net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   8
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_BONDABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96         MGMT_OP_START_SERVICE_DISCOVERY,
  97 };
  98
  99 static const u16 mgmt_events[] = {
 100         MGMT_EV_CONTROLLER_ERROR,
 101         MGMT_EV_INDEX_ADDED,
 102         MGMT_EV_INDEX_REMOVED,
 103         MGMT_EV_NEW_SETTINGS,
 104         MGMT_EV_CLASS_OF_DEV_CHANGED,
 105         MGMT_EV_LOCAL_NAME_CHANGED,
 106         MGMT_EV_NEW_LINK_KEY,
 107         MGMT_EV_NEW_LONG_TERM_KEY,
 108         MGMT_EV_DEVICE_CONNECTED,
 109         MGMT_EV_DEVICE_DISCONNECTED,
 110         MGMT_EV_CONNECT_FAILED,
 111         MGMT_EV_PIN_CODE_REQUEST,
 112         MGMT_EV_USER_CONFIRM_REQUEST,
 113         MGMT_EV_USER_PASSKEY_REQUEST,
 114         MGMT_EV_AUTH_FAILED,
 115         MGMT_EV_DEVICE_FOUND,
 116         MGMT_EV_DISCOVERING,
 117         MGMT_EV_DEVICE_BLOCKED,
 118         MGMT_EV_DEVICE_UNBLOCKED,
 119         MGMT_EV_DEVICE_UNPAIRED,
 120         MGMT_EV_PASSKEY_NOTIFY,
 121         MGMT_EV_NEW_IRK,
 122         MGMT_EV_NEW_CSRK,
 123         MGMT_EV_DEVICE_ADDED,
 124         MGMT_EV_DEVICE_REMOVED,
 125         MGMT_EV_NEW_CONN_PARAM,
 126         MGMT_EV_UNCONF_INDEX_ADDED,
 127         MGMT_EV_UNCONF_INDEX_REMOVED,
 128         MGMT_EV_NEW_CONFIG_OPTIONS,
 129 };
 130
 131 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 132
 133 struct pending_cmd {
 134         struct list_head list;
 135         u16 opcode;
 136         int index;
 137         void *param;
 138         size_t param_len;
 139         struct sock *sk;
 140         void *user_data;
 141         void (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 142 };
 143
 144 /* HCI to MGMT error code conversion table */
 145 static u8 mgmt_status_table[] = {
 146         MGMT_STATUS_SUCCESS,
 147         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 148         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 149         MGMT_STATUS_FAILED,             /* Hardware Failure */
 150         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 151         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 152         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 153         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 154         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 157         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 158         MGMT_STATUS_BUSY,               /* Command Disallowed */
 159         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 160         MGMT_STATUS_REJECTED,           /* Rejected Security */
 161         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 162         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 165         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 166         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 167         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 168         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 169         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 170         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 171         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 173         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 174         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 175         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 177         MGMT_STATUS_FAILED,             /* Unspecified Error */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 179         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 180         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 181         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 182         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 183         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 184         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 186         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 188         MGMT_STATUS_FAILED,             /* Transaction Collision */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 190         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 192         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 194         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 195         MGMT_STATUS_FAILED,             /* Slot Violation */
 196         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 197         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 199         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 200         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 201         MGMT_STATUS_BUSY,               /* Controller Busy */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 203         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 204         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 205         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 206         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 207 };
 208
 209 static u8 mgmt_status(u8 hci_status)
 210 {
 211         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 212                 return mgmt_status_table[hci_status];
 213
 214         return MGMT_STATUS_FAILED;
 215 }
 216
 217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 218                       struct sock *skip_sk)
 219 {
 220         struct sk_buff *skb;
 221         struct mgmt_hdr *hdr;
 222
 223         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228         hdr->opcode = cpu_to_le16(event);
 229         if (hdev)
 230                 hdr->index = cpu_to_le16(hdev->id);
 231         else
 232                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 233         hdr->len = cpu_to_le16(data_len);
 234
 235         if (data)
 236                 memcpy(skb_put(skb, data_len), data, data_len);
 237
 238         /* Time stamp */
 239         __net_timestamp(skb);
 240
 241         hci_send_to_control(skb, skip_sk);
 242         kfree_skb(skb);
 243
 244         return 0;
 245 }
 246
 247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 248 {
 249         struct sk_buff *skb;
 250         struct mgmt_hdr *hdr;
 251         struct mgmt_ev_cmd_status *ev;
 252         int err;
 253
 254         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 255
 256         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 257         if (!skb)
 258                 return -ENOMEM;
 259
 260         hdr = (void *) skb_put(skb, sizeof(*hdr));
 261
 262         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 263         hdr->index = cpu_to_le16(index);
 264         hdr->len = cpu_to_le16(sizeof(*ev));
 265
 266         ev = (void *) skb_put(skb, sizeof(*ev));
 267         ev->status = status;
 268         ev->opcode = cpu_to_le16(cmd);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 278                         void *rp, size_t rp_len)
 279 {
 280         struct sk_buff *skb;
 281         struct mgmt_hdr *hdr;
 282         struct mgmt_ev_cmd_complete *ev;
 283         int err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 288         if (!skb)
 289                 return -ENOMEM;
 290
 291         hdr = (void *) skb_put(skb, sizeof(*hdr));
 292
 293         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 294         hdr->index = cpu_to_le16(index);
 295         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 296
 297         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 298         ev->opcode = cpu_to_le16(cmd);
 299         ev->status = status;
 300
 301         if (rp)
 302                 memcpy(ev->data, rp, rp_len);
 303
 304         err = sock_queue_rcv_skb(sk, skb);
 305         if (err < 0)
 306                 kfree_skb(skb);
 307
 308         return err;
 309 }
 310
 311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 312                         u16 data_len)
 313 {
 314         struct mgmt_rp_read_version rp;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         rp.version = MGMT_VERSION;
 319         rp.revision = cpu_to_le16(MGMT_REVISION);
 320
 321         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 322                             sizeof(rp));
 323 }
 324
 325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 326                          u16 data_len)
 327 {
 328         struct mgmt_rp_read_commands *rp;
 329         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 330         const u16 num_events = ARRAY_SIZE(mgmt_events);
 331         __le16 *opcode;
 332         size_t rp_size;
 333         int i, err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 338
 339         rp = kmalloc(rp_size, GFP_KERNEL);
 340         if (!rp)
 341                 return -ENOMEM;
 342
 343         rp->num_commands = cpu_to_le16(num_commands);
 344         rp->num_events = cpu_to_le16(num_events);
 345
 346         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 347                 put_unaligned_le16(mgmt_commands[i], opcode);
 348
 349         for (i = 0; i < num_events; i++, opcode++)
 350                 put_unaligned_le16(mgmt_events[i], opcode);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 353                            rp_size);
 354         kfree(rp);
 355
 356         return err;
 357 }
 358
 359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 360                            u16 data_len)
 361 {
 362         struct mgmt_rp_read_index_list *rp;
 363         struct hci_dev *d;
 364         size_t rp_len;
 365         u16 count;
 366         int err;
 367
 368         BT_DBG("sock %p", sk);
 369
 370         read_lock(&hci_dev_list_lock);
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (d->dev_type == HCI_BREDR &&
 375                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 376                         count++;
 377         }
 378
 379         rp_len = sizeof(*rp) + (2 * count);
 380         rp = kmalloc(rp_len, GFP_ATOMIC);
 381         if (!rp) {
 382                 read_unlock(&hci_dev_list_lock);
 383                 return -ENOMEM;
 384         }
 385
 386         count = 0;
 387         list_for_each_entry(d, &hci_dev_list, list) {
 388                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 389                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 390                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 391                         continue;
 392
 393                 /* Devices marked as raw-only are neither configured
 394                  * nor unconfigured controllers.
 395                  */
 396                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 397                         continue;
 398
 399                 if (d->dev_type == HCI_BREDR &&
 400                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 401                         rp->index[count++] = cpu_to_le16(d->id);
 402                         BT_DBG("Added hci%u", d->id);
 403                 }
 404         }
 405
 406         rp->num_controllers = cpu_to_le16(count);
 407         rp_len = sizeof(*rp) + (2 * count);
 408
 409         read_unlock(&hci_dev_list_lock);
 410
 411         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 412                            rp_len);
 413
 414         kfree(rp);
 415
 416         return err;
 417 }
 418
 419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 420                                   void *data, u16 data_len)
 421 {
 422         struct mgmt_rp_read_unconf_index_list *rp;
 423         struct hci_dev *d;
 424         size_t rp_len;
 425         u16 count;
 426         int err;
 427
 428         BT_DBG("sock %p", sk);
 429
 430         read_lock(&hci_dev_list_lock);
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (d->dev_type == HCI_BREDR &&
 435                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 436                         count++;
 437         }
 438
 439         rp_len = sizeof(*rp) + (2 * count);
 440         rp = kmalloc(rp_len, GFP_ATOMIC);
 441         if (!rp) {
 442                 read_unlock(&hci_dev_list_lock);
 443                 return -ENOMEM;
 444         }
 445
 446         count = 0;
 447         list_for_each_entry(d, &hci_dev_list, list) {
 448                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 449                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 450                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 451                         continue;
 452
 453                 /* Devices marked as raw-only are neither configured
 454                  * nor unconfigured controllers.
 455                  */
 456                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 457                         continue;
 458
 459                 if (d->dev_type == HCI_BREDR &&
 460                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 461                         rp->index[count++] = cpu_to_le16(d->id);
 462                         BT_DBG("Added hci%u", d->id);
 463                 }
 464         }
 465
 466         rp->num_controllers = cpu_to_le16(count);
 467         rp_len = sizeof(*rp) + (2 * count);
 468
 469         read_unlock(&hci_dev_list_lock);
 470
 471         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 472                            0, rp, rp_len);
 473
 474         kfree(rp);
 475
 476         return err;
 477 }
 478
 479 static bool is_configured(struct hci_dev *hdev)
 480 {
 481         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 482             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 483                 return false;
 484
 485         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 486             !bacmp(&hdev->public_addr, BDADDR_ANY))
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 static __le32 get_missing_options(struct hci_dev *hdev)
 493 {
 494         u32 options = 0;
 495
 496         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 497             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 498                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 499
 500         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 501             !bacmp(&hdev->public_addr, BDADDR_ANY))
 502                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 503
 504         return cpu_to_le32(options);
 505 }
 506
 507 static int new_options(struct hci_dev *hdev, struct sock *skip)
 508 {
 509         __le32 options = get_missing_options(hdev);
 510
 511         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 512                           sizeof(options), skip);
 513 }
 514
 515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 516 {
 517         __le32 options = get_missing_options(hdev);
 518
 519         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 520                             sizeof(options));
 521 }
 522
 523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 524                             void *data, u16 data_len)
 525 {
 526         struct mgmt_rp_read_config_info rp;
 527         u32 options = 0;
 528
 529         BT_DBG("sock %p %s", sk, hdev->name);
 530
 531         hci_dev_lock(hdev);
 532
 533         memset(&rp, 0, sizeof(rp));
 534         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 537                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 538
 539         if (hdev->set_bdaddr)
 540                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 541
 542         rp.supported_options = cpu_to_le32(options);
 543         rp.missing_options = get_missing_options(hdev);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 548                             sizeof(rp));
 549 }
 550
 551 static u32 get_supported_settings(struct hci_dev *hdev)
 552 {
 553         u32 settings = 0;
 554
 555         settings |= MGMT_SETTING_POWERED;
 556         settings |= MGMT_SETTING_BONDABLE;
 557         settings |= MGMT_SETTING_DEBUG_KEYS;
 558         settings |= MGMT_SETTING_CONNECTABLE;
 559         settings |= MGMT_SETTING_DISCOVERABLE;
 560
 561         if (lmp_bredr_capable(hdev)) {
 562                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 563                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 564                 settings |= MGMT_SETTING_BREDR;
 565                 settings |= MGMT_SETTING_LINK_SECURITY;
 566
 567                 if (lmp_ssp_capable(hdev)) {
 568                         settings |= MGMT_SETTING_SSP;
 569                         settings |= MGMT_SETTING_HS;
 570                 }
 571
 572                 if (lmp_sc_capable(hdev) ||
 573                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_SECURE_CONN;
 581                 settings |= MGMT_SETTING_PRIVACY;
 582         }
 583
 584         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 585             hdev->set_bdaddr)
 586                 settings |= MGMT_SETTING_CONFIGURATION;
 587
 588         return settings;
 589 }
 590
 591 static u32 get_current_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         if (hdev_is_powered(hdev))
 596                 settings |= MGMT_SETTING_POWERED;
 597
 598         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 599                 settings |= MGMT_SETTING_CONNECTABLE;
 600
 601         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 602                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 603
 604         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 605                 settings |= MGMT_SETTING_DISCOVERABLE;
 606
 607         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 608                 settings |= MGMT_SETTING_BONDABLE;
 609
 610         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 611                 settings |= MGMT_SETTING_BREDR;
 612
 613         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 614                 settings |= MGMT_SETTING_LE;
 615
 616         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 617                 settings |= MGMT_SETTING_LINK_SECURITY;
 618
 619         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 620                 settings |= MGMT_SETTING_SSP;
 621
 622         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 623                 settings |= MGMT_SETTING_HS;
 624
 625         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 626                 settings |= MGMT_SETTING_ADVERTISING;
 627
 628         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 629                 settings |= MGMT_SETTING_SECURE_CONN;
 630
 631         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 632                 settings |= MGMT_SETTING_DEBUG_KEYS;
 633
 634         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 635                 settings |= MGMT_SETTING_PRIVACY;
 636
 637         return settings;
 638 }
 639
 640 #define PNP_INFO_SVCLASS_ID             0x1200
 641
 642 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 643 {
 644         u8 *ptr = data, *uuids_start = NULL;
 645         struct bt_uuid *uuid;
 646
 647         if (len < 4)
 648                 return ptr;
 649
 650         list_for_each_entry(uuid, &hdev->uuids, list) {
 651                 u16 uuid16;
 652
 653                 if (uuid->size != 16)
 654                         continue;
 655
 656                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 657                 if (uuid16 < 0x1100)
 658                         continue;
 659
 660                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 661                         continue;
 662
 663                 if (!uuids_start) {
 664                         uuids_start = ptr;
 665                         uuids_start[0] = 1;
 666                         uuids_start[1] = EIR_UUID16_ALL;
 667                         ptr += 2;
 668                 }
 669
 670                 /* Stop if not enough space to put next UUID */
 671                 if ((ptr - data) + sizeof(u16) > len) {
 672                         uuids_start[1] = EIR_UUID16_SOME;
 673                         break;
 674                 }
 675
 676                 *ptr++ = (uuid16 & 0x00ff);
 677                 *ptr++ = (uuid16 & 0xff00) >> 8;
 678                 uuids_start[0] += sizeof(uuid16);
 679         }
 680
 681         return ptr;
 682 }
 683
 684 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 685 {
 686         u8 *ptr = data, *uuids_start = NULL;
 687         struct bt_uuid *uuid;
 688
 689         if (len < 6)
 690                 return ptr;
 691
 692         list_for_each_entry(uuid, &hdev->uuids, list) {
 693                 if (uuid->size != 32)
 694                         continue;
 695
 696                 if (!uuids_start) {
 697                         uuids_start = ptr;
 698                         uuids_start[0] = 1;
 699                         uuids_start[1] = EIR_UUID32_ALL;
 700                         ptr += 2;
 701                 }
 702
 703                 /* Stop if not enough space to put next UUID */
 704                 if ((ptr - data) + sizeof(u32) > len) {
 705                         uuids_start[1] = EIR_UUID32_SOME;
 706                         break;
 707                 }
 708
 709                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 710                 ptr += sizeof(u32);
 711                 uuids_start[0] += sizeof(u32);
 712         }
 713
 714         return ptr;
 715 }
 716
 717 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 718 {
 719         u8 *ptr = data, *uuids_start = NULL;
 720         struct bt_uuid *uuid;
 721
 722         if (len < 18)
 723                 return ptr;
 724
 725         list_for_each_entry(uuid, &hdev->uuids, list) {
 726                 if (uuid->size != 128)
 727                         continue;
 728
 729                 if (!uuids_start) {
 730                         uuids_start = ptr;
 731                         uuids_start[0] = 1;
 732                         uuids_start[1] = EIR_UUID128_ALL;
 733                         ptr += 2;
 734                 }
 735
 736                 /* Stop if not enough space to put next UUID */
 737                 if ((ptr - data) + 16 > len) {
 738                         uuids_start[1] = EIR_UUID128_SOME;
 739                         break;
 740                 }
 741
 742                 memcpy(ptr, uuid->uuid, 16);
 743                 ptr += 16;
 744                 uuids_start[0] += 16;
 745         }
 746
 747         return ptr;
 748 }
 749
 750 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 751 {
 752         struct pending_cmd *cmd;
 753
 754         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 755                 if (cmd->opcode == opcode)
 756                         return cmd;
 757         }
 758
 759         return NULL;
 760 }
 761
 762 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 763                                                   struct hci_dev *hdev,
 764                                                   const void *data)
 765 {
 766         struct pending_cmd *cmd;
 767
 768         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 769                 if (cmd->user_data != data)
 770                         continue;
 771                 if (cmd->opcode == opcode)
 772                         return cmd;
 773         }
 774
 775         return NULL;
 776 }
 777
 778 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 779 {
 780         u8 ad_len = 0;
 781         size_t name_len;
 782
 783         name_len = strlen(hdev->dev_name);
 784         if (name_len > 0) {
 785                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 786
 787                 if (name_len > max_len) {
 788                         name_len = max_len;
 789                         ptr[1] = EIR_NAME_SHORT;
 790                 } else
 791                         ptr[1] = EIR_NAME_COMPLETE;
 792
 793                 ptr[0] = name_len + 1;
 794
 795                 memcpy(ptr + 2, hdev->dev_name, name_len);
 796
 797                 ad_len += (name_len + 2);
 798                 ptr += (name_len + 2);
 799         }
 800
 801         return ad_len;
 802 }
 803
 804 static void update_scan_rsp_data(struct hci_request *req)
 805 {
 806         struct hci_dev *hdev = req->hdev;
 807         struct hci_cp_le_set_scan_rsp_data cp;
 808         u8 len;
 809
 810         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 811                 return;
 812
 813         memset(&cp, 0, sizeof(cp));
 814
 815         len = create_scan_rsp_data(hdev, cp.data);
 816
 817         if (hdev->scan_rsp_data_len == len &&
 818             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 819                 return;
 820
 821         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 822         hdev->scan_rsp_data_len = len;
 823
 824         cp.length = len;
 825
 826         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 827 }
 828
 829 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 830 {
 831         struct pending_cmd *cmd;
 832
 833         /* If there's a pending mgmt command the flags will not yet have
 834          * their final values, so check for this first.
 835          */
 836         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 837         if (cmd) {
 838                 struct mgmt_mode *cp = cmd->param;
 839                 if (cp->val == 0x01)
 840                         return LE_AD_GENERAL;
 841                 else if (cp->val == 0x02)
 842                         return LE_AD_LIMITED;
 843         } else {
 844                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 845                         return LE_AD_LIMITED;
 846                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 847                         return LE_AD_GENERAL;
 848         }
 849
 850         return 0;
 851 }
 852
 853 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 854 {
 855         u8 ad_len = 0, flags = 0;
 856
 857         flags |= get_adv_discov_flags(hdev);
 858
 859         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 860                 flags |= LE_AD_NO_BREDR;
 861
 862         if (flags) {
 863                 BT_DBG("adv flags 0x%02x", flags);
 864
 865                 ptr[0] = 2;
 866                 ptr[1] = EIR_FLAGS;
 867                 ptr[2] = flags;
 868
 869                 ad_len += 3;
 870                 ptr += 3;
 871         }
 872
 873         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 874                 ptr[0] = 2;
 875                 ptr[1] = EIR_TX_POWER;
 876                 ptr[2] = (u8) hdev->adv_tx_power;
 877
 878                 ad_len += 3;
 879                 ptr += 3;
 880         }
 881
 882         return ad_len;
 883 }
 884
 885 static void update_adv_data(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         struct hci_cp_le_set_adv_data cp;
 889         u8 len;
 890
 891         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 892                 return;
 893
 894         memset(&cp, 0, sizeof(cp));
 895
 896         len = create_adv_data(hdev, cp.data);
 897
 898         if (hdev->adv_data_len == len &&
 899             memcmp(cp.data, hdev->adv_data, len) == 0)
 900                 return;
 901
 902         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 903         hdev->adv_data_len = len;
 904
 905         cp.length = len;
 906
 907         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 908 }
 909
 910 int mgmt_update_adv_data(struct hci_dev *hdev)
 911 {
 912         struct hci_request req;
 913
 914         hci_req_init(&req, hdev);
 915         update_adv_data(&req);
 916
 917         return hci_req_run(&req, NULL);
 918 }
 919
 920 static void create_eir(struct hci_dev *hdev, u8 *data)
 921 {
 922         u8 *ptr = data;
 923         size_t name_len;
 924
 925         name_len = strlen(hdev->dev_name);
 926
 927         if (name_len > 0) {
 928                 /* EIR Data type */
 929                 if (name_len > 48) {
 930                         name_len = 48;
 931                         ptr[1] = EIR_NAME_SHORT;
 932                 } else
 933                         ptr[1] = EIR_NAME_COMPLETE;
 934
 935                 /* EIR Data length */
 936                 ptr[0] = name_len + 1;
 937
 938                 memcpy(ptr + 2, hdev->dev_name, name_len);
 939
 940                 ptr += (name_len + 2);
 941         }
 942
 943         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 944                 ptr[0] = 2;
 945                 ptr[1] = EIR_TX_POWER;
 946                 ptr[2] = (u8) hdev->inq_tx_power;
 947
 948                 ptr += 3;
 949         }
 950
 951         if (hdev->devid_source > 0) {
 952                 ptr[0] = 9;
 953                 ptr[1] = EIR_DEVICE_ID;
 954
 955                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 956                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 957                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 958                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 959
 960                 ptr += 10;
 961         }
 962
 963         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 964         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 965         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 966 }
 967
 968 static void update_eir(struct hci_request *req)
 969 {
 970         struct hci_dev *hdev = req->hdev;
 971         struct hci_cp_write_eir cp;
 972
 973         if (!hdev_is_powered(hdev))
 974                 return;
 975
 976         if (!lmp_ext_inq_capable(hdev))
 977                 return;
 978
 979         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 980                 return;
 981
 982         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 983                 return;
 984
 985         memset(&cp, 0, sizeof(cp));
 986
 987         create_eir(hdev, cp.data);
 988
 989         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 990                 return;
 991
 992         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 993
 994         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 995 }
 996
 997 static u8 get_service_classes(struct hci_dev *hdev)
 998 {
 999         struct bt_uuid *uuid;
1000         u8 val = 0;
1001
1002         list_for_each_entry(uuid, &hdev->uuids, list)
1003                 val |= uuid->svc_hint;
1004
1005         return val;
1006 }
1007
1008 static void update_class(struct hci_request *req)
1009 {
1010         struct hci_dev *hdev = req->hdev;
1011         u8 cod[3];
1012
1013         BT_DBG("%s", hdev->name);
1014
1015         if (!hdev_is_powered(hdev))
1016                 return;
1017
1018         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1019                 return;
1020
1021         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1022                 return;
1023
1024         cod[0] = hdev->minor_class;
1025         cod[1] = hdev->major_class;
1026         cod[2] = get_service_classes(hdev);
1027
1028         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1029                 cod[1] |= 0x20;
1030
1031         if (memcmp(cod, hdev->dev_class, 3) == 0)
1032                 return;
1033
1034         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1035 }
1036
1037 static bool get_connectable(struct hci_dev *hdev)
1038 {
1039         struct pending_cmd *cmd;
1040
1041         /* If there's a pending mgmt command the flag will not yet have
1042          * it's final value, so check for this first.
