380         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1382                                  MGMT_STATUS_BUSY);
1383                 goto failed;
1384         }
1385
1386         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387                 cancel_delayed_work(&hdev->power_off);
1388
1389                 if (cp->val) {
1390                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1391                                          data, len);
1392                         err = mgmt_powered(hdev, 1);
1393                         goto failed;
1394                 }
1395         }
1396
1397         if (!!cp->val == hdev_is_powered(hdev)) {
1398                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1399                 goto failed;
1400         }
1401
1402         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1403         if (!cmd) {
1404                 err = -ENOMEM;
1405                 goto failed;
1406         }
1407
1408         if (cp->val) {
1409                 queue_work(hdev->req_workqueue, &hdev->power_on);
1410                 err = 0;
1411         } else {
1412                 /* Disconnect connections, stop scans, etc */
1413                 err = clean_up_hci_state(hdev);
1414                 if (!err)
1415                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416                                            HCI_POWER_OFF_TIMEOUT);
1417
1418                 /* ENODATA means there were no HCI commands queued */
1419                 if (err == -ENODATA) {
1420                         cancel_delayed_work(&hdev->power_off);
1421                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1422                         err = 0;
1423                 }
1424         }
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1432 {
1433         __le32 ev;
1434
1435         ev = cpu_to_le32(get_current_settings(hdev));
1436
1437         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1438 }
1439
1440 int mgmt_new_settings(struct hci_dev *hdev)
1441 {
1442         return new_settings(hdev, NULL);
1443 }
1444
1445 struct cmd_lookup {
1446         struct sock *sk;
1447         struct hci_dev *hdev;
1448         u8 mgmt_status;
1449 };
1450
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1452 {
1453         struct cmd_lookup *match = data;
1454
1455         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1456
1457         list_del(&cmd->list);
1458
1459         if (match->sk == NULL) {
1460                 match->sk = cmd->sk;
1461                 sock_hold(match->sk);
1462         }
1463
1464         mgmt_pending_free(cmd);
1465 }
1466
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1468 {
1469         u8 *status = data;
1470
1471         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472         mgmt_pending_remove(cmd);
1473 }
1474
1475 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1476 {
1477         if (cmd->cmd_complete) {
1478                 u8 *status = data;
1479
1480                 cmd->cmd_complete(cmd, *status);
1481                 mgmt_pending_remove(cmd);
1482
1483                 return;
1484         }
1485
1486         cmd_status_rsp(cmd, data);
1487 }
1488
1489 static void generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1490 {
1491         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1492                      cmd->param_len);
1493 }
1494
1495 static void addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1496 {
1497         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1498                      sizeof(struct mgmt_addr_info));
1499 }
1500
1501 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1502 {
1503         if (!lmp_bredr_capable(hdev))
1504                 return MGMT_STATUS_NOT_SUPPORTED;
1505         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1506                 return MGMT_STATUS_REJECTED;
1507         else
1508                 return MGMT_STATUS_SUCCESS;
1509 }
1510
1511 static u8 mgmt_le_support(struct hci_dev *hdev)
1512 {
1513         if (!lmp_le_capable(hdev))
1514                 return MGMT_STATUS_NOT_SUPPORTED;
1515         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1516                 return MGMT_STATUS_REJECTED;
1517         else
1518                 return MGMT_STATUS_SUCCESS;
1519 }
1520
1521 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1522 {
1523         struct pending_cmd *cmd;
1524         struct mgmt_mode *cp;
1525         struct hci_request req;
1526         bool changed;
1527
1528         BT_DBG("status 0x%02x", status);
1529
1530         hci_dev_lock(hdev);
1531
1532         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1533         if (!cmd)
1534                 goto unlock;
1535
1536         if (status) {
1537                 u8 mgmt_err = mgmt_status(status);
1538                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1539                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1540                 goto remove_cmd;
1541         }
1542
1543         cp = cmd->param;
1544         if (cp->val) {
1545                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1546                                             &hdev->dev_flags);
1547
1548                 if (hdev->discov_timeout > 0) {
1549                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1550                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1551                                            to);
1552                 }
1553         } else {
1554                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1555                                              &hdev->dev_flags);
1556         }
1557
1558         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1559
1560         if (changed)
1561                 new_settings(hdev, cmd->sk);
1562
1563         /* When the discoverable mode gets changed, make sure
1564          * that class of device has the limited discoverable
1565          * bit correctly set. Also update page scan based on whitelist
1566          * entries.
1567          */
1568         hci_req_init(&req, hdev);
1569         hci_update_page_scan(hdev, &req);
1570         update_class(&req);
1571         hci_req_run(&req, NULL);
1572
1573 remove_cmd:
1574         mgmt_pending_remove(cmd);
1575
1576 unlock:
1577         hci_dev_unlock(hdev);
1578 }
1579
1580 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1581                             u16 len)
1582 {
1583         struct mgmt_cp_set_discoverable *cp = data;
1584         struct pending_cmd *cmd;
1585         struct hci_request req;
1586         u16 timeout;
1587         u8 scan;
1588         int err;
1589
1590         BT_DBG("request for %s", hdev->name);
1591
1592         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1595                                   MGMT_STATUS_REJECTED);
1596
1597         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                   MGMT_STATUS_INVALID_PARAMS);
1600
1601         timeout = __le16_to_cpu(cp->timeout);
1602
1603         /* Disabling discoverable requires that no timeout is set,
1604          * and enabling limited discoverable requires a timeout.
1605          */
1606         if ((cp->val == 0x00 && timeout > 0) ||
1607             (cp->val == 0x02 && timeout == 0))
1608                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1609                                   MGMT_STATUS_INVALID_PARAMS);
1610
1611         hci_dev_lock(hdev);
1612
1613         if (!hdev_is_powered(hdev) && timeout > 0) {
1614                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1615                                  MGMT_STATUS_NOT_POWERED);
1616                 goto failed;
1617         }
1618
1619         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1620             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1628                                  MGMT_STATUS_REJECTED);
1629                 goto failed;
1630         }
1631
1632         if (!hdev_is_powered(hdev)) {
1633                 bool changed = false;
1634
1635                 /* Setting limited discoverable when powered off is
1636                  * not a valid operation since it requires a timeout
1637                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1638                  */
1639                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1640                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1641                         changed = true;
1642                 }
1643
1644                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1645                 if (err < 0)
1646                         goto failed;
1647
1648                 if (changed)
1649                         err = new_settings(hdev, sk);
1650
1651                 goto failed;
1652         }
1653
1654         /* If the current mode is the same, then just update the timeout
1655          * value with the new value. And if only the timeout gets updated,
1656          * then no need for any HCI transactions.
1657          */
1658         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1659             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1660                                           &hdev->dev_flags)) {
1661                 cancel_delayed_work(&hdev->discov_off);
1662                 hdev->discov_timeout = timeout;
1663
1664                 if (cp->val && hdev->discov_timeout > 0) {
1665                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1666                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1667                                            to);
1668                 }
1669
1670                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1671                 goto failed;
1672         }
1673
1674         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1675         if (!cmd) {
1676                 err = -ENOMEM;
1677                 goto failed;
1678         }
1679
1680         /* Cancel any potential discoverable timeout that might be
1681          * still active and store new timeout value. The arming of
1682          * the timeout happens in the complete handler.
1683          */
1684         cancel_delayed_work(&hdev->discov_off);
1685         hdev->discov_timeout = timeout;
1686
1687         /* Limited discoverable mode */
1688         if (cp->val == 0x02)
1689                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1690         else
1691                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1692
1693         hci_req_init(&req, hdev);
1694
1695         /* The procedure for LE-only controllers is much simpler - just
1696          * update the advertising data.
1697          */
1698         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1699                 goto update_ad;
1700
1701         scan = SCAN_PAGE;
1702
1703         if (cp->val) {
1704                 struct hci_cp_write_current_iac_lap hci_cp;
1705
1706                 if (cp->val == 0x02) {
1707                         /* Limited discoverable mode */
1708                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1709                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1710                         hci_cp.iac_lap[1] = 0x8b;
1711                         hci_cp.iac_lap[2] = 0x9e;
1712                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1713                         hci_cp.iac_lap[4] = 0x8b;
1714                         hci_cp.iac_lap[5] = 0x9e;
1715                 } else {
1716                         /* General discoverable mode */
1717                         hci_cp.num_iac = 1;
1718                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1719                         hci_cp.iac_lap[1] = 0x8b;
1720                         hci_cp.iac_lap[2] = 0x9e;
1721                 }
1722
1723                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1724                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1725
1726                 scan |= SCAN_INQUIRY;
1727         } else {
1728                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1729         }
1730
1731         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1732
1733 update_ad:
1734         update_adv_data(&req);
1735
1736         err = hci_req_run(&req, set_discoverable_complete);
1737         if (err < 0)
1738                 mgmt_pending_remove(cmd);
1739
1740 failed:
1741         hci_dev_unlock(hdev);
1742         return err;
1743 }
1744
1745 static void write_fast_connectable(struct hci_request *req, bool enable)
1746 {
1747         struct hci_dev *hdev = req->hdev;
1748         struct hci_cp_write_page_scan_activity acp;
1749         u8 type;
1750
1751         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1752                 return;
1753
1754         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1755                 return;
1756
1757         if (enable) {
1758                 type = PAGE_SCAN_TYPE_INTERLACED;
1759
1760                 /* 160 msec page scan interval */
1761                 acp.interval = cpu_to_le16(0x0100);
1762         } else {
1763                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1764
1765                 /* default 1.28 sec page scan */
1766                 acp.interval = cpu_to_le16(0x0800);
1767         }
1768
1769         acp.window = cpu_to_le16(0x0012);
1770
1771         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1772             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1773                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1774                             sizeof(acp), &acp);
1775
1776         if (hdev->page_scan_type != type)
1777                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1778 }
1779
1780 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1781 {
1782         struct pending_cmd *cmd;
1783         struct mgmt_mode *cp;
1784         bool conn_changed, discov_changed;
1785
1786         BT_DBG("status 0x%02x", status);
1787
1788         hci_dev_lock(hdev);
1789
1790         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1791         if (!cmd)
1792                 goto unlock;
1793
1794         if (status) {
1795                 u8 mgmt_err = mgmt_status(status);
1796                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1797                 goto remove_cmd;
1798         }
1799
1800         cp = cmd->param;
1801         if (cp->val) {
1802                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1803                                                  &hdev->dev_flags);
1804                 discov_changed = false;
1805         } else {
1806                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1807                                                   &hdev->dev_flags);
1808                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1809                                                     &hdev->dev_flags);
1810         }
1811
1812         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1813
1814         if (conn_changed || discov_changed) {
1815                 new_settings(hdev, cmd->sk);
1816                 hci_update_page_scan(hdev, NULL);
1817                 if (discov_changed)
1818                         mgmt_update_adv_data(hdev);
1819                 hci_update_background_scan(hdev);
1820         }
1821
1822 remove_cmd:
1823         mgmt_pending_remove(cmd);
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827 }
1828
1829 static int set_connectable_update_settings(struct hci_dev *hdev,
1830                                            struct sock *sk, u8 val)
1831 {
1832         bool changed = false;
1833         int err;
1834
1835         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1836                 changed = true;
1837
1838         if (val) {
1839                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1840         } else {
1841                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1842                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1843         }
1844
1845         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1846         if (err < 0)
1847                 return err;
1848
1849         if (changed) {
1850                 hci_update_page_scan(hdev, NULL);
1851                 hci_update_background_scan(hdev);
1852                 return new_settings(hdev, sk);
1853         }
1854
1855         return 0;
1856 }
1857
1858 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1859                            u16 len)
1860 {
1861         struct mgmt_mode *cp = data;
1862         struct pending_cmd *cmd;
1863         struct hci_request req;
1864         u8 scan;
1865         int err;
1866
1867         BT_DBG("request for %s", hdev->name);
1868
1869         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1870             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1872                                   MGMT_STATUS_REJECTED);
1873
1874         if (cp->val != 0x00 && cp->val != 0x01)
1875                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1876                                   MGMT_STATUS_INVALID_PARAMS);
1877
1878         hci_dev_lock(hdev);
1879
1880         if (!hdev_is_powered(hdev)) {
1881                 err = set_connectable_update_settings(hdev, sk, cp->val);
1882                 goto failed;
1883         }
1884
1885         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1886             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1888                                  MGMT_STATUS_BUSY);
1889                 goto failed;
1890         }
1891
1892         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1893         if (!cmd) {
1894                 err = -ENOMEM;
1895                 goto failed;
1896         }
1897
1898         hci_req_init(&req, hdev);
1899
1900         /* If BR/EDR is not enabled and we disable advertising as a
1901          * by-product of disabling connectable, we need to update the
1902          * advertising flags.
1903          */
1904         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1905                 if (!cp->val) {
1906                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1907                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1908                 }
1909                 update_adv_data(&req);
1910         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1911                 if (cp->val) {
1912                         scan = SCAN_PAGE;
1913                 } else {
1914                         /* If we don't have any whitelist entries just
1915                          * disable all scanning. If there are entries
1916                          * and we had both page and inquiry scanning
1917                          * enabled then fall back to only page scanning.
1918                          * Otherwise no changes are needed.
1919                          */
1920                         if (list_empty(&hdev->whitelist))
1921                                 scan = SCAN_DISABLED;
1922                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1923                                 scan = SCAN_PAGE;
1924                         else
1925                                 goto no_scan_update;
1926
1927                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1928                             hdev->discov_timeout > 0)
1929                                 cancel_delayed_work(&hdev->discov_off);
1930                 }
1931
1932                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1933         }
1934
1935 no_scan_update:
1936         /* If we're going from non-connectable to connectable or
1937          * vice-versa when fast connectable is enabled ensure that fast
1938          * connectable gets disabled. write_fast_connectable won't do
1939          * anything if the page scan parameters are already what they
1940          * should be.
1941          */
1942         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1943                 write_fast_connectable(&req, false);
1944
1945         /* Update the advertising parameters if necessary */
1946         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1947                 enable_advertising(&req);
1948
1949         err = hci_req_run(&req, set_connectable_complete);
1950         if (err < 0) {
1951                 mgmt_pending_remove(cmd);
1952                 if (err == -ENODATA)
1953                         err = set_connectable_update_settings(hdev, sk,
1954                                                               cp->val);
1955                 goto failed;
1956         }
1957
1958 failed:
1959         hci_dev_unlock(hdev);
1960         return err;
1961 }
1962
1963 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1964                         u16 len)
1965 {
1966         struct mgmt_mode *cp = data;
1967         bool changed;
1968         int err;
1969
1970         BT_DBG("request for %s", hdev->name);
1971
1972         if (cp->val != 0x00 && cp->val != 0x01)
1973                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1974                                   MGMT_STATUS_INVALID_PARAMS);
1975
1976         hci_dev_lock(hdev);
1977
1978         if (cp->val)
1979                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1980         else
1981                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1982
1983         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1984         if (err < 0)
1985                 goto unlock;
1986
1987         if (changed)
1988                 err = new_settings(hdev, sk);
1989
1990 unlock:
1991         hci_dev_unlock(hdev);
1992         return err;
1993 }
1994
1995 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1996                              u16 len)
1997 {
1998         struct mgmt_mode *cp = data;
1999         struct pending_cmd *cmd;
2000         u8 val, status;
2001         int err;
2002
2003         BT_DBG("request for %s", hdev->name);
2004
2005         status = mgmt_bredr_support(hdev);
2006         if (status)
2007                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2008                                   status);
2009
2010         if (cp->val != 0x00 && cp->val != 0x01)
2011                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2012                                   MGMT_STATUS_INVALID_PARAMS);
2013
2014         hci_dev_lock(hdev);
2015
2016         if (!hdev_is_powered(hdev)) {
2017                 bool changed = false;
2018
2019                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2020                                           &hdev->dev_flags)) {
2021                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2022                         changed = true;
2023                 }
2024
2025                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2026                 if (err < 0)
2027                         goto failed;
2028
2029                 if (changed)
2030                         err = new_settings(hdev, sk);
2031
2032                 goto failed;
2033         }
2034
2035         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2036                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2037                                  MGMT_STATUS_BUSY);
2038                 goto failed;
2039         }
2040
2041         val = !!cp->val;
2042
2043         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2044                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2045                 goto failed;
2046         }
2047
2048         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2049         if (!cmd) {
2050                 err = -ENOMEM;
2051                 goto failed;
2052         }
2053
2054         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2055         if (err < 0) {
2056                 mgmt_pending_remove(cmd);
2057                 goto failed;
2058         }
2059
2060 failed:
2061         hci_dev_unlock(hdev);
2062         return err;
2063 }
2064
2065 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         struct pending_cmd *cmd;
2069         u8 status;
2070         int err;
2071
2072         BT_DBG("request for %s", hdev->name);
2073
2074         status = mgmt_bredr_support(hdev);
2075         if (status)
2076                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2077
2078         if (!lmp_ssp_capable(hdev))
2079                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2080                                   MGMT_STATUS_NOT_SUPPORTED);
2081
2082         if (cp->val != 0x00 && cp->val != 0x01)
2083                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2084                                   MGMT_STATUS_INVALID_PARAMS);
2085
2086         hci_dev_lock(hdev);
2087
2088         if (!hdev_is_powered(hdev)) {
2089                 bool changed;
2090
2091                 if (cp->val) {
2092                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2093                                                     &hdev->dev_flags);
2094                 } else {
2095                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2096                                                      &hdev->dev_flags);
2097                         if (!changed)
2098                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2099                                                              &hdev->dev_flags);
2100                         else
2101                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2102                 }
2103
2104                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2105                 if (err < 0)
2106                         goto failed;
2107
2108                 if (changed)
2109                         err = new_settings(hdev, sk);
2110
2111                 goto failed;
2112         }
2113
2114         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2115             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2116                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2117                                  MGMT_STATUS_BUSY);
2118                 goto failed;
2119         }
2120
2121         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2122                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2123                 goto failed;
2124         }
2125
2126         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2127         if (!cmd) {
2128                 err = -ENOMEM;
2129                 goto failed;
2130         }
2131
2132         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2133                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2134                              sizeof(cp->val), &cp->val);
2135
2136         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2137         if (err < 0) {
2138                 mgmt_pending_remove(cmd);
2139                 goto failed;
2140         }
2141
2142 failed:
2143         hci_dev_unlock(hdev);
2144         return err;
2145 }
2146
2147 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2148 {
2149         struct mgmt_mode *cp = data;
2150         bool changed;
2151         u8 status;
2152         int err;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         status = mgmt_bredr_support(hdev);
2157         if (status)
2158                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2159
2160         if (!lmp_ssp_capable(hdev))
2161                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2162                                   MGMT_STATUS_NOT_SUPPORTED);
2163
2164         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2165                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2166                                   MGMT_STATUS_REJECTED);
2167
2168         if (cp->val != 0x00 && cp->val != 0x01)
2169                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2170                                   MGMT_STATUS_INVALID_PARAMS);
2171
2172         hci_dev_lock(hdev);
2173
2174         if (cp->val) {
2175                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2176         } else {
2177                 if (hdev_is_powered(hdev)) {
2178                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2179                                          MGMT_STATUS_REJECTED);
2180                         goto unlock;
2181                 }
2182
2183                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2184         }
2185
2186         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2187         if (err < 0)
2188                 goto unlock;
2189
2190         if (changed)
2191                 err = new_settings(hdev, sk);
2192
2193 unlock:
2194         hci_dev_unlock(hdev);
2195         return err;
2196 }
2197
2198 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2199 {
2200         struct cmd_lookup match = { NULL, hdev };
2201
2202         if (status) {
2203                 u8 mgmt_err = mgmt_status(status);
2204
2205                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2206                                      &mgmt_err);
2207                 return;
2208         }
2209
2210         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2211
2212         new_settings(hdev, match.sk);
2213
2214         if (match.sk)
2215                 sock_put(match.sk);
2216
2217         /* Make sure the controller has a good default for
2218          * advertising data. Restrict the update to when LE
2219          * has actually been enabled. During power on, the
2220          * update in powered_update_hci will take care of it.