1043          */
1044         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1045         if (cmd) {
1046                 struct mgmt_mode *cp = cmd->param;
1047                 return cp->val;
1048         }
1049
1050         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1051 }
1052
1053 static void disable_advertising(struct hci_request *req)
1054 {
1055         u8 enable = 0x00;
1056
1057         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1058 }
1059
1060 static void enable_advertising(struct hci_request *req)
1061 {
1062         struct hci_dev *hdev = req->hdev;
1063         struct hci_cp_le_set_adv_param cp;
1064         u8 own_addr_type, enable = 0x01;
1065         bool connectable;
1066
1067         if (hci_conn_num(hdev, LE_LINK) > 0)
1068                 return;
1069
1070         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1071                 disable_advertising(req);
1072
1073         /* Clear the HCI_LE_ADV bit temporarily so that the
1074          * hci_update_random_address knows that it's safe to go ahead
1075          * and write a new random address. The flag will be set back on
1076          * as soon as the SET_ADV_ENABLE HCI command completes.
1077          */
1078         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1079
1080         connectable = get_connectable(hdev);
1081
1082         /* Set require_privacy to true only when non-connectable
1083          * advertising is used. In that case it is fine to use a
1084          * non-resolvable private address.
1085          */
1086         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1087                 return;
1088
1089         memset(&cp, 0, sizeof(cp));
1090         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1091         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1092         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1093         cp.own_address_type = own_addr_type;
1094         cp.channel_map = hdev->le_adv_channel_map;
1095
1096         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1097
1098         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1099 }
1100
1101 static void service_cache_off(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             service_cache.work);
1105         struct hci_request req;
1106
1107         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1108                 return;
1109
1110         hci_req_init(&req, hdev);
1111
1112         hci_dev_lock(hdev);
1113
1114         update_eir(&req);
1115         update_class(&req);
1116
1117         hci_dev_unlock(hdev);
1118
1119         hci_req_run(&req, NULL);
1120 }
1121
1122 static void rpa_expired(struct work_struct *work)
1123 {
1124         struct hci_dev *hdev = container_of(work, struct hci_dev,
1125                                             rpa_expired.work);
1126         struct hci_request req;
1127
1128         BT_DBG("");
1129
1130         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1131
1132         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1133                 return;
1134
1135         /* The generation of a new RPA and programming it into the
1136          * controller happens in the enable_advertising() function.
1137          */
1138         hci_req_init(&req, hdev);
1139         enable_advertising(&req);
1140         hci_req_run(&req, NULL);
1141 }
1142
1143 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1144 {
1145         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1146                 return;
1147
1148         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1149         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1150
1151         /* Non-mgmt controlled devices get this bit set
1152          * implicitly so that pairing works for them, however
1153          * for mgmt we require user-space to explicitly enable
1154          * it
1155          */
1156         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1157 }
1158
1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160                                 void *data, u16 data_len)
1161 {
1162         struct mgmt_rp_read_info rp;
1163
1164         BT_DBG("sock %p %s", sk, hdev->name);
1165
1166         hci_dev_lock(hdev);
1167
1168         memset(&rp, 0, sizeof(rp));
1169
1170         bacpy(&rp.bdaddr, &hdev->bdaddr);
1171
1172         rp.version = hdev->hci_ver;
1173         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1174
1175         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1177
1178         memcpy(rp.dev_class, hdev->dev_class, 3);
1179
1180         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1182
1183         hci_dev_unlock(hdev);
1184
1185         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1186                             sizeof(rp));
1187 }
1188
1189 static void mgmt_pending_free(struct pending_cmd *cmd)
1190 {
1191         sock_put(cmd->sk);
1192         kfree(cmd->param);
1193         kfree(cmd);
1194 }
1195
1196 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1197                                             struct hci_dev *hdev, void *data,
1198                                             u16 len)
1199 {
1200         struct pending_cmd *cmd;
1201
1202         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1203         if (!cmd)
1204                 return NULL;
1205
1206         cmd->opcode = opcode;
1207         cmd->index = hdev->id;
1208
1209         cmd->param = kmemdup(data, len, GFP_KERNEL);
1210         if (!cmd->param) {
1211                 kfree(cmd);
1212                 return NULL;
1213         }
1214
1215         cmd->param_len = len;
1216
1217         cmd->sk = sk;
1218         sock_hold(sk);
1219
1220         list_add(&cmd->list, &hdev->mgmt_pending);
1221
1222         return cmd;
1223 }
1224
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226                                  void (*cb)(struct pending_cmd *cmd,
1227                                             void *data),
1228                                  void *data)
1229 {
1230         struct pending_cmd *cmd, *tmp;
1231
1232         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233                 if (opcode > 0 && cmd->opcode != opcode)
1234                         continue;
1235
1236                 cb(cmd, data);
1237         }
1238 }
1239
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1241 {
1242         list_del(&cmd->list);
1243         mgmt_pending_free(cmd);
1244 }
1245
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1247 {
1248         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1249
1250         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1251                             sizeof(settings));
1252 }
1253
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1255 {
1256         BT_DBG("%s status 0x%02x", hdev->name, status);
1257
1258         if (hci_conn_count(hdev) == 0) {
1259                 cancel_delayed_work(&hdev->power_off);
1260                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1261         }
1262 }
1263
1264 static bool hci_stop_discovery(struct hci_request *req)
1265 {
1266         struct hci_dev *hdev = req->hdev;
1267         struct hci_cp_remote_name_req_cancel cp;
1268         struct inquiry_entry *e;
1269
1270         switch (hdev->discovery.state) {
1271         case DISCOVERY_FINDING:
1272                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1274                 } else {
1275                         cancel_delayed_work(&hdev->le_scan_disable);
1276                         hci_req_add_le_scan_disable(req);
1277                 }
1278
1279                 return true;
1280
1281         case DISCOVERY_RESOLVING:
1282                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1283                                                      NAME_PENDING);
1284                 if (!e)
1285                         break;
1286
1287                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1289                             &cp);
1290
1291                 return true;
1292
1293         default:
1294                 /* Passive scanning */
1295                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296                         hci_req_add_le_scan_disable(req);
1297                         return true;
1298                 }
1299
1300                 break;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1307 {
1308         struct hci_request req;
1309         struct hci_conn *conn;
1310         bool discov_stopped;
1311         int err;
1312
1313         hci_req_init(&req, hdev);
1314
1315         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316             test_bit(HCI_PSCAN, &hdev->flags)) {
1317                 u8 scan = 0x00;
1318                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1319         }
1320
1321         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322                 disable_advertising(&req);
1323
1324         discov_stopped = hci_stop_discovery(&req);
1325
1326         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327                 struct hci_cp_disconnect dc;
1328                 struct hci_cp_reject_conn_req rej;
1329
1330                 switch (conn->state) {
1331                 case BT_CONNECTED:
1332                 case BT_CONFIG:
1333                         dc.handle = cpu_to_le16(conn->handle);
1334                         dc.reason = 0x15; /* Terminated due to Power Off */
1335                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1336                         break;
1337                 case BT_CONNECT:
1338                         if (conn->type == LE_LINK)
1339                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1340                                             0, NULL);
1341                         else if (conn->type == ACL_LINK)
1342                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1343                                             6, &conn->dst);
1344                         break;
1345                 case BT_CONNECT2:
1346                         bacpy(&rej.bdaddr, &conn->dst);
1347                         rej.reason = 0x15; /* Terminated due to Power Off */
1348                         if (conn->type == ACL_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         else if (conn->type == SCO_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         break;
1355                 }
1356         }
1357
1358         err = hci_req_run(&req, clean_up_hci_complete);
1359         if (!err && discov_stopped)
1360                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1361
1362         return err;
1363 }
1364
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1366                        u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         struct pending_cmd *cmd;
1370         int err;
1371
1372         BT_DBG("request for %s", hdev->name);
1373
1374         if (cp->val != 0x00 && cp->val != 0x01)
1375                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376                                   MGMT_STATUS_INVALID_PARAMS);
1377
1378         hci_dev_lock(hdev);
1379
1380         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1382                                  MGMT_STATUS_BUSY);
1383                 goto failed;
1384         }
1385
1386         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387                 cancel_delayed_work(&hdev->power_off);
1388
1389                 if (cp->val) {
1390                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1391                                          data, len);
1392                         err = mgmt_powered(hdev, 1);
1393                         goto failed;
1394                 }
1395         }
1396
1397         if (!!cp->val == hdev_is_powered(hdev)) {
1398                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1399                 goto failed;
1400         }
1401
1402         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1403         if (!cmd) {
1404                 err = -ENOMEM;
1405                 goto failed;
1406         }
1407
1408         if (cp->val) {
1409                 queue_work(hdev->req_workqueue, &hdev->power_on);
1410                 err = 0;
1411         } else {
1412                 /* Disconnect connections, stop scans, etc */
1413                 err = clean_up_hci_state(hdev);
1414                 if (!err)
1415                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416                                            HCI_POWER_OFF_TIMEOUT);
1417
1418                 /* ENODATA means there were no HCI commands queued */
1419                 if (err == -ENODATA) {
1420                         cancel_delayed_work(&hdev->power_off);
1421                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1422                         err = 0;
1423                 }
1424         }
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1432 {
1433         __le32 ev;
1434
1435         ev = cpu_to_le32(get_current_settings(hdev));
1436
1437         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1438 }
1439
1440 int mgmt_new_settings(struct hci_dev *hdev)
1441 {
1442         return new_settings(hdev, NULL);
1443 }
1444
1445 struct cmd_lookup {
1446         struct sock *sk;
1447         struct hci_dev *hdev;
1448         u8 mgmt_status;
1449 };
1450
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1452 {
1453         struct cmd_lookup *match = data;
1454
1455         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1456
1457         list_del(&cmd->list);
1458
1459         if (match->sk == NULL) {
1460                 match->sk = cmd->sk;
1461                 sock_hold(match->sk);
1462         }
1463
1464         mgmt_pending_free(cmd);
1465 }
1466
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1468 {
1469         u8 *status = data;
1470
1471         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472         mgmt_pending_remove(cmd);
1473 }
1474
1475 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1476 {
1477         if (cmd->cmd_complete) {
1478                 u8 *status = data;
1479
1480                 cmd->cmd_complete(cmd, *status);
1481                 mgmt_pending_remove(cmd);
1482
1483                 return;
1484         }
1485
1486         cmd_status_rsp(cmd, data);
1487 }
1488
1489 static void generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1490 {
1491         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1492                      cmd->param_len);
1493 }
1494
1495 static void addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1496 {
1497         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1498                      sizeof(struct mgmt_addr_info));
1499 }
1500
1501 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1502 {
1503         if (!lmp_bredr_capable(hdev))
1504                 return MGMT_STATUS_NOT_SUPPORTED;
1505         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1506                 return MGMT_STATUS_REJECTED;
1507         else
1508                 return MGMT_STATUS_SUCCESS;
1509 }
1510
1511 static u8 mgmt_le_support(struct hci_dev *hdev)
1512 {
1513         if (!lmp_le_capable(hdev))
1514                 return MGMT_STATUS_NOT_SUPPORTED;
1515         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1516                 return MGMT_STATUS_REJECTED;
1517         else
1518                 return MGMT_STATUS_SUCCESS;
1519 }
1520
1521 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1522 {
1523         struct pending_cmd *cmd;
1524         struct mgmt_mode *cp;
1525         struct hci_request req;
1526         bool changed;
1527
1528         BT_DBG("status 0x%02x", status);
1529
1530         hci_dev_lock(hdev);
1531
1532         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1533         if (!cmd)
1534                 goto unlock;
1535
1536         if (status) {
1537                 u8 mgmt_err = mgmt_status(status);
1538                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1539                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1540                 goto remove_cmd;
1541         }
1542
1543         cp = cmd->param;
1544         if (cp->val) {
1545                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1546                                             &hdev->dev_flags);
1547
1548                 if (hdev->discov_timeout > 0) {
1549                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1550                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1551                                            to);
1552                 }
1553         } else {
1554                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1555                                              &hdev->dev_flags);
1556         }
1557
1558         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1559
1560         if (changed)
1561                 new_settings(hdev, cmd->sk);
1562
1563         /* When the discoverable mode gets changed, make sure
1564          * that class of device has the limited discoverable
1565          * bit correctly set. Also update page scan based on whitelist
1566          * entries.
1567          */
1568         hci_req_init(&req, hdev);
1569         hci_update_page_scan(hdev, &req);
1570         update_class(&req);
1571         hci_req_run(&req, NULL);
1572
1573 remove_cmd:
1574         mgmt_pending_remove(cmd);
1575
1576 unlock:
1577         hci_dev_unlock(hdev);
1578 }
1579
1580 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1581                             u16 len)
1582 {
1583         struct mgmt_cp_set_discoverable *cp = data;
1584         struct pending_cmd *cmd;
1585         struct hci_request req;
1586         u16 timeout;
1587         u8 scan;
1588         int err;
1589
1590         BT_DBG("request for %s", hdev->name);
1591
1592         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1595                                   MGMT_STATUS_REJECTED);
1596
1597         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                   MGMT_STATUS_INVALID_PARAMS);
1600
1601         timeout = __le16_to_cpu(cp->timeout);
1602
1603         /* Disabling discoverable requires that no timeout is set,
1604          * and enabling limited discoverable requires a timeout.
1605          */
1606         if ((cp->val == 0x00 && timeout > 0) ||
1607             (cp->val == 0x02 && timeout == 0))
1608                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1609                                   MGMT_STATUS_INVALID_PARAMS);
1610
1611         hci_dev_lock(hdev);
1612
1613         if (!hdev_is_powered(hdev) && timeout > 0) {
1614                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1615                                  MGMT_STATUS_NOT_POWERED);
1616                 goto failed;
1617         }
1618
1619         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1620             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1628                                  MGMT_STATUS_REJECTED);
1629                 goto failed;
1630         }
1631
1632         if (!hdev_is_powered(hdev)) {
1633                 bool changed = false;
1634
1635                 /* Setting limited discoverable when powered off is
1636                  * not a valid operation since it requires a timeout
1637                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1638                  */
1639                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1640                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1641                         changed = true;
1642                 }
1643
1644                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1645                 if (err < 0)
1646                         goto failed;
1647
1648                 if (changed)
1649                         err = new_settings(hdev, sk);
1650
1651                 goto failed;
1652         }
1653
1654         /* If the current mode is the same, then just update the timeout
1655          * value with the new value. And if only the timeout gets updated,
1656          * then no need for any HCI transactions.
1657          */
1658         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1659             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1660                                           &hdev->dev_flags)) {
1661                 cancel_delayed_work(&hdev->discov_off);
1662                 hdev->discov_timeout = timeout;
1663
1664                 if (cp->val && hdev->discov_timeout > 0) {
1665                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1666                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1667                                            to);
1668                 }
1669
1670                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1671                 goto failed;
1672         }
1673
1674         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1675         if (!cmd) {
1676                 err = -ENOMEM;
1677                 goto failed;
1678         }
1679
1680         /* Cancel any potential discoverable timeout that might be
1681          * still active and store new timeout value. The arming of
1682          * the timeout happens in the complete handler.
1683          */
1684         cancel_delayed_work(&hdev->discov_off);
1685         hdev->discov_timeout = timeout;
1686
1687         /* Limited discoverable mode */
1688         if (cp->val == 0x02)
1689                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1690         else
1691                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1692
1693         hci_req_init(&req, hdev);
1694
1695         /* The procedure for LE-only controllers is much simpler - just
1696          * update the advertising data.
1697          */
1698         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1699                 goto update_ad;
1700
1701         scan = SCAN_PAGE;
1702
1703         if (cp->val) {
1704                 struct hci_cp_write_current_iac_lap hci_cp;
1705
1706                 if (cp->val == 0x02) {
1707                         /* Limited discoverable mode */
1708                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1709                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1710                         hci_cp.iac_lap[1] = 0x8b;
1711                         hci_cp.iac_lap[2] = 0x9e;
1712                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1713                         hci_cp.iac_lap[4] = 0x8b;
1714                         hci_cp.iac_lap[5] = 0x9e;
1715                 } else {
1716                         /* General discoverable mode */
1717                         hci_cp.num_iac = 1;
1718                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1719                         hci_cp.iac_lap[1] = 0x8b;
1720                         hci_cp.iac_lap[2] = 0x9e;
1721                 }
1722
1723                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1724                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1725
1726                 scan |= SCAN_INQUIRY;
1727         } else {
1728                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1729         }
1730
1731         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1732
1733 update_ad:
1734         update_adv_data(&req);
1735
1736         err = hci_req_run(&req, set_discoverable_complete);
1737         if (err < 0)
1738                 mgmt_pending_remove(cmd);
1739
1740 failed:
1741         hci_dev_unlock(hdev);
1742         return err;
1743 }
1744
1745 static void write_fast_connectable(struct hci_request *req, bool enable)
1746 {
1747         struct hci_dev *hdev = req->hdev;
1748         struct hci_cp_write_page_scan_activity acp;
1749         u8 type;
1750
1751         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1752                 return;
1753
1754         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1755                 return;
1756
1757         if (enable) {
1758                 type = PAGE_SCAN_TYPE_INTERLACED;
1759
1760                 /* 160 msec page scan interval */
1761                 acp.interval = cpu_to_le16(0x0100);
1762         } else {
1763                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1764
1765                 /* default 1.28 sec page scan */
1766                 acp.interval = cpu_to_le16(0x0800);
1767         }
1768
1769         acp.window = cpu_to_le16(0x0012);
1770
1771         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1772             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1773                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1774                             sizeof(acp), &acp);
1775
1776         if (hdev->page_scan_type != type)
1777                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1778 }
1779
1780 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1781 {
1782         struct pending_cmd *cmd;
1783         struct mgmt_mode *cp;
1784         bool conn_changed, discov_changed;
1785
1786         BT_DBG("status 0x%02x", status);
1787
1788         hci_dev_lock(hdev);
1789
1790         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1791         if (!cmd)
1792                 goto unlock;
1793
1794         if (status) {
1795                 u8 mgmt_err = mgmt_status(status);
1796                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1797                 goto remove_cmd;
1798         }
1799
1800         cp = cmd->param;
1801         if (cp->val) {
1802                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1803                                                  &hdev->dev_flags);
1804                 discov_changed = false;
1805         } else {
1806                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1807                                                   &hdev->dev_flags);
1808                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1809                                                     &hdev->dev_flags);
1810         }
1811
1812         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1813
1814         if (conn_changed || discov_changed) {
1815                 new_settings(hdev, cmd->sk);
1816                 hci_update_page_scan(hdev, NULL);
1817                 if (discov_changed)
1818                         mgmt_update_adv_data(hdev);
1819                 hci_update_background_scan(hdev);
1820         }
1821
1822 remove_cmd:
1823         mgmt_pending_remove(cmd);
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827 }
1828
1829 static int set_connectable_update_settings(struct hci_dev *hdev,
1830                                            struct sock *sk, u8 val)
1831 {
1832         bool changed = false;
1833         int err;
1834
1835         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1836                 changed = true;
1837
1838         if (val) {
1839                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1840         } else {
1841                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1842                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1843         }
1844
1845         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1846         if (err < 0)
1847                 return err;
1848
1849         if (changed) {
1850                 hci_update_page_scan(hdev, NULL);
1851                 hci_update_background_scan(hdev);
1852                 return new_settings(hdev, sk);
1853         }
1854
1855         return 0;
1856 }
1857
1858 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1859                            u16 len)
1860 {
1861         struct mgmt_mode *cp = data;
1862         struct pending_cmd *cmd;
1863         struct hci_request req;
1864         u8 scan;
1865         int err;
1866
1867         BT_DBG("request for %s", hdev->name);
1868
1869         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1870             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1872                                   MGMT_STATUS_REJECTED);
1873
1874         if (cp->val != 0x00 && cp->val != 0x01)
1875                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1876                                   MGMT_STATUS_INVALID_PARAMS);
1877
1878         hci_dev_lock(hdev);
1879
1880         if (!hdev_is_powered(hdev)) {
1881                 err = set_connectable_update_settings(hdev, sk, cp->val);
1882                 goto failed;
1883         }
1884
1885         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1886             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1888                                  MGMT_STATUS_BUSY);
1889                 goto failed;
1890         }
1891
1892         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1893         if (!cmd) {
1894                 err = -ENOMEM;
1895                 goto failed;
1896         }
1897
1898         hci_req_init(&req, hdev);
1899
1900         /* If BR/EDR is not enabled and we disable advertising as a
1901          * by-product of disabling connectable, we need to update the
1902          * advertising flags.