2221          */
2222         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2223                 struct hci_request req;
2224
2225                 hci_dev_lock(hdev);
2226
2227                 hci_req_init(&req, hdev);
2228                 update_adv_data(&req);
2229                 update_scan_rsp_data(&req);
2230                 hci_req_run(&req, NULL);
2231
2232                 hci_update_background_scan(hdev);
2233
2234                 hci_dev_unlock(hdev);
2235         }
2236 }
2237
2238 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2239 {
2240         struct mgmt_mode *cp = data;
2241         struct hci_cp_write_le_host_supported hci_cp;
2242         struct pending_cmd *cmd;
2243         struct hci_request req;
2244         int err;
2245         u8 val, enabled;
2246
2247         BT_DBG("request for %s", hdev->name);
2248
2249         if (!lmp_le_capable(hdev))
2250                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2251                                   MGMT_STATUS_NOT_SUPPORTED);
2252
2253         if (cp->val != 0x00 && cp->val != 0x01)
2254                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2255                                   MGMT_STATUS_INVALID_PARAMS);
2256
2257         /* LE-only devices do not allow toggling LE on/off */
2258         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2260                                   MGMT_STATUS_REJECTED);
2261
2262         hci_dev_lock(hdev);
2263
2264         val = !!cp->val;
2265         enabled = lmp_host_le_capable(hdev);
2266
2267         if (!hdev_is_powered(hdev) || val == enabled) {
2268                 bool changed = false;
2269
2270                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2271                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2272                         changed = true;
2273                 }
2274
2275                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2276                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2277                         changed = true;
2278                 }
2279
2280                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2281                 if (err < 0)
2282                         goto unlock;
2283
2284                 if (changed)
2285                         err = new_settings(hdev, sk);
2286
2287                 goto unlock;
2288         }
2289
2290         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2291             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2292                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2293                                  MGMT_STATUS_BUSY);
2294                 goto unlock;
2295         }
2296
2297         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2298         if (!cmd) {
2299                 err = -ENOMEM;
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         memset(&hci_cp, 0, sizeof(hci_cp));
2306
2307         if (val) {
2308                 hci_cp.le = val;
2309                 hci_cp.simul = 0x00;
2310         } else {
2311                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2312                         disable_advertising(&req);
2313         }
2314
2315         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2316                     &hci_cp);
2317
2318         err = hci_req_run(&req, le_enable_complete);
2319         if (err < 0)
2320                 mgmt_pending_remove(cmd);
2321
2322 unlock:
2323         hci_dev_unlock(hdev);
2324         return err;
2325 }
2326
2327 /* This is a helper function to test for pending mgmt commands that can
2328  * cause CoD or EIR HCI commands. We can only allow one such pending
2329  * mgmt command at a time since otherwise we cannot easily track what
2330  * the current values are, will be, and based on that calculate if a new
2331  * HCI command needs to be sent and if yes with what value.
2332  */
2333 static bool pending_eir_or_class(struct hci_dev *hdev)
2334 {
2335         struct pending_cmd *cmd;
2336
2337         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2338                 switch (cmd->opcode) {
2339                 case MGMT_OP_ADD_UUID:
2340                 case MGMT_OP_REMOVE_UUID:
2341                 case MGMT_OP_SET_DEV_CLASS:
2342                 case MGMT_OP_SET_POWERED:
2343                         return true;
2344                 }
2345         }
2346
2347         return false;
2348 }
2349
2350 static const u8 bluetooth_base_uuid[] = {
2351                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2352                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2353 };
2354
2355 static u8 get_uuid_size(const u8 *uuid)
2356 {
2357         u32 val;
2358
2359         if (memcmp(uuid, bluetooth_base_uuid, 12))
2360                 return 128;
2361
2362         val = get_unaligned_le32(&uuid[12]);
2363         if (val > 0xffff)
2364                 return 32;
2365
2366         return 16;
2367 }
2368
2369 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2370 {
2371         struct pending_cmd *cmd;
2372
2373         hci_dev_lock(hdev);
2374
2375         cmd = mgmt_pending_find(mgmt_op, hdev);
2376         if (!cmd)
2377                 goto unlock;
2378
2379         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2380                      hdev->dev_class, 3);
2381
2382         mgmt_pending_remove(cmd);
2383
2384 unlock:
2385         hci_dev_unlock(hdev);
2386 }
2387
2388 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2389 {
2390         BT_DBG("status 0x%02x", status);
2391
2392         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2393 }
2394
2395 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2396 {
2397         struct mgmt_cp_add_uuid *cp = data;
2398         struct pending_cmd *cmd;
2399         struct hci_request req;
2400         struct bt_uuid *uuid;
2401         int err;
2402
2403         BT_DBG("request for %s", hdev->name);
2404
2405         hci_dev_lock(hdev);
2406
2407         if (pending_eir_or_class(hdev)) {
2408                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2409                                  MGMT_STATUS_BUSY);
2410                 goto failed;
2411         }
2412
2413         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2414         if (!uuid) {
2415                 err = -ENOMEM;
2416                 goto failed;
2417         }
2418
2419         memcpy(uuid->uuid, cp->uuid, 16);
2420         uuid->svc_hint = cp->svc_hint;
2421         uuid->size = get_uuid_size(cp->uuid);
2422
2423         list_add_tail(&uuid->list, &hdev->uuids);
2424
2425         hci_req_init(&req, hdev);
2426
2427         update_class(&req);
2428         update_eir(&req);
2429
2430         err = hci_req_run(&req, add_uuid_complete);
2431         if (err < 0) {
2432                 if (err != -ENODATA)
2433                         goto failed;
2434
2435                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2436                                    hdev->dev_class, 3);
2437                 goto failed;
2438         }
2439
2440         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2441         if (!cmd) {
2442                 err = -ENOMEM;
2443                 goto failed;
2444         }
2445
2446         err = 0;
2447
2448 failed:
2449         hci_dev_unlock(hdev);
2450         return err;
2451 }
2452
2453 static bool enable_service_cache(struct hci_dev *hdev)
2454 {
2455         if (!hdev_is_powered(hdev))
2456                 return false;
2457
2458         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2459                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2460                                    CACHE_TIMEOUT);
2461                 return true;
2462         }
2463
2464         return false;
2465 }
2466
2467 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2468 {
2469         BT_DBG("status 0x%02x", status);
2470
2471         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2472 }
2473
2474 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2475                        u16 len)
2476 {
2477         struct mgmt_cp_remove_uuid *cp = data;
2478         struct pending_cmd *cmd;
2479         struct bt_uuid *match, *tmp;
2480         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2481         struct hci_request req;
2482         int err, found;
2483
2484         BT_DBG("request for %s", hdev->name);
2485
2486         hci_dev_lock(hdev);
2487
2488         if (pending_eir_or_class(hdev)) {
2489                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2490                                  MGMT_STATUS_BUSY);
2491                 goto unlock;
2492         }
2493
2494         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2495                 hci_uuids_clear(hdev);
2496
2497                 if (enable_service_cache(hdev)) {
2498                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2499                                            0, hdev->dev_class, 3);
2500                         goto unlock;
2501                 }
2502
2503                 goto update_class;
2504         }
2505
2506         found = 0;
2507
2508         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2509                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2510                         continue;
2511
2512                 list_del(&match->list);
2513                 kfree(match);
2514                 found++;
2515         }
2516
2517         if (found == 0) {
2518                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2519                                  MGMT_STATUS_INVALID_PARAMS);
2520                 goto unlock;
2521         }
2522
2523 update_class:
2524         hci_req_init(&req, hdev);
2525
2526         update_class(&req);
2527         update_eir(&req);
2528
2529         err = hci_req_run(&req, remove_uuid_complete);
2530         if (err < 0) {
2531                 if (err != -ENODATA)
2532                         goto unlock;
2533
2534                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2535                                    hdev->dev_class, 3);
2536                 goto unlock;
2537         }
2538
2539         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2540         if (!cmd) {
2541                 err = -ENOMEM;
2542                 goto unlock;
2543         }
2544
2545         err = 0;
2546
2547 unlock:
2548         hci_dev_unlock(hdev);
2549         return err;
2550 }
2551
2552 static void set_class_complete(struct hci_dev *hdev, u8 status)
2553 {
2554         BT_DBG("status 0x%02x", status);
2555
2556         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2557 }
2558
2559 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2560                          u16 len)
2561 {
2562         struct mgmt_cp_set_dev_class *cp = data;
2563         struct pending_cmd *cmd;
2564         struct hci_request req;
2565         int err;
2566
2567         BT_DBG("request for %s", hdev->name);
2568
2569         if (!lmp_bredr_capable(hdev))
2570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2571                                   MGMT_STATUS_NOT_SUPPORTED);
2572
2573         hci_dev_lock(hdev);
2574
2575         if (pending_eir_or_class(hdev)) {
2576                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2577                                  MGMT_STATUS_BUSY);
2578                 goto unlock;
2579         }
2580
2581         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2582                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2583                                  MGMT_STATUS_INVALID_PARAMS);
2584                 goto unlock;
2585         }
2586
2587         hdev->major_class = cp->major;
2588         hdev->minor_class = cp->minor;
2589
2590         if (!hdev_is_powered(hdev)) {
2591                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2592                                    hdev->dev_class, 3);
2593                 goto unlock;
2594         }
2595
2596         hci_req_init(&req, hdev);
2597
2598         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2599                 hci_dev_unlock(hdev);
2600                 cancel_delayed_work_sync(&hdev->service_cache);
2601                 hci_dev_lock(hdev);
2602                 update_eir(&req);
2603         }
2604
2605         update_class(&req);
2606
2607         err = hci_req_run(&req, set_class_complete);
2608         if (err < 0) {
2609                 if (err != -ENODATA)
2610                         goto unlock;
2611
2612                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2613                                    hdev->dev_class, 3);
2614                 goto unlock;
2615         }
2616
2617         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2618         if (!cmd) {
2619                 err = -ENOMEM;
2620                 goto unlock;
2621         }
2622
2623         err = 0;
2624
2625 unlock:
2626         hci_dev_unlock(hdev);
2627         return err;
2628 }
2629
2630 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2631                           u16 len)
2632 {
2633         struct mgmt_cp_load_link_keys *cp = data;
2634         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2635                                    sizeof(struct mgmt_link_key_info));
2636         u16 key_count, expected_len;
2637         bool changed;
2638         int i;
2639
2640         BT_DBG("request for %s", hdev->name);
2641
2642         if (!lmp_bredr_capable(hdev))
2643                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2644                                   MGMT_STATUS_NOT_SUPPORTED);
2645
2646         key_count = __le16_to_cpu(cp->key_count);
2647         if (key_count > max_key_count) {
2648                 BT_ERR("load_link_keys: too big key_count value %u",
2649                        key_count);
2650                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2651                                   MGMT_STATUS_INVALID_PARAMS);
2652         }
2653
2654         expected_len = sizeof(*cp) + key_count *
2655                                         sizeof(struct mgmt_link_key_info);
2656         if (expected_len != len) {
2657                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2658                        expected_len, len);
2659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2660                                   MGMT_STATUS_INVALID_PARAMS);
2661         }
2662
2663         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2664                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2665                                   MGMT_STATUS_INVALID_PARAMS);
2666
2667         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2668                key_count);
2669
2670         for (i = 0; i < key_count; i++) {
2671                 struct mgmt_link_key_info *key = &cp->keys[i];
2672
2673                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2674                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2675                                           MGMT_STATUS_INVALID_PARAMS);
2676         }
2677
2678         hci_dev_lock(hdev);
2679
2680         hci_link_keys_clear(hdev);
2681
2682         if (cp->debug_keys)
2683                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2684                                             &hdev->dev_flags);
2685         else
2686                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2687                                              &hdev->dev_flags);
2688
2689         if (changed)
2690                 new_settings(hdev, NULL);
2691
2692         for (i = 0; i < key_count; i++) {
2693                 struct mgmt_link_key_info *key = &cp->keys[i];
2694
2695                 /* Always ignore debug keys and require a new pairing if
2696                  * the user wants to use them.
2697                  */
2698                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2699                         continue;
2700
2701                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2702                                  key->type, key->pin_len, NULL);
2703         }
2704
2705         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2706
2707         hci_dev_unlock(hdev);
2708
2709         return 0;
2710 }
2711
2712 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2713                            u8 addr_type, struct sock *skip_sk)
2714 {
2715         struct mgmt_ev_device_unpaired ev;
2716
2717         bacpy(&ev.addr.bdaddr, bdaddr);
2718         ev.addr.type = addr_type;
2719
2720         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2721                           skip_sk);
2722 }
2723
2724 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2725                          u16 len)
2726 {
2727         struct mgmt_cp_unpair_device *cp = data;
2728         struct mgmt_rp_unpair_device rp;
2729         struct hci_cp_disconnect dc;
2730         struct pending_cmd *cmd;
2731         struct hci_conn *conn;
2732         int err;
2733
2734         memset(&rp, 0, sizeof(rp));
2735         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2736         rp.addr.type = cp->addr.type;
2737
2738         if (!bdaddr_type_is_valid(cp->addr.type))
2739                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2740                                     MGMT_STATUS_INVALID_PARAMS,
2741                                     &rp, sizeof(rp));
2742
2743         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2744                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2745                                     MGMT_STATUS_INVALID_PARAMS,
2746                                     &rp, sizeof(rp));
2747
2748         hci_dev_lock(hdev);
2749
2750         if (!hdev_is_powered(hdev)) {
2751                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2752                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2753                 goto unlock;
2754         }
2755
2756         if (cp->addr.type == BDADDR_BREDR) {
2757                 /* If disconnection is requested, then look up the
2758                  * connection. If the remote device is connected, it
2759                  * will be later used to terminate the link.
2760                  *
2761                  * Setting it to NULL explicitly will cause no
2762                  * termination of the link.
2763                  */
2764                 if (cp->disconnect)
2765                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2766                                                        &cp->addr.bdaddr);
2767                 else
2768                         conn = NULL;
2769
2770                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2771         } else {
2772                 u8 addr_type;
2773
2774                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2775                                                &cp->addr.bdaddr);
2776                 if (conn) {
2777                         /* Defer clearing up the connection parameters
2778                          * until closing to give a chance of keeping
2779                          * them if a repairing happens.
2780                          */
2781                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2782
2783                         /* If disconnection is not requested, then
2784                          * clear the connection variable so that the
2785                          * link is not terminated.
2786                          */
2787                         if (!cp->disconnect)
2788                                 conn = NULL;
2789                 }
2790
2791                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2792                         addr_type = ADDR_LE_DEV_PUBLIC;
2793                 else
2794                         addr_type = ADDR_LE_DEV_RANDOM;
2795
2796                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2797
2798                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2799         }
2800
2801         if (err < 0) {
2802                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2803                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2804                 goto unlock;
2805         }
2806
2807         /* If the connection variable is set, then termination of the
2808          * link is requested.
2809          */
2810         if (!conn) {
2811                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2812                                    &rp, sizeof(rp));
2813                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2814                 goto unlock;
2815         }
2816
2817         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2818                                sizeof(*cp));
2819         if (!cmd) {
2820                 err = -ENOMEM;
2821                 goto unlock;
2822         }
2823
2824         dc.handle = cpu_to_le16(conn->handle);
2825         dc.reason = 0x13; /* Remote User Terminated Connection */
2826         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2827         if (err < 0)
2828                 mgmt_pending_remove(cmd);
2829
2830 unlock:
2831         hci_dev_unlock(hdev);
2832         return err;
2833 }
2834
2835 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2836                       u16 len)
2837 {
2838         struct mgmt_cp_disconnect *cp = data;
2839         struct mgmt_rp_disconnect rp;
2840         struct pending_cmd *cmd;
2841         struct hci_conn *conn;
2842         int err;
2843
2844         BT_DBG("");
2845
2846         memset(&rp, 0, sizeof(rp));
2847         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2848         rp.addr.type = cp->addr.type;
2849
2850         if (!bdaddr_type_is_valid(cp->addr.type))
2851                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2852                                     MGMT_STATUS_INVALID_PARAMS,
2853                                     &rp, sizeof(rp));
2854
2855         hci_dev_lock(hdev);
2856
2857         if (!test_bit(HCI_UP, &hdev->flags)) {
2858                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2859                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2860                 goto failed;
2861         }
2862
2863         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2864                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2865                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2866                 goto failed;
2867         }
2868
2869         if (cp->addr.type == BDADDR_BREDR)
2870                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2871                                                &cp->addr.bdaddr);
2872         else
2873                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2874
2875         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2876                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2877                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2878                 goto failed;
2879         }
2880
2881         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2882         if (!cmd) {
2883                 err = -ENOMEM;
2884                 goto failed;
2885         }
2886
2887         cmd->cmd_complete = generic_cmd_complete;
2888
2889         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2890         if (err < 0)
2891                 mgmt_pending_remove(cmd);
2892
2893 failed:
2894         hci_dev_unlock(hdev);
2895         return err;
2896 }
2897
2898 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2899 {
2900         switch (link_type) {
2901         case LE_LINK:
2902                 switch (addr_type) {
2903                 case ADDR_LE_DEV_PUBLIC:
2904                         return BDADDR_LE_PUBLIC;
2905
2906                 default:
2907                         /* Fallback to LE Random address type */
2908                         return BDADDR_LE_RANDOM;
2909                 }
2910
2911         default:
2912                 /* Fallback to BR/EDR type */
2913                 return BDADDR_BREDR;
2914         }
2915 }
2916
2917 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2918                            u16 data_len)
2919 {
2920         struct mgmt_rp_get_connections *rp;
2921         struct hci_conn *c;
2922         size_t rp_len;
2923         int err;
2924         u16 i;
2925
2926         BT_DBG("");
2927
2928         hci_dev_lock(hdev);
2929
2930         if (!hdev_is_powered(hdev)) {
2931                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2932                                  MGMT_STATUS_NOT_POWERED);
2933                 goto unlock;
2934         }
2935
2936         i = 0;
2937         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2938                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2939                         i++;
2940         }
2941
2942         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2943         rp = kmalloc(rp_len, GFP_KERNEL);
2944         if (!rp) {
2945                 err = -ENOMEM;
2946                 goto unlock;
2947         }
2948
2949         i = 0;
2950         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2951                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2952                         continue;
2953                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2954                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2955                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2956                         continue;
2957                 i++;
2958         }
2959
2960         rp->conn_count = cpu_to_le16(i);
2961
2962         /* Recalculate length in case of filtered SCO connections, etc */
2963         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2964
2965         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2966                            rp_len);
2967
2968         kfree(rp);
2969
2970 unlock:
2971         hci_dev_unlock(hdev);
2972         return err;
2973 }
2974
2975 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2976                                    struct mgmt_cp_pin_code_neg_reply *cp)
2977 {
2978         struct pending_cmd *cmd;
2979         int err;
2980
2981         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2982                                sizeof(*cp));
2983         if (!cmd)
2984                 return -ENOMEM;
2985
2986         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2987                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2988         if (err < 0)
2989                 mgmt_pending_remove(cmd);
2990
2991         return err;
2992 }
2993
2994 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2995                           u16 len)
2996 {
2997         struct hci_conn *conn;
2998         struct mgmt_cp_pin_code_reply *cp = data;
2999         struct hci_cp_pin_code_reply reply;
3000         struct pending_cmd *cmd;
3001         int err;
3002
3003         BT_DBG("");
3004
3005         hci_dev_lock(hdev);
3006
3007         if (!hdev_is_powered(hdev)) {
3008                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3009                                  MGMT_STATUS_NOT_POWERED);
3010                 goto failed;
3011         }
3012
3013         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3014         if (!conn) {
3015                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3016                                  MGMT_STATUS_NOT_CONNECTED);
3017                 goto failed;
3018         }
3019
3020         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3021                 struct mgmt_cp_pin_code_neg_reply ncp;
3022
3023                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3024
3025                 BT_ERR("PIN code is not 16 bytes long");
3026
3027                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3028                 if (err >= 0)
3029                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3030                                          MGMT_STATUS_INVALID_PARAMS);
3031
3032                 goto failed;
3033         }
3034
3035         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3036         if (!cmd) {
3037                 err = -ENOMEM;
3038                 goto failed;
3039         }
3040
3041         cmd->cmd_complete = addr_cmd_complete;
3042
3043         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3044         reply.pin_len = cp->pin_len;
3045         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3046
3047         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3048         if (err < 0)
3049                 mgmt_pending_remove(cmd);
3050
3051 failed:
3052         hci_dev_unlock(hdev);
3053         return err;
3054 }
3055
3056 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3057                              u16 len)
3058 {
3059         struct mgmt_cp_set_io_capability *cp = data;
3060
3061         BT_DBG("");
3062
3063         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3064                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3065                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3066
3067         hci_dev_lock(hdev);
3068
3069         hdev->io_capability = cp->io_capability;
3070
3071         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3072                hdev->io_capability);
3073
3074         hci_dev_unlock(hdev);
3075
3076         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3077                             0);
3078 }
3079
3080 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3081 {
3082         struct hci_dev *hdev = conn->hdev;
3083         struct pending_cmd *cmd;
3084
3085         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3086                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3087                         continue;
3088
3089                 if (cmd->user_data != conn)
3090                         continue;
3091
3092                 return cmd;
3093         }
3094
3095         return NULL;
3096 }
3097
3098 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3099 {
3100         struct mgmt_rp_pair_device rp;
3101         struct hci_conn *conn = cmd->user_data;
3102
3103         bacpy(&rp.addr.bdaddr, &conn->dst);
3104         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3105
3106         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3107                      &rp, sizeof(rp));
3108
3109         /* So we don't get further callbacks for this connection */
3110         conn->connect_cfm_cb = NULL;
3111         conn->security_cfm_cb = NULL;
3112         conn->disconn_cfm_cb = NULL;
3113
3114         hci_conn_drop(conn);
3115         hci_conn_put(conn);
3116
3117         mgmt_pending_remove(cmd);
3118
3119         /* The device is paired so there is no need to remove
3120          * its connection parameters anymore.
3121          */
3122         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3123 }
3124
3125 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3126 {
3127         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3128         struct pending_cmd *cmd;
3129
3130         cmd = find_pairing(conn);
3131         if (cmd)
3132                 cmd->cmd_complete(cmd, status);
3133 }
3134
3135 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3136 {
3137         struct pending_cmd *cmd;
3138
3139         BT_DBG("status %u", status);
3140
3141         cmd = find_pairing(conn);
3142         if (!cmd)
3143                 BT_DBG("Unable to find a pending command");
3144         else
3145                 cmd->cmd_complete(cmd, mgmt_status(status));
3146 }
3147
3148 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3149 {
3150         struct pending_cmd *cmd;
3151
3152         BT_DBG("status %u", status);
3153
3154         if (!status)
3155                 return;
3156
3157         cmd = find_pairing(conn);
3158         if (!cmd)
3159                 BT_DBG("Unable to find a pending command");
3160         else
3161                 cmd->cmd_complete(cmd, mgmt_status(status));
3162 }
3163
3164 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3165                        u16 len)
3166 {
3167         struct mgmt_cp_pair_device *cp = data;
3168         struct mgmt_rp_pair_device rp;
3169         struct pending_cmd *cmd;
3170         u8 sec_level, auth_type;
3171         struct hci_conn *conn;
3172         int err;
3173
3174         BT_DBG("");
3175
3176         memset(&rp, 0, sizeof(rp));
3177         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3178         rp.addr.type = cp->addr.type;
3179
3180         if (!bdaddr_type_is_valid(cp->addr.type))
3181                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3182                                     MGMT_STATUS_INVALID_PARAMS,
3183                                     &rp, sizeof(rp));
3184
3185         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3186                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3187                                     MGMT_STATUS_INVALID_PARAMS,
3188                                     &rp, sizeof(rp));
3189
3190         hci_dev_lock(hdev);
3191
3192         if (!hdev_is_powered(hdev)) {
3193                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3194                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3195                 goto unlock;
3196         }
3197
3198         sec_level = BT_SECURITY_MEDIUM;
3199         auth_type = HCI_AT_DEDICATED_BONDING;
3200
3201         if (cp->addr.type == BDADDR_BREDR) {
3202                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3203                                        auth_type);
3204         } else {
3205                 u8 addr_type;
3206
3207                 /* Convert from L2CAP channel address type to HCI address type
3208                  */
3209                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3210                         addr_type = ADDR_LE_DEV_PUBLIC;
3211                 else
3212                         addr_type = ADDR_LE_DEV_RANDOM;
3213
3214                 /* When pairing a new device, it is expected to remember
3215                  * this device for future connections. Adding the connection
3216                  * parameter information ahead of time allows tracking
3217                  * of the slave preferred values and will speed up any
3218                  * further connection establishment.
3219                  *
3220                  * If connection parameters already exist, then they
3221                  * will be kept and this function does nothing.
3222                  */
3223                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3224
3225                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3226                                       sec_level, HCI_LE_CONN_TIMEOUT,
3227                                       HCI_ROLE_MASTER);
3228         }
3229
3230         if (IS_ERR(conn)) {
3231                 int status;
3232
3233                 if (PTR_ERR(conn) == -EBUSY)
3234                         status = MGMT_STATUS_BUSY;
3235                 else
3236                         status = MGMT_STATUS_CONNECT_FAILED;
3237
3238                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3239                                    status, &rp,
3240                                    sizeof(rp));
3241                 goto unlock;
3242         }
3243
3244         if (conn->connect_cfm_cb) {
3245                 hci_conn_drop(conn);
3246                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3247                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3248                 goto unlock;
3249         }
3250
3251         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3252         if (!cmd) {
3253                 err = -ENOMEM;
3254                 hci_conn_drop(conn);
3255                 goto unlock;
3256         }
3257
3258         cmd->cmd_complete = pairing_complete;
3259
3260         /* For LE, just connecting isn't a proof that the pairing finished */
3261         if (cp->addr.type == BDADDR_BREDR) {
3262                 conn->connect_cfm_cb = pairing_complete_cb;
3263                 conn->security_cfm_cb = pairing_complete_cb;
3264                 conn->disconn_cfm_cb = pairing_complete_cb;
3265         } else {
3266                 conn->connect_cfm_cb = le_pairing_complete_cb;
3267                 conn->security_cfm_cb = le_pairing_complete_cb;
3268                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3269         }
3270
3271         conn->io_capability = cp->io_cap;
3272         cmd->user_data = hci_conn_get(conn);
3273
3274         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3275             hci_conn_security(conn, sec_level, auth_type, true))
3276                 pairing_complete(cmd, 0);
3277
3278         err = 0;
3279
3280 unlock:
3281         hci_dev_unlock(hdev);
3282         return err;
3283 }
3284
3285 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3286                               u16 len)
3287 {
3288         struct mgmt_addr_info *addr = data;
3289         struct pending_cmd *cmd;
3290         struct hci_conn *conn;
3291         int err;
3292
3293         BT_DBG("");
3294
3295         hci_dev_lock(hdev);
3296
3297         if (!hdev_is_powered(hdev)) {
3298                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3299                                  MGMT_STATUS_NOT_POWERED);
3300                 goto unlock;
3301         }
3302
3303         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3304         if (!cmd) {
3305                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3306                                  MGMT_STATUS_INVALID_PARAMS);
3307                 goto unlock;
3308         }
3309
3310         conn = cmd->user_data;
3311
3312         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3313                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3314                                  MGMT_STATUS_INVALID_PARAMS);
3315                 goto unlock;
3316         }
3317
3318         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3319
3320         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3321                            addr, sizeof(*addr));
3322 unlock:
3323         hci_dev_unlock(hdev);
3324         return err;
3325 }
3326
3327 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3328                              struct mgmt_addr_info *addr, u16 mgmt_op,
3329                              u16 hci_op, __le32 passkey)
3330 {
3331         struct pending_cmd *cmd;
3332         struct hci_conn *conn;
3333         int err;
3334
3335         hci_dev_lock(hdev);
3336
3337         if (!hdev_is_powered(hdev)) {
3338                 err = cmd_complete(sk, hdev->id, mgmt_op,
3339                                    MGMT_STATUS_NOT_POWERED, addr,
3340                                    sizeof(*addr));
3341                 goto done;
3342         }
3343
3344         if (addr->type == BDADDR_BREDR)
3345                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3346         else
3347                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3348
3349         if (!conn) {
3350                 err = cmd_complete(sk, hdev->id, mgmt_op,
3351                                    MGMT_STATUS_NOT_CONNECTED, addr,
3352                                    sizeof(*addr));
3353                 goto done;
3354         }
3355
3356         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3357                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3358                 if (!err)
3359                         err = cmd_complete(sk, hdev->id, mgmt_op,
3360                                            MGMT_STATUS_SUCCESS, addr,
3361                                            sizeof(*addr));
3362                 else
3363                         err = cmd_complete(sk, hdev->id, mgmt_op,
3364                                            MGMT_STATUS_FAILED, addr,
3365                                            sizeof(*addr));
3366
3367                 goto done;
3368         }
3369
3370         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3371         if (!cmd) {
3372                 err = -ENOMEM;
3373                 goto done;
3374         }
3375
3376         cmd->cmd_complete = addr_cmd_complete;
3377
3378         /* Continue with pairing via HCI */
3379         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3380                 struct hci_cp_user_passkey_reply cp;
3381
3382                 bacpy(&cp.bdaddr, &addr->bdaddr);
3383                 cp.passkey = passkey;
3384                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3385         } else
3386                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3387                                    &addr->bdaddr);
3388
3389         if (err < 0)
3390                 mgmt_pending_remove(cmd);
3391
3392 done:
3393         hci_dev_unlock(hdev);
3394         return err;
3395 }
3396
3397 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3398                               void *data, u16 len)
3399 {
3400         struct mgmt_cp_pin_code_neg_reply *cp = data;
3401
3402         BT_DBG("");
3403
3404         return user_pairing_resp(sk, hdev, &cp->addr,
3405                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3406                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3407 }
3408
3409 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3410                               u16 len)
3411 {
3412         struct mgmt_cp_user_confirm_reply *cp = data;
3413
3414         BT_DBG("");
3415
3416         if (len != sizeof(*cp))
3417                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3418                                   MGMT_STATUS_INVALID_PARAMS);
3419
3420         return user_pairing_resp(sk, hdev, &cp->addr,
3421                                  MGMT_OP_USER_CONFIRM_REPLY,
3422                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3423 }
3424
3425 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3426                                   void *data, u16 len)
3427 {
3428         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3429
3430         BT_DBG("");
3431
3432         return user_pairing_resp(sk, hdev, &cp->addr,
3433                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3434                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3435 }
3436
3437 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3438                               u16 len)
3439 {
3440         struct mgmt_cp_user_passkey_reply *cp = data;
3441
3442         BT_DBG("");
3443
3444         return user_pairing_resp(sk, hdev, &cp->addr,
3445                                  MGMT_OP_USER_PASSKEY_REPLY,
3446                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3447 }
3448
3449 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3450                                   void *data, u16 len)
3451 {
3452         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3453
3454         BT_DBG("");
3455
3456         return user_pairing_resp(sk, hdev, &cp->addr,
3457                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3458                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3459 }
3460
3461 static void update_name(struct hci_request *req)
3462 {
3463         struct hci_dev *hdev = req->hdev;
3464         struct hci_cp_write_local_name cp;
3465
3466         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3467
3468         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3469 }
3470
3471 static void set_name_complete(struct hci_dev *hdev, u8 status)
3472 {
3473         struct mgmt_cp_set_local_name *cp;
3474         struct pending_cmd *cmd;
3475
3476         BT_DBG("status 0x%02x", status);
3477
3478         hci_dev_lock(hdev);
3479
3480         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3481         if (!cmd)
3482                 goto unlock;
3483
3484         cp = cmd->param;
3485
3486         if (status)
3487                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3488                            mgmt_status(status));
3489         else
3490                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3491                              cp, sizeof(*cp));
3492
3493         mgmt_pending_remove(cmd);
3494
3495 unlock:
3496         hci_dev_unlock(hdev);
3497 }
3498
3499 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3500                           u16 len)
3501 {
3502         struct mgmt_cp_set_local_name *cp = data;
3503         struct pending_cmd *cmd;
3504         struct hci_request req;
3505         int err;
3506
3507         BT_DBG("");
3508
3509         hci_dev_lock(hdev);
3510
3511         /* If the old values are the same as the new ones just return a
3512          * direct command complete event.
3513          */
3514         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3515             !memcmp(hdev->short_name, cp->short_name,
3516                     sizeof(hdev->short_name))) {
3517                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3518                                    data, len);
3519                 goto failed;
3520         }
3521
3522         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3523
3524         if (!hdev_is_powered(hdev)) {
3525                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3526
3527                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3528                                    data, len);
3529                 if (err < 0)
3530                         goto failed;
3531
3532                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3533                                  sk);
3534
3535                 goto failed;
3536         }
3537
3538         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3539         if (!cmd) {
3540                 err = -ENOMEM;
3541                 goto failed;
3542         }
3543
3544         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3545
3546         hci_req_init(&req, hdev);
3547
3548         if (lmp_bredr_capable(hdev)) {
3549                 update_name(&req);
3550                 update_eir(&req);
3551         }
3552
3553         /* The name is stored in the scan response data and so
3554          * no need to udpate the advertising data here.