1903          */
1904         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1905                 if (!cp->val) {
1906                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1907                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1908                 }
1909                 update_adv_data(&req);
1910         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1911                 if (cp->val) {
1912                         scan = SCAN_PAGE;
1913                 } else {
1914                         /* If we don't have any whitelist entries just
1915                          * disable all scanning. If there are entries
1916                          * and we had both page and inquiry scanning
1917                          * enabled then fall back to only page scanning.
1918                          * Otherwise no changes are needed.
1919                          */
1920                         if (list_empty(&hdev->whitelist))
1921                                 scan = SCAN_DISABLED;
1922                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1923                                 scan = SCAN_PAGE;
1924                         else
1925                                 goto no_scan_update;
1926
1927                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1928                             hdev->discov_timeout > 0)
1929                                 cancel_delayed_work(&hdev->discov_off);
1930                 }
1931
1932                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1933         }
1934
1935 no_scan_update:
1936         /* If we're going from non-connectable to connectable or
1937          * vice-versa when fast connectable is enabled ensure that fast
1938          * connectable gets disabled. write_fast_connectable won't do
1939          * anything if the page scan parameters are already what they
1940          * should be.
1941          */
1942         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1943                 write_fast_connectable(&req, false);
1944
1945         /* Update the advertising parameters if necessary */
1946         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1947                 enable_advertising(&req);
1948
1949         err = hci_req_run(&req, set_connectable_complete);
1950         if (err < 0) {
1951                 mgmt_pending_remove(cmd);
1952                 if (err == -ENODATA)
1953                         err = set_connectable_update_settings(hdev, sk,
1954                                                               cp->val);
1955                 goto failed;
1956         }
1957
1958 failed:
1959         hci_dev_unlock(hdev);
1960         return err;
1961 }
1962
1963 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1964                         u16 len)
1965 {
1966         struct mgmt_mode *cp = data;
1967         bool changed;
1968         int err;
1969
1970         BT_DBG("request for %s", hdev->name);
1971
1972         if (cp->val != 0x00 && cp->val != 0x01)
1973                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1974                                   MGMT_STATUS_INVALID_PARAMS);
1975
1976         hci_dev_lock(hdev);
1977
1978         if (cp->val)
1979                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1980         else
1981                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1982
1983         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1984         if (err < 0)
1985                 goto unlock;
1986
1987         if (changed)
1988                 err = new_settings(hdev, sk);
1989
1990 unlock:
1991         hci_dev_unlock(hdev);
1992         return err;
1993 }
1994
1995 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1996                              u16 len)
1997 {
1998         struct mgmt_mode *cp = data;
1999         struct pending_cmd *cmd;
2000         u8 val, status;
2001         int err;
2002
2003         BT_DBG("request for %s", hdev->name);
2004
2005         status = mgmt_bredr_support(hdev);
2006         if (status)
2007                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2008                                   status);
2009
2010         if (cp->val != 0x00 && cp->val != 0x01)
2011                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2012                                   MGMT_STATUS_INVALID_PARAMS);
2013
2014         hci_dev_lock(hdev);
2015
2016         if (!hdev_is_powered(hdev)) {
2017                 bool changed = false;
2018
2019                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2020                                           &hdev->dev_flags)) {
2021                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2022                         changed = true;
2023                 }
2024
2025                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2026                 if (err < 0)
2027                         goto failed;
2028
2029                 if (changed)
2030                         err = new_settings(hdev, sk);
2031
2032                 goto failed;
2033         }
2034
2035         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2036                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2037                                  MGMT_STATUS_BUSY);
2038                 goto failed;
2039         }
2040
2041         val = !!cp->val;
2042
2043         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2044                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2045                 goto failed;
2046         }
2047
2048         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2049         if (!cmd) {
2050                 err = -ENOMEM;
2051                 goto failed;
2052         }
2053
2054         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2055         if (err < 0) {
2056                 mgmt_pending_remove(cmd);
2057                 goto failed;
2058         }
2059
2060 failed:
2061         hci_dev_unlock(hdev);
2062         return err;
2063 }
2064
2065 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         struct pending_cmd *cmd;
2069         u8 status;
2070         int err;
2071
2072         BT_DBG("request for %s", hdev->name);
2073
2074         status = mgmt_bredr_support(hdev);
2075         if (status)
2076                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2077
2078         if (!lmp_ssp_capable(hdev))
2079                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2080                                   MGMT_STATUS_NOT_SUPPORTED);
2081
2082         if (cp->val != 0x00 && cp->val != 0x01)
2083                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2084                                   MGMT_STATUS_INVALID_PARAMS);
2085
2086         hci_dev_lock(hdev);
2087
2088         if (!hdev_is_powered(hdev)) {
2089                 bool changed;
2090
2091                 if (cp->val) {
2092                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2093                                                     &hdev->dev_flags);
2094                 } else {
2095                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2096                                                      &hdev->dev_flags);
2097                         if (!changed)
2098                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2099                                                              &hdev->dev_flags);
2100                         else
2101                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2102                 }
2103
2104                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2105                 if (err < 0)
2106                         goto failed;
2107
2108                 if (changed)
2109                         err = new_settings(hdev, sk);
2110
2111                 goto failed;
2112         }
2113
2114         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2115             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2116                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2117                                  MGMT_STATUS_BUSY);
2118                 goto failed;
2119         }
2120
2121         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2122                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2123                 goto failed;
2124         }
2125
2126         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2127         if (!cmd) {
2128                 err = -ENOMEM;
2129                 goto failed;
2130         }
2131
2132         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2133                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2134                              sizeof(cp->val), &cp->val);
2135
2136         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2137         if (err < 0) {
2138                 mgmt_pending_remove(cmd);
2139                 goto failed;
2140         }
2141
2142 failed:
2143         hci_dev_unlock(hdev);
2144         return err;
2145 }
2146
2147 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2148 {
2149         struct mgmt_mode *cp = data;
2150         bool changed;
2151         u8 status;
2152         int err;
2153
2154         BT_DBG("request for %s", hdev->name);
2155
2156         status = mgmt_bredr_support(hdev);
2157         if (status)
2158                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2159
2160         if (!lmp_ssp_capable(hdev))
2161                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2162                                   MGMT_STATUS_NOT_SUPPORTED);
2163
2164         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2165                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2166                                   MGMT_STATUS_REJECTED);
2167
2168         if (cp->val != 0x00 && cp->val != 0x01)
2169                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2170                                   MGMT_STATUS_INVALID_PARAMS);
2171
2172         hci_dev_lock(hdev);
2173
2174         if (cp->val) {
2175                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2176         } else {
2177                 if (hdev_is_powered(hdev)) {
2178                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2179                                          MGMT_STATUS_REJECTED);
2180                         goto unlock;
2181                 }
2182
2183                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2184         }
2185
2186         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2187         if (err < 0)
2188                 goto unlock;
2189
2190         if (changed)
2191                 err = new_settings(hdev, sk);
2192
2193 unlock:
2194         hci_dev_unlock(hdev);
2195         return err;
2196 }
2197
2198 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2199 {
2200         struct cmd_lookup match = { NULL, hdev };
2201
2202         hci_dev_lock(hdev);
2203
2204         if (status) {
2205                 u8 mgmt_err = mgmt_status(status);
2206
2207                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2208                                      &mgmt_err);
2209                 goto unlock;
2210         }
2211
2212         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2213
2214         new_settings(hdev, match.sk);
2215
2216         if (match.sk)
2217                 sock_put(match.sk);
2218
2219         /* Make sure the controller has a good default for
2220          * advertising data. Restrict the update to when LE
2221          * has actually been enabled. During power on, the
2222          * update in powered_update_hci will take care of it.
2223          */
2224         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2225                 struct hci_request req;
2226
2227                 hci_req_init(&req, hdev);
2228                 update_adv_data(&req);
2229                 update_scan_rsp_data(&req);
2230                 hci_req_run(&req, NULL);
2231
2232                 hci_update_background_scan(hdev);
2233         }
2234
2235 unlock:
2236         hci_dev_unlock(hdev);
2237 }
2238
2239 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2240 {
2241         struct mgmt_mode *cp = data;
2242         struct hci_cp_write_le_host_supported hci_cp;
2243         struct pending_cmd *cmd;
2244         struct hci_request req;
2245         int err;
2246         u8 val, enabled;
2247
2248         BT_DBG("request for %s", hdev->name);
2249
2250         if (!lmp_le_capable(hdev))
2251                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2252                                   MGMT_STATUS_NOT_SUPPORTED);
2253
2254         if (cp->val != 0x00 && cp->val != 0x01)
2255                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2256                                   MGMT_STATUS_INVALID_PARAMS);
2257
2258         /* LE-only devices do not allow toggling LE on/off */
2259         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2260                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2261                                   MGMT_STATUS_REJECTED);
2262
2263         hci_dev_lock(hdev);
2264
2265         val = !!cp->val;
2266         enabled = lmp_host_le_capable(hdev);
2267
2268         if (!hdev_is_powered(hdev) || val == enabled) {
2269                 bool changed = false;
2270
2271                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2272                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2273                         changed = true;
2274                 }
2275
2276                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2277                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2278                         changed = true;
2279                 }
2280
2281                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2282                 if (err < 0)
2283                         goto unlock;
2284
2285                 if (changed)
2286                         err = new_settings(hdev, sk);
2287
2288                 goto unlock;
2289         }
2290
2291         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2292             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2293                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2294                                  MGMT_STATUS_BUSY);
2295                 goto unlock;
2296         }
2297
2298         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2299         if (!cmd) {
2300                 err = -ENOMEM;
2301                 goto unlock;
2302         }
2303
2304         hci_req_init(&req, hdev);
2305
2306         memset(&hci_cp, 0, sizeof(hci_cp));
2307
2308         if (val) {
2309                 hci_cp.le = val;
2310                 hci_cp.simul = 0x00;
2311         } else {
2312                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2313                         disable_advertising(&req);
2314         }
2315
2316         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2317                     &hci_cp);
2318
2319         err = hci_req_run(&req, le_enable_complete);
2320         if (err < 0)
2321                 mgmt_pending_remove(cmd);
2322
2323 unlock:
2324         hci_dev_unlock(hdev);
2325         return err;
2326 }
2327
2328 /* This is a helper function to test for pending mgmt commands that can
2329  * cause CoD or EIR HCI commands. We can only allow one such pending
2330  * mgmt command at a time since otherwise we cannot easily track what
2331  * the current values are, will be, and based on that calculate if a new
2332  * HCI command needs to be sent and if yes with what value.
2333  */
2334 static bool pending_eir_or_class(struct hci_dev *hdev)
2335 {
2336         struct pending_cmd *cmd;
2337
2338         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2339                 switch (cmd->opcode) {
2340                 case MGMT_OP_ADD_UUID:
2341                 case MGMT_OP_REMOVE_UUID:
2342                 case MGMT_OP_SET_DEV_CLASS:
2343                 case MGMT_OP_SET_POWERED:
2344                         return true;
2345                 }
2346         }
2347
2348         return false;
2349 }
2350
2351 static const u8 bluetooth_base_uuid[] = {
2352                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2353                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2354 };
2355
2356 static u8 get_uuid_size(const u8 *uuid)
2357 {
2358         u32 val;
2359
2360         if (memcmp(uuid, bluetooth_base_uuid, 12))
2361                 return 128;
2362
2363         val = get_unaligned_le32(&uuid[12]);
2364         if (val > 0xffff)
2365                 return 32;
2366
2367         return 16;
2368 }
2369
2370 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2371 {
2372         struct pending_cmd *cmd;
2373
2374         hci_dev_lock(hdev);
2375
2376         cmd = mgmt_pending_find(mgmt_op, hdev);
2377         if (!cmd)
2378                 goto unlock;
2379
2380         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2381                      hdev->dev_class, 3);
2382
2383         mgmt_pending_remove(cmd);
2384
2385 unlock:
2386         hci_dev_unlock(hdev);
2387 }
2388
2389 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2390 {
2391         BT_DBG("status 0x%02x", status);
2392
2393         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2394 }
2395
2396 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2397 {
2398         struct mgmt_cp_add_uuid *cp = data;
2399         struct pending_cmd *cmd;
2400         struct hci_request req;
2401         struct bt_uuid *uuid;
2402         int err;
2403
2404         BT_DBG("request for %s", hdev->name);
2405
2406         hci_dev_lock(hdev);
2407
2408         if (pending_eir_or_class(hdev)) {
2409                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2410                                  MGMT_STATUS_BUSY);
2411                 goto failed;
2412         }
2413
2414         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2415         if (!uuid) {
2416                 err = -ENOMEM;
2417                 goto failed;
2418         }
2419
2420         memcpy(uuid->uuid, cp->uuid, 16);
2421         uuid->svc_hint = cp->svc_hint;
2422         uuid->size = get_uuid_size(cp->uuid);
2423
2424         list_add_tail(&uuid->list, &hdev->uuids);
2425
2426         hci_req_init(&req, hdev);
2427
2428         update_class(&req);
2429         update_eir(&req);
2430
2431         err = hci_req_run(&req, add_uuid_complete);
2432         if (err < 0) {
2433                 if (err != -ENODATA)
2434                         goto failed;
2435
2436                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2437                                    hdev->dev_class, 3);
2438                 goto failed;
2439         }
2440
2441         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2442         if (!cmd) {
2443                 err = -ENOMEM;
2444                 goto failed;
2445         }
2446
2447         err = 0;
2448
2449 failed:
2450         hci_dev_unlock(hdev);
2451         return err;
2452 }
2453
2454 static bool enable_service_cache(struct hci_dev *hdev)
2455 {
2456         if (!hdev_is_powered(hdev))
2457                 return false;
2458
2459         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2460                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2461                                    CACHE_TIMEOUT);
2462                 return true;
2463         }
2464
2465         return false;
2466 }
2467
2468 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2469 {
2470         BT_DBG("status 0x%02x", status);
2471
2472         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2473 }
2474
2475 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2476                        u16 len)
2477 {
2478         struct mgmt_cp_remove_uuid *cp = data;
2479         struct pending_cmd *cmd;
2480         struct bt_uuid *match, *tmp;
2481         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2482         struct hci_request req;
2483         int err, found;
2484
2485         BT_DBG("request for %s", hdev->name);
2486
2487         hci_dev_lock(hdev);
2488
2489         if (pending_eir_or_class(hdev)) {
2490                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2491                                  MGMT_STATUS_BUSY);
2492                 goto unlock;
2493         }
2494
2495         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2496                 hci_uuids_clear(hdev);
2497
2498                 if (enable_service_cache(hdev)) {
2499                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2500                                            0, hdev->dev_class, 3);
2501                         goto unlock;
2502                 }
2503
2504                 goto update_class;
2505         }
2506
2507         found = 0;
2508
2509         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2510                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2511                         continue;
2512
2513                 list_del(&match->list);
2514                 kfree(match);
2515                 found++;
2516         }
2517
2518         if (found == 0) {
2519                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2520                                  MGMT_STATUS_INVALID_PARAMS);
2521                 goto unlock;
2522         }
2523
2524 update_class:
2525         hci_req_init(&req, hdev);
2526
2527         update_class(&req);
2528         update_eir(&req);
2529
2530         err = hci_req_run(&req, remove_uuid_complete);
2531         if (err < 0) {
2532                 if (err != -ENODATA)
2533                         goto unlock;
2534
2535                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2536                                    hdev->dev_class, 3);
2537                 goto unlock;
2538         }
2539
2540         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2541         if (!cmd) {
2542                 err = -ENOMEM;
2543                 goto unlock;
2544         }
2545
2546         err = 0;
2547
2548 unlock:
2549         hci_dev_unlock(hdev);
2550         return err;
2551 }
2552
2553 static void set_class_complete(struct hci_dev *hdev, u8 status)
2554 {
2555         BT_DBG("status 0x%02x", status);
2556
2557         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2558 }
2559
2560 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2561                          u16 len)
2562 {
2563         struct mgmt_cp_set_dev_class *cp = data;
2564         struct pending_cmd *cmd;
2565         struct hci_request req;
2566         int err;
2567
2568         BT_DBG("request for %s", hdev->name);
2569
2570         if (!lmp_bredr_capable(hdev))
2571                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2572                                   MGMT_STATUS_NOT_SUPPORTED);
2573
2574         hci_dev_lock(hdev);
2575
2576         if (pending_eir_or_class(hdev)) {
2577                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2578                                  MGMT_STATUS_BUSY);
2579                 goto unlock;
2580         }
2581
2582         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2583                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2584                                  MGMT_STATUS_INVALID_PARAMS);
2585                 goto unlock;
2586         }
2587
2588         hdev->major_class = cp->major;
2589         hdev->minor_class = cp->minor;
2590
2591         if (!hdev_is_powered(hdev)) {
2592                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2593                                    hdev->dev_class, 3);
2594                 goto unlock;
2595         }
2596
2597         hci_req_init(&req, hdev);
2598
2599         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2600                 hci_dev_unlock(hdev);
2601                 cancel_delayed_work_sync(&hdev->service_cache);
2602                 hci_dev_lock(hdev);
2603                 update_eir(&req);
2604         }
2605
2606         update_class(&req);
2607
2608         err = hci_req_run(&req, set_class_complete);
2609         if (err < 0) {
2610                 if (err != -ENODATA)
2611                         goto unlock;
2612
2613                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2614                                    hdev->dev_class, 3);
2615                 goto unlock;
2616         }
2617
2618         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2619         if (!cmd) {
2620                 err = -ENOMEM;
2621                 goto unlock;
2622         }
2623
2624         err = 0;
2625
2626 unlock:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2632                           u16 len)
2633 {
2634         struct mgmt_cp_load_link_keys *cp = data;
2635         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2636                                    sizeof(struct mgmt_link_key_info));
2637         u16 key_count, expected_len;
2638         bool changed;
2639         int i;
2640
2641         BT_DBG("request for %s", hdev->name);
2642
2643         if (!lmp_bredr_capable(hdev))
2644                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2645                                   MGMT_STATUS_NOT_SUPPORTED);
2646
2647         key_count = __le16_to_cpu(cp->key_count);
2648         if (key_count > max_key_count) {
2649                 BT_ERR("load_link_keys: too big key_count value %u",
2650                        key_count);
2651                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2652                                   MGMT_STATUS_INVALID_PARAMS);
2653         }
2654
2655         expected_len = sizeof(*cp) + key_count *
2656                                         sizeof(struct mgmt_link_key_info);
2657         if (expected_len != len) {
2658                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2659                        expected_len, len);
2660                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2661                                   MGMT_STATUS_INVALID_PARAMS);
2662         }
2663
2664         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2665                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2666                                   MGMT_STATUS_INVALID_PARAMS);
2667
2668         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2669                key_count);
2670
2671         for (i = 0; i < key_count; i++) {
2672                 struct mgmt_link_key_info *key = &cp->keys[i];
2673
2674                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2675                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2676                                           MGMT_STATUS_INVALID_PARAMS);
2677         }
2678
2679         hci_dev_lock(hdev);
2680
2681         hci_link_keys_clear(hdev);
2682
2683         if (cp->debug_keys)
2684                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2685                                             &hdev->dev_flags);
2686         else
2687                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2688                                              &hdev->dev_flags);
2689
2690         if (changed)
2691                 new_settings(hdev, NULL);
2692
2693         for (i = 0; i < key_count; i++) {
2694                 struct mgmt_link_key_info *key = &cp->keys[i];
2695
2696                 /* Always ignore debug keys and require a new pairing if
2697                  * the user wants to use them.