3555          */
3556         if (lmp_le_capable(hdev))
3557                 update_scan_rsp_data(&req);
3558
3559         err = hci_req_run(&req, set_name_complete);
3560         if (err < 0)
3561                 mgmt_pending_remove(cmd);
3562
3563 failed:
3564         hci_dev_unlock(hdev);
3565         return err;
3566 }
3567
3568 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3569                                void *data, u16 data_len)
3570 {
3571         struct pending_cmd *cmd;
3572         int err;
3573
3574         BT_DBG("%s", hdev->name);
3575
3576         hci_dev_lock(hdev);
3577
3578         if (!hdev_is_powered(hdev)) {
3579                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3580                                  MGMT_STATUS_NOT_POWERED);
3581                 goto unlock;
3582         }
3583
3584         if (!lmp_ssp_capable(hdev)) {
3585                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3586                                  MGMT_STATUS_NOT_SUPPORTED);
3587                 goto unlock;
3588         }
3589
3590         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3591                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3592                                  MGMT_STATUS_BUSY);
3593                 goto unlock;
3594         }
3595
3596         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3597         if (!cmd) {
3598                 err = -ENOMEM;
3599                 goto unlock;
3600         }
3601
3602         if (bredr_sc_enabled(hdev))
3603                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3604                                    0, NULL);
3605         else
3606                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3607
3608         if (err < 0)
3609                 mgmt_pending_remove(cmd);
3610
3611 unlock:
3612         hci_dev_unlock(hdev);
3613         return err;
3614 }
3615
3616 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3617                                void *data, u16 len)
3618 {
3619         int err;
3620
3621         BT_DBG("%s ", hdev->name);
3622
3623         hci_dev_lock(hdev);
3624
3625         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3626                 struct mgmt_cp_add_remote_oob_data *cp = data;
3627                 u8 status;
3628
3629                 if (cp->addr.type != BDADDR_BREDR) {
3630                         err = cmd_complete(sk, hdev->id,
3631                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3632                                            MGMT_STATUS_INVALID_PARAMS,
3633                                            &cp->addr, sizeof(cp->addr));
3634                         goto unlock;
3635                 }
3636
3637                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3638                                               cp->addr.type, cp->hash,
3639                                               cp->rand, NULL, NULL);
3640                 if (err < 0)
3641                         status = MGMT_STATUS_FAILED;
3642                 else
3643                         status = MGMT_STATUS_SUCCESS;
3644
3645                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3646                                    status, &cp->addr, sizeof(cp->addr));
3647         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3648                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3649                 u8 *rand192, *hash192;
3650                 u8 status;
3651
3652                 if (cp->addr.type != BDADDR_BREDR) {
3653                         err = cmd_complete(sk, hdev->id,
3654                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3655                                            MGMT_STATUS_INVALID_PARAMS,
3656                                            &cp->addr, sizeof(cp->addr));
3657                         goto unlock;
3658                 }
3659
3660                 if (bdaddr_type_is_le(cp->addr.type)) {
3661                         rand192 = NULL;
3662                         hash192 = NULL;
3663                 } else {
3664                         rand192 = cp->rand192;
3665                         hash192 = cp->hash192;
3666                 }
3667
3668                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3669                                               cp->addr.type, hash192, rand192,
3670                                               cp->hash256, cp->rand256);
3671                 if (err < 0)
3672                         status = MGMT_STATUS_FAILED;
3673                 else
3674                         status = MGMT_STATUS_SUCCESS;
3675
3676                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3677                                    status, &cp->addr, sizeof(cp->addr));
3678         } else {
3679                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3680                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3681                                  MGMT_STATUS_INVALID_PARAMS);
3682         }
3683
3684 unlock:
3685         hci_dev_unlock(hdev);
3686         return err;
3687 }
3688
3689 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3690                                   void *data, u16 len)
3691 {
3692         struct mgmt_cp_remove_remote_oob_data *cp = data;
3693         u8 status;
3694         int err;
3695
3696         BT_DBG("%s", hdev->name);
3697
3698         if (cp->addr.type != BDADDR_BREDR)
3699                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3700                                     MGMT_STATUS_INVALID_PARAMS,
3701                                     &cp->addr, sizeof(cp->addr));
3702
3703         hci_dev_lock(hdev);
3704
3705         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3706                 hci_remote_oob_data_clear(hdev);
3707                 status = MGMT_STATUS_SUCCESS;
3708                 goto done;
3709         }
3710
3711         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3712         if (err < 0)
3713                 status = MGMT_STATUS_INVALID_PARAMS;
3714         else
3715                 status = MGMT_STATUS_SUCCESS;
3716
3717 done:
3718         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3719                            status, &cp->addr, sizeof(cp->addr));
3720
3721         hci_dev_unlock(hdev);
3722         return err;
3723 }
3724
3725 static bool trigger_discovery(struct hci_request *req, u8 *status)
3726 {
3727         struct hci_dev *hdev = req->hdev;
3728         struct hci_cp_le_set_scan_param param_cp;
3729         struct hci_cp_le_set_scan_enable enable_cp;
3730         struct hci_cp_inquiry inq_cp;
3731         /* General inquiry access code (GIAC) */
3732         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3733         u8 own_addr_type;
3734         int err;
3735
3736         switch (hdev->discovery.type) {
3737         case DISCOV_TYPE_BREDR:
3738                 *status = mgmt_bredr_support(hdev);
3739                 if (*status)
3740                         return false;
3741
3742                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3743                         *status = MGMT_STATUS_BUSY;
3744                         return false;
3745                 }
3746
3747                 hci_inquiry_cache_flush(hdev);
3748
3749                 memset(&inq_cp, 0, sizeof(inq_cp));
3750                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3751                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3752                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3753                 break;
3754
3755         case DISCOV_TYPE_LE:
3756         case DISCOV_TYPE_INTERLEAVED:
3757                 *status = mgmt_le_support(hdev);
3758                 if (*status)
3759                         return false;
3760
3761                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3762                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3763                         *status = MGMT_STATUS_NOT_SUPPORTED;
3764                         return false;
3765                 }
3766
3767                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3768                         /* Don't let discovery abort an outgoing
3769                          * connection attempt that's using directed
3770                          * advertising.
3771                          */
3772                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3773                                                        BT_CONNECT)) {
3774                                 *status = MGMT_STATUS_REJECTED;
3775                                 return false;
3776                         }
3777
3778                         disable_advertising(req);
3779                 }
3780
3781                 /* If controller is scanning, it means the background scanning
3782                  * is running. Thus, we should temporarily stop it in order to
3783                  * set the discovery scanning parameters.
3784                  */
3785                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3786                         hci_req_add_le_scan_disable(req);
3787
3788                 memset(&param_cp, 0, sizeof(param_cp));
3789
3790                 /* All active scans will be done with either a resolvable
3791                  * private address (when privacy feature has been enabled)
3792                  * or unresolvable private address.
3793                  */
3794                 err = hci_update_random_address(req, true, &own_addr_type);
3795                 if (err < 0) {
3796                         *status = MGMT_STATUS_FAILED;
3797                         return false;
3798                 }
3799
3800                 param_cp.type = LE_SCAN_ACTIVE;
3801                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3802                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3803                 param_cp.own_address_type = own_addr_type;
3804                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3805                             &param_cp);
3806
3807                 memset(&enable_cp, 0, sizeof(enable_cp));
3808                 enable_cp.enable = LE_SCAN_ENABLE;
3809                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3810                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3811                             &enable_cp);
3812                 break;
3813
3814         default:
3815                 *status = MGMT_STATUS_INVALID_PARAMS;
3816                 return false;
3817         }
3818
3819         return true;
3820 }
3821
3822 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3823 {
3824         struct pending_cmd *cmd;
3825         unsigned long timeout;
3826
3827         BT_DBG("status %d", status);
3828
3829         hci_dev_lock(hdev);
3830
3831         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3832         if (!cmd)
3833                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3834
3835         if (cmd) {
3836                 u8 type = hdev->discovery.type;
3837
3838                 cmd_complete(cmd->sk, hdev->id, cmd->opcode,
3839                              mgmt_status(status), &type, sizeof(type));
3840                 mgmt_pending_remove(cmd);
3841         }
3842
3843         if (status) {
3844                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3845                 goto unlock;
3846         }
3847
3848         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3849
3850         switch (hdev->discovery.type) {
3851         case DISCOV_TYPE_LE:
3852                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3853                 break;
3854         case DISCOV_TYPE_INTERLEAVED:
3855                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3856                 break;
3857         case DISCOV_TYPE_BREDR:
3858                 timeout = 0;
3859                 break;
3860         default:
3861                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3862                 timeout = 0;
3863                 break;
3864         }
3865
3866         if (timeout)
3867                 queue_delayed_work(hdev->workqueue,
3868                                    &hdev->le_scan_disable, timeout);
3869
3870 unlock:
3871         hci_dev_unlock(hdev);
3872 }
3873
3874 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3875                            void *data, u16 len)
3876 {
3877         struct mgmt_cp_start_discovery *cp = data;
3878         struct pending_cmd *cmd;
3879         struct hci_request req;
3880         u8 status;
3881         int err;
3882
3883         BT_DBG("%s", hdev->name);
3884
3885         hci_dev_lock(hdev);
3886
3887         if (!hdev_is_powered(hdev)) {
3888                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3889                                    MGMT_STATUS_NOT_POWERED,
3890                                    &cp->type, sizeof(cp->type));
3891                 goto failed;
3892         }
3893
3894         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3895             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3896                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3897                                    MGMT_STATUS_BUSY, &cp->type,
3898                                    sizeof(cp->type));
3899                 goto failed;
3900         }
3901
3902         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3903         if (!cmd) {
3904                 err = -ENOMEM;
3905                 goto failed;
3906         }
3907
3908         /* Clear the discovery filter first to free any previously
3909          * allocated memory for the UUID list.
3910          */
3911         hci_discovery_filter_clear(hdev);
3912
3913         hdev->discovery.type = cp->type;
3914
3915         hci_req_init(&req, hdev);
3916
3917         if (!trigger_discovery(&req, &status)) {
3918                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3919                                    status, &cp->type, sizeof(cp->type));
3920                 mgmt_pending_remove(cmd);
3921                 goto failed;
3922         }
3923
3924         err = hci_req_run(&req, start_discovery_complete);
3925         if (err < 0) {
3926                 mgmt_pending_remove(cmd);
3927                 goto failed;
3928         }
3929
3930         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3931
3932 failed:
3933         hci_dev_unlock(hdev);
3934         return err;
3935 }
3936
3937 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3938                                    void *data, u16 len)
3939 {
3940         struct mgmt_cp_start_service_discovery *cp = data;
3941         struct pending_cmd *cmd;
3942         struct hci_request req;
3943         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3944         u16 uuid_count, expected_len;
3945         u8 status;
3946         int err;
3947
3948         BT_DBG("%s", hdev->name);
3949
3950         hci_dev_lock(hdev);
3951
3952         if (!hdev_is_powered(hdev)) {
3953                 err = cmd_complete(sk, hdev->id,
3954                                    MGMT_OP_START_SERVICE_DISCOVERY,
3955                                    MGMT_STATUS_NOT_POWERED,
3956                                    &cp->type, sizeof(cp->type));
3957                 goto failed;
3958         }
3959
3960         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3961             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3962                 err = cmd_complete(sk, hdev->id,
3963                                    MGMT_OP_START_SERVICE_DISCOVERY,
3964                                    MGMT_STATUS_BUSY, &cp->type,
3965                                    sizeof(cp->type));
3966                 goto failed;
3967         }
3968
3969         uuid_count = __le16_to_cpu(cp->uuid_count);
3970         if (uuid_count > max_uuid_count) {
3971                 BT_ERR("service_discovery: too big uuid_count value %u",
3972                        uuid_count);
3973                 err = cmd_complete(sk, hdev->id,
3974                                    MGMT_OP_START_SERVICE_DISCOVERY,
3975                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
3976                                    sizeof(cp->type));
3977                 goto failed;
3978         }
3979
3980         expected_len = sizeof(*cp) + uuid_count * 16;
3981         if (expected_len != len) {
3982                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
3983                        expected_len, len);
3984                 err = cmd_complete(sk, hdev->id,
3985                                    MGMT_OP_START_SERVICE_DISCOVERY,
3986                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
3987                                    sizeof(cp->type));
3988                 goto failed;
3989         }
3990
3991         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3992                                hdev, NULL, 0);
3993         if (!cmd) {
3994                 err = -ENOMEM;
3995                 goto failed;
3996         }
3997
3998         /* Clear the discovery filter first to free any previously
3999          * allocated memory for the UUID list.
4000          */
4001         hci_discovery_filter_clear(hdev);
4002
4003         hdev->discovery.type = cp->type;
4004         hdev->discovery.rssi = cp->rssi;
4005         hdev->discovery.uuid_count = uuid_count;
4006
4007         if (uuid_count > 0) {
4008                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4009                                                 GFP_KERNEL);
4010                 if (!hdev->discovery.uuids) {
4011                         err = cmd_complete(sk, hdev->id,
4012                                            MGMT_OP_START_SERVICE_DISCOVERY,
4013                                            MGMT_STATUS_FAILED,
4014                                            &cp->type, sizeof(cp->type));
4015                         mgmt_pending_remove(cmd);
4016                         goto failed;
4017                 }
4018         }
4019
4020         hci_req_init(&req, hdev);
4021
4022         if (!trigger_discovery(&req, &status)) {
4023                 err = cmd_complete(sk, hdev->id,
4024                                    MGMT_OP_START_SERVICE_DISCOVERY,
4025                                    status, &cp->type, sizeof(cp->type));
4026                 mgmt_pending_remove(cmd);
4027                 goto failed;
4028         }
4029
4030         err = hci_req_run(&req, start_discovery_complete);
4031         if (err < 0) {
4032                 mgmt_pending_remove(cmd);
4033                 goto failed;
4034         }
4035
4036         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4037
4038 failed:
4039         hci_dev_unlock(hdev);
4040         return err;
4041 }
4042
4043 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
4044 {
4045         struct pending_cmd *cmd;
4046
4047         BT_DBG("status %d", status);
4048
4049         hci_dev_lock(hdev);
4050
4051         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4052         if (cmd) {
4053                 u8 type = hdev->discovery.type;
4054
4055                 cmd_complete(cmd->sk, hdev->id, cmd->opcode,
4056                              mgmt_status(status), &type, sizeof(type));
4057                 mgmt_pending_remove(cmd);
4058         }
4059
4060         if (!status)
4061                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4062
4063         hci_dev_unlock(hdev);
4064 }
4065
4066 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4067                           u16 len)
4068 {
4069         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4070         struct pending_cmd *cmd;
4071         struct hci_request req;
4072         int err;
4073
4074         BT_DBG("%s", hdev->name);
4075
4076         hci_dev_lock(hdev);
4077
4078         if (!hci_discovery_active(hdev)) {
4079                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4080                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4081                                    sizeof(mgmt_cp->type));
4082                 goto unlock;
4083         }
4084
4085         if (hdev->discovery.type != mgmt_cp->type) {
4086                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4087                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4088                                    sizeof(mgmt_cp->type));
4089                 goto unlock;
4090         }
4091
4092         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
4093         if (!cmd) {
4094                 err = -ENOMEM;
4095                 goto unlock;
4096         }
4097
4098         hci_req_init(&req, hdev);
4099
4100         hci_stop_discovery(&req);
4101
4102         err = hci_req_run(&req, stop_discovery_complete);
4103         if (!err) {
4104                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4105                 goto unlock;
4106         }
4107
4108         mgmt_pending_remove(cmd);
4109
4110         /* If no HCI commands were sent we're done */
4111         if (err == -ENODATA) {
4112                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4113                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4114                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4115         }
4116
4117 unlock:
4118         hci_dev_unlock(hdev);
4119         return err;
4120 }
4121
4122 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4123                         u16 len)
4124 {
4125         struct mgmt_cp_confirm_name *cp = data;
4126         struct inquiry_entry *e;
4127         int err;
4128
4129         BT_DBG("%s", hdev->name);
4130
4131         hci_dev_lock(hdev);
4132
4133         if (!hci_discovery_active(hdev)) {
4134                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4135                                    MGMT_STATUS_FAILED, &cp->addr,
4136                                    sizeof(cp->addr));
4137                 goto failed;
4138         }
4139
4140         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4141         if (!e) {
4142                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4143                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4144                                    sizeof(cp->addr));
4145                 goto failed;
4146         }
4147
4148         if (cp->name_known) {
4149                 e->name_state = NAME_KNOWN;
4150                 list_del(&e->list);
4151         } else {
4152                 e->name_state = NAME_NEEDED;
4153                 hci_inquiry_cache_update_resolve(hdev, e);
4154         }
4155
4156         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4157                            sizeof(cp->addr));
4158
4159 failed:
4160         hci_dev_unlock(hdev);
4161         return err;
4162 }
4163
4164 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4165                         u16 len)
4166 {
4167         struct mgmt_cp_block_device *cp = data;
4168         u8 status;
4169         int err;
4170
4171         BT_DBG("%s", hdev->name);
4172
4173         if (!bdaddr_type_is_valid(cp->addr.type))
4174                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4175                                     MGMT_STATUS_INVALID_PARAMS,
4176                                     &cp->addr, sizeof(cp->addr));
4177
4178         hci_dev_lock(hdev);
4179
4180         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4181                                   cp->addr.type);
4182         if (err < 0) {
4183                 status = MGMT_STATUS_FAILED;
4184                 goto done;
4185         }
4186
4187         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4188                    sk);
4189         status = MGMT_STATUS_SUCCESS;
4190
4191 done:
4192         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4193                            &cp->addr, sizeof(cp->addr));
4194
4195         hci_dev_unlock(hdev);
4196
4197         return err;
4198 }
4199
4200 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4201                           u16 len)
4202 {
4203         struct mgmt_cp_unblock_device *cp = data;
4204         u8 status;
4205         int err;
4206
4207         BT_DBG("%s", hdev->name);
4208
4209         if (!bdaddr_type_is_valid(cp->addr.type))
4210                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4211                                     MGMT_STATUS_INVALID_PARAMS,
4212                                     &cp->addr, sizeof(cp->addr));
4213
4214         hci_dev_lock(hdev);
4215
4216         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4217                                   cp->addr.type);
4218         if (err < 0) {
4219                 status = MGMT_STATUS_INVALID_PARAMS;
4220                 goto done;
4221         }
4222
4223         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4224                    sk);
4225         status = MGMT_STATUS_SUCCESS;
4226
4227 done:
4228         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4229                            &cp->addr, sizeof(cp->addr));
4230
4231         hci_dev_unlock(hdev);
4232
4233         return err;
4234 }
4235
4236 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4237                          u16 len)
4238 {
4239         struct mgmt_cp_set_device_id *cp = data;
4240         struct hci_request req;
4241         int err;
4242         __u16 source;
4243
4244         BT_DBG("%s", hdev->name);
4245
4246         source = __le16_to_cpu(cp->source);
4247
4248         if (source > 0x0002)
4249                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4250                                   MGMT_STATUS_INVALID_PARAMS);
4251
4252         hci_dev_lock(hdev);
4253
4254         hdev->devid_source = source;
4255         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4256         hdev->devid_product = __le16_to_cpu(cp->product);
4257         hdev->devid_version = __le16_to_cpu(cp->version);
4258
4259         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4260
4261         hci_req_init(&req, hdev);
4262         update_eir(&req);
4263         hci_req_run(&req, NULL);
4264
4265         hci_dev_unlock(hdev);
4266
4267         return err;
4268 }
4269
4270 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4271 {
4272         struct cmd_lookup match = { NULL, hdev };
4273
4274         if (status) {
4275                 u8 mgmt_err = mgmt_status(status);
4276
4277                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4278                                      cmd_status_rsp, &mgmt_err);
4279                 return;
4280         }
4281
4282         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4283                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4284         else
4285                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4286
4287         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4288                              &match);
4289
4290         new_settings(hdev, match.sk);
4291
4292         if (match.sk)
4293                 sock_put(match.sk);
4294 }
4295
4296 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4297                            u16 len)
4298 {
4299         struct mgmt_mode *cp = data;
4300         struct pending_cmd *cmd;
4301         struct hci_request req;
4302         u8 val, enabled, status;
4303         int err;
4304
4305         BT_DBG("request for %s", hdev->name);
4306
4307         status = mgmt_le_support(hdev);
4308         if (status)
4309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4310                                   status);
4311
4312         if (cp->val != 0x00 && cp->val != 0x01)
4313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4314                                   MGMT_STATUS_INVALID_PARAMS);
4315
4316         hci_dev_lock(hdev);
4317
4318         val = !!cp->val;
4319         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4320
4321         /* The following conditions are ones which mean that we should
4322          * not do any HCI communication but directly send a mgmt
4323          * response to user space (after toggling the flag if
4324          * necessary).