2698                  */
2699                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2700                         continue;
2701
2702                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2703                                  key->type, key->pin_len, NULL);
2704         }
2705
2706         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2707
2708         hci_dev_unlock(hdev);
2709
2710         return 0;
2711 }
2712
2713 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2714                            u8 addr_type, struct sock *skip_sk)
2715 {
2716         struct mgmt_ev_device_unpaired ev;
2717
2718         bacpy(&ev.addr.bdaddr, bdaddr);
2719         ev.addr.type = addr_type;
2720
2721         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2722                           skip_sk);
2723 }
2724
2725 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2726                          u16 len)
2727 {
2728         struct mgmt_cp_unpair_device *cp = data;
2729         struct mgmt_rp_unpair_device rp;
2730         struct hci_cp_disconnect dc;
2731         struct pending_cmd *cmd;
2732         struct hci_conn *conn;
2733         int err;
2734
2735         memset(&rp, 0, sizeof(rp));
2736         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2737         rp.addr.type = cp->addr.type;
2738
2739         if (!bdaddr_type_is_valid(cp->addr.type))
2740                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2741                                     MGMT_STATUS_INVALID_PARAMS,
2742                                     &rp, sizeof(rp));
2743
2744         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2745                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2746                                     MGMT_STATUS_INVALID_PARAMS,
2747                                     &rp, sizeof(rp));
2748
2749         hci_dev_lock(hdev);
2750
2751         if (!hdev_is_powered(hdev)) {
2752                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2753                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2754                 goto unlock;
2755         }
2756
2757         if (cp->addr.type == BDADDR_BREDR) {
2758                 /* If disconnection is requested, then look up the
2759                  * connection. If the remote device is connected, it
2760                  * will be later used to terminate the link.
2761                  *
2762                  * Setting it to NULL explicitly will cause no
2763                  * termination of the link.
2764                  */
2765                 if (cp->disconnect)
2766                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2767                                                        &cp->addr.bdaddr);
2768                 else
2769                         conn = NULL;
2770
2771                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2772         } else {
2773                 u8 addr_type;
2774
2775                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2776                                                &cp->addr.bdaddr);
2777                 if (conn) {
2778                         /* Defer clearing up the connection parameters
2779                          * until closing to give a chance of keeping
2780                          * them if a repairing happens.
2781                          */
2782                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2783
2784                         /* If disconnection is not requested, then
2785                          * clear the connection variable so that the
2786                          * link is not terminated.
2787                          */
2788                         if (!cp->disconnect)
2789                                 conn = NULL;
2790                 }
2791
2792                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2793                         addr_type = ADDR_LE_DEV_PUBLIC;
2794                 else
2795                         addr_type = ADDR_LE_DEV_RANDOM;
2796
2797                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2798
2799                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2800         }
2801
2802         if (err < 0) {
2803                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2804                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2805                 goto unlock;
2806         }
2807
2808         /* If the connection variable is set, then termination of the
2809          * link is requested.
2810          */
2811         if (!conn) {
2812                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2813                                    &rp, sizeof(rp));
2814                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2815                 goto unlock;
2816         }
2817
2818         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2819                                sizeof(*cp));
2820         if (!cmd) {
2821                 err = -ENOMEM;
2822                 goto unlock;
2823         }
2824
2825         cmd->cmd_complete = addr_cmd_complete;
2826
2827         dc.handle = cpu_to_le16(conn->handle);
2828         dc.reason = 0x13; /* Remote User Terminated Connection */
2829         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2830         if (err < 0)
2831                 mgmt_pending_remove(cmd);
2832
2833 unlock:
2834         hci_dev_unlock(hdev);
2835         return err;
2836 }
2837
2838 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2839                       u16 len)
2840 {
2841         struct mgmt_cp_disconnect *cp = data;
2842         struct mgmt_rp_disconnect rp;
2843         struct pending_cmd *cmd;
2844         struct hci_conn *conn;
2845         int err;
2846
2847         BT_DBG("");
2848
2849         memset(&rp, 0, sizeof(rp));
2850         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2851         rp.addr.type = cp->addr.type;
2852
2853         if (!bdaddr_type_is_valid(cp->addr.type))
2854                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2855                                     MGMT_STATUS_INVALID_PARAMS,
2856                                     &rp, sizeof(rp));
2857
2858         hci_dev_lock(hdev);
2859
2860         if (!test_bit(HCI_UP, &hdev->flags)) {
2861                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2862                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2863                 goto failed;
2864         }
2865
2866         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2867                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2868                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2869                 goto failed;
2870         }
2871
2872         if (cp->addr.type == BDADDR_BREDR)
2873                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2874                                                &cp->addr.bdaddr);
2875         else
2876                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2877
2878         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2879                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2880                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2881                 goto failed;
2882         }
2883
2884         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2885         if (!cmd) {
2886                 err = -ENOMEM;
2887                 goto failed;
2888         }
2889
2890         cmd->cmd_complete = generic_cmd_complete;
2891
2892         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2893         if (err < 0)
2894                 mgmt_pending_remove(cmd);
2895
2896 failed:
2897         hci_dev_unlock(hdev);
2898         return err;
2899 }
2900
2901 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2902 {
2903         switch (link_type) {
2904         case LE_LINK:
2905                 switch (addr_type) {
2906                 case ADDR_LE_DEV_PUBLIC:
2907                         return BDADDR_LE_PUBLIC;
2908
2909                 default:
2910                         /* Fallback to LE Random address type */
2911                         return BDADDR_LE_RANDOM;
2912                 }
2913
2914         default:
2915                 /* Fallback to BR/EDR type */
2916                 return BDADDR_BREDR;
2917         }
2918 }
2919
2920 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2921                            u16 data_len)
2922 {
2923         struct mgmt_rp_get_connections *rp;
2924         struct hci_conn *c;
2925         size_t rp_len;
2926         int err;
2927         u16 i;
2928
2929         BT_DBG("");
2930
2931         hci_dev_lock(hdev);
2932
2933         if (!hdev_is_powered(hdev)) {
2934                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2935                                  MGMT_STATUS_NOT_POWERED);
2936                 goto unlock;
2937         }
2938
2939         i = 0;
2940         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2941                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2942                         i++;
2943         }
2944
2945         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2946         rp = kmalloc(rp_len, GFP_KERNEL);
2947         if (!rp) {
2948                 err = -ENOMEM;
2949                 goto unlock;
2950         }
2951
2952         i = 0;
2953         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2954                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2955                         continue;
2956                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2957                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2958                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2959                         continue;
2960                 i++;
2961         }
2962
2963         rp->conn_count = cpu_to_le16(i);
2964
2965         /* Recalculate length in case of filtered SCO connections, etc */
2966         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2967
2968         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2969                            rp_len);
2970
2971         kfree(rp);
2972
2973 unlock:
2974         hci_dev_unlock(hdev);
2975         return err;
2976 }
2977
2978 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2979                                    struct mgmt_cp_pin_code_neg_reply *cp)
2980 {
2981         struct pending_cmd *cmd;
2982         int err;
2983
2984         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2985                                sizeof(*cp));
2986         if (!cmd)
2987                 return -ENOMEM;
2988
2989         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2990                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2991         if (err < 0)
2992                 mgmt_pending_remove(cmd);
2993
2994         return err;
2995 }
2996
2997 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2998                           u16 len)
2999 {
3000         struct hci_conn *conn;
3001         struct mgmt_cp_pin_code_reply *cp = data;
3002         struct hci_cp_pin_code_reply reply;
3003         struct pending_cmd *cmd;
3004         int err;
3005
3006         BT_DBG("");
3007
3008         hci_dev_lock(hdev);
3009
3010         if (!hdev_is_powered(hdev)) {
3011                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3012                                  MGMT_STATUS_NOT_POWERED);
3013                 goto failed;
3014         }
3015
3016         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3017         if (!conn) {
3018                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3019                                  MGMT_STATUS_NOT_CONNECTED);
3020                 goto failed;
3021         }
3022
3023         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3024                 struct mgmt_cp_pin_code_neg_reply ncp;
3025
3026                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3027
3028                 BT_ERR("PIN code is not 16 bytes long");
3029
3030                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3031                 if (err >= 0)
3032                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3033                                          MGMT_STATUS_INVALID_PARAMS);
3034
3035                 goto failed;
3036         }
3037
3038         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3039         if (!cmd) {
3040                 err = -ENOMEM;
3041                 goto failed;
3042         }
3043
3044         cmd->cmd_complete = addr_cmd_complete;
3045
3046         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3047         reply.pin_len = cp->pin_len;
3048         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3049
3050         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3051         if (err < 0)
3052                 mgmt_pending_remove(cmd);
3053
3054 failed:
3055         hci_dev_unlock(hdev);
3056         return err;
3057 }
3058
3059 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3060                              u16 len)
3061 {
3062         struct mgmt_cp_set_io_capability *cp = data;
3063
3064         BT_DBG("");
3065
3066         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3067                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3068                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3069
3070         hci_dev_lock(hdev);
3071
3072         hdev->io_capability = cp->io_capability;
3073
3074         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3075                hdev->io_capability);
3076
3077         hci_dev_unlock(hdev);
3078
3079         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3080                             0);
3081 }
3082
3083 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3084 {
3085         struct hci_dev *hdev = conn->hdev;
3086         struct pending_cmd *cmd;
3087
3088         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3089                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3090                         continue;
3091
3092                 if (cmd->user_data != conn)
3093                         continue;
3094
3095                 return cmd;
3096         }
3097
3098         return NULL;
3099 }
3100
3101 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3102 {
3103         struct mgmt_rp_pair_device rp;
3104         struct hci_conn *conn = cmd->user_data;
3105
3106         bacpy(&rp.addr.bdaddr, &conn->dst);
3107         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3108
3109         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3110                      &rp, sizeof(rp));
3111
3112         /* So we don't get further callbacks for this connection */
3113         conn->connect_cfm_cb = NULL;
3114         conn->security_cfm_cb = NULL;
3115         conn->disconn_cfm_cb = NULL;
3116
3117         hci_conn_drop(conn);
3118
3119         /* The device is paired so there is no need to remove
3120          * its connection parameters anymore.
3121          */
3122         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3123
3124         hci_conn_put(conn);
3125 }
3126
3127 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3128 {
3129         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3130         struct pending_cmd *cmd;
3131
3132         cmd = find_pairing(conn);
3133         if (cmd) {
3134                 cmd->cmd_complete(cmd, status);
3135                 mgmt_pending_remove(cmd);
3136         }
3137 }
3138
3139 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3140 {
3141         struct pending_cmd *cmd;
3142
3143         BT_DBG("status %u", status);
3144
3145         cmd = find_pairing(conn);
3146         if (!cmd) {
3147                 BT_DBG("Unable to find a pending command");
3148                 return;
3149         }
3150
3151         cmd->cmd_complete(cmd, mgmt_status(status));
3152         mgmt_pending_remove(cmd);
3153 }
3154
3155 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3156 {
3157         struct pending_cmd *cmd;
3158
3159         BT_DBG("status %u", status);
3160
3161         if (!status)
3162                 return;
3163
3164         cmd = find_pairing(conn);
3165         if (!cmd) {
3166                 BT_DBG("Unable to find a pending command");
3167                 return;
3168         }
3169
3170         cmd->cmd_complete(cmd, mgmt_status(status));
3171         mgmt_pending_remove(cmd);
3172 }
3173
3174 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3175                        u16 len)
3176 {
3177         struct mgmt_cp_pair_device *cp = data;
3178         struct mgmt_rp_pair_device rp;
3179         struct pending_cmd *cmd;
3180         u8 sec_level, auth_type;
3181         struct hci_conn *conn;
3182         int err;
3183
3184         BT_DBG("");
3185
3186         memset(&rp, 0, sizeof(rp));
3187         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3188         rp.addr.type = cp->addr.type;
3189
3190         if (!bdaddr_type_is_valid(cp->addr.type))
3191                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3192                                     MGMT_STATUS_INVALID_PARAMS,
3193                                     &rp, sizeof(rp));
3194
3195         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3196                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3197                                     MGMT_STATUS_INVALID_PARAMS,
3198                                     &rp, sizeof(rp));
3199
3200         hci_dev_lock(hdev);
3201
3202         if (!hdev_is_powered(hdev)) {
3203                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3204                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3205                 goto unlock;
3206         }
3207
3208         sec_level = BT_SECURITY_MEDIUM;
3209         auth_type = HCI_AT_DEDICATED_BONDING;
3210
3211         if (cp->addr.type == BDADDR_BREDR) {
3212                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3213                                        auth_type);
3214         } else {
3215                 u8 addr_type;
3216
3217                 /* Convert from L2CAP channel address type to HCI address type
3218                  */
3219                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3220                         addr_type = ADDR_LE_DEV_PUBLIC;
3221                 else
3222                         addr_type = ADDR_LE_DEV_RANDOM;
3223
3224                 /* When pairing a new device, it is expected to remember
3225                  * this device for future connections. Adding the connection
3226                  * parameter information ahead of time allows tracking
3227                  * of the slave preferred values and will speed up any
3228                  * further connection establishment.
3229                  *
3230                  * If connection parameters already exist, then they
3231                  * will be kept and this function does nothing.
3232                  */
3233                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3234
3235                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3236                                       sec_level, HCI_LE_CONN_TIMEOUT,
3237                                       HCI_ROLE_MASTER);
3238         }
3239
3240         if (IS_ERR(conn)) {
3241                 int status;
3242
3243                 if (PTR_ERR(conn) == -EBUSY)
3244                         status = MGMT_STATUS_BUSY;
3245                 else
3246                         status = MGMT_STATUS_CONNECT_FAILED;
3247
3248                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3249                                    status, &rp,
3250                                    sizeof(rp));
3251                 goto unlock;
3252         }
3253
3254         if (conn->connect_cfm_cb) {
3255                 hci_conn_drop(conn);
3256                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3257                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3258                 goto unlock;
3259         }
3260
3261         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3262         if (!cmd) {
3263                 err = -ENOMEM;
3264                 hci_conn_drop(conn);
3265                 goto unlock;
3266         }
3267
3268         cmd->cmd_complete = pairing_complete;
3269
3270         /* For LE, just connecting isn't a proof that the pairing finished */
3271         if (cp->addr.type == BDADDR_BREDR) {
3272                 conn->connect_cfm_cb = pairing_complete_cb;
3273                 conn->security_cfm_cb = pairing_complete_cb;
3274                 conn->disconn_cfm_cb = pairing_complete_cb;
3275         } else {
3276                 conn->connect_cfm_cb = le_pairing_complete_cb;
3277                 conn->security_cfm_cb = le_pairing_complete_cb;
3278                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3279         }
3280
3281         conn->io_capability = cp->io_cap;
3282         cmd->user_data = hci_conn_get(conn);
3283
3284         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3285             hci_conn_security(conn, sec_level, auth_type, true)) {
3286                 cmd->cmd_complete(cmd, 0);
3287                 mgmt_pending_remove(cmd);
3288         }
3289
3290         err = 0;
3291
3292 unlock:
3293         hci_dev_unlock(hdev);
3294         return err;
3295 }
3296
3297 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3298                               u16 len)
3299 {
3300         struct mgmt_addr_info *addr = data;
3301         struct pending_cmd *cmd;
3302         struct hci_conn *conn;
3303         int err;
3304
3305         BT_DBG("");
3306
3307         hci_dev_lock(hdev);
3308
3309         if (!hdev_is_powered(hdev)) {
3310                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3311                                  MGMT_STATUS_NOT_POWERED);
3312                 goto unlock;
3313         }
3314
3315         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3316         if (!cmd) {
3317                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3318                                  MGMT_STATUS_INVALID_PARAMS);
3319                 goto unlock;
3320         }
3321
3322         conn = cmd->user_data;
3323
3324         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3325                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3326                                  MGMT_STATUS_INVALID_PARAMS);
3327                 goto unlock;
3328         }
3329
3330         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3331         mgmt_pending_remove(cmd);
3332
3333         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3334                            addr, sizeof(*addr));
3335 unlock:
3336         hci_dev_unlock(hdev);
3337         return err;
3338 }
3339
3340 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3341                              struct mgmt_addr_info *addr, u16 mgmt_op,
3342                              u16 hci_op, __le32 passkey)
3343 {
3344         struct pending_cmd *cmd;
3345         struct hci_conn *conn;
3346         int err;
3347
3348         hci_dev_lock(hdev);
3349
3350         if (!hdev_is_powered(hdev)) {
3351                 err = cmd_complete(sk, hdev->id, mgmt_op,
3352                                    MGMT_STATUS_NOT_POWERED, addr,
3353                                    sizeof(*addr));
3354                 goto done;
3355         }
3356
3357         if (addr->type == BDADDR_BREDR)
3358                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3359         else
3360                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3361
3362         if (!conn) {
3363                 err = cmd_complete(sk, hdev->id, mgmt_op,
3364                                    MGMT_STATUS_NOT_CONNECTED, addr,
3365                                    sizeof(*addr));
3366                 goto done;
3367         }
3368
3369         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3370                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3371                 if (!err)
3372                         err = cmd_complete(sk, hdev->id, mgmt_op,
3373                                            MGMT_STATUS_SUCCESS, addr,
3374                                            sizeof(*addr));
3375                 else
3376                         err = cmd_complete(sk, hdev->id, mgmt_op,
3377                                            MGMT_STATUS_FAILED, addr,
3378                                            sizeof(*addr));
3379
3380                 goto done;
3381         }
3382
3383         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3384         if (!cmd) {
3385                 err = -ENOMEM;
3386                 goto done;
3387         }
3388
3389         cmd->cmd_complete = addr_cmd_complete;
3390
3391         /* Continue with pairing via HCI */
3392         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3393                 struct hci_cp_user_passkey_reply cp;
3394
3395                 bacpy(&cp.bdaddr, &addr->bdaddr);
3396                 cp.passkey = passkey;
3397                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3398         } else
3399                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3400                                    &addr->bdaddr);
3401
3402         if (err < 0)
3403                 mgmt_pending_remove(cmd);
3404
3405 done:
3406         hci_dev_unlock(hdev);
3407         return err;
3408 }
3409
3410 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3411                               void *data, u16 len)
3412 {
3413         struct mgmt_cp_pin_code_neg_reply *cp = data;
3414
3415         BT_DBG("");
3416
3417         return user_pairing_resp(sk, hdev, &cp->addr,
3418                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3419                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3420 }
3421
3422 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3423                               u16 len)
3424 {
3425         struct mgmt_cp_user_confirm_reply *cp = data;
3426
3427         BT_DBG("");
3428
3429         if (len != sizeof(*cp))
3430                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3431                                   MGMT_STATUS_INVALID_PARAMS);
3432
3433         return user_pairing_resp(sk, hdev, &cp->addr,
3434                                  MGMT_OP_USER_CONFIRM_REPLY,
3435                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3436 }
3437
3438 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3439                                   void *data, u16 len)
3440 {
3441         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3442
3443         BT_DBG("");
3444
3445         return user_pairing_resp(sk, hdev, &cp->addr,
3446                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3447                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3448 }
3449
3450 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3451                               u16 len)
3452 {
3453         struct mgmt_cp_user_passkey_reply *cp = data;
3454
3455         BT_DBG("");
3456
3457         return user_pairing_resp(sk, hdev, &cp->addr,
3458                                  MGMT_OP_USER_PASSKEY_REPLY,
3459                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3460 }
3461
3462 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3463                                   void *data, u16 len)
3464 {
3465         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3466
3467         BT_DBG("");
3468
3469         return user_pairing_resp(sk, hdev, &cp->addr,
3470                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3471                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3472 }
3473
3474 static void update_name(struct hci_request *req)
3475 {
3476         struct hci_dev *hdev = req->hdev;
3477         struct hci_cp_write_local_name cp;
3478
3479         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3480
3481         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3482 }
3483
3484 static void set_name_complete(struct hci_dev *hdev, u8 status)
3485 {
3486         struct mgmt_cp_set_local_name *cp;
3487         struct pending_cmd *cmd;
3488
3489         BT_DBG("status 0x%02x", status);
3490
3491         hci_dev_lock(hdev);
3492
3493         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3494         if (!cmd)
3495                 goto unlock;
3496
3497         cp = cmd->param;
3498
3499         if (status)
3500                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3501                            mgmt_status(status));
3502         else
3503                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3504                              cp, sizeof(*cp));
3505
3506         mgmt_pending_remove(cmd);
3507
3508 unlock:
3509         hci_dev_unlock(hdev);
3510 }
3511
3512 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3513                           u16 len)
3514 {
3515         struct mgmt_cp_set_local_name *cp = data;
3516         struct pending_cmd *cmd;
3517         struct hci_request req;
3518         int err;
3519
3520         BT_DBG("");
3521
3522         hci_dev_lock(hdev);
3523
3524         /* If the old values are the same as the new ones just return a
3525          * direct command complete event.
3526          */
3527         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3528             !memcmp(hdev->short_name, cp->short_name,
3529                     sizeof(hdev->short_name))) {
3530                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3531                                    data, len);
3532                 goto failed;
3533         }
3534
3535         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3536
3537         if (!hdev_is_powered(hdev)) {
3538                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3539
3540                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3541                                    data, len);
3542                 if (err < 0)
3543                         goto failed;
3544
3545                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3546                                  sk);
3547
3548                 goto failed;
3549         }
3550
3551         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3552         if (!cmd) {
3553                 err = -ENOMEM;
3554                 goto failed;
3555         }
3556
3557         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3558
3559         hci_req_init(&req, hdev);
3560
3561         if (lmp_bredr_capable(hdev)) {
3562                 update_name(&req);
3563                 update_eir(&req);
3564         }
3565
3566         /* The name is stored in the scan response data and so
3567          * no need to udpate the advertising data here.
3568          */
3569         if (lmp_le_capable(hdev))
3570                 update_scan_rsp_data(&req);
3571
3572         err = hci_req_run(&req, set_name_complete);
3573         if (err < 0)
3574                 mgmt_pending_remove(cmd);
3575
3576 failed:
3577         hci_dev_unlock(hdev);
3578         return err;
3579 }
3580
3581 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3582                                void *data, u16 data_len)
3583 {
3584         struct pending_cmd *cmd;
3585         int err;
3586
3587         BT_DBG("%s", hdev->name);
3588
3589         hci_dev_lock(hdev);
3590
3591         if (!hdev_is_powered(hdev)) {
3592                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3593                                  MGMT_STATUS_NOT_POWERED);
3594                 goto unlock;
3595         }
3596
3597         if (!lmp_ssp_capable(hdev)) {
3598                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3599                                  MGMT_STATUS_NOT_SUPPORTED);
3600                 goto unlock;
3601         }
3602
3603         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3604                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3605                                  MGMT_STATUS_BUSY);
3606                 goto unlock;
3607         }
3608
3609         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3610         if (!cmd) {
3611                 err = -ENOMEM;
3612                 goto unlock;
3613         }
3614
3615         if (bredr_sc_enabled(hdev))
3616                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3617                                    0, NULL);
3618         else
3619                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3620
3621         if (err < 0)
3622                 mgmt_pending_remove(cmd);
3623
3624 unlock:
3625         hci_dev_unlock(hdev);
3626         return err;
3627 }
3628
3629 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3630                                void *data, u16 len)
3631 {
3632         int err;
3633
3634         BT_DBG("%s ", hdev->name);
3635
3636         hci_dev_lock(hdev);
3637
3638         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3639                 struct mgmt_cp_add_remote_oob_data *cp = data;
3640                 u8 status;
3641
3642                 if (cp->addr.type != BDADDR_BREDR) {
3643                         err = cmd_complete(sk, hdev->id,
3644                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3645                                            MGMT_STATUS_INVALID_PARAMS,
3646                                            &cp->addr, sizeof(cp->addr));
3647                         goto unlock;
3648                 }
3649
3650                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3651                                               cp->addr.type, cp->hash,
3652                                               cp->rand, NULL, NULL);
3653                 if (err < 0)
3654                         status = MGMT_STATUS_FAILED;
3655                 else
3656                         status = MGMT_STATUS_SUCCESS;
3657
3658                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3659                                    status, &cp->addr, sizeof(cp->addr));
3660         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3661                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3662                 u8 *rand192, *hash192;
3663                 u8 status;
3664
3665                 if (cp->addr.type != BDADDR_BREDR) {
3666                         err = cmd_complete(sk, hdev->id,
3667                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3668                                            MGMT_STATUS_INVALID_PARAMS,
3669                                            &cp->addr, sizeof(cp->addr));
3670                         goto unlock;
3671                 }
3672
3673                 if (bdaddr_type_is_le(cp->addr.type)) {
3674                         rand192 = NULL;
3675                         hash192 = NULL;
3676                 } else {
3677                         rand192 = cp->rand192;
3678                         hash192 = cp->hash192;
3679                 }
3680
3681                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3682                                               cp->addr.type, hash192, rand192,
3683                                               cp->hash256, cp->rand256);
3684                 if (err < 0)
3685                         status = MGMT_STATUS_FAILED;
3686                 else
3687                         status = MGMT_STATUS_SUCCESS;
3688
3689                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3690                                    status, &cp->addr, sizeof(cp->addr));
3691         } else {
3692                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3693                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3694                                  MGMT_STATUS_INVALID_PARAMS);
3695         }
3696
3697 unlock:
3698         hci_dev_unlock(hdev);
3699         return err;
3700 }
3701
3702 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3703                                   void *data, u16 len)
3704 {
3705         struct mgmt_cp_remove_remote_oob_data *cp = data;
3706         u8 status;
3707         int err;
3708
3709         BT_DBG("%s", hdev->name);
3710
3711         if (cp->addr.type != BDADDR_BREDR)
3712                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3713                                     MGMT_STATUS_INVALID_PARAMS,
3714                                     &cp->addr, sizeof(cp->addr));
3715
3716         hci_dev_lock(hdev);
3717
3718         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3719                 hci_remote_oob_data_clear(hdev);
3720                 status = MGMT_STATUS_SUCCESS;
3721                 goto done;
3722         }
3723
3724         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3725         if (err < 0)
3726                 status = MGMT_STATUS_INVALID_PARAMS;
3727         else
3728                 status = MGMT_STATUS_SUCCESS;
3729
3730 done:
3731         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3732                            status, &cp->addr, sizeof(cp->addr));
3733
3734         hci_dev_unlock(hdev);
3735         return err;
3736 }
3737
3738 static bool trigger_discovery(struct hci_request *req, u8 *status)
3739 {
3740         struct hci_dev *hdev = req->hdev;
3741         struct hci_cp_le_set_scan_param param_cp;
3742         struct hci_cp_le_set_scan_enable enable_cp;
3743         struct hci_cp_inquiry inq_cp;
3744         /* General inquiry access code (GIAC) */
3745         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3746         u8 own_addr_type;
3747         int err;
3748
3749         switch (hdev->discovery.type) {
3750         case DISCOV_TYPE_BREDR:
3751                 *status = mgmt_bredr_support(hdev);
3752                 if (*status)
3753                         return false;
3754
3755                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3756                         *status = MGMT_STATUS_BUSY;
3757                         return false;
3758                 }
3759
3760                 hci_inquiry_cache_flush(hdev);
3761
3762                 memset(&inq_cp, 0, sizeof(inq_cp));
3763                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3764                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3765                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3766                 break;
3767
3768         case DISCOV_TYPE_LE:
3769         case DISCOV_TYPE_INTERLEAVED:
3770                 *status = mgmt_le_support(hdev);
3771                 if (*status)
3772                         return false;
3773
3774                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3775                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3776                         *status = MGMT_STATUS_NOT_SUPPORTED;
3777                         return false;
3778                 }
3779
3780                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3781                         /* Don't let discovery abort an outgoing
3782                          * connection attempt that's using directed
3783                          * advertising.
3784                          */
3785                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3786                                                        BT_CONNECT)) {
3787                                 *status = MGMT_STATUS_REJECTED;
3788                                 return false;
3789                         }
3790
3791                         disable_advertising(req);
3792                 }
3793
3794                 /* If controller is scanning, it means the background scanning
3795                  * is running. Thus, we should temporarily stop it in order to
3796                  * set the discovery scanning parameters.
3797                  */
3798                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3799                         hci_req_add_le_scan_disable(req);
3800
3801                 memset(&param_cp, 0, sizeof(param_cp));
3802
3803                 /* All active scans will be done with either a resolvable
3804                  * private address (when privacy feature has been enabled)
3805                  * or non-resolvable private address.
3806                  */
3807                 err = hci_update_random_address(req, true, &own_addr_type);
3808                 if (err < 0) {
3809                         *status = MGMT_STATUS_FAILED;
3810                         return false;
3811                 }
3812
3813                 param_cp.type = LE_SCAN_ACTIVE;
3814                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3815                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3816                 param_cp.own_address_type = own_addr_type;
3817                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3818                             &param_cp);
3819
3820                 memset(&enable_cp, 0, sizeof(enable_cp));
3821                 enable_cp.enable = LE_SCAN_ENABLE;
3822                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3823                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3824                             &enable_cp);
3825                 break;
3826
3827         default:
3828                 *status = MGMT_STATUS_INVALID_PARAMS;
3829                 return false;
3830         }
3831
3832         return true;
3833 }
3834
3835 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3836 {
3837         struct pending_cmd *cmd;
3838         unsigned long timeout;
3839
3840         BT_DBG("status %d", status);
3841
3842         hci_dev_lock(hdev);
3843
3844         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3845         if (!cmd)
3846                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3847
3848         if (cmd) {
3849                 cmd->cmd_complete(cmd, mgmt_status(status));
3850                 mgmt_pending_remove(cmd);
3851         }
3852
3853         if (status) {
3854                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3855                 goto unlock;
3856         }
3857
3858         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3859
3860         switch (hdev->discovery.type) {
3861         case DISCOV_TYPE_LE:
3862                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3863                 break;
3864         case DISCOV_TYPE_INTERLEAVED:
3865                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3866                 break;
3867         case DISCOV_TYPE_BREDR:
3868                 timeout = 0;
3869                 break;
3870         default:
3871                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3872                 timeout = 0;
3873                 break;
3874         }
3875
3876         if (timeout)
3877                 queue_delayed_work(hdev->workqueue,
3878                                    &hdev->le_scan_disable, timeout);
3879
3880 unlock:
3881         hci_dev_unlock(hdev);
3882 }
3883
3884 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3885                            void *data, u16 len)
3886 {
3887         struct mgmt_cp_start_discovery *cp = data;
3888         struct pending_cmd *cmd;
3889         struct hci_request req;
3890         u8 status;
3891         int err;
3892
3893         BT_DBG("%s", hdev->name);
3894
3895         hci_dev_lock(hdev);
3896
3897         if (!hdev_is_powered(hdev)) {
3898                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3899                                    MGMT_STATUS_NOT_POWERED,
3900                                    &cp->type, sizeof(cp->type));
3901                 goto failed;
3902         }
3903
3904         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3905             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3906                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3907                                    MGMT_STATUS_BUSY, &cp->type,
3908                                    sizeof(cp->type));
3909                 goto failed;
3910         }
3911
3912         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3913         if (!cmd) {
3914                 err = -ENOMEM;
3915                 goto failed;
3916         }
3917
3918         cmd->cmd_complete = generic_cmd_complete;
3919
3920         /* Clear the discovery filter first to free any previously
3921          * allocated memory for the UUID list.
3922          */
3923         hci_discovery_filter_clear(hdev);
3924
3925         hdev->discovery.type = cp->type;
3926         hdev->discovery.report_invalid_rssi = false;
3927
3928         hci_req_init(&req, hdev);
3929
3930         if (!trigger_discovery(&req, &status)) {
3931                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3932                                    status, &cp->type, sizeof(cp->type));
3933                 mgmt_pending_remove(cmd);
3934                 goto failed;
3935         }
3936
3937         err = hci_req_run(&req, start_discovery_complete);
3938         if (err < 0) {
3939                 mgmt_pending_remove(cmd);
3940                 goto failed;
3941         }
3942
3943         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3944
3945 failed:
3946         hci_dev_unlock(hdev);
3947         return err;
3948 }
3949
3950 static void service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
3951 {
3952         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param, 1);
3953 }
3954
3955 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3956                                    void *data, u16 len)
3957 {
3958         struct mgmt_cp_start_service_discovery *cp = data;
3959         struct pending_cmd *cmd;
3960         struct hci_request req;
3961         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3962         u16 uuid_count, expected_len;
3963         u8 status;
3964         int err;
3965
3966         BT_DBG("%s", hdev->name);
3967
3968         hci_dev_lock(hdev);
3969
3970         if (!hdev_is_powered(hdev)) {
3971                 err = cmd_complete(sk, hdev->id,
3972                                    MGMT_OP_START_SERVICE_DISCOVERY,
3973                                    MGMT_STATUS_NOT_POWERED,
3974                                    &cp->type, sizeof(cp->type));
3975                 goto failed;
3976         }
3977
3978         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3979             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3980                 err = cmd_complete(sk, hdev->id,
3981                                    MGMT_OP_START_SERVICE_DISCOVERY,
3982                                    MGMT_STATUS_BUSY, &cp->type,
3983                                    sizeof(cp->type));
3984                 goto failed;
3985         }
3986
3987         uuid_count = __le16_to_cpu(cp->uuid_count);
3988         if (uuid_count > max_uuid_count) {
3989                 BT_ERR("service_discovery: too big uuid_count value %u",
3990                        uuid_count);
3991                 err = cmd_complete(sk, hdev->id,
3992                                    MGMT_OP_START_SERVICE_DISCOVERY,
3993                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
3994                                    sizeof(cp->type));
3995                 goto failed;
3996         }
3997
3998         expected_len = sizeof(*cp) + uuid_count * 16;
3999         if (expected_len != len) {
4000                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4001                        expected_len, len);
4002                 err = cmd_complete(sk, hdev->id,
4003                                    MGMT_OP_START_SERVICE_DISCOVERY,
4004                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4005                                    sizeof(cp->type));
4006                 goto failed;
4007         }
4008
4009         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4010                                hdev, data, len);
4011         if (!cmd) {
4012                 err = -ENOMEM;
4013                 goto failed;
4014         }
4015
4016         cmd->cmd_complete = service_discovery_cmd_complete;
4017
4018         /* Clear the discovery filter first to free any previously
4019          * allocated memory for the UUID list.
4020          */
4021         hci_discovery_filter_clear(hdev);
4022
4023         hdev->discovery.type = cp->type;
4024         hdev->discovery.rssi = cp->rssi;
4025         hdev->discovery.uuid_count = uuid_count;
4026
4027         if (uuid_count > 0) {
4028                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4029                                                 GFP_KERNEL);
4030                 if (!hdev->discovery.uuids) {
4031                         err = cmd_complete(sk, hdev->id,
4032                                            MGMT_OP_START_SERVICE_DISCOVERY,
4033                                            MGMT_STATUS_FAILED,
4034                                            &cp->type, sizeof(cp->type));
4035                         mgmt_pending_remove(cmd);
4036                         goto failed;
4037                 }
4038         }
4039
4040         hci_req_init(&req, hdev);
4041
4042         if (!trigger_discovery(&req, &status)) {
4043                 err = cmd_complete(sk, hdev->id,
4044                                    MGMT_OP_START_SERVICE_DISCOVERY,
4045                                    status, &cp->type, sizeof(cp->type));
4046                 mgmt_pending_remove(cmd);
4047                 goto failed;
4048         }
4049
4050         err = hci_req_run(&req, start_discovery_complete);
4051         if (err < 0) {
4052                 mgmt_pending_remove(cmd);
4053                 goto failed;
4054         }
4055
4056         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4057
4058 failed:
4059         hci_dev_unlock(hdev);
4060         return err;
4061 }
4062
4063 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
4064 {
4065         struct pending_cmd *cmd;
4066
4067         BT_DBG("status %d", status);
4068
4069         hci_dev_lock(hdev);
4070
4071         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4072         if (cmd) {
4073                 cmd->cmd_complete(cmd, mgmt_status(status));
4074                 mgmt_pending_remove(cmd);
4075         }
4076
4077         if (!status)
4078                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4079
4080         hci_dev_unlock(hdev);
4081 }
4082
4083 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4084                           u16 len)
4085 {
4086         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4087         struct pending_cmd *cmd;
4088         struct hci_request req;
4089         int err;
4090
4091         BT_DBG("%s", hdev->name);
4092
4093         hci_dev_lock(hdev);
4094
4095         if (!hci_discovery_active(hdev)) {
4096                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4097                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4098                                    sizeof(mgmt_cp->type));
4099                 goto unlock;
4100         }
4101
4102         if (hdev->discovery.type != mgmt_cp->type) {
4103                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4104                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4105                                    sizeof(mgmt_cp->type));
4106                 goto unlock;
4107         }
4108
4109         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4110         if (!cmd) {
4111                 err = -ENOMEM;
4112                 goto unlock;
4113         }
4114
4115         cmd->cmd_complete = generic_cmd_complete;
4116
4117         hci_req_init(&req, hdev);
4118
4119         hci_stop_discovery(&req);
4120
4121         err = hci_req_run(&req, stop_discovery_complete);
4122         if (!err) {
4123                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4124                 goto unlock;
4125         }
4126
4127         mgmt_pending_remove(cmd);
4128
4129         /* If no HCI commands were sent we're done */
4130         if (err == -ENODATA) {
4131                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4132                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4133                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4134         }
4135
4136 unlock:
4137         hci_dev_unlock(hdev);
4138         return err;
4139 }
4140
4141 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4142                         u16 len)
4143 {
4144         struct mgmt_cp_confirm_name *cp = data;
4145         struct inquiry_entry *e;
4146         int err;
4147
4148         BT_DBG("%s", hdev->name);
4149
4150         hci_dev_lock(hdev);
4151
4152         if (!hci_discovery_active(hdev)) {
4153                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4154                                    MGMT_STATUS_FAILED, &cp->addr,
4155                                    sizeof(cp->addr));
4156                 goto failed;
4157         }
4158
4159         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4160         if (!e) {
4161                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4162                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4163                                    sizeof(cp->addr));
4164                 goto failed;
4165         }
4166
4167         if (cp->name_known) {
4168                 e->name_state = NAME_KNOWN;
4169                 list_del(&e->list);
4170         } else {
4171                 e->name_state = NAME_NEEDED;
4172                 hci_inquiry_cache_update_resolve(hdev, e);
4173         }
4174
4175         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4176                            sizeof(cp->addr));
4177
4178 failed:
4179         hci_dev_unlock(hdev);
4180         return err;
4181 }
4182
4183 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4184                         u16 len)
4185 {
4186         struct mgmt_cp_block_device *cp = data;
4187         u8 status;
4188         int err;
4189
4190         BT_DBG("%s", hdev->name);
4191
4192         if (!bdaddr_type_is_valid(cp->addr.type))
4193                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4194                                     MGMT_STATUS_INVALID_PARAMS,
4195                                     &cp->addr, sizeof(cp->addr));
4196
4197         hci_dev_lock(hdev);
4198
4199         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4200                                   cp->addr.type);
4201         if (err < 0) {
4202                 status = MGMT_STATUS_FAILED;
4203                 goto done;
4204         }
4205
4206         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4207                    sk);
4208         status = MGMT_STATUS_SUCCESS;
4209
4210 done:
4211         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4212                            &cp->addr, sizeof(cp->addr));
4213
4214         hci_dev_unlock(hdev);
4215
4216         return err;
4217 }
4218
4219 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4220                           u16 len)
4221 {
4222         struct mgmt_cp_unblock_device *cp = data;
4223         u8 status;
4224         int err;
4225
4226         BT_DBG("%s", hdev->name);
4227
4228         if (!bdaddr_type_is_valid(cp->addr.type))
4229                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4230                                     MGMT_STATUS_INVALID_PARAMS,
4231                                     &cp->addr, sizeof(cp->addr));
4232
4233         hci_dev_lock(hdev);
4234
4235         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4236                                   cp->addr.type);
4237         if (err < 0) {
4238                 status = MGMT_STATUS_INVALID_PARAMS;
4239                 goto done;
4240         }
4241
4242         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4243                    sk);
4244         status = MGMT_STATUS_SUCCESS;
4245
4246 done:
4247         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4248                            &cp->addr, sizeof(cp->addr));
4249
4250         hci_dev_unlock(hdev);
4251
4252         return err;
4253 }
4254
4255 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4256                          u16 len)
4257 {
4258         struct mgmt_cp_set_device_id *cp = data;
4259         struct hci_request req;
4260         int err;
4261         __u16 source;
4262
4263         BT_DBG("%s", hdev->name);
4264
4265         source = __le16_to_cpu(cp->source);
4266
4267         if (source > 0x0002)
4268                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4269                                   MGMT_STATUS_INVALID_PARAMS);
4270
4271         hci_dev_lock(hdev);
4272
4273         hdev->devid_source = source;
4274         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4275         hdev->devid_product = __le16_to_cpu(cp->product);
4276         hdev->devid_version = __le16_to_cpu(cp->version);
4277
4278         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4279
4280         hci_req_init(&req, hdev);
4281         update_eir(&req);
4282         hci_req_run(&req, NULL);
4283
4284         hci_dev_unlock(hdev);
4285
4286         return err;
4287 }
4288
4289 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4290 {
4291         struct cmd_lookup match = { NULL, hdev };
4292
4293         hci_dev_lock(hdev);
4294
4295         if (status) {
4296                 u8 mgmt_err = mgmt_status(status);
4297
4298                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4299                                      cmd_status_rsp, &mgmt_err);
4300                 goto unlock;
4301         }
4302
4303         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4304                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4305         else
4306                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4307
4308         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4309                              &match);
4310
4311         new_settings(hdev, match.sk);
4312
4313         if (match.sk)
4314                 sock_put(match.sk);
4315
4316 unlock:
4317         hci_dev_unlock(hdev);
4318 }
4319
4320 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4321                            u16 len)
4322 {
4323         struct mgmt_mode *cp = data;
4324         struct pending_cmd *cmd;
4325         struct hci_request req;
4326         u8 val, enabled, status;
4327         int err;
4328
4329         BT_DBG("request for %s", hdev->name);
4330
4331         status = mgmt_le_support(hdev);
4332         if (status)
4333                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4334                                   status);
4335
4336         if (cp->val != 0x00 && cp->val != 0x01)
4337                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4338                                   MGMT_STATUS_INVALID_PARAMS);
4339
4340         hci_dev_lock(hdev);
4341
4342         val = !!cp->val;
4343         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4344
4345         /* The following conditions are ones which mean that we should
4346          * not do any HCI communication but directly send a mgmt
4347          * response to user space (after toggling the flag if
4348          * necessary).