4325          */
4326         if (!hdev_is_powered(hdev) || val == enabled ||
4327             hci_conn_num(hdev, LE_LINK) > 0 ||
4328             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4329              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4330                 bool changed = false;
4331
4332                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4333                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4334                         changed = true;
4335                 }
4336
4337                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4338                 if (err < 0)
4339                         goto unlock;
4340
4341                 if (changed)
4342                         err = new_settings(hdev, sk);
4343
4344                 goto unlock;
4345         }
4346
4347         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4348             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4349                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4350                                  MGMT_STATUS_BUSY);
4351                 goto unlock;
4352         }
4353
4354         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4355         if (!cmd) {
4356                 err = -ENOMEM;
4357                 goto unlock;
4358         }
4359
4360         hci_req_init(&req, hdev);
4361
4362         if (val)
4363                 enable_advertising(&req);
4364         else
4365                 disable_advertising(&req);
4366
4367         err = hci_req_run(&req, set_advertising_complete);
4368         if (err < 0)
4369                 mgmt_pending_remove(cmd);
4370
4371 unlock:
4372         hci_dev_unlock(hdev);
4373         return err;
4374 }
4375
4376 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4377                               void *data, u16 len)
4378 {
4379         struct mgmt_cp_set_static_address *cp = data;
4380         int err;
4381
4382         BT_DBG("%s", hdev->name);
4383
4384         if (!lmp_le_capable(hdev))
4385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4386                                   MGMT_STATUS_NOT_SUPPORTED);
4387
4388         if (hdev_is_powered(hdev))
4389                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4390                                   MGMT_STATUS_REJECTED);
4391
4392         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4393                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4394                         return cmd_status(sk, hdev->id,
4395                                           MGMT_OP_SET_STATIC_ADDRESS,
4396                                           MGMT_STATUS_INVALID_PARAMS);
4397
4398                 /* Two most significant bits shall be set */
4399                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4400                         return cmd_status(sk, hdev->id,
4401                                           MGMT_OP_SET_STATIC_ADDRESS,
4402                                           MGMT_STATUS_INVALID_PARAMS);
4403         }
4404
4405         hci_dev_lock(hdev);
4406
4407         bacpy(&hdev->static_addr, &cp->bdaddr);
4408
4409         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4410
4411         hci_dev_unlock(hdev);
4412
4413         return err;
4414 }
4415
4416 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4417                            void *data, u16 len)
4418 {
4419         struct mgmt_cp_set_scan_params *cp = data;
4420         __u16 interval, window;
4421         int err;
4422
4423         BT_DBG("%s", hdev->name);
4424
4425         if (!lmp_le_capable(hdev))
4426                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4427                                   MGMT_STATUS_NOT_SUPPORTED);
4428
4429         interval = __le16_to_cpu(cp->interval);
4430
4431         if (interval < 0x0004 || interval > 0x4000)
4432                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4433                                   MGMT_STATUS_INVALID_PARAMS);
4434
4435         window = __le16_to_cpu(cp->window);
4436
4437         if (window < 0x0004 || window > 0x4000)
4438                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4439                                   MGMT_STATUS_INVALID_PARAMS);
4440
4441         if (window > interval)
4442                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4443                                   MGMT_STATUS_INVALID_PARAMS);
4444
4445         hci_dev_lock(hdev);
4446
4447         hdev->le_scan_interval = interval;
4448         hdev->le_scan_window = window;
4449
4450         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4451
4452         /* If background scan is running, restart it so new parameters are
4453          * loaded.
4454          */
4455         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4456             hdev->discovery.state == DISCOVERY_STOPPED) {
4457                 struct hci_request req;
4458
4459                 hci_req_init(&req, hdev);
4460
4461                 hci_req_add_le_scan_disable(&req);
4462                 hci_req_add_le_passive_scan(&req);
4463
4464                 hci_req_run(&req, NULL);
4465         }
4466
4467         hci_dev_unlock(hdev);
4468
4469         return err;
4470 }
4471
4472 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4473 {
4474         struct pending_cmd *cmd;
4475
4476         BT_DBG("status 0x%02x", status);
4477
4478         hci_dev_lock(hdev);
4479
4480         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4481         if (!cmd)
4482                 goto unlock;
4483
4484         if (status) {
4485                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4486                            mgmt_status(status));
4487         } else {
4488                 struct mgmt_mode *cp = cmd->param;
4489
4490                 if (cp->val)
4491                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4492                 else
4493                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4494
4495                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4496                 new_settings(hdev, cmd->sk);
4497         }
4498
4499         mgmt_pending_remove(cmd);
4500
4501 unlock:
4502         hci_dev_unlock(hdev);
4503 }
4504
4505 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4506                                 void *data, u16 len)
4507 {
4508         struct mgmt_mode *cp = data;
4509         struct pending_cmd *cmd;
4510         struct hci_request req;
4511         int err;
4512
4513         BT_DBG("%s", hdev->name);
4514
4515         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4516             hdev->hci_ver < BLUETOOTH_VER_1_2)
4517                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4518                                   MGMT_STATUS_NOT_SUPPORTED);
4519
4520         if (cp->val != 0x00 && cp->val != 0x01)
4521                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4522                                   MGMT_STATUS_INVALID_PARAMS);
4523
4524         if (!hdev_is_powered(hdev))
4525                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4526                                   MGMT_STATUS_NOT_POWERED);
4527
4528         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4529                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4530                                   MGMT_STATUS_REJECTED);
4531
4532         hci_dev_lock(hdev);
4533
4534         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4535                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4536                                  MGMT_STATUS_BUSY);
4537                 goto unlock;
4538         }
4539
4540         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4541                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4542                                         hdev);
4543                 goto unlock;
4544         }
4545
4546         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4547                                data, len);
4548         if (!cmd) {
4549                 err = -ENOMEM;
4550                 goto unlock;
4551         }
4552
4553         hci_req_init(&req, hdev);
4554
4555         write_fast_connectable(&req, cp->val);
4556
4557         err = hci_req_run(&req, fast_connectable_complete);
4558         if (err < 0) {
4559                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560                                  MGMT_STATUS_FAILED);
4561                 mgmt_pending_remove(cmd);
4562         }
4563
4564 unlock:
4565         hci_dev_unlock(hdev);
4566
4567         return err;
4568 }
4569
4570 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4571 {
4572         struct pending_cmd *cmd;
4573
4574         BT_DBG("status 0x%02x", status);
4575
4576         hci_dev_lock(hdev);
4577
4578         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4579         if (!cmd)
4580                 goto unlock;
4581
4582         if (status) {
4583                 u8 mgmt_err = mgmt_status(status);
4584
4585                 /* We need to restore the flag if related HCI commands
4586                  * failed.
4587                  */
4588                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4589
4590                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4591         } else {
4592                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4593                 new_settings(hdev, cmd->sk);
4594         }
4595
4596         mgmt_pending_remove(cmd);
4597
4598 unlock:
4599         hci_dev_unlock(hdev);
4600 }
4601
4602 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4603 {
4604         struct mgmt_mode *cp = data;
4605         struct pending_cmd *cmd;
4606         struct hci_request req;
4607         int err;
4608
4609         BT_DBG("request for %s", hdev->name);
4610
4611         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4612                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4613                                   MGMT_STATUS_NOT_SUPPORTED);
4614
4615         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4616                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4617                                   MGMT_STATUS_REJECTED);
4618
4619         if (cp->val != 0x00 && cp->val != 0x01)
4620                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4621                                   MGMT_STATUS_INVALID_PARAMS);
4622
4623         hci_dev_lock(hdev);
4624
4625         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4626                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4627                 goto unlock;
4628         }
4629
4630         if (!hdev_is_powered(hdev)) {
4631                 if (!cp->val) {
4632                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4633                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4634                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4635                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4636                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4637                 }
4638
4639                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4640
4641                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4642                 if (err < 0)
4643                         goto unlock;
4644
4645                 err = new_settings(hdev, sk);
4646                 goto unlock;
4647         }
4648
4649         /* Reject disabling when powered on */
4650         if (!cp->val) {
4651                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4652                                  MGMT_STATUS_REJECTED);
4653                 goto unlock;
4654         }
4655
4656         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4657                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4658                                  MGMT_STATUS_BUSY);
4659                 goto unlock;
4660         }
4661
4662         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4663         if (!cmd) {
4664                 err = -ENOMEM;
4665                 goto unlock;
4666         }
4667
4668         /* We need to flip the bit already here so that update_adv_data
4669          * generates the correct flags.
4670          */
4671         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4672
4673         hci_req_init(&req, hdev);
4674
4675         write_fast_connectable(&req, false);
4676         hci_update_page_scan(hdev, &req);
4677
4678         /* Since only the advertising data flags will change, there
4679          * is no need to update the scan response data.
4680          */
4681         update_adv_data(&req);
4682
4683         err = hci_req_run(&req, set_bredr_complete);
4684         if (err < 0)
4685                 mgmt_pending_remove(cmd);
4686
4687 unlock:
4688         hci_dev_unlock(hdev);
4689         return err;
4690 }
4691
4692 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4693                            void *data, u16 len)
4694 {
4695         struct mgmt_mode *cp = data;
4696         struct pending_cmd *cmd;
4697         u8 val;
4698         int err;
4699
4700         BT_DBG("request for %s", hdev->name);
4701
4702         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4703             !lmp_sc_capable(hdev) && !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4704                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4705                                   MGMT_STATUS_NOT_SUPPORTED);
4706
4707         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4708                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4709                                   MGMT_STATUS_INVALID_PARAMS);
4710
4711         hci_dev_lock(hdev);
4712
4713         if (!hdev_is_powered(hdev) ||
4714             (!lmp_sc_capable(hdev) &&
4715              !test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) ||
4716             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4717                 bool changed;
4718
4719                 if (cp->val) {
4720                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4721                                                     &hdev->dev_flags);
4722                         if (cp->val == 0x02)
4723                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4724                         else
4725                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4726                 } else {
4727                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4728                                                      &hdev->dev_flags);
4729                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4730                 }
4731
4732                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4733                 if (err < 0)
4734                         goto failed;
4735
4736                 if (changed)
4737                         err = new_settings(hdev, sk);
4738
4739                 goto failed;
4740         }
4741
4742         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4743                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4744                                  MGMT_STATUS_BUSY);
4745                 goto failed;
4746         }
4747
4748         val = !!cp->val;
4749
4750         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4751             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4752                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4753                 goto failed;
4754         }
4755
4756         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4757         if (!cmd) {
4758                 err = -ENOMEM;
4759                 goto failed;
4760         }
4761
4762         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4763         if (err < 0) {
4764                 mgmt_pending_remove(cmd);
4765                 goto failed;
4766         }
4767
4768         if (cp->val == 0x02)
4769                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4770         else
4771                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4772
4773 failed:
4774         hci_dev_unlock(hdev);
4775         return err;
4776 }
4777
4778 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4779                           void *data, u16 len)
4780 {
4781         struct mgmt_mode *cp = data;
4782         bool changed, use_changed;
4783         int err;
4784
4785         BT_DBG("request for %s", hdev->name);
4786
4787         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4788                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4789                                   MGMT_STATUS_INVALID_PARAMS);
4790
4791         hci_dev_lock(hdev);
4792
4793         if (cp->val)
4794                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4795                                             &hdev->dev_flags);
4796         else
4797                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4798                                              &hdev->dev_flags);
4799
4800         if (cp->val == 0x02)
4801                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4802                                                 &hdev->dev_flags);
4803         else
4804                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4805                                                  &hdev->dev_flags);
4806
4807         if (hdev_is_powered(hdev) && use_changed &&
4808             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4809                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4811                              sizeof(mode), &mode);
4812         }
4813
4814         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4815         if (err < 0)
4816                 goto unlock;
4817
4818         if (changed)
4819                 err = new_settings(hdev, sk);
4820
4821 unlock:
4822         hci_dev_unlock(hdev);
4823         return err;
4824 }
4825
4826 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4827                        u16 len)
4828 {
4829         struct mgmt_cp_set_privacy *cp = cp_data;
4830         bool changed;
4831         int err;
4832
4833         BT_DBG("request for %s", hdev->name);
4834
4835         if (!lmp_le_capable(hdev))
4836                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4837                                   MGMT_STATUS_NOT_SUPPORTED);
4838
4839         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4840                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4841                                   MGMT_STATUS_INVALID_PARAMS);
4842
4843         if (hdev_is_powered(hdev))
4844                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4845                                   MGMT_STATUS_REJECTED);
4846
4847         hci_dev_lock(hdev);
4848
4849         /* If user space supports this command it is also expected to
4850          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4851          */
4852         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4853
4854         if (cp->privacy) {
4855                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4856                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4857                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4858         } else {
4859                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4860                 memset(hdev->irk, 0, sizeof(hdev->irk));
4861                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4862         }
4863
4864         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4865         if (err < 0)
4866                 goto unlock;
4867
4868         if (changed)
4869                 err = new_settings(hdev, sk);
4870
4871 unlock:
4872         hci_dev_unlock(hdev);
4873         return err;
4874 }
4875
4876 static bool irk_is_valid(struct mgmt_irk_info *irk)
4877 {
4878         switch (irk->addr.type) {
4879         case BDADDR_LE_PUBLIC:
4880                 return true;
4881
4882         case BDADDR_LE_RANDOM:
4883                 /* Two most significant bits shall be set */
4884                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4885                         return false;
4886                 return true;
4887         }
4888
4889         return false;
4890 }
4891
4892 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4893                      u16 len)
4894 {
4895         struct mgmt_cp_load_irks *cp = cp_data;
4896         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4897                                    sizeof(struct mgmt_irk_info));
4898         u16 irk_count, expected_len;
4899         int i, err;
4900
4901         BT_DBG("request for %s", hdev->name);
4902
4903         if (!lmp_le_capable(hdev))
4904                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4905                                   MGMT_STATUS_NOT_SUPPORTED);
4906
4907         irk_count = __le16_to_cpu(cp->irk_count);
4908         if (irk_count > max_irk_count) {
4909                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4910                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4911                                   MGMT_STATUS_INVALID_PARAMS);
4912         }
4913
4914         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4915         if (expected_len != len) {
4916                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4917                        expected_len, len);
4918                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4919                                   MGMT_STATUS_INVALID_PARAMS);
4920         }
4921
4922         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4923
4924         for (i = 0; i < irk_count; i++) {
4925                 struct mgmt_irk_info *key = &cp->irks[i];
4926
4927                 if (!irk_is_valid(key))
4928                         return cmd_status(sk, hdev->id,
4929                                           MGMT_OP_LOAD_IRKS,
4930                                           MGMT_STATUS_INVALID_PARAMS);
4931         }
4932
4933         hci_dev_lock(hdev);
4934
4935         hci_smp_irks_clear(hdev);
4936
4937         for (i = 0; i < irk_count; i++) {
4938                 struct mgmt_irk_info *irk = &cp->irks[i];
4939                 u8 addr_type;
4940
4941                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4942                         addr_type = ADDR_LE_DEV_PUBLIC;
4943                 else
4944                         addr_type = ADDR_LE_DEV_RANDOM;
4945
4946                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4947                             BDADDR_ANY);
4948         }
4949
4950         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4951
4952         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4953
4954         hci_dev_unlock(hdev);
4955
4956         return err;
4957 }
4958
4959 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4960 {
4961         if (key->master != 0x00 && key->master != 0x01)
4962                 return false;
4963
4964         switch (key->addr.type) {
4965         case BDADDR_LE_PUBLIC:
4966                 return true;
4967
4968         case BDADDR_LE_RANDOM:
4969                 /* Two most significant bits shall be set */
4970                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4971                         return false;
4972                 return true;
4973         }
4974
4975         return false;
4976 }
4977
4978 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4979                                void *cp_data, u16 len)
4980 {
4981         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4982         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4983                                    sizeof(struct mgmt_ltk_info));
4984         u16 key_count, expected_len;
4985         int i, err;
4986
4987         BT_DBG("request for %s", hdev->name);
4988
4989         if (!lmp_le_capable(hdev))
4990                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4991                                   MGMT_STATUS_NOT_SUPPORTED);
4992
4993         key_count = __le16_to_cpu(cp->key_count);
4994         if (key_count > max_key_count) {
4995                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4996                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4997                                   MGMT_STATUS_INVALID_PARAMS);
4998         }
4999
5000         expected_len = sizeof(*cp) + key_count *
5001                                         sizeof(struct mgmt_ltk_info);
5002         if (expected_len != len) {
5003                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5004                        expected_len, len);
5005                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5006                                   MGMT_STATUS_INVALID_PARAMS);
5007         }
5008
5009         BT_DBG("%s key_count %u", hdev->name, key_count);
5010
5011         for (i = 0; i < key_count; i++) {
5012                 struct mgmt_ltk_info *key = &cp->keys[i];
5013
5014                 if (!ltk_is_valid(key))
5015                         return cmd_status(sk, hdev->id,
5016                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
5017                                           MGMT_STATUS_INVALID_PARAMS);
5018         }
5019
5020         hci_dev_lock(hdev);
5021
5022         hci_smp_ltks_clear(hdev);
5023
5024         for (i = 0; i < key_count; i++) {
5025                 struct mgmt_ltk_info *key = &cp->keys[i];
5026                 u8 type, addr_type, authenticated;
5027
5028                 if (key->addr.type == BDADDR_LE_PUBLIC)
5029                         addr_type = ADDR_LE_DEV_PUBLIC;
5030                 else
5031                         addr_type = ADDR_LE_DEV_RANDOM;
5032
5033                 switch (key->type) {
5034                 case MGMT_LTK_UNAUTHENTICATED:
5035                         authenticated = 0x00;
5036                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5037                         break;
5038                 case MGMT_LTK_AUTHENTICATED:
5039                         authenticated = 0x01;
5040                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5041                         break;
5042                 case MGMT_LTK_P256_UNAUTH:
5043                         authenticated = 0x00;
5044                         type = SMP_LTK_P256;
5045                         break;
5046                 case MGMT_LTK_P256_AUTH:
5047                         authenticated = 0x01;
5048                         type = SMP_LTK_P256;
5049                         break;
5050                 case MGMT_LTK_P256_DEBUG:
5051                         authenticated = 0x00;
5052                         type = SMP_LTK_P256_DEBUG;
5053                 default:
5054                         continue;
5055                 }
5056
5057                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5058                             authenticated, key->val, key->enc_size, key->ediv,
5059                             key->rand);
5060         }
5061
5062         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5063                            NULL, 0);
5064
5065         hci_dev_unlock(hdev);
5066
5067         return err;
5068 }
5069
5070 struct cmd_conn_lookup {
5071         struct hci_conn *conn;
5072         bool valid_tx_power;
5073         u8 mgmt_status;
5074 };
5075
5076 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
5077 {
5078         struct cmd_conn_lookup *match = data;
5079         struct mgmt_cp_get_conn_info *cp;
5080         struct mgmt_rp_get_conn_info rp;
5081         struct hci_conn *conn = cmd->user_data;
5082
5083         if (conn != match->conn)
5084                 return;
5085
5086         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
5087
5088         memset(&rp, 0, sizeof(rp));
5089         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5090         rp.addr.type = cp->addr.type;
5091
5092         if (!match->mgmt_status) {
5093                 rp.rssi = conn->rssi;
5094
5095                 if (match->valid_tx_power) {
5096                         rp.tx_power = conn->tx_power;
5097                         rp.max_tx_power = conn->max_tx_power;
5098                 } else {
5099                         rp.tx_power = HCI_TX_POWER_INVALID;
5100                         rp.max_tx_power = HCI_TX_POWER_INVALID;
5101                 }
5102         }
5103
5104         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5105                      match->mgmt_status, &rp, sizeof(rp));
5106
5107         hci_conn_drop(conn);
5108         hci_conn_put(conn);
5109
5110         mgmt_pending_remove(cmd);
5111 }
5112
5113 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
5114 {
5115         struct hci_cp_read_rssi *cp;
5116         struct hci_conn *conn;
5117         struct cmd_conn_lookup match;
5118         u16 handle;
5119
5120         BT_DBG("status 0x%02x", status);
5121
5122         hci_dev_lock(hdev);
5123
5124         /* TX power data is valid in case request completed successfully,
5125          * otherwise we assume it's not valid. At the moment we assume that
5126          * either both or none of current and max values are valid to keep code
5127          * simple.
5128          */
5129         match.valid_tx_power = !status;
5130
5131         /* Commands sent in request are either Read RSSI or Read Transmit Power
5132          * Level so we check which one was last sent to retrieve connection
5133          * handle.  Both commands have handle as first parameter so it's safe to
5134          * cast data on the same command struct.
5135          *
5136          * First command sent is always Read RSSI and we fail only if it fails.
5137          * In other case we simply override error to indicate success as we
5138          * already remembered if TX power value is actually valid.
5139          */
5140         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5141         if (!cp) {
5142                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5143                 status = 0;
5144         }
5145
5146         if (!cp) {
5147                 BT_ERR("invalid sent_cmd in response");
5148                 goto unlock;
5149         }
5150
5151         handle = __le16_to_cpu(cp->handle);
5152         conn = hci_conn_hash_lookup_handle(hdev, handle);
5153         if (!conn) {
5154                 BT_ERR("unknown handle (%d) in response", handle);
5155                 goto unlock;
5156         }
5157
5158         match.conn = conn;
5159         match.mgmt_status = mgmt_status(status);
5160
5161         /* Cache refresh is complete, now reply for mgmt request for given
5162          * connection only.
5163          */
5164         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
5165                              get_conn_info_complete, &match);
5166
5167 unlock:
5168         hci_dev_unlock(hdev);
5169 }
5170
5171 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5172                          u16 len)
5173 {
5174         struct mgmt_cp_get_conn_info *cp = data;
5175         struct mgmt_rp_get_conn_info rp;
5176         struct hci_conn *conn;
5177         unsigned long conn_info_age;
5178         int err = 0;
5179
5180         BT_DBG("%s", hdev->name);
5181
5182         memset(&rp, 0, sizeof(rp));
5183         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5184         rp.addr.type = cp->addr.type;
5185
5186         if (!bdaddr_type_is_valid(cp->addr.type))
5187                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5188                                     MGMT_STATUS_INVALID_PARAMS,
5189                                     &rp, sizeof(rp));
5190
5191         hci_dev_lock(hdev);
5192
5193         if (!hdev_is_powered(hdev)) {
5194                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5195                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5196                 goto unlock;
5197         }
5198
5199         if (cp->addr.type == BDADDR_BREDR)
5200                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5201                                                &cp->addr.bdaddr);
5202         else
5203                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5204
5205         if (!conn || conn->state != BT_CONNECTED) {
5206                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5207                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5208                 goto unlock;
5209         }
5210
5211         /* To avoid client trying to guess when to poll again for information we
5212          * calculate conn info age as random value between min/max set in hdev.
5213          */
5214         conn_info_age = hdev->conn_info_min_age +
5215                         prandom_u32_max(hdev->conn_info_max_age -
5216                                         hdev->conn_info_min_age);
5217
5218         /* Query controller to refresh cached values if they are too old or were
5219          * never read.
5220          */
5221         if (time_after(jiffies, conn->conn_info_timestamp +
5222                        msecs_to_jiffies(conn_info_age)) ||
5223             !conn->conn_info_timestamp) {
5224                 struct hci_request req;
5225                 struct hci_cp_read_tx_power req_txp_cp;
5226                 struct hci_cp_read_rssi req_rssi_cp;
5227                 struct pending_cmd *cmd;
5228
5229                 hci_req_init(&req, hdev);
5230                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5231                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5232                             &req_rssi_cp);
5233
5234                 /* For LE links TX power does not change thus we don't need to
5235                  * query for it once value is known.
5236                  */
5237                 if (!bdaddr_type_is_le(cp->addr.type) ||
5238                     conn->tx_power == HCI_TX_POWER_INVALID) {
5239                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5240                         req_txp_cp.type = 0x00;
5241                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5242                                     sizeof(req_txp_cp), &req_txp_cp);
5243                 }
5244
5245                 /* Max TX power needs to be read only once per connection */
5246                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5247                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5248                         req_txp_cp.type = 0x01;
5249                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5250                                     sizeof(req_txp_cp), &req_txp_cp);
5251                 }
5252
5253                 err = hci_req_run(&req, conn_info_refresh_complete);
5254                 if (err < 0)
5255                         goto unlock;
5256
5257                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5258                                        data, len);
5259                 if (!cmd) {
5260                         err = -ENOMEM;
5261                         goto unlock;
5262                 }
5263
5264                 hci_conn_hold(conn);
5265                 cmd->user_data = hci_conn_get(conn);
5266
5267                 conn->conn_info_timestamp = jiffies;
5268         } else {
5269                 /* Cache is valid, just reply with values cached in hci_conn */
5270                 rp.rssi = conn->rssi;
5271                 rp.tx_power = conn->tx_power;
5272                 rp.max_tx_power = conn->max_tx_power;
5273
5274                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5275                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5276         }
5277
5278 unlock:
5279         hci_dev_unlock(hdev);
5280         return err;
5281 }
5282
5283 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5284 {
5285         struct mgmt_cp_get_clock_info *cp;
5286         struct mgmt_rp_get_clock_info rp;
5287         struct hci_cp_read_clock *hci_cp;
5288         struct pending_cmd *cmd;
5289         struct hci_conn *conn;
5290
5291         BT_DBG("%s status %u", hdev->name, status);
5292
5293         hci_dev_lock(hdev);
5294
5295         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5296         if (!hci_cp)
5297                 goto unlock;
5298
5299         if (hci_cp->which) {
5300                 u16 handle = __le16_to_cpu(hci_cp->handle);
5301                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5302         } else {
5303                 conn = NULL;
5304         }
5305
5306         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5307         if (!cmd)
5308                 goto unlock;
5309
5310         cp = cmd->param;
5311
5312         memset(&rp, 0, sizeof(rp));
5313         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5314
5315         if (status)
5316                 goto send_rsp;
5317
5318         rp.local_clock = cpu_to_le32(hdev->clock);
5319
5320         if (conn) {
5321                 rp.piconet_clock = cpu_to_le32(conn->clock);
5322                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5323         }
5324
5325 send_rsp:
5326         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5327                      &rp, sizeof(rp));
5328         mgmt_pending_remove(cmd);
5329         if (conn) {
5330                 hci_conn_drop(conn);
5331                 hci_conn_put(conn);
5332         }
5333
5334 unlock:
5335         hci_dev_unlock(hdev);
5336 }
5337
5338 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5339                          u16 len)
5340 {
5341         struct mgmt_cp_get_clock_info *cp = data;
5342         struct mgmt_rp_get_clock_info rp;
5343         struct hci_cp_read_clock hci_cp;
5344         struct pending_cmd *cmd;
5345         struct hci_request req;
5346         struct hci_conn *conn;
5347         int err;
5348
5349         BT_DBG("%s", hdev->name);
5350
5351         memset(&rp, 0, sizeof(rp));
5352         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5353         rp.addr.type = cp->addr.type;
5354
5355         if (cp->addr.type != BDADDR_BREDR)
5356                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5357                                     MGMT_STATUS_INVALID_PARAMS,
5358                                     &rp, sizeof(rp));
5359
5360         hci_dev_lock(hdev);
5361
5362         if (!hdev_is_powered(hdev)) {
5363                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5364                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5365                 goto unlock;
5366         }
5367
5368         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5369                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5370                                                &cp->addr.bdaddr);
5371                 if (!conn || conn->state != BT_CONNECTED) {
5372                         err = cmd_complete(sk, hdev->id,
5373                                            MGMT_OP_GET_CLOCK_INFO,
5374                                            MGMT_STATUS_NOT_CONNECTED,
5375                                            &rp, sizeof(rp));
5376                         goto unlock;
5377                 }
5378         } else {
5379                 conn = NULL;
5380         }
5381
5382         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5383         if (!cmd) {
5384                 err = -ENOMEM;
5385                 goto unlock;
5386         }
5387
5388         hci_req_init(&req, hdev);
5389
5390         memset(&hci_cp, 0, sizeof(hci_cp));
5391         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5392
5393         if (conn) {
5394                 hci_conn_hold(conn);
5395                 cmd->user_data = hci_conn_get(conn);
5396
5397                 hci_cp.handle = cpu_to_le16(conn->handle);
5398                 hci_cp.which = 0x01; /* Piconet clock */
5399                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5400         }
5401
5402         err = hci_req_run(&req, get_clock_info_complete);
5403         if (err < 0)
5404                 mgmt_pending_remove(cmd);
5405
5406 unlock:
5407         hci_dev_unlock(hdev);
5408         return err;
5409 }
5410
5411 static void device_added(struct sock *sk, struct hci_dev *hdev,
5412                          bdaddr_t *bdaddr, u8 type, u8 action)
5413 {
5414         struct mgmt_ev_device_added ev;
5415
5416         bacpy(&ev.addr.bdaddr, bdaddr);
5417         ev.addr.type = type;
5418         ev.action = action;
5419
5420         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5421 }
5422
5423 static int add_device(struct sock *sk, struct hci_dev *hdev,
5424                       void *data, u16 len)
5425 {
5426         struct mgmt_cp_add_device *cp = data;
5427         u8 auto_conn, addr_type;
5428         int err;
5429
5430         BT_DBG("%s", hdev->name);
5431
5432         if (!bdaddr_type_is_valid(cp->addr.type) ||
5433             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5434                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5435                                     MGMT_STATUS_INVALID_PARAMS,
5436                                     &cp->addr, sizeof(cp->addr));
5437
5438         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5439                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5440                                     MGMT_STATUS_INVALID_PARAMS,
5441                                     &cp->addr, sizeof(cp->addr));
5442
5443         hci_dev_lock(hdev);
5444
5445         if (cp->addr.type == BDADDR_BREDR) {
5446                 /* Only incoming connections action is supported for now */
5447                 if (cp->action != 0x01) {
5448                         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5449                                            MGMT_STATUS_INVALID_PARAMS,
5450                                            &cp->addr, sizeof(cp->addr));
5451                         goto unlock;
5452                 }
5453
5454                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5455                                           cp->addr.type);
5456                 if (err)
5457                         goto unlock;
5458
5459                 hci_update_page_scan(hdev, NULL);
5460
5461                 goto added;
5462         }
5463
5464         if (cp->addr.type == BDADDR_LE_PUBLIC)
5465                 addr_type = ADDR_LE_DEV_PUBLIC;
5466         else
5467                 addr_type = ADDR_LE_DEV_RANDOM;
5468
5469         if (cp->action == 0x02)
5470                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5471         else if (cp->action == 0x01)
5472                 auto_conn = HCI_AUTO_CONN_DIRECT;
5473         else
5474                 auto_conn = HCI_AUTO_CONN_REPORT;
5475
5476         /* If the connection parameters don't exist for this device,
5477          * they will be created and configured with defaults.
5478          */
5479         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5480                                 auto_conn) < 0) {
5481                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5482                                    MGMT_STATUS_FAILED,
5483                                    &cp->addr, sizeof(cp->addr));
5484                 goto unlock;
5485         }
5486
5487 added:
5488         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5489
5490         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5491                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5492
5493 unlock:
5494         hci_dev_unlock(hdev);
5495         return err;
5496 }
5497
5498 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5499                            bdaddr_t *bdaddr, u8 type)
5500 {
5501         struct mgmt_ev_device_removed ev;
5502
5503         bacpy(&ev.addr.bdaddr, bdaddr);
5504         ev.addr.type = type;
5505
5506         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5507 }
5508
5509 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5510                          void *data, u16 len)
5511 {
5512         struct mgmt_cp_remove_device *cp = data;
5513         int err;
5514
5515         BT_DBG("%s", hdev->name);
5516
5517         hci_dev_lock(hdev);
5518
5519         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5520                 struct hci_conn_params *params;
5521                 u8 addr_type;
5522
5523                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5524                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5525                                            MGMT_STATUS_INVALID_PARAMS,
5526                                            &cp->addr, sizeof(cp->addr));
5527                         goto unlock;
5528                 }
5529
5530                 if (cp->addr.type == BDADDR_BREDR) {
5531                         err = hci_bdaddr_list_del(&hdev->whitelist,
5532                                                   &cp->addr.bdaddr,
5533                                                   cp->addr.type);
5534                         if (err) {
5535                                 err = cmd_complete(sk, hdev->id,
5536                                                    MGMT_OP_REMOVE_DEVICE,
5537                                                    MGMT_STATUS_INVALID_PARAMS,
5538                                                    &cp->addr, sizeof(cp->addr));
5539                                 goto unlock;
5540                         }
5541
5542                         hci_update_page_scan(hdev, NULL);
5543
5544                         device_removed(sk, hdev, &cp->addr.bdaddr,
5545                                        cp->addr.type);
5546                         goto complete;
5547                 }
5548
5549                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5550                         addr_type = ADDR_LE_DEV_PUBLIC;
5551                 else
5552                         addr_type = ADDR_LE_DEV_RANDOM;
5553
5554                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5555                                                 addr_type);
5556                 if (!params) {
5557                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5558                                            MGMT_STATUS_INVALID_PARAMS,
5559                                            &cp->addr, sizeof(cp->addr));
5560                         goto unlock;
5561                 }
5562
5563                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5564                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5565                                            MGMT_STATUS_INVALID_PARAMS,
5566                                            &cp->addr, sizeof(cp->addr));
5567                         goto unlock;
5568                 }
5569
5570                 list_del(&params->action);
5571                 list_del(&params->list);
5572                 kfree(params);
5573                 hci_update_background_scan(hdev);
5574
5575                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5576         } else {
5577                 struct hci_conn_params *p, *tmp;
5578                 struct bdaddr_list *b, *btmp;
5579
5580                 if (cp->addr.type) {
5581                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5582                                            MGMT_STATUS_INVALID_PARAMS,
5583                                            &cp->addr, sizeof(cp->addr));
5584                         goto unlock;
5585                 }
5586
5587                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5588                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5589                         list_del(&b->list);
5590                         kfree(b);
5591                 }
5592
5593                 hci_update_page_scan(hdev, NULL);
5594
5595                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5596                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5597                                 continue;
5598                         device_removed(sk, hdev, &p->addr, p->addr_type);
5599                         list_del(&p->action);
5600                         list_del(&p->list);
5601                         kfree(p);
5602                 }
5603
5604                 BT_DBG("All LE connection parameters were removed");
5605
5606                 hci_update_background_scan(hdev);
5607         }
5608
5609 complete:
5610         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5611                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5612
5613 unlock:
5614         hci_dev_unlock(hdev);
5615         return err;
5616 }
5617
5618 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5619                            u16 len)
5620 {
5621         struct mgmt_cp_load_conn_param *cp = data;
5622         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5623                                      sizeof(struct mgmt_conn_param));
5624         u16 param_count, expected_len;
5625         int i;
5626
5627         if (!lmp_le_capable(hdev))
5628                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5629                                   MGMT_STATUS_NOT_SUPPORTED);
5630
5631         param_count = __le16_to_cpu(cp->param_count);
5632         if (param_count > max_param_count) {
5633                 BT_ERR("load_conn_param: too big param_count value %u",
5634                        param_count);
5635                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5636                                   MGMT_STATUS_INVALID_PARAMS);
5637         }
5638
5639         expected_len = sizeof(*cp) + param_count *
5640                                         sizeof(struct mgmt_conn_param);
5641         if (expected_len != len) {
5642                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5643                        expected_len, len);
5644                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5645                                   MGMT_STATUS_INVALID_PARAMS);
5646         }
5647
5648         BT_DBG("%s param_count %u", hdev->name, param_count);
5649
5650         hci_dev_lock(hdev);
5651
5652         hci_conn_params_clear_disabled(hdev);
5653
5654         for (i = 0; i < param_count; i++) {
5655                 struct mgmt_conn_param *param = &cp->params[i];
5656                 struct hci_conn_params *hci_param;
5657                 u16 min, max, latency, timeout;
5658                 u8 addr_type;
5659
5660                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5661                        param->addr.type);
5662
5663                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5664                         addr_type = ADDR_LE_DEV_PUBLIC;
5665                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5666                         addr_type = ADDR_LE_DEV_RANDOM;
5667                 } else {
5668                         BT_ERR("Ignoring invalid connection parameters");
5669                         continue;
5670                 }
5671
5672                 min = le16_to_cpu(param->min_interval);
5673                 max = le16_to_cpu(param->max_interval);
5674                 latency = le16_to_cpu(param->latency);
5675                 timeout = le16_to_cpu(param->timeout);
5676
5677                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5678                        min, max, latency, timeout);
5679
5680                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5681                         BT_ERR("Ignoring invalid connection parameters");
5682                         continue;
5683                 }
5684
5685                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5686                                                 addr_type);
5687                 if (!hci_param) {
5688                         BT_ERR("Failed to add connection parameters");
5689                         continue;
5690                 }
5691
5692                 hci_param->conn_min_interval = min;
5693                 hci_param->conn_max_interval = max;
5694                 hci_param->conn_latency = latency;
5695                 hci_param->supervision_timeout = timeout;
5696         }
5697
5698         hci_dev_unlock(hdev);
5699
5700         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5701 }
5702
5703 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5704                                void *data, u16 len)
5705 {
5706         struct mgmt_cp_set_external_config *cp = data;
5707         bool changed;
5708         int err;
5709
5710         BT_DBG("%s", hdev->name);
5711
5712         if (hdev_is_powered(hdev))
5713                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5714                                   MGMT_STATUS_REJECTED);
5715
5716         if (cp->config != 0x00 && cp->config != 0x01)
5717                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5718                                     MGMT_STATUS_INVALID_PARAMS);
5719
5720         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5721                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5722                                   MGMT_STATUS_NOT_SUPPORTED);
5723
5724         hci_dev_lock(hdev);
5725
5726         if (cp->config)
5727                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5728                                             &hdev->dev_flags);
5729         else
5730                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5731                                              &hdev->dev_flags);
5732
5733         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5734         if (err < 0)
5735                 goto unlock;
5736
5737         if (!changed)
5738                 goto unlock;
5739
5740         err = new_options(hdev, sk);
5741
5742         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5743                 mgmt_index_removed(hdev);
5744
5745                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5746                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5747                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5748
5749                         queue_work(hdev->req_workqueue, &hdev->power_on);
5750                 } else {