4349          */
4350         if (!hdev_is_powered(hdev) || val == enabled ||
4351             hci_conn_num(hdev, LE_LINK) > 0 ||
4352             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4353              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4354                 bool changed = false;
4355
4356                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4357                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4358                         changed = true;
4359                 }
4360
4361                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4362                 if (err < 0)
4363                         goto unlock;
4364
4365                 if (changed)
4366                         err = new_settings(hdev, sk);
4367
4368                 goto unlock;
4369         }
4370
4371         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4372             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4373                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4374                                  MGMT_STATUS_BUSY);
4375                 goto unlock;
4376         }
4377
4378         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4379         if (!cmd) {
4380                 err = -ENOMEM;
4381                 goto unlock;
4382         }
4383
4384         hci_req_init(&req, hdev);
4385
4386         if (val)
4387                 enable_advertising(&req);
4388         else
4389                 disable_advertising(&req);
4390
4391         err = hci_req_run(&req, set_advertising_complete);
4392         if (err < 0)
4393                 mgmt_pending_remove(cmd);
4394
4395 unlock:
4396         hci_dev_unlock(hdev);
4397         return err;
4398 }
4399
4400 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4401                               void *data, u16 len)
4402 {
4403         struct mgmt_cp_set_static_address *cp = data;
4404         int err;
4405
4406         BT_DBG("%s", hdev->name);
4407
4408         if (!lmp_le_capable(hdev))
4409                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4410                                   MGMT_STATUS_NOT_SUPPORTED);
4411
4412         if (hdev_is_powered(hdev))
4413                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4414                                   MGMT_STATUS_REJECTED);
4415
4416         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4417                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4418                         return cmd_status(sk, hdev->id,
4419                                           MGMT_OP_SET_STATIC_ADDRESS,
4420                                           MGMT_STATUS_INVALID_PARAMS);
4421
4422                 /* Two most significant bits shall be set */
4423                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4424                         return cmd_status(sk, hdev->id,
4425                                           MGMT_OP_SET_STATIC_ADDRESS,
4426                                           MGMT_STATUS_INVALID_PARAMS);
4427         }
4428
4429         hci_dev_lock(hdev);
4430
4431         bacpy(&hdev->static_addr, &cp->bdaddr);
4432
4433         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4434
4435         hci_dev_unlock(hdev);
4436
4437         return err;
4438 }
4439
4440 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4441                            void *data, u16 len)
4442 {
4443         struct mgmt_cp_set_scan_params *cp = data;
4444         __u16 interval, window;
4445         int err;
4446
4447         BT_DBG("%s", hdev->name);
4448
4449         if (!lmp_le_capable(hdev))
4450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4451                                   MGMT_STATUS_NOT_SUPPORTED);
4452
4453         interval = __le16_to_cpu(cp->interval);
4454
4455         if (interval < 0x0004 || interval > 0x4000)
4456                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4457                                   MGMT_STATUS_INVALID_PARAMS);
4458
4459         window = __le16_to_cpu(cp->window);
4460
4461         if (window < 0x0004 || window > 0x4000)
4462                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4463                                   MGMT_STATUS_INVALID_PARAMS);
4464
4465         if (window > interval)
4466                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4467                                   MGMT_STATUS_INVALID_PARAMS);
4468
4469         hci_dev_lock(hdev);
4470
4471         hdev->le_scan_interval = interval;
4472         hdev->le_scan_window = window;
4473
4474         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4475
4476         /* If background scan is running, restart it so new parameters are
4477          * loaded.
4478          */
4479         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4480             hdev->discovery.state == DISCOVERY_STOPPED) {
4481                 struct hci_request req;
4482
4483                 hci_req_init(&req, hdev);
4484
4485                 hci_req_add_le_scan_disable(&req);
4486                 hci_req_add_le_passive_scan(&req);
4487
4488                 hci_req_run(&req, NULL);
4489         }
4490
4491         hci_dev_unlock(hdev);
4492
4493         return err;
4494 }
4495
4496 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4497 {
4498         struct pending_cmd *cmd;
4499
4500         BT_DBG("status 0x%02x", status);
4501
4502         hci_dev_lock(hdev);
4503
4504         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4505         if (!cmd)
4506                 goto unlock;
4507
4508         if (status) {
4509                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4510                            mgmt_status(status));
4511         } else {
4512                 struct mgmt_mode *cp = cmd->param;
4513
4514                 if (cp->val)
4515                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4516                 else
4517                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4518
4519                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4520                 new_settings(hdev, cmd->sk);
4521         }
4522
4523         mgmt_pending_remove(cmd);
4524
4525 unlock:
4526         hci_dev_unlock(hdev);
4527 }
4528
4529 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4530                                 void *data, u16 len)
4531 {
4532         struct mgmt_mode *cp = data;
4533         struct pending_cmd *cmd;
4534         struct hci_request req;
4535         int err;
4536
4537         BT_DBG("%s", hdev->name);
4538
4539         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4540             hdev->hci_ver < BLUETOOTH_VER_1_2)
4541                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4542                                   MGMT_STATUS_NOT_SUPPORTED);
4543
4544         if (cp->val != 0x00 && cp->val != 0x01)
4545                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4546                                   MGMT_STATUS_INVALID_PARAMS);
4547
4548         if (!hdev_is_powered(hdev))
4549                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4550                                   MGMT_STATUS_NOT_POWERED);
4551
4552         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4553                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4554                                   MGMT_STATUS_REJECTED);
4555
4556         hci_dev_lock(hdev);
4557
4558         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4559                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560                                  MGMT_STATUS_BUSY);
4561                 goto unlock;
4562         }
4563
4564         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4565                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4566                                         hdev);
4567                 goto unlock;
4568         }
4569
4570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4571                                data, len);
4572         if (!cmd) {
4573                 err = -ENOMEM;
4574                 goto unlock;
4575         }
4576
4577         hci_req_init(&req, hdev);
4578
4579         write_fast_connectable(&req, cp->val);
4580
4581         err = hci_req_run(&req, fast_connectable_complete);
4582         if (err < 0) {
4583                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4584                                  MGMT_STATUS_FAILED);
4585                 mgmt_pending_remove(cmd);
4586         }
4587
4588 unlock:
4589         hci_dev_unlock(hdev);
4590
4591         return err;
4592 }
4593
4594 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4595 {
4596         struct pending_cmd *cmd;
4597
4598         BT_DBG("status 0x%02x", status);
4599
4600         hci_dev_lock(hdev);
4601
4602         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4603         if (!cmd)
4604                 goto unlock;
4605
4606         if (status) {
4607                 u8 mgmt_err = mgmt_status(status);
4608
4609                 /* We need to restore the flag if related HCI commands
4610                  * failed.
4611                  */
4612                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4613
4614                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4615         } else {
4616                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4617                 new_settings(hdev, cmd->sk);
4618         }
4619
4620         mgmt_pending_remove(cmd);
4621
4622 unlock:
4623         hci_dev_unlock(hdev);
4624 }
4625
4626 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4627 {
4628         struct mgmt_mode *cp = data;
4629         struct pending_cmd *cmd;
4630         struct hci_request req;
4631         int err;
4632
4633         BT_DBG("request for %s", hdev->name);
4634
4635         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4636                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4637                                   MGMT_STATUS_NOT_SUPPORTED);
4638
4639         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4640                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4641                                   MGMT_STATUS_REJECTED);
4642
4643         if (cp->val != 0x00 && cp->val != 0x01)
4644                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4645                                   MGMT_STATUS_INVALID_PARAMS);
4646
4647         hci_dev_lock(hdev);
4648
4649         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4650                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4651                 goto unlock;
4652         }
4653
4654         if (!hdev_is_powered(hdev)) {
4655                 if (!cp->val) {
4656                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4657                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4658                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4659                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4660                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4661                 }
4662
4663                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4664
4665                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4666                 if (err < 0)
4667                         goto unlock;
4668
4669                 err = new_settings(hdev, sk);
4670                 goto unlock;
4671         }
4672
4673         /* Reject disabling when powered on */
4674         if (!cp->val) {
4675                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4676                                  MGMT_STATUS_REJECTED);
4677                 goto unlock;
4678         }
4679
4680         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4681                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4682                                  MGMT_STATUS_BUSY);
4683                 goto unlock;
4684         }
4685
4686         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4687         if (!cmd) {
4688                 err = -ENOMEM;
4689                 goto unlock;
4690         }
4691
4692         /* We need to flip the bit already here so that update_adv_data
4693          * generates the correct flags.
4694          */
4695         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4696
4697         hci_req_init(&req, hdev);
4698
4699         write_fast_connectable(&req, false);
4700         hci_update_page_scan(hdev, &req);
4701
4702         /* Since only the advertising data flags will change, there
4703          * is no need to update the scan response data.
4704          */
4705         update_adv_data(&req);
4706
4707         err = hci_req_run(&req, set_bredr_complete);
4708         if (err < 0)
4709                 mgmt_pending_remove(cmd);
4710
4711 unlock:
4712         hci_dev_unlock(hdev);
4713         return err;
4714 }
4715
4716 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4717                            void *data, u16 len)
4718 {
4719         struct mgmt_mode *cp = data;
4720         struct pending_cmd *cmd;
4721         u8 val;
4722         int err;
4723
4724         BT_DBG("request for %s", hdev->name);
4725
4726         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4727             !lmp_sc_capable(hdev) && !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4728                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4729                                   MGMT_STATUS_NOT_SUPPORTED);
4730
4731         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4732                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4733                                   MGMT_STATUS_INVALID_PARAMS);
4734
4735         hci_dev_lock(hdev);
4736
4737         if (!hdev_is_powered(hdev) ||
4738             (!lmp_sc_capable(hdev) &&
4739              !test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) ||
4740             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4741                 bool changed;
4742
4743                 if (cp->val) {
4744                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4745                                                     &hdev->dev_flags);
4746                         if (cp->val == 0x02)
4747                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4748                         else
4749                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4750                 } else {
4751                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4752                                                      &hdev->dev_flags);
4753                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4754                 }
4755
4756                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4757                 if (err < 0)
4758                         goto failed;
4759
4760                 if (changed)
4761                         err = new_settings(hdev, sk);
4762
4763                 goto failed;
4764         }
4765
4766         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4767                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4768                                  MGMT_STATUS_BUSY);
4769                 goto failed;
4770         }
4771
4772         val = !!cp->val;
4773
4774         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4775             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4776                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4777                 goto failed;
4778         }
4779
4780         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4781         if (!cmd) {
4782                 err = -ENOMEM;
4783                 goto failed;
4784         }
4785
4786         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4787         if (err < 0) {
4788                 mgmt_pending_remove(cmd);
4789                 goto failed;
4790         }
4791
4792         if (cp->val == 0x02)
4793                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4794         else
4795                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4796
4797 failed:
4798         hci_dev_unlock(hdev);
4799         return err;
4800 }
4801
4802 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4803                           void *data, u16 len)
4804 {
4805         struct mgmt_mode *cp = data;
4806         bool changed, use_changed;
4807         int err;
4808
4809         BT_DBG("request for %s", hdev->name);
4810
4811         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4812                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4813                                   MGMT_STATUS_INVALID_PARAMS);
4814
4815         hci_dev_lock(hdev);
4816
4817         if (cp->val)
4818                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4819                                             &hdev->dev_flags);
4820         else
4821                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4822                                              &hdev->dev_flags);
4823
4824         if (cp->val == 0x02)
4825                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4826                                                 &hdev->dev_flags);
4827         else
4828                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4829                                                  &hdev->dev_flags);
4830
4831         if (hdev_is_powered(hdev) && use_changed &&
4832             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4833                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4834                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4835                              sizeof(mode), &mode);
4836         }
4837
4838         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4839         if (err < 0)
4840                 goto unlock;
4841
4842         if (changed)
4843                 err = new_settings(hdev, sk);
4844
4845 unlock:
4846         hci_dev_unlock(hdev);
4847         return err;
4848 }
4849
4850 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4851                        u16 len)
4852 {
4853         struct mgmt_cp_set_privacy *cp = cp_data;
4854         bool changed;
4855         int err;
4856
4857         BT_DBG("request for %s", hdev->name);
4858
4859         if (!lmp_le_capable(hdev))
4860                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4861                                   MGMT_STATUS_NOT_SUPPORTED);
4862
4863         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4864                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4865                                   MGMT_STATUS_INVALID_PARAMS);
4866
4867         if (hdev_is_powered(hdev))
4868                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4869                                   MGMT_STATUS_REJECTED);
4870
4871         hci_dev_lock(hdev);
4872
4873         /* If user space supports this command it is also expected to
4874          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4875          */
4876         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4877
4878         if (cp->privacy) {
4879                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4880                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4881                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4882         } else {
4883                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4884                 memset(hdev->irk, 0, sizeof(hdev->irk));
4885                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4886         }
4887
4888         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4889         if (err < 0)
4890                 goto unlock;
4891
4892         if (changed)
4893                 err = new_settings(hdev, sk);
4894
4895 unlock:
4896         hci_dev_unlock(hdev);
4897         return err;
4898 }
4899
4900 static bool irk_is_valid(struct mgmt_irk_info *irk)
4901 {
4902         switch (irk->addr.type) {
4903         case BDADDR_LE_PUBLIC:
4904                 return true;
4905
4906         case BDADDR_LE_RANDOM:
4907                 /* Two most significant bits shall be set */
4908                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4909                         return false;
4910                 return true;
4911         }
4912
4913         return false;
4914 }
4915
4916 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4917                      u16 len)
4918 {
4919         struct mgmt_cp_load_irks *cp = cp_data;
4920         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4921                                    sizeof(struct mgmt_irk_info));
4922         u16 irk_count, expected_len;
4923         int i, err;
4924
4925         BT_DBG("request for %s", hdev->name);
4926
4927         if (!lmp_le_capable(hdev))
4928                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4929                                   MGMT_STATUS_NOT_SUPPORTED);
4930
4931         irk_count = __le16_to_cpu(cp->irk_count);
4932         if (irk_count > max_irk_count) {
4933                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4934                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4935                                   MGMT_STATUS_INVALID_PARAMS);
4936         }
4937
4938         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4939         if (expected_len != len) {
4940                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4941                        expected_len, len);
4942                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4943                                   MGMT_STATUS_INVALID_PARAMS);
4944         }
4945
4946         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4947
4948         for (i = 0; i < irk_count; i++) {
4949                 struct mgmt_irk_info *key = &cp->irks[i];
4950
4951                 if (!irk_is_valid(key))
4952                         return cmd_status(sk, hdev->id,
4953                                           MGMT_OP_LOAD_IRKS,
4954                                           MGMT_STATUS_INVALID_PARAMS);
4955         }
4956
4957         hci_dev_lock(hdev);
4958
4959         hci_smp_irks_clear(hdev);
4960
4961         for (i = 0; i < irk_count; i++) {
4962                 struct mgmt_irk_info *irk = &cp->irks[i];
4963                 u8 addr_type;
4964
4965                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4966                         addr_type = ADDR_LE_DEV_PUBLIC;
4967                 else
4968                         addr_type = ADDR_LE_DEV_RANDOM;
4969
4970                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4971                             BDADDR_ANY);
4972         }
4973
4974         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4975
4976         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4977
4978         hci_dev_unlock(hdev);
4979
4980         return err;
4981 }
4982
4983 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4984 {
4985         if (key->master != 0x00 && key->master != 0x01)
4986                 return false;
4987
4988         switch (key->addr.type) {
4989         case BDADDR_LE_PUBLIC:
4990                 return true;
4991
4992         case BDADDR_LE_RANDOM:
4993                 /* Two most significant bits shall be set */
4994                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4995                         return false;
4996                 return true;
4997         }
4998
4999         return false;
5000 }
5001
5002 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5003                                void *cp_data, u16 len)
5004 {
5005         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5006         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5007                                    sizeof(struct mgmt_ltk_info));
5008         u16 key_count, expected_len;
5009         int i, err;
5010
5011         BT_DBG("request for %s", hdev->name);
5012
5013         if (!lmp_le_capable(hdev))
5014                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5015                                   MGMT_STATUS_NOT_SUPPORTED);
5016
5017         key_count = __le16_to_cpu(cp->key_count);
5018         if (key_count > max_key_count) {
5019                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5020                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5021                                   MGMT_STATUS_INVALID_PARAMS);
5022         }
5023
5024         expected_len = sizeof(*cp) + key_count *
5025                                         sizeof(struct mgmt_ltk_info);
5026         if (expected_len != len) {
5027                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5028                        expected_len, len);
5029                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5030                                   MGMT_STATUS_INVALID_PARAMS);
5031         }
5032
5033         BT_DBG("%s key_count %u", hdev->name, key_count);
5034
5035         for (i = 0; i < key_count; i++) {
5036                 struct mgmt_ltk_info *key = &cp->keys[i];
5037
5038                 if (!ltk_is_valid(key))
5039                         return cmd_status(sk, hdev->id,
5040                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
5041                                           MGMT_STATUS_INVALID_PARAMS);
5042         }
5043
5044         hci_dev_lock(hdev);
5045
5046         hci_smp_ltks_clear(hdev);
5047
5048         for (i = 0; i < key_count; i++) {
5049                 struct mgmt_ltk_info *key = &cp->keys[i];
5050                 u8 type, addr_type, authenticated;
5051
5052                 if (key->addr.type == BDADDR_LE_PUBLIC)
5053                         addr_type = ADDR_LE_DEV_PUBLIC;
5054                 else
5055                         addr_type = ADDR_LE_DEV_RANDOM;
5056
5057                 switch (key->type) {
5058                 case MGMT_LTK_UNAUTHENTICATED:
5059                         authenticated = 0x00;
5060                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5061                         break;
5062                 case MGMT_LTK_AUTHENTICATED:
5063                         authenticated = 0x01;
5064                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5065                         break;
5066                 case MGMT_LTK_P256_UNAUTH:
5067                         authenticated = 0x00;
5068                         type = SMP_LTK_P256;
5069                         break;
5070                 case MGMT_LTK_P256_AUTH:
5071                         authenticated = 0x01;
5072                         type = SMP_LTK_P256;
5073                         break;
5074                 case MGMT_LTK_P256_DEBUG:
5075                         authenticated = 0x00;
5076                         type = SMP_LTK_P256_DEBUG;
5077                 default:
5078                         continue;
5079                 }
5080
5081                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5082                             authenticated, key->val, key->enc_size, key->ediv,
5083                             key->rand);
5084         }
5085
5086         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5087                            NULL, 0);
5088
5089         hci_dev_unlock(hdev);
5090
5091         return err;
5092 }
5093
5094 static void conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5095 {
5096         struct hci_conn *conn = cmd->user_data;
5097         struct mgmt_rp_get_conn_info rp;
5098
5099         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5100
5101         if (status == MGMT_STATUS_SUCCESS) {
5102                 rp.rssi = conn->rssi;
5103                 rp.tx_power = conn->tx_power;
5104                 rp.max_tx_power = conn->max_tx_power;
5105         } else {
5106                 rp.rssi = HCI_RSSI_INVALID;
5107                 rp.tx_power = HCI_TX_POWER_INVALID;
5108                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5109         }
5110
5111         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5112                      &rp, sizeof(rp));
5113
5114         hci_conn_drop(conn);
5115         hci_conn_put(conn);
5116 }
5117
5118 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status)
5119 {
5120         struct hci_cp_read_rssi *cp;
5121         struct pending_cmd *cmd;
5122         struct hci_conn *conn;
5123         u16 handle;
5124         u8 status;
5125
5126         BT_DBG("status 0x%02x", hci_status);
5127
5128         hci_dev_lock(hdev);
5129
5130         /* Commands sent in request are either Read RSSI or Read Transmit Power
5131          * Level so we check which one was last sent to retrieve connection
5132          * handle.  Both commands have handle as first parameter so it's safe to
5133          * cast data on the same command struct.
5134          *
5135          * First command sent is always Read RSSI and we fail only if it fails.
5136          * In other case we simply override error to indicate success as we
5137          * already remembered if TX power value is actually valid.
5138          */
5139         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5140         if (!cp) {
5141                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5142                 status = MGMT_STATUS_SUCCESS;
5143         } else {
5144                 status = mgmt_status(hci_status);
5145         }
5146
5147         if (!cp) {
5148                 BT_ERR("invalid sent_cmd in conn_info response");
5149                 goto unlock;
5150         }
5151
5152         handle = __le16_to_cpu(cp->handle);
5153         conn = hci_conn_hash_lookup_handle(hdev, handle);
5154         if (!conn) {
5155                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5156                 goto unlock;
5157         }
5158
5159         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5160         if (!cmd)
5161                 goto unlock;
5162
5163         cmd->cmd_complete(cmd, status);
5164         mgmt_pending_remove(cmd);
5165
5166 unlock:
5167         hci_dev_unlock(hdev);
5168 }
5169
5170 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5171                          u16 len)
5172 {
5173         struct mgmt_cp_get_conn_info *cp = data;
5174         struct mgmt_rp_get_conn_info rp;
5175         struct hci_conn *conn;
5176         unsigned long conn_info_age;
5177         int err = 0;
5178
5179         BT_DBG("%s", hdev->name);
5180
5181         memset(&rp, 0, sizeof(rp));
5182         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5183         rp.addr.type = cp->addr.type;
5184
5185         if (!bdaddr_type_is_valid(cp->addr.type))
5186                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5187                                     MGMT_STATUS_INVALID_PARAMS,
5188                                     &rp, sizeof(rp));
5189
5190         hci_dev_lock(hdev);
5191
5192         if (!hdev_is_powered(hdev)) {
5193                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5194                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5195                 goto unlock;
5196         }
5197
5198         if (cp->addr.type == BDADDR_BREDR)
5199                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5200                                                &cp->addr.bdaddr);
5201         else
5202                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5203
5204         if (!conn || conn->state != BT_CONNECTED) {
5205                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5206                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5207                 goto unlock;
5208         }
5209
5210         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5211                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5212                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
5213                 goto unlock;
5214         }
5215
5216         /* To avoid client trying to guess when to poll again for information we
5217          * calculate conn info age as random value between min/max set in hdev.
5218          */
5219         conn_info_age = hdev->conn_info_min_age +
5220                         prandom_u32_max(hdev->conn_info_max_age -
5221                                         hdev->conn_info_min_age);
5222
5223         /* Query controller to refresh cached values if they are too old or were
5224          * never read.
5225          */
5226         if (time_after(jiffies, conn->conn_info_timestamp +
5227                        msecs_to_jiffies(conn_info_age)) ||
5228             !conn->conn_info_timestamp) {
5229                 struct hci_request req;
5230                 struct hci_cp_read_tx_power req_txp_cp;
5231                 struct hci_cp_read_rssi req_rssi_cp;
5232                 struct pending_cmd *cmd;
5233
5234                 hci_req_init(&req, hdev);
5235                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5236                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5237                             &req_rssi_cp);
5238
5239                 /* For LE links TX power does not change thus we don't need to
5240                  * query for it once value is known.
5241                  */
5242                 if (!bdaddr_type_is_le(cp->addr.type) ||
5243                     conn->tx_power == HCI_TX_POWER_INVALID) {
5244                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5245                         req_txp_cp.type = 0x00;
5246                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5247                                     sizeof(req_txp_cp), &req_txp_cp);
5248                 }
5249
5250                 /* Max TX power needs to be read only once per connection */
5251                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5252                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5253                         req_txp_cp.type = 0x01;
5254                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5255                                     sizeof(req_txp_cp), &req_txp_cp);
5256                 }
5257
5258                 err = hci_req_run(&req, conn_info_refresh_complete);
5259                 if (err < 0)
5260                         goto unlock;
5261
5262                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5263                                        data, len);
5264                 if (!cmd) {
5265                         err = -ENOMEM;
5266                         goto unlock;
5267                 }
5268
5269                 hci_conn_hold(conn);
5270                 cmd->user_data = hci_conn_get(conn);
5271                 cmd->cmd_complete = conn_info_cmd_complete;
5272
5273                 conn->conn_info_timestamp = jiffies;
5274         } else {
5275                 /* Cache is valid, just reply with values cached in hci_conn */
5276                 rp.rssi = conn->rssi;
5277                 rp.tx_power = conn->tx_power;
5278                 rp.max_tx_power = conn->max_tx_power;
5279
5280                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5281                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5282         }
5283
5284 unlock:
5285         hci_dev_unlock(hdev);
5286         return err;
5287 }
5288
5289 static void clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5290 {
5291         struct hci_conn *conn = cmd->user_data;
5292         struct mgmt_rp_get_clock_info rp;
5293         struct hci_dev *hdev;
5294
5295         memset(&rp, 0, sizeof(rp));
5296         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5297
5298         if (status)
5299                 goto complete;
5300
5301         hdev = hci_dev_get(cmd->index);
5302         if (hdev) {
5303                 rp.local_clock = cpu_to_le32(hdev->clock);
5304                 hci_dev_put(hdev);
5305         }
5306
5307         if (conn) {
5308                 rp.piconet_clock = cpu_to_le32(conn->clock);
5309                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5310         }
5311
5312 complete:
5313         cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, sizeof(rp));
5314
5315         if (conn) {
5316                 hci_conn_drop(conn);
5317                 hci_conn_put(conn);
5318         }
5319 }
5320
5321 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5322 {
5323         struct hci_cp_read_clock *hci_cp;
5324         struct pending_cmd *cmd;
5325         struct hci_conn *conn;
5326
5327         BT_DBG("%s status %u", hdev->name, status);
5328
5329         hci_dev_lock(hdev);
5330
5331         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5332         if (!hci_cp)
5333                 goto unlock;
5334
5335         if (hci_cp->which) {
5336                 u16 handle = __le16_to_cpu(hci_cp->handle);
5337                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5338         } else {
5339                 conn = NULL;
5340         }
5341
5342         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5343         if (!cmd)
5344                 goto unlock;
5345
5346         cmd->cmd_complete(cmd, mgmt_status(status));
5347         mgmt_pending_remove(cmd);
5348
5349 unlock:
5350         hci_dev_unlock(hdev);
5351 }
5352
5353 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5354                          u16 len)
5355 {
5356         struct mgmt_cp_get_clock_info *cp = data;
5357         struct mgmt_rp_get_clock_info rp;
5358         struct hci_cp_read_clock hci_cp;
5359         struct pending_cmd *cmd;
5360         struct hci_request req;
5361         struct hci_conn *conn;
5362         int err;
5363
5364         BT_DBG("%s", hdev->name);
5365
5366         memset(&rp, 0, sizeof(rp));
5367         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5368         rp.addr.type = cp->addr.type;
5369
5370         if (cp->addr.type != BDADDR_BREDR)
5371                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5372                                     MGMT_STATUS_INVALID_PARAMS,
5373                                     &rp, sizeof(rp));
5374
5375         hci_dev_lock(hdev);
5376
5377         if (!hdev_is_powered(hdev)) {
5378                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5379                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5380                 goto unlock;
5381         }
5382
5383         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5384                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5385                                                &cp->addr.bdaddr);
5386                 if (!conn || conn->state != BT_CONNECTED) {
5387                         err = cmd_complete(sk, hdev->id,
5388                                            MGMT_OP_GET_CLOCK_INFO,
5389                                            MGMT_STATUS_NOT_CONNECTED,
5390                                            &rp, sizeof(rp));
5391                         goto unlock;
5392                 }
5393         } else {
5394                 conn = NULL;
5395         }
5396
5397         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5398         if (!cmd) {
5399                 err = -ENOMEM;
5400                 goto unlock;
5401         }
5402
5403         cmd->cmd_complete = clock_info_cmd_complete;
5404
5405         hci_req_init(&req, hdev);
5406
5407         memset(&hci_cp, 0, sizeof(hci_cp));
5408         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5409
5410         if (conn) {
5411                 hci_conn_hold(conn);
5412                 cmd->user_data = hci_conn_get(conn);
5413
5414                 hci_cp.handle = cpu_to_le16(conn->handle);
5415                 hci_cp.which = 0x01; /* Piconet clock */
5416                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5417         }
5418
5419         err = hci_req_run(&req, get_clock_info_complete);
5420         if (err < 0)
5421                 mgmt_pending_remove(cmd);
5422
5423 unlock:
5424         hci_dev_unlock(hdev);
5425         return err;
5426 }
5427
5428 static void device_added(struct sock *sk, struct hci_dev *hdev,
5429                          bdaddr_t *bdaddr, u8 type, u8 action)
5430 {
5431         struct mgmt_ev_device_added ev;
5432
5433         bacpy(&ev.addr.bdaddr, bdaddr);
5434         ev.addr.type = type;
5435         ev.action = action;
5436
5437         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5438 }
5439
5440 static int add_device(struct sock *sk, struct hci_dev *hdev,
5441                       void *data, u16 len)
5442 {
5443         struct mgmt_cp_add_device *cp = data;
5444         u8 auto_conn, addr_type;
5445         int err;
5446
5447         BT_DBG("%s", hdev->name);
5448
5449         if (!bdaddr_type_is_valid(cp->addr.type) ||
5450             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5451                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5452                                     MGMT_STATUS_INVALID_PARAMS,
5453                                     &cp->addr, sizeof(cp->addr));
5454
5455         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5456                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5457                                     MGMT_STATUS_INVALID_PARAMS,
5458                                     &cp->addr, sizeof(cp->addr));
5459
5460         hci_dev_lock(hdev);
5461
5462         if (cp->addr.type == BDADDR_BREDR) {
5463                 /* Only incoming connections action is supported for now */
5464                 if (cp->action != 0x01) {
5465                         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5466                                            MGMT_STATUS_INVALID_PARAMS,
5467                                            &cp->addr, sizeof(cp->addr));
5468                         goto unlock;
5469                 }
5470
5471                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5472                                           cp->addr.type);
5473                 if (err)
5474                         goto unlock;
5475
5476                 hci_update_page_scan(hdev, NULL);
5477
5478                 goto added;
5479         }
5480
5481         if (cp->addr.type == BDADDR_LE_PUBLIC)
5482                 addr_type = ADDR_LE_DEV_PUBLIC;
5483         else
5484                 addr_type = ADDR_LE_DEV_RANDOM;
5485
5486         if (cp->action == 0x02)
5487                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5488         else if (cp->action == 0x01)
5489                 auto_conn = HCI_AUTO_CONN_DIRECT;
5490         else
5491                 auto_conn = HCI_AUTO_CONN_REPORT;
5492
5493         /* If the connection parameters don't exist for this device,
5494          * they will be created and configured with defaults.
5495          */
5496         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5497                                 auto_conn) < 0) {
5498                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5499                                    MGMT_STATUS_FAILED,
5500                                    &cp->addr, sizeof(cp->addr));
5501                 goto unlock;
5502         }
5503
5504 added:
5505         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5506
5507         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5508                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5509
5510 unlock:
5511         hci_dev_unlock(hdev);
5512         return err;
5513 }
5514
5515 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5516                            bdaddr_t *bdaddr, u8 type)
5517 {
5518         struct mgmt_ev_device_removed ev;
5519
5520         bacpy(&ev.addr.bdaddr, bdaddr);
5521         ev.addr.type = type;
5522
5523         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5524 }
5525
5526 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5527                          void *data, u16 len)
5528 {
5529         struct mgmt_cp_remove_device *cp = data;
5530         int err;
5531
5532         BT_DBG("%s", hdev->name);
5533
5534         hci_dev_lock(hdev);
5535
5536         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5537                 struct hci_conn_params *params;
5538                 u8 addr_type;
5539
5540                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5541                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5542                                            MGMT_STATUS_INVALID_PARAMS,
5543                                            &cp->addr, sizeof(cp->addr));
5544                         goto unlock;
5545                 }
5546
5547                 if (cp->addr.type == BDADDR_BREDR) {
5548                         err = hci_bdaddr_list_del(&hdev->whitelist,
5549                                                   &cp->addr.bdaddr,
5550                                                   cp->addr.type);
5551                         if (err) {
5552                                 err = cmd_complete(sk, hdev->id,
5553                                                    MGMT_OP_REMOVE_DEVICE,
5554                                                    MGMT_STATUS_INVALID_PARAMS,
5555                                                    &cp->addr, sizeof(cp->addr));
5556                                 goto unlock;
5557                         }
5558
5559                         hci_update_page_scan(hdev, NULL);
5560
5561                         device_removed(sk, hdev, &cp->addr.bdaddr,
5562                                        cp->addr.type);
5563                         goto complete;
5564                 }
5565
5566                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5567                         addr_type = ADDR_LE_DEV_PUBLIC;
5568                 else
5569                         addr_type = ADDR_LE_DEV_RANDOM;
5570
5571                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5572                                                 addr_type);
5573                 if (!params) {
5574                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5575                                            MGMT_STATUS_INVALID_PARAMS,
5576                                            &cp->addr, sizeof(cp->addr));
5577                         goto unlock;
5578                 }
5579
5580                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5581                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5582                                            MGMT_STATUS_INVALID_PARAMS,
5583                                            &cp->addr, sizeof(cp->addr));
5584                         goto unlock;
5585                 }
5586
5587                 list_del(&params->action);
5588                 list_del(&params->list);
5589                 kfree(params);
5590                 hci_update_background_scan(hdev);
5591
5592                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5593         } else {
5594                 struct hci_conn_params *p, *tmp;
5595                 struct bdaddr_list *b, *btmp;
5596
5597                 if (cp->addr.type) {
5598                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5599                                            MGMT_STATUS_INVALID_PARAMS,
5600                                            &cp->addr, sizeof(cp->addr));
5601                         goto unlock;
5602                 }
5603
5604                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5605                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5606                         list_del(&b->list);
5607                         kfree(b);
5608                 }
5609
5610                 hci_update_page_scan(hdev, NULL);
5611
5612                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5613                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5614                                 continue;
5615                         device_removed(sk, hdev, &p->addr, p->addr_type);
5616                         list_del(&p->action);
5617                         list_del(&p->list);
5618                         kfree(p);
5619                 }
5620
5621                 BT_DBG("All LE connection parameters were removed");
5622
5623                 hci_update_background_scan(hdev);
5624         }
5625
5626 complete:
5627         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5628                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5629
5630 unlock:
5631         hci_dev_unlock(hdev);
5632         return err;
5633 }
5634
5635 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5636                            u16 len)
5637 {
5638         struct mgmt_cp_load_conn_param *cp = data;
5639         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5640                                      sizeof(struct mgmt_conn_param));
5641         u16 param_count, expected_len;
5642         int i;
5643
5644         if (!lmp_le_capable(hdev))
5645                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5646                                   MGMT_STATUS_NOT_SUPPORTED);
5647
5648         param_count = __le16_to_cpu(cp->param_count);
5649         if (param_count > max_param_count) {
5650                 BT_ERR("load_conn_param: too big param_count value %u",
5651                        param_count);
5652                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5653                                   MGMT_STATUS_INVALID_PARAMS);
5654         }
5655
5656         expected_len = sizeof(*cp) + param_count *
5657                                         sizeof(struct mgmt_conn_param);
5658         if (expected_len != len) {
5659                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5660                        expected_len, len);
5661                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5662                                   MGMT_STATUS_INVALID_PARAMS);
5663         }
5664
5665         BT_DBG("%s param_count %u", hdev->name, param_count);
5666
5667         hci_dev_lock(hdev);
5668
5669         hci_conn_params_clear_disabled(hdev);
5670
5671         for (i = 0; i < param_count; i++) {
5672                 struct mgmt_conn_param *param = &cp->params[i];
5673                 struct hci_conn_params *hci_param;
5674                 u16 min, max, latency, timeout;
5675                 u8 addr_type;
5676
5677                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5678                        param->addr.type);
5679
5680                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5681                         addr_type = ADDR_LE_DEV_PUBLIC;
5682                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5683                         addr_type = ADDR_LE_DEV_RANDOM;
5684                 } else {
5685                         BT_ERR("Ignoring invalid connection parameters");
5686                         continue;
5687                 }
5688
5689                 min = le16_to_cpu(param->min_interval);
5690                 max = le16_to_cpu(param->max_interval);
5691                 latency = le16_to_cpu(param->latency);
5692                 timeout = le16_to_cpu(param->timeout);
5693
5694                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5695                        min, max, latency, timeout);
5696
5697                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5698                         BT_ERR("Ignoring invalid connection parameters");
5699                         continue;
5700                 }
5701
5702                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5703                                                 addr_type);
5704                 if (!hci_param) {
5705                         BT_ERR("Failed to add connection parameters");
5706                         continue;
5707                 }
5708
5709                 hci_param->conn_min_interval = min;
5710                 hci_param->conn_max_interval = max;
5711                 hci_param->conn_latency = latency;
5712                 hci_param->supervision_timeout = timeout;
5713         }
5714
5715         hci_dev_unlock(hdev);
5716
5717         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5718 }
5719
5720 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5721                                void *data, u16 len)
5722 {
5723         struct mgmt_cp_set_external_config *cp = data;
5724         bool changed;
5725         int err;
5726
5727         BT_DBG("%s", hdev->name);
5728
5729         if (hdev_is_powered(hdev))
5730                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5731                                   MGMT_STATUS_REJECTED);
5732
5733         if (cp->config != 0x00 && cp->config != 0x01)
5734                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5735                                     MGMT_STATUS_INVALID_PARAMS);
5736
5737         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5738                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5739                                   MGMT_STATUS_NOT_SUPPORTED);
5740
5741         hci_dev_lock(hdev);
5742
5743         if (cp->config)
5744                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5745                                             &hdev->dev_flags);
5746         else
5747                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5748                                              &hdev->dev_flags);
5749
5750         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5751         if (err < 0)
5752                 goto unlock;
5753
5754         if (!changed)
5755                 goto unlock;
5756
5757         err = new_options(hdev, sk);
5758
5759         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5760                 mgmt_index_removed(hdev);
5761
5762                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5763                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5764                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5765
5766                         queue_work(hdev->req_workqueue, &hdev->power_on);
5767                 } else {
5768                         set_bit(HCI_RAW, &hdev->flags);
5769                         mgmt_index_added(hdev);
5770                 }
5771         }
5772
5773 unlock:
5774         hci_dev_unlock(hdev);
5775         return err;
5776 }
5777
5778 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5779                               void *data, u16 len)
5780 {
5781         struct mgmt_cp_set_public_address *cp = data;
5782         bool changed;
5783         int err;
5784
5785         BT_DBG("%s", hdev->name);
5786
5787         if (hdev_is_powered(hdev))
5788                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5789                                   MGMT_STATUS_REJECTED);
5790
5791         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5792                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5793                                   MGMT_STATUS_INVALID_PARAMS);
5794
5795         if (!hdev->set_bdaddr)
5796                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5797                                   MGMT_STATUS_NOT_SUPPORTED);
5798
5799         hci_dev_lock(hdev);
5800
5801         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5802         bacpy(&hdev->public_addr, &cp->bdaddr);
5803
5804         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5805         if (err < 0)
5806                 goto unlock;
5807
5808         if (!changed)
5809                 goto unlock;
5810
5811         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5812                 err = new_options(hdev, sk);
5813
5814         if (is_configured(hdev)) {
5815                 mgmt_index_removed(hdev);
5816
5817                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5818
5819                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5820                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5821
5822                 queue_work(hdev->req_workqueue, &hdev->power_on);
5823         }
5824
5825 unlock:
5826         hci_dev_unlock(hdev);
5827         return err;
5828 }
5829
5830 static const struct mgmt_handler {
5831         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5832                      u16 data_len);
5833         bool var_len;
5834         size_t data_len;
5835 } mgmt_handlers[] = {
5836         { NULL }, /* 0x0000 (no command) */
5837         { read_version,           false, MGMT_READ_VERSION_SIZE },
5838         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5839         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5840         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5841         { set_powered,            false, MGMT_SETTING_SIZE },
5842         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5843         { set_connectable,        false, MGMT_SETTING_SIZE },
5844         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5845         { set_bondable,           false, MGMT_SETTING_SIZE },
5846         { set_link_security,      false, MGMT_SETTING_SIZE },
5847         { set_ssp,                false, MGMT_SETTING_SIZE },
5848         { set_hs,                 false, MGMT_SETTING_SIZE },
5849         { set_le,                 false, MGMT_SETTING_SIZE },
5850         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5851         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5852         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5853         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5854         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5855         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5856         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5857         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5858         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5859         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5860         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5861         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5862         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5863         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5864         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5865         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5866         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5867         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5868         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5869         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5870         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5871         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5872         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5873         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5874         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5875         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5876         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5877         { set_advertising,        false, MGMT_SETTING_SIZE },
5878         { set_bredr,              false, MGMT_SETTING_SIZE },
5879         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5880         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5881         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5882         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5883         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5884         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5885         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5886         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5887         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5888         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5889         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5890         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5891         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5892         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5893         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5894         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
5895 };
5896
5897 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5898 {
5899         void *buf;
5900         u8 *cp;
5901         struct mgmt_hdr *hdr;
5902         u16 opcode, index, len;
5903         struct hci_dev *hdev = NULL;
5904         const struct mgmt_handler *handler;
5905         int err;
5906
5907         BT_DBG("got %zu bytes", msglen);
5908
5909         if (msglen < sizeof(*hdr))
5910                 return -EINVAL;
5911
5912         buf = kmalloc(msglen, GFP_KERNEL);
5913         if (!buf)
5914                 return -ENOMEM;
5915
5916         if (memcpy_from_msg(buf, msg, msglen)) {
5917                 err = -EFAULT;
5918                 goto done;
5919         }
5920
5921         hdr = buf;
5922         opcode = __le16_to_cpu(hdr->opcode);
5923         index = __le16_to_cpu(hdr->index);
5924         len = __le16_to_cpu(hdr->len);
5925
5926         if (len != msglen - sizeof(*hdr)) {
5927                 err = -EINVAL;
5928                 goto done;
5929         }
5930
5931         if (index != MGMT_INDEX_NONE) {
5932                 hdev = hci_dev_get(index);
5933                 if (!hdev) {
5934                         err = cmd_status(sk, index, opcode,
5935                                          MGMT_STATUS_INVALID_INDEX);
5936                         goto done;
5937                 }
5938
5939                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5940                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5941                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5942                         err = cmd_status(sk, index, opcode,
5943                                          MGMT_STATUS_INVALID_INDEX);
5944                         goto done;
5945                 }
5946
5947                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5948                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5949                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5950                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5951                         err = cmd_status(sk, index, opcode,
5952                                          MGMT_STATUS_INVALID_INDEX);
5953                         goto done;
5954                 }
5955         }
5956
5957         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5958             mgmt_handlers[opcode].func == NULL) {
5959                 BT_DBG("Unknown op %u", opcode);
5960                 err = cmd_status(sk, index, opcode,
5961                                  MGMT_STATUS_UNKNOWN_COMMAND);
5962                 goto done;
5963         }
5964
5965         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5966                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5967                 err = cmd_status(sk, index, opcode,
5968                                  MGMT_STATUS_INVALID_INDEX);
5969                 goto done;
5970         }
5971
5972         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5973                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5974                 err = cmd_status(sk, index, opcode,
5975                                  MGMT_STATUS_INVALID_INDEX);
5976                 goto done;
5977         }
5978
5979         handler = &mgmt_handlers[opcode];
5980
5981         if ((handler->var_len && len < handler->data_len) ||
5982             (!handler->var_len && len != handler->data_len)) {
5983                 err = cmd_status(sk, index, opcode,
5984                                  MGMT_STATUS_INVALID_PARAMS);
5985                 goto done;
5986         }
5987
5988         if (hdev)
5989                 mgmt_init_hdev(sk, hdev);
5990
5991         cp = buf + sizeof(*hdr);
5992
5993         err = handler->func(sk, hdev, cp, len);
5994         if (err < 0)
5995                 goto done;
5996
5997         err = msglen;
5998
5999 done:
6000         if (hdev)
6001                 hci_dev_put(hdev);
6002
6003         kfree(buf);
6004         return err;
6005 }
6006
6007 void mgmt_index_added(struct hci_dev *hdev)
6008 {
6009         if (hdev->dev_type != HCI_BREDR)
6010                 return;
6011
6012         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6013                 return;
6014
6015         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6016                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6017         else
6018                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6019 }
6020
6021 void mgmt_index_removed(struct hci_dev *hdev)
6022 {
6023         u8 status = MGMT_STATUS_INVALID_INDEX;
6024
6025         if (hdev->dev_type != HCI_BREDR)
6026                 return;
6027
6028         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6029                 return;
6030
6031         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6032
6033         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6034                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6035         else
6036                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6037 }
6038
6039 /* This function requires the caller holds hdev->lock */
6040 static void restart_le_actions(struct hci_dev *hdev)
6041 {
6042         struct hci_conn_params *p;
6043
6044         list_for_each_entry(p, &hdev->le_conn_params, list) {
6045                 /* Needed for AUTO_OFF case where might not "really"
6046                  * have been powered off.