5751                         set_bit(HCI_RAW, &hdev->flags);
5752                         mgmt_index_added(hdev);
5753                 }
5754         }
5755
5756 unlock:
5757         hci_dev_unlock(hdev);
5758         return err;
5759 }
5760
5761 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5762                               void *data, u16 len)
5763 {
5764         struct mgmt_cp_set_public_address *cp = data;
5765         bool changed;
5766         int err;
5767
5768         BT_DBG("%s", hdev->name);
5769
5770         if (hdev_is_powered(hdev))
5771                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5772                                   MGMT_STATUS_REJECTED);
5773
5774         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5775                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5776                                   MGMT_STATUS_INVALID_PARAMS);
5777
5778         if (!hdev->set_bdaddr)
5779                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5780                                   MGMT_STATUS_NOT_SUPPORTED);
5781
5782         hci_dev_lock(hdev);
5783
5784         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5785         bacpy(&hdev->public_addr, &cp->bdaddr);
5786
5787         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5788         if (err < 0)
5789                 goto unlock;
5790
5791         if (!changed)
5792                 goto unlock;
5793
5794         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5795                 err = new_options(hdev, sk);
5796
5797         if (is_configured(hdev)) {
5798                 mgmt_index_removed(hdev);
5799
5800                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5801
5802                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5803                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5804
5805                 queue_work(hdev->req_workqueue, &hdev->power_on);
5806         }
5807
5808 unlock:
5809         hci_dev_unlock(hdev);
5810         return err;
5811 }
5812
5813 static const struct mgmt_handler {
5814         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5815                      u16 data_len);
5816         bool var_len;
5817         size_t data_len;
5818 } mgmt_handlers[] = {
5819         { NULL }, /* 0x0000 (no command) */
5820         { read_version,           false, MGMT_READ_VERSION_SIZE },
5821         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5822         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5823         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5824         { set_powered,            false, MGMT_SETTING_SIZE },
5825         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5826         { set_connectable,        false, MGMT_SETTING_SIZE },
5827         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5828         { set_bondable,           false, MGMT_SETTING_SIZE },
5829         { set_link_security,      false, MGMT_SETTING_SIZE },
5830         { set_ssp,                false, MGMT_SETTING_SIZE },
5831         { set_hs,                 false, MGMT_SETTING_SIZE },
5832         { set_le,                 false, MGMT_SETTING_SIZE },
5833         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5834         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5835         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5836         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5837         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5838         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5839         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5840         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5841         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5842         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5843         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5844         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5845         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5846         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5847         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5848         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5849         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5850         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5851         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5852         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5853         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5854         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5855         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5856         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5857         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5858         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5859         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5860         { set_advertising,        false, MGMT_SETTING_SIZE },
5861         { set_bredr,              false, MGMT_SETTING_SIZE },
5862         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5863         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5864         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5865         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5866         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5867         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5868         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5869         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5870         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5871         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5872         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5873         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5874         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5875         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5876         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5877         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
5878 };
5879
5880 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5881 {
5882         void *buf;
5883         u8 *cp;
5884         struct mgmt_hdr *hdr;
5885         u16 opcode, index, len;
5886         struct hci_dev *hdev = NULL;
5887         const struct mgmt_handler *handler;
5888         int err;
5889
5890         BT_DBG("got %zu bytes", msglen);
5891
5892         if (msglen < sizeof(*hdr))
5893                 return -EINVAL;
5894
5895         buf = kmalloc(msglen, GFP_KERNEL);
5896         if (!buf)
5897                 return -ENOMEM;
5898
5899         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5900                 err = -EFAULT;
5901                 goto done;
5902         }
5903
5904         hdr = buf;
5905         opcode = __le16_to_cpu(hdr->opcode);
5906         index = __le16_to_cpu(hdr->index);
5907         len = __le16_to_cpu(hdr->len);
5908
5909         if (len != msglen - sizeof(*hdr)) {
5910                 err = -EINVAL;
5911                 goto done;
5912         }
5913
5914         if (index != MGMT_INDEX_NONE) {
5915                 hdev = hci_dev_get(index);
5916                 if (!hdev) {
5917                         err = cmd_status(sk, index, opcode,
5918                                          MGMT_STATUS_INVALID_INDEX);
5919                         goto done;
5920                 }
5921
5922                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5923                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5924                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5925                         err = cmd_status(sk, index, opcode,
5926                                          MGMT_STATUS_INVALID_INDEX);
5927                         goto done;
5928                 }
5929
5930                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5931                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5932                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5933                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5934                         err = cmd_status(sk, index, opcode,
5935                                          MGMT_STATUS_INVALID_INDEX);
5936                         goto done;
5937                 }
5938         }
5939
5940         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5941             mgmt_handlers[opcode].func == NULL) {
5942                 BT_DBG("Unknown op %u", opcode);
5943                 err = cmd_status(sk, index, opcode,
5944                                  MGMT_STATUS_UNKNOWN_COMMAND);
5945                 goto done;
5946         }
5947
5948         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5949                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5950                 err = cmd_status(sk, index, opcode,
5951                                  MGMT_STATUS_INVALID_INDEX);
5952                 goto done;
5953         }
5954
5955         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5956                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5957                 err = cmd_status(sk, index, opcode,
5958                                  MGMT_STATUS_INVALID_INDEX);
5959                 goto done;
5960         }
5961
5962         handler = &mgmt_handlers[opcode];
5963
5964         if ((handler->var_len && len < handler->data_len) ||
5965             (!handler->var_len && len != handler->data_len)) {
5966                 err = cmd_status(sk, index, opcode,
5967                                  MGMT_STATUS_INVALID_PARAMS);
5968                 goto done;
5969         }
5970
5971         if (hdev)
5972                 mgmt_init_hdev(sk, hdev);
5973
5974         cp = buf + sizeof(*hdr);
5975
5976         err = handler->func(sk, hdev, cp, len);
5977         if (err < 0)
5978                 goto done;
5979
5980         err = msglen;
5981
5982 done:
5983         if (hdev)
5984                 hci_dev_put(hdev);
5985
5986         kfree(buf);
5987         return err;
5988 }
5989
5990 void mgmt_index_added(struct hci_dev *hdev)
5991 {
5992         if (hdev->dev_type != HCI_BREDR)
5993                 return;
5994
5995         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5996                 return;
5997
5998         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5999                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6000         else
6001                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6002 }
6003
6004 void mgmt_index_removed(struct hci_dev *hdev)
6005 {
6006         u8 status = MGMT_STATUS_INVALID_INDEX;
6007
6008         if (hdev->dev_type != HCI_BREDR)
6009                 return;
6010
6011         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6012                 return;
6013
6014         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6015
6016         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6017                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6018         else
6019                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6020 }
6021
6022 /* This function requires the caller holds hdev->lock */
6023 static void restart_le_actions(struct hci_dev *hdev)
6024 {
6025         struct hci_conn_params *p;
6026
6027         list_for_each_entry(p, &hdev->le_conn_params, list) {
6028                 /* Needed for AUTO_OFF case where might not "really"
6029                  * have been powered off.
6030                  */
6031                 list_del_init(&p->action);
6032
6033                 switch (p->auto_connect) {
6034                 case HCI_AUTO_CONN_DIRECT:
6035                 case HCI_AUTO_CONN_ALWAYS:
6036                         list_add(&p->action, &hdev->pend_le_conns);
6037                         break;
6038                 case HCI_AUTO_CONN_REPORT:
6039                         list_add(&p->action, &hdev->pend_le_reports);
6040                         break;
6041                 default:
6042                         break;
6043                 }
6044         }
6045
6046         hci_update_background_scan(hdev);
6047 }
6048
6049 static void powered_complete(struct hci_dev *hdev, u8 status)
6050 {
6051         struct cmd_lookup match = { NULL, hdev };
6052
6053         BT_DBG("status 0x%02x", status);
6054
6055         hci_dev_lock(hdev);
6056
6057         restart_le_actions(hdev);
6058
6059         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6060
6061         new_settings(hdev, match.sk);
6062
6063         hci_dev_unlock(hdev);
6064
6065         if (match.sk)
6066                 sock_put(match.sk);
6067 }
6068
6069 static int powered_update_hci(struct hci_dev *hdev)
6070 {
6071         struct hci_request req;
6072         u8 link_sec;
6073
6074         hci_req_init(&req, hdev);
6075
6076         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6077             !lmp_host_ssp_capable(hdev)) {
6078                 u8 ssp = 1;
6079
6080                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
6081         }
6082
6083         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6084             lmp_bredr_capable(hdev)) {
6085                 struct hci_cp_write_le_host_supported cp;
6086
6087                 cp.le = 0x01;
6088                 cp.simul = 0x00;
6089
6090                 /* Check first if we already have the right
6091                  * host state (host features set)
6092                  */
6093                 if (cp.le != lmp_host_le_capable(hdev) ||
6094                     cp.simul != lmp_host_le_br_capable(hdev))
6095                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6096                                     sizeof(cp), &cp);
6097         }
6098
6099         if (lmp_le_capable(hdev)) {
6100                 /* Make sure the controller has a good default for
6101                  * advertising data. This also applies to the case
6102                  * where BR/EDR was toggled during the AUTO_OFF phase.
6103                  */
6104                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6105                         update_adv_data(&req);
6106                         update_scan_rsp_data(&req);
6107                 }
6108
6109                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6110                         enable_advertising(&req);
6111         }
6112
6113         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6114         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6115                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6116                             sizeof(link_sec), &link_sec);
6117
6118         if (lmp_bredr_capable(hdev)) {
6119                 write_fast_connectable(&req, false);
6120                 hci_update_page_scan(hdev, &req);
6121                 update_class(&req);
6122                 update_name(&req);
6123                 update_eir(&req);
6124         }
6125
6126         return hci_req_run(&req, powered_complete);
6127 }
6128
6129 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6130 {
6131         struct cmd_lookup match = { NULL, hdev };
6132         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
6133         u8 zero_cod[] = { 0, 0, 0 };
6134         int err;
6135
6136         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6137                 return 0;
6138
6139         if (powered) {
6140                 if (powered_update_hci(hdev) == 0)
6141                         return 0;
6142
6143                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6144                                      &match);
6145                 goto new_settings;
6146         }
6147
6148         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6149         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status_not_powered);
6150
6151         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6152                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6153                            zero_cod, sizeof(zero_cod), NULL);
6154
6155 new_settings:
6156         err = new_settings(hdev, match.sk);
6157
6158         if (match.sk)
6159                 sock_put(match.sk);
6160
6161         return err;
6162 }
6163
6164 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6165 {
6166         struct pending_cmd *cmd;
6167         u8 status;
6168
6169         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6170         if (!cmd)
6171                 return;
6172
6173         if (err == -ERFKILL)
6174                 status = MGMT_STATUS_RFKILLED;
6175         else
6176                 status = MGMT_STATUS_FAILED;
6177
6178         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6179
6180         mgmt_pending_remove(cmd);
6181 }
6182
6183 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6184 {
6185         struct hci_request req;
6186
6187         hci_dev_lock(hdev);
6188
6189         /* When discoverable timeout triggers, then just make sure
6190          * the limited discoverable flag is cleared. Even in the case
6191          * of a timeout triggered from general discoverable, it is
6192          * safe to unconditionally clear the flag.
6193          */
6194         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6195         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6196
6197         hci_req_init(&req, hdev);
6198         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6199                 u8 scan = SCAN_PAGE;
6200                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6201                             sizeof(scan), &scan);
6202         }
6203         update_class(&req);
6204         update_adv_data(&req);
6205         hci_req_run(&req, NULL);
6206
6207         hdev->discov_timeout = 0;
6208
6209         new_settings(hdev, NULL);
6210
6211         hci_dev_unlock(hdev);
6212 }
6213
6214 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6215                        bool persistent)
6216 {
6217         struct mgmt_ev_new_link_key ev;
6218
6219         memset(&ev, 0, sizeof(ev));
6220
6221         ev.store_hint = persistent;
6222         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6223         ev.key.addr.type = BDADDR_BREDR;
6224         ev.key.type = key->type;
6225         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6226         ev.key.pin_len = key->pin_len;
6227
6228         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6229 }
6230
6231 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6232 {
6233         switch (ltk->type) {
6234         case SMP_LTK:
6235         case SMP_LTK_SLAVE:
6236                 if (ltk->authenticated)
6237                         return MGMT_LTK_AUTHENTICATED;
6238                 return MGMT_LTK_UNAUTHENTICATED;
6239         case SMP_LTK_P256:
6240                 if (ltk->authenticated)
6241                         return MGMT_LTK_P256_AUTH;
6242                 return MGMT_LTK_P256_UNAUTH;
6243         case SMP_LTK_P256_DEBUG:
6244                 return MGMT_LTK_P256_DEBUG;
6245         }
6246
6247         return MGMT_LTK_UNAUTHENTICATED;
6248 }
6249
6250 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6251 {
6252         struct mgmt_ev_new_long_term_key ev;
6253
6254         memset(&ev, 0, sizeof(ev));
6255
6256         /* Devices using resolvable or non-resolvable random addresses
6257          * without providing an indentity resolving key don't require
6258          * to store long term keys. Their addresses will change the
6259          * next time around.
6260          *
6261          * Only when a remote device provides an identity address
6262          * make sure the long term key is stored. If the remote
6263          * identity is known, the long term keys are internally
6264          * mapped to the identity address. So allow static random
6265          * and public addresses here.
6266          */
6267         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6268             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6269                 ev.store_hint = 0x00;
6270         else
6271                 ev.store_hint = persistent;
6272
6273         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6274         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6275         ev.key.type = mgmt_ltk_type(key);
6276         ev.key.enc_size = key->enc_size;
6277         ev.key.ediv = key->ediv;
6278         ev.key.rand = key->rand;
6279
6280         if (key->type == SMP_LTK)
6281                 ev.key.master = 1;
6282
6283         memcpy(ev.key.val, key->val, sizeof(key->val));
6284
6285         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6286 }
6287
6288 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6289 {
6290         struct mgmt_ev_new_irk ev;
6291
6292         memset(&ev, 0, sizeof(ev));
6293
6294         /* For identity resolving keys from devices that are already
6295          * using a public address or static random address, do not
6296          * ask for storing this key. The identity resolving key really
6297          * is only mandatory for devices using resovlable random
6298          * addresses.
6299          *
6300          * Storing all identity resolving keys has the downside that
6301          * they will be also loaded on next boot of they system. More
6302          * identity resolving keys, means more time during scanning is
6303          * needed to actually resolve these addresses.
6304          */
6305         if (bacmp(&irk->rpa, BDADDR_ANY))
6306                 ev.store_hint = 0x01;
6307         else
6308                 ev.store_hint = 0x00;
6309
6310         bacpy(&ev.rpa, &irk->rpa);
6311         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6312         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6313         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6314
6315         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6316 }
6317
6318 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6319                    bool persistent)
6320 {
6321         struct mgmt_ev_new_csrk ev;
6322
6323         memset(&ev, 0, sizeof(ev));
6324
6325         /* Devices using resolvable or non-resolvable random addresses
6326          * without providing an indentity resolving key don't require
6327          * to store signature resolving keys. Their addresses will change
6328          * the next time around.
6329          *
6330          * Only when a remote device provides an identity address
6331          * make sure the signature resolving key is stored. So allow
6332          * static random and public addresses here.
6333          */
6334         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6335             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6336                 ev.store_hint = 0x00;
6337         else
6338                 ev.store_hint = persistent;
6339
6340         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6341         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6342         ev.key.master = csrk->master;
6343         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6344
6345         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6346 }
6347
6348 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6349                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6350                          u16 max_interval, u16 latency, u16 timeout)
6351 {
6352         struct mgmt_ev_new_conn_param ev;
6353
6354         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6355                 return;
6356
6357         memset(&ev, 0, sizeof(ev));
6358         bacpy(&ev.addr.bdaddr, bdaddr);
6359         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6360         ev.store_hint = store_hint;
6361         ev.min_interval = cpu_to_le16(min_interval);
6362         ev.max_interval = cpu_to_le16(max_interval);
6363         ev.latency = cpu_to_le16(latency);
6364         ev.timeout = cpu_to_le16(timeout);
6365
6366         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6367 }
6368
6369 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6370                                   u8 data_len)
6371 {
6372         eir[eir_len++] = sizeof(type) + data_len;
6373         eir[eir_len++] = type;
6374         memcpy(&eir[eir_len], data, data_len);
6375         eir_len += data_len;
6376
6377         return eir_len;
6378 }
6379
6380 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6381                            u32 flags, u8 *name, u8 name_len)
6382 {
6383         char buf[512];
6384         struct mgmt_ev_device_connected *ev = (void *) buf;
6385         u16 eir_len = 0;
6386
6387         bacpy(&ev->addr.bdaddr, &conn->dst);
6388         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6389
6390         ev->flags = __cpu_to_le32(flags);
6391
6392         /* We must ensure that the EIR Data fields are ordered and
6393          * unique. Keep it simple for now and avoid the problem by not
6394          * adding any BR/EDR data to the LE adv.
6395          */
6396         if (conn->le_adv_data_len > 0) {
6397                 memcpy(&ev->eir[eir_len],
6398                        conn->le_adv_data, conn->le_adv_data_len);
6399                 eir_len = conn->le_adv_data_len;
6400         } else {
6401                 if (name_len > 0)
6402                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6403                                                   name, name_len);
6404
6405                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6406                         eir_len = eir_append_data(ev->eir, eir_len,
6407                                                   EIR_CLASS_OF_DEV,
6408                                                   conn->dev_class, 3);
6409         }
6410
6411         ev->eir_len = cpu_to_le16(eir_len);
6412
6413         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6414                     sizeof(*ev) + eir_len, NULL);
6415 }
6416
6417 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6418 {
6419         struct sock **sk = data;
6420
6421         cmd->cmd_complete(cmd, 0);
6422
6423         *sk = cmd->sk;
6424         sock_hold(*sk);
6425
6426         mgmt_pending_remove(cmd);
6427 }
6428
6429 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6430 {
6431         struct hci_dev *hdev = data;
6432         struct mgmt_cp_unpair_device *cp = cmd->param;
6433         struct mgmt_rp_unpair_device rp;
6434
6435         memset(&rp, 0, sizeof(rp));
6436         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6437         rp.addr.type = cp->addr.type;
6438
6439         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6440
6441         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6442
6443         mgmt_pending_remove(cmd);
6444 }
6445
6446 bool mgmt_powering_down(struct hci_dev *hdev)
6447 {
6448         struct pending_cmd *cmd;
6449         struct mgmt_mode *cp;
6450
6451         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6452         if (!cmd)
6453                 return false;
6454
6455         cp = cmd->param;
6456         if (!cp->val)
6457                 return true;
6458
6459         return false;
6460 }
6461
6462 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6463                               u8 link_type, u8 addr_type, u8 reason,
6464                               bool mgmt_connected)
6465 {
6466         struct mgmt_ev_device_disconnected ev;
6467         struct sock *sk = NULL;
6468
6469         /* The connection is still in hci_conn_hash so test for 1
6470          * instead of 0 to know if this is the last one.
6471          */
6472         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6473                 cancel_delayed_work(&hdev->power_off);
6474                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6475         }
6476
6477         if (!mgmt_connected)
6478                 return;
6479
6480         if (link_type != ACL_LINK && link_type != LE_LINK)
6481                 return;
6482
6483         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6484
6485         bacpy(&ev.addr.bdaddr, bdaddr);
6486         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6487         ev.reason = reason;
6488
6489         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6490
6491         if (sk)
6492                 sock_put(sk);
6493
6494         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6495                              hdev);
6496 }
6497
6498 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6499                             u8 link_type, u8 addr_type, u8 status)
6500 {
6501         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6502         struct mgmt_cp_disconnect *cp;
6503         struct pending_cmd *cmd;
6504
6505         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6506                              hdev);
6507
6508         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6509         if (!cmd)
6510                 return;
6511
6512         cp = cmd->param;
6513
6514         if (bacmp(bdaddr, &cp->addr.bdaddr))
6515                 return;
6516
6517         if (cp->addr.type != bdaddr_type)
6518                 return;
6519
6520         cmd->cmd_complete(cmd, mgmt_status(status));
6521         mgmt_pending_remove(cmd);
6522 }
6523
6524 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6525                          u8 addr_type, u8 status)
6526 {
6527         struct mgmt_ev_connect_failed ev;
6528
6529         /* The connection is still in hci_conn_hash so test for 1
6530          * instead of 0 to know if this is the last one.
6531          */
6532         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6533                 cancel_delayed_work(&hdev->power_off);
6534                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6535         }
6536
6537         bacpy(&ev.addr.bdaddr, bdaddr);
6538         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6539         ev.status = mgmt_status(status);
6540
6541         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6542 }
6543
6544 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6545 {
6546         struct mgmt_ev_pin_code_request ev;
6547
6548         bacpy(&ev.addr.bdaddr, bdaddr);
6549         ev.addr.type = BDADDR_BREDR;
6550         ev.secure = secure;
6551
6552         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6553 }
6554
6555 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6556                                   u8 status)
6557 {
6558         struct pending_cmd *cmd;
6559
6560         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6561         if (!cmd)
6562                 return;
6563
6564         cmd->cmd_complete(cmd, mgmt_status(status));
6565         mgmt_pending_remove(cmd);
6566 }
6567
6568 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6569                                       u8 status)
6570 {
6571         struct pending_cmd *cmd;
6572
6573         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6574         if (!cmd)
6575                 return;
6576
6577         cmd->cmd_complete(cmd, mgmt_status(status));
6578         mgmt_pending_remove(cmd);
6579 }
6580
6581 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6582                               u8 link_type, u8 addr_type, u32 value,
6583                               u8 confirm_hint)
6584 {
6585         struct mgmt_ev_user_confirm_request ev;
6586
6587         BT_DBG("%s", hdev->name);
6588
6589         bacpy(&ev.addr.bdaddr, bdaddr);
6590         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6591         ev.confirm_hint = confirm_hint;
6592         ev.value = cpu_to_le32(value);
6593
6594         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6595                           NULL);
6596 }
6597
6598 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6599                               u8 link_type, u8 addr_type)
6600 {
6601         struct mgmt_ev_user_passkey_request ev;
6602
6603         BT_DBG("%s", hdev->name);
6604
6605         bacpy(&ev.addr.bdaddr, bdaddr);
6606         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6607
6608         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6609                           NULL);
6610 }
6611
6612 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6613                                       u8 link_type, u8 addr_type, u8 status,
6614                                       u8 opcode)
6615 {
6616         struct pending_cmd *cmd;
6617
6618         cmd = mgmt_pending_find(opcode, hdev);
6619         if (!cmd)
6620                 return -ENOENT;
6621
6622         cmd->cmd_complete(cmd, mgmt_status(status));
6623         mgmt_pending_remove(cmd);
6624
6625         return 0;
6626 }
6627
6628 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6629                                      u8 link_type, u8 addr_type, u8 status)
6630 {
6631         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6632                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6633 }
6634
6635 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6636                                          u8 link_type, u8 addr_type, u8 status)
6637 {
6638         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6639                                           status,
6640                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6641 }
6642
6643 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6644                                      u8 link_type, u8 addr_type, u8 status)
6645 {
6646         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6647                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6648 }
6649
6650 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6651                                          u8 link_type, u8 addr_type, u8 status)
6652 {
6653         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6654                                           status,
6655                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6656 }
6657
6658 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6659                              u8 link_type, u8 addr_type, u32 passkey,
6660                              u8 entered)
6661 {
6662         struct mgmt_ev_passkey_notify ev;
6663
6664         BT_DBG("%s", hdev->name);
6665
6666         bacpy(&ev.addr.bdaddr, bdaddr);
6667         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6668         ev.passkey = __cpu_to_le32(passkey);
6669         ev.entered = entered;
6670
6671         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6672 }
6673
6674 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6675 {
6676         struct mgmt_ev_auth_failed ev;
6677         struct pending_cmd *cmd;
6678         u8 status = mgmt_status(hci_status);
6679
6680         bacpy(&ev.addr.bdaddr, &conn->dst);
6681         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6682         ev.status = status;
6683
6684         cmd = find_pairing(conn);
6685
6686         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6687                     cmd ? cmd->sk : NULL);
6688
6689         if (cmd)
6690                 pairing_complete(cmd, status);
6691 }
6692
6693 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6694 {
6695         struct cmd_lookup match = { NULL, hdev };
6696         bool changed;
6697
6698         if (status) {
6699                 u8 mgmt_err = mgmt_status(status);
6700                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6701                                      cmd_status_rsp, &mgmt_err);
6702                 return;
6703         }
6704
6705         if (test_bit(HCI_AUTH, &hdev->flags))
6706                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6707                                             &hdev->dev_flags);
6708         else
6709                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6710                                              &hdev->dev_flags);
6711
6712         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6713                              &match);
6714
6715         if (changed)
6716                 new_settings(hdev, match.sk);
6717
6718         if (match.sk)
6719                 sock_put(match.sk);
6720 }
6721
6722 static void clear_eir(struct hci_request *req)
6723 {
6724         struct hci_dev *hdev = req->hdev;
6725         struct hci_cp_write_eir cp;
6726
6727         if (!lmp_ext_inq_capable(hdev))
6728                 return;
6729
6730         memset(hdev->eir, 0, sizeof(hdev->eir));
6731
6732         memset(&cp, 0, sizeof(cp));
6733
6734         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6735 }
6736
6737 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6738 {
6739         struct cmd_lookup match = { NULL, hdev };
6740         struct hci_request req;
6741         bool changed = false;
6742
6743         if (status) {
6744                 u8 mgmt_err = mgmt_status(status);
6745
6746                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6747                                                  &hdev->dev_flags)) {
6748                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6749                         new_settings(hdev, NULL);
6750                 }
6751
6752                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6753                                      &mgmt_err);
6754                 return;
6755         }
6756
6757         if (enable) {
6758                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6759         } else {
6760                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6761                 if (!changed)
6762                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6763                                                      &hdev->dev_flags);
6764                 else
6765                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6766         }
6767
6768         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6769
6770         if (changed)
6771                 new_settings(hdev, match.sk);
6772
6773         if (match.sk)
6774                 sock_put(match.sk);
6775
6776         hci_req_init(&req, hdev);
6777
6778         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6779                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6780                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6781                                     sizeof(enable), &enable);
6782                 update_eir(&req);
6783         } else {
6784                 clear_eir(&req);
6785         }
6786
6787         hci_req_run(&req, NULL);
6788 }
6789
6790 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6791 {
6792         struct cmd_lookup match = { NULL, hdev };
6793         bool changed = false;
6794
6795         if (status) {
6796                 u8 mgmt_err = mgmt_status(status);
6797
6798                 if (enable) {
6799                         if (test_and_clear_bit(HCI_SC_ENABLED,
6800                                                &hdev->dev_flags))
6801                                 new_settings(hdev, NULL);
6802                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6803                 }
6804
6805                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6806                                      cmd_status_rsp, &mgmt_err);
6807                 return;
6808         }
6809
6810         if (enable) {
6811                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6812         } else {
6813                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6814                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6815         }
6816
6817         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6818                              settings_rsp, &match);
6819
6820         if (changed)
6821                 new_settings(hdev, match.sk);
6822
6823         if (match.sk)
6824                 sock_put(match.sk);
6825 }
6826
6827 static void sk_lookup(struct pending_cmd *cmd, void *data)
6828 {
6829         struct cmd_lookup *match = data;
6830
6831         if (match->sk == NULL) {
6832                 match->sk = cmd->sk;
6833                 sock_hold(match->sk);
6834         }
6835 }
6836
6837 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6838                                     u8 status)
6839 {
6840         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6841
6842         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6843         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6844         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6845
6846         if (!status)
6847                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6848                            NULL);
6849
6850         if (match.sk)
6851                 sock_put(match.sk);
6852 }
6853
6854 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6855 {
6856         struct mgmt_cp_set_local_name ev;
6857         struct pending_cmd *cmd;
6858
6859         if (status)
6860                 return;
6861
6862         memset(&ev, 0, sizeof(ev));
6863         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6864         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6865
6866         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6867         if (!cmd) {
6868                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6869
6870                 /* If this is a HCI command related to powering on the
6871                  * HCI dev don't send any mgmt signals.
6872                  */
6873                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6874                         return;
6875         }
6876
6877         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6878                    cmd ? cmd->sk : NULL);
6879 }
6880
6881 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6882                                        u8 *rand192, u8 *hash256, u8 *rand256,
6883                                        u8 status)
6884 {
6885         struct pending_cmd *cmd;
6886
6887         BT_DBG("%s status %u", hdev->name, status);
6888
6889         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6890         if (!cmd)
6891                 return;
6892
6893         if (status) {
6894                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6895                            mgmt_status(status));
6896         } else {
6897                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
6898                         struct mgmt_rp_read_local_oob_ext_data rp;
6899
6900                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6901                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
6902
6903                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6904                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
6905
6906                         cmd_complete(cmd->sk, hdev->id,
6907                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6908                                      &rp, sizeof(rp));
6909                 } else {
6910                         struct mgmt_rp_read_local_oob_data rp;
6911
6912                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6913                         memcpy(rp.rand, rand192, sizeof(rp.rand));
6914
6915                         cmd_complete(cmd->sk, hdev->id,
6916                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6917                                      &rp, sizeof(rp));
6918                 }
6919         }
6920
6921         mgmt_pending_remove(cmd);
6922 }
6923
6924 /* this is reversed hex representation of bluetooth base uuid. We need it for
6925  * service uuid parsing in eir.
6926  */
6927 static const u8 reverse_base_uuid[] = {
6928                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
6929                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
6930 };
6931
6932 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
6933 {
6934         int i;
6935
6936         for (i = 0; i < uuid_count; i++) {
6937                 if (!memcmp(uuid, uuids[i], 16))
6938                         return true;
6939         }
6940
6941         return false;
6942 }
6943
6944 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
6945 {
6946         u16 parsed = 0;
6947
6948         while (parsed < eir_len) {
6949                 u8 field_len = eir[0];
6950                 u8 uuid[16];
6951                 int i;
6952
6953                 if (field_len == 0)
6954                         break;
6955
6956                 if (eir_len - parsed < field_len + 1)
6957                         break;
6958
6959                 switch (eir[1]) {
6960                 case EIR_UUID16_ALL:
6961                 case EIR_UUID16_SOME:
6962                         for (i = 0; i + 3 <= field_len; i += 2) {
6963                                 memcpy(uuid, reverse_base_uuid, 16);
6964                                 uuid[13] = eir[i + 3];
6965                                 uuid[12] = eir[i + 2];
6966                                 if (has_uuid(uuid, uuid_count, uuids))
6967                                         return true;
6968                         }
6969                         break;
6970                 case EIR_UUID32_ALL:
6971                 case EIR_UUID32_SOME:
6972                         for (i = 0; i + 5 <= field_len; i += 4) {
6973                                 memcpy(uuid, reverse_base_uuid, 16);
6974                                 uuid[15] = eir[i + 5];
6975                                 uuid[14] = eir[i + 4];
6976                                 uuid[13] = eir[i + 3];
6977                                 uuid[12] = eir[i + 2];
6978                                 if (has_uuid(uuid, uuid_count, uuids))
6979                                         return true;
6980                         }
6981                         break;
6982                 case EIR_UUID128_ALL:
6983                 case EIR_UUID128_SOME:
6984                         for (i = 0; i + 17 <= field_len; i += 16) {
6985                                 memcpy(uuid, eir + i + 2, 16);
6986                                 if (has_uuid(uuid, uuid_count, uuids))
6987                                         return true;
6988                         }
6989                         break;
6990                 }
6991
6992                 parsed += field_len + 1;
6993                 eir += field_len + 1;
6994         }
6995
6996         return false;
6997 }
6998
6999 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7000                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7001                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7002 {
7003         char buf[512];
7004         struct mgmt_ev_device_found *ev = (void *) buf;
7005         size_t ev_size;
7006         bool match;
7007
7008         /* Don't send events for a non-kernel initiated discovery. With
7009          * LE one exception is if we have pend_le_reports > 0 in which
7010          * case we're doing passive scanning and want these events.
7011          */
7012         if (!hci_discovery_active(hdev)) {
7013                 if (link_type == ACL_LINK)
7014                         return;
7015                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7016                         return;
7017         }
7018
7019         /* When using service discovery with a RSSI threshold, then check
7020          * if such a RSSI threshold is specified. If a RSSI threshold has
7021          * been specified, then all results with a RSSI smaller than the
7022          * RSSI threshold will be dropped.
7023          */
7024         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7025             rssi < hdev->discovery.rssi)
7026                 return;
7027
7028         /* Make sure that the buffer is big enough. The 5 extra bytes
7029          * are for the potential CoD field.
7030          */
7031         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7032                 return;
7033
7034         memset(buf, 0, sizeof(buf));
7035
7036         bacpy(&ev->addr.bdaddr, bdaddr);
7037         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7038         ev->rssi = rssi;
7039         ev->flags = cpu_to_le32(flags);
7040
7041         if (eir_len > 0) {
7042                 /* When using service discovery and a list of UUID is
7043                  * provided, results with no matching UUID should be
7044                  * dropped. In case there is a match the result is
7045                  * kept and checking possible scan response data
7046                  * will be skipped.
7047                  */
7048                 if (hdev->discovery.uuid_count > 0) {
7049                         match = eir_has_uuids(eir, eir_len,
7050                                               hdev->discovery.uuid_count,
7051                                               hdev->discovery.uuids);
7052                         if (!match)
7053                                 return;
7054                 }
7055
7056                 /* Copy EIR or advertising data into event */
7057                 memcpy(ev->eir, eir, eir_len);
7058         } else {
7059                 /* When using service discovery and a list of UUID is
7060                  * provided, results with empty EIR or advertising data
7061                  * should be dropped since they do not match any UUID.
7062                  */
7063                 if (hdev->discovery.uuid_count > 0)
7064                         return;
7065         }
7066
7067         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7068                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7069                                           dev_class, 3);
7070
7071         if (scan_rsp_len > 0) {
7072                 /* When using service discovery and a list of UUID is
7073                  * provided, results with no matching UUID should be
7074                  * dropped if there is no previous match from the
7075                  * advertising data.
7076                  */
7077                 if (hdev->discovery.uuid_count > 0) {
7078                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7079                                                      hdev->discovery.uuid_count,
7080                                                      hdev->discovery.uuids))
7081                                 return;
7082                 }
7083
7084                 /* Append scan response data to event */
7085                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7086         } else {
7087                 /* When using service discovery and a list of UUID is
7088                  * provided, results with empty scan response and no
7089                  * previous matched advertising data should be dropped.
7090                  */
7091                 if (hdev->discovery.uuid_count > 0 && !match)
7092                         return;
7093         }
7094
7095         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7096         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7097
7098         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7099 }
7100
7101 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7102                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7103 {
7104         struct mgmt_ev_device_found *ev;
7105         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7106         u16 eir_len;
7107
7108         ev = (struct mgmt_ev_device_found *) buf;
7109
7110         memset(buf, 0, sizeof(buf));
7111
7112         bacpy(&ev->addr.bdaddr, bdaddr);
7113         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7114         ev->rssi = rssi;
7115
7116         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7117                                   name_len);
7118
7119         ev->eir_len = cpu_to_le16(eir_len);
7120
7121         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7122 }
7123
7124 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7125 {
7126         struct mgmt_ev_discovering ev;
7127
7128         BT_DBG("%s discovering %u", hdev->name, discovering);
7129
7130         memset(&ev, 0, sizeof(ev));
7131         ev.type = hdev->discovery.type;
7132         ev.discovering = discovering;
7133
7134         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7135 }
7136
7137 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
7138 {
7139         BT_DBG("%s status %u", hdev->name, status);
7140 }
7141
7142 void mgmt_reenable_advertising(struct hci_dev *hdev)
7143 {
7144         struct hci_request req;
7145
7146         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7147                 return;
7148
7149         hci_req_init(&req, hdev);
7150         enable_advertising(&req);
7151         hci_req_run(&req, adv_enable_complete);
7152 }