6047                  */
6048                 list_del_init(&p->action);
6049
6050                 switch (p->auto_connect) {
6051                 case HCI_AUTO_CONN_DIRECT:
6052                 case HCI_AUTO_CONN_ALWAYS:
6053                         list_add(&p->action, &hdev->pend_le_conns);
6054                         break;
6055                 case HCI_AUTO_CONN_REPORT:
6056                         list_add(&p->action, &hdev->pend_le_reports);
6057                         break;
6058                 default:
6059                         break;
6060                 }
6061         }
6062
6063         hci_update_background_scan(hdev);
6064 }
6065
6066 static void powered_complete(struct hci_dev *hdev, u8 status)
6067 {
6068         struct cmd_lookup match = { NULL, hdev };
6069
6070         BT_DBG("status 0x%02x", status);
6071
6072         hci_dev_lock(hdev);
6073
6074         restart_le_actions(hdev);
6075
6076         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6077
6078         new_settings(hdev, match.sk);
6079
6080         hci_dev_unlock(hdev);
6081
6082         if (match.sk)
6083                 sock_put(match.sk);
6084 }
6085
6086 static int powered_update_hci(struct hci_dev *hdev)
6087 {
6088         struct hci_request req;
6089         u8 link_sec;
6090
6091         hci_req_init(&req, hdev);
6092
6093         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6094             !lmp_host_ssp_capable(hdev)) {
6095                 u8 ssp = 1;
6096
6097                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
6098         }
6099
6100         if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6101                 u8 sc = 0x01;
6102                 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, sizeof(sc), &sc);
6103         }
6104
6105         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6106             lmp_bredr_capable(hdev)) {
6107                 struct hci_cp_write_le_host_supported cp;
6108
6109                 cp.le = 0x01;
6110                 cp.simul = 0x00;
6111
6112                 /* Check first if we already have the right
6113                  * host state (host features set)
6114                  */
6115                 if (cp.le != lmp_host_le_capable(hdev) ||
6116                     cp.simul != lmp_host_le_br_capable(hdev))
6117                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6118                                     sizeof(cp), &cp);
6119         }
6120
6121         if (lmp_le_capable(hdev)) {
6122                 /* Make sure the controller has a good default for
6123                  * advertising data. This also applies to the case
6124                  * where BR/EDR was toggled during the AUTO_OFF phase.
6125                  */
6126                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6127                         update_adv_data(&req);
6128                         update_scan_rsp_data(&req);
6129                 }
6130
6131                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6132                         enable_advertising(&req);
6133         }
6134
6135         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6136         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6137                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6138                             sizeof(link_sec), &link_sec);
6139
6140         if (lmp_bredr_capable(hdev)) {
6141                 write_fast_connectable(&req, false);
6142                 hci_update_page_scan(hdev, &req);
6143                 update_class(&req);
6144                 update_name(&req);
6145                 update_eir(&req);
6146         }
6147
6148         return hci_req_run(&req, powered_complete);
6149 }
6150
6151 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6152 {
6153         struct cmd_lookup match = { NULL, hdev };
6154         u8 status, zero_cod[] = { 0, 0, 0 };
6155         int err;
6156
6157         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6158                 return 0;
6159
6160         if (powered) {
6161                 if (powered_update_hci(hdev) == 0)
6162                         return 0;
6163
6164                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6165                                      &match);
6166                 goto new_settings;
6167         }
6168
6169         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6170
6171         /* If the power off is because of hdev unregistration let
6172          * use the appropriate INVALID_INDEX status. Otherwise use
6173          * NOT_POWERED. We cover both scenarios here since later in
6174          * mgmt_index_removed() any hci_conn callbacks will have already
6175          * been triggered, potentially causing misleading DISCONNECTED
6176          * status responses.
6177          */
6178         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6179                 status = MGMT_STATUS_INVALID_INDEX;
6180         else
6181                 status = MGMT_STATUS_NOT_POWERED;
6182
6183         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6184
6185         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6186                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6187                            zero_cod, sizeof(zero_cod), NULL);
6188
6189 new_settings:
6190         err = new_settings(hdev, match.sk);
6191
6192         if (match.sk)
6193                 sock_put(match.sk);
6194
6195         return err;
6196 }
6197
6198 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6199 {
6200         struct pending_cmd *cmd;
6201         u8 status;
6202
6203         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6204         if (!cmd)
6205                 return;
6206
6207         if (err == -ERFKILL)
6208                 status = MGMT_STATUS_RFKILLED;
6209         else
6210                 status = MGMT_STATUS_FAILED;
6211
6212         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6213
6214         mgmt_pending_remove(cmd);
6215 }
6216
6217 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6218 {
6219         struct hci_request req;
6220
6221         hci_dev_lock(hdev);
6222
6223         /* When discoverable timeout triggers, then just make sure
6224          * the limited discoverable flag is cleared. Even in the case
6225          * of a timeout triggered from general discoverable, it is
6226          * safe to unconditionally clear the flag.
6227          */
6228         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6229         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6230
6231         hci_req_init(&req, hdev);
6232         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6233                 u8 scan = SCAN_PAGE;
6234                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6235                             sizeof(scan), &scan);
6236         }
6237         update_class(&req);
6238         update_adv_data(&req);
6239         hci_req_run(&req, NULL);
6240
6241         hdev->discov_timeout = 0;
6242
6243         new_settings(hdev, NULL);
6244
6245         hci_dev_unlock(hdev);
6246 }
6247
6248 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6249                        bool persistent)
6250 {
6251         struct mgmt_ev_new_link_key ev;
6252
6253         memset(&ev, 0, sizeof(ev));
6254
6255         ev.store_hint = persistent;
6256         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6257         ev.key.addr.type = BDADDR_BREDR;
6258         ev.key.type = key->type;
6259         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6260         ev.key.pin_len = key->pin_len;
6261
6262         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6263 }
6264
6265 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6266 {
6267         switch (ltk->type) {
6268         case SMP_LTK:
6269         case SMP_LTK_SLAVE:
6270                 if (ltk->authenticated)
6271                         return MGMT_LTK_AUTHENTICATED;
6272                 return MGMT_LTK_UNAUTHENTICATED;
6273         case SMP_LTK_P256:
6274                 if (ltk->authenticated)
6275                         return MGMT_LTK_P256_AUTH;
6276                 return MGMT_LTK_P256_UNAUTH;
6277         case SMP_LTK_P256_DEBUG:
6278                 return MGMT_LTK_P256_DEBUG;
6279         }
6280
6281         return MGMT_LTK_UNAUTHENTICATED;
6282 }
6283
6284 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6285 {
6286         struct mgmt_ev_new_long_term_key ev;
6287
6288         memset(&ev, 0, sizeof(ev));
6289
6290         /* Devices using resolvable or non-resolvable random addresses
6291          * without providing an indentity resolving key don't require
6292          * to store long term keys. Their addresses will change the
6293          * next time around.
6294          *
6295          * Only when a remote device provides an identity address
6296          * make sure the long term key is stored. If the remote
6297          * identity is known, the long term keys are internally
6298          * mapped to the identity address. So allow static random
6299          * and public addresses here.
6300          */
6301         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6302             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6303                 ev.store_hint = 0x00;
6304         else
6305                 ev.store_hint = persistent;
6306
6307         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6308         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6309         ev.key.type = mgmt_ltk_type(key);
6310         ev.key.enc_size = key->enc_size;
6311         ev.key.ediv = key->ediv;
6312         ev.key.rand = key->rand;
6313
6314         if (key->type == SMP_LTK)
6315                 ev.key.master = 1;
6316
6317         memcpy(ev.key.val, key->val, sizeof(key->val));
6318
6319         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6320 }
6321
6322 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6323 {
6324         struct mgmt_ev_new_irk ev;
6325
6326         memset(&ev, 0, sizeof(ev));
6327
6328         /* For identity resolving keys from devices that are already
6329          * using a public address or static random address, do not
6330          * ask for storing this key. The identity resolving key really
6331          * is only mandatory for devices using resovlable random
6332          * addresses.
6333          *
6334          * Storing all identity resolving keys has the downside that
6335          * they will be also loaded on next boot of they system. More
6336          * identity resolving keys, means more time during scanning is
6337          * needed to actually resolve these addresses.
6338          */
6339         if (bacmp(&irk->rpa, BDADDR_ANY))
6340                 ev.store_hint = 0x01;
6341         else
6342                 ev.store_hint = 0x00;
6343
6344         bacpy(&ev.rpa, &irk->rpa);
6345         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6346         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6347         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6348
6349         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6350 }
6351
6352 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6353                    bool persistent)
6354 {
6355         struct mgmt_ev_new_csrk ev;
6356
6357         memset(&ev, 0, sizeof(ev));
6358
6359         /* Devices using resolvable or non-resolvable random addresses
6360          * without providing an indentity resolving key don't require
6361          * to store signature resolving keys. Their addresses will change
6362          * the next time around.
6363          *
6364          * Only when a remote device provides an identity address
6365          * make sure the signature resolving key is stored. So allow
6366          * static random and public addresses here.
6367          */
6368         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6369             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6370                 ev.store_hint = 0x00;
6371         else
6372                 ev.store_hint = persistent;
6373
6374         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6375         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6376         ev.key.master = csrk->master;
6377         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6378
6379         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6380 }
6381
6382 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6383                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6384                          u16 max_interval, u16 latency, u16 timeout)
6385 {
6386         struct mgmt_ev_new_conn_param ev;
6387
6388         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6389                 return;
6390
6391         memset(&ev, 0, sizeof(ev));
6392         bacpy(&ev.addr.bdaddr, bdaddr);
6393         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6394         ev.store_hint = store_hint;
6395         ev.min_interval = cpu_to_le16(min_interval);
6396         ev.max_interval = cpu_to_le16(max_interval);
6397         ev.latency = cpu_to_le16(latency);
6398         ev.timeout = cpu_to_le16(timeout);
6399
6400         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6401 }
6402
6403 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6404                                   u8 data_len)
6405 {
6406         eir[eir_len++] = sizeof(type) + data_len;
6407         eir[eir_len++] = type;
6408         memcpy(&eir[eir_len], data, data_len);
6409         eir_len += data_len;
6410
6411         return eir_len;
6412 }
6413
6414 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6415                            u32 flags, u8 *name, u8 name_len)
6416 {
6417         char buf[512];
6418         struct mgmt_ev_device_connected *ev = (void *) buf;
6419         u16 eir_len = 0;
6420
6421         bacpy(&ev->addr.bdaddr, &conn->dst);
6422         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6423
6424         ev->flags = __cpu_to_le32(flags);
6425
6426         /* We must ensure that the EIR Data fields are ordered and
6427          * unique. Keep it simple for now and avoid the problem by not
6428          * adding any BR/EDR data to the LE adv.
6429          */
6430         if (conn->le_adv_data_len > 0) {
6431                 memcpy(&ev->eir[eir_len],
6432                        conn->le_adv_data, conn->le_adv_data_len);
6433                 eir_len = conn->le_adv_data_len;
6434         } else {
6435                 if (name_len > 0)
6436                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6437                                                   name, name_len);
6438
6439                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6440                         eir_len = eir_append_data(ev->eir, eir_len,
6441                                                   EIR_CLASS_OF_DEV,
6442                                                   conn->dev_class, 3);
6443         }
6444
6445         ev->eir_len = cpu_to_le16(eir_len);
6446
6447         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6448                     sizeof(*ev) + eir_len, NULL);
6449 }
6450
6451 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6452 {
6453         struct sock **sk = data;
6454
6455         cmd->cmd_complete(cmd, 0);
6456
6457         *sk = cmd->sk;
6458         sock_hold(*sk);
6459
6460         mgmt_pending_remove(cmd);
6461 }
6462
6463 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6464 {
6465         struct hci_dev *hdev = data;
6466         struct mgmt_cp_unpair_device *cp = cmd->param;
6467
6468         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6469
6470         cmd->cmd_complete(cmd, 0);
6471         mgmt_pending_remove(cmd);
6472 }
6473
6474 bool mgmt_powering_down(struct hci_dev *hdev)
6475 {
6476         struct pending_cmd *cmd;
6477         struct mgmt_mode *cp;
6478
6479         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6480         if (!cmd)
6481                 return false;
6482
6483         cp = cmd->param;
6484         if (!cp->val)
6485                 return true;
6486
6487         return false;
6488 }
6489
6490 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6491                               u8 link_type, u8 addr_type, u8 reason,
6492                               bool mgmt_connected)
6493 {
6494         struct mgmt_ev_device_disconnected ev;
6495         struct sock *sk = NULL;
6496
6497         /* The connection is still in hci_conn_hash so test for 1
6498          * instead of 0 to know if this is the last one.
6499          */
6500         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6501                 cancel_delayed_work(&hdev->power_off);
6502                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6503         }
6504
6505         if (!mgmt_connected)
6506                 return;
6507
6508         if (link_type != ACL_LINK && link_type != LE_LINK)
6509                 return;
6510
6511         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6512
6513         bacpy(&ev.addr.bdaddr, bdaddr);
6514         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6515         ev.reason = reason;
6516
6517         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6518
6519         if (sk)
6520                 sock_put(sk);
6521
6522         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6523                              hdev);
6524 }
6525
6526 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6527                             u8 link_type, u8 addr_type, u8 status)
6528 {
6529         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6530         struct mgmt_cp_disconnect *cp;
6531         struct pending_cmd *cmd;
6532
6533         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6534                              hdev);
6535
6536         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6537         if (!cmd)
6538                 return;
6539
6540         cp = cmd->param;
6541
6542         if (bacmp(bdaddr, &cp->addr.bdaddr))
6543                 return;
6544
6545         if (cp->addr.type != bdaddr_type)
6546                 return;
6547
6548         cmd->cmd_complete(cmd, mgmt_status(status));
6549         mgmt_pending_remove(cmd);
6550 }
6551
6552 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6553                          u8 addr_type, u8 status)
6554 {
6555         struct mgmt_ev_connect_failed ev;
6556
6557         /* The connection is still in hci_conn_hash so test for 1
6558          * instead of 0 to know if this is the last one.
6559          */
6560         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6561                 cancel_delayed_work(&hdev->power_off);
6562                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6563         }
6564
6565         bacpy(&ev.addr.bdaddr, bdaddr);
6566         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6567         ev.status = mgmt_status(status);
6568
6569         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6570 }
6571
6572 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6573 {
6574         struct mgmt_ev_pin_code_request ev;
6575
6576         bacpy(&ev.addr.bdaddr, bdaddr);
6577         ev.addr.type = BDADDR_BREDR;
6578         ev.secure = secure;
6579
6580         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6581 }
6582
6583 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6584                                   u8 status)
6585 {
6586         struct pending_cmd *cmd;
6587
6588         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6589         if (!cmd)
6590                 return;
6591
6592         cmd->cmd_complete(cmd, mgmt_status(status));
6593         mgmt_pending_remove(cmd);
6594 }
6595
6596 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6597                                       u8 status)
6598 {
6599         struct pending_cmd *cmd;
6600
6601         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6602         if (!cmd)
6603                 return;
6604
6605         cmd->cmd_complete(cmd, mgmt_status(status));
6606         mgmt_pending_remove(cmd);
6607 }
6608
6609 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6610                               u8 link_type, u8 addr_type, u32 value,
6611                               u8 confirm_hint)
6612 {
6613         struct mgmt_ev_user_confirm_request ev;
6614
6615         BT_DBG("%s", hdev->name);
6616
6617         bacpy(&ev.addr.bdaddr, bdaddr);
6618         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6619         ev.confirm_hint = confirm_hint;
6620         ev.value = cpu_to_le32(value);
6621
6622         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6623                           NULL);
6624 }
6625
6626 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6627                               u8 link_type, u8 addr_type)
6628 {
6629         struct mgmt_ev_user_passkey_request ev;
6630
6631         BT_DBG("%s", hdev->name);
6632
6633         bacpy(&ev.addr.bdaddr, bdaddr);
6634         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6635
6636         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6637                           NULL);
6638 }
6639
6640 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6641                                       u8 link_type, u8 addr_type, u8 status,
6642                                       u8 opcode)
6643 {
6644         struct pending_cmd *cmd;
6645
6646         cmd = mgmt_pending_find(opcode, hdev);
6647         if (!cmd)
6648                 return -ENOENT;
6649
6650         cmd->cmd_complete(cmd, mgmt_status(status));
6651         mgmt_pending_remove(cmd);
6652
6653         return 0;
6654 }
6655
6656 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6657                                      u8 link_type, u8 addr_type, u8 status)
6658 {
6659         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6660                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6661 }
6662
6663 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6664                                          u8 link_type, u8 addr_type, u8 status)
6665 {
6666         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6667                                           status,
6668                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6669 }
6670
6671 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6672                                      u8 link_type, u8 addr_type, u8 status)
6673 {
6674         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6675                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6676 }
6677
6678 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6679                                          u8 link_type, u8 addr_type, u8 status)
6680 {
6681         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6682                                           status,
6683                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6684 }
6685
6686 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6687                              u8 link_type, u8 addr_type, u32 passkey,
6688                              u8 entered)
6689 {
6690         struct mgmt_ev_passkey_notify ev;
6691
6692         BT_DBG("%s", hdev->name);
6693
6694         bacpy(&ev.addr.bdaddr, bdaddr);
6695         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6696         ev.passkey = __cpu_to_le32(passkey);
6697         ev.entered = entered;
6698
6699         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6700 }
6701
6702 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6703 {
6704         struct mgmt_ev_auth_failed ev;
6705         struct pending_cmd *cmd;
6706         u8 status = mgmt_status(hci_status);
6707
6708         bacpy(&ev.addr.bdaddr, &conn->dst);
6709         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6710         ev.status = status;
6711
6712         cmd = find_pairing(conn);
6713
6714         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6715                     cmd ? cmd->sk : NULL);
6716
6717         if (cmd) {
6718                 cmd->cmd_complete(cmd, status);
6719                 mgmt_pending_remove(cmd);
6720         }
6721 }
6722
6723 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6724 {
6725         struct cmd_lookup match = { NULL, hdev };
6726         bool changed;
6727
6728         if (status) {
6729                 u8 mgmt_err = mgmt_status(status);
6730                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6731                                      cmd_status_rsp, &mgmt_err);
6732                 return;
6733         }
6734
6735         if (test_bit(HCI_AUTH, &hdev->flags))
6736                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6737                                             &hdev->dev_flags);
6738         else
6739                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6740                                              &hdev->dev_flags);
6741
6742         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6743                              &match);
6744
6745         if (changed)
6746                 new_settings(hdev, match.sk);
6747
6748         if (match.sk)
6749                 sock_put(match.sk);
6750 }
6751
6752 static void clear_eir(struct hci_request *req)
6753 {
6754         struct hci_dev *hdev = req->hdev;
6755         struct hci_cp_write_eir cp;
6756
6757         if (!lmp_ext_inq_capable(hdev))
6758                 return;
6759
6760         memset(hdev->eir, 0, sizeof(hdev->eir));
6761
6762         memset(&cp, 0, sizeof(cp));
6763
6764         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6765 }
6766
6767 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6768 {
6769         struct cmd_lookup match = { NULL, hdev };
6770         struct hci_request req;
6771         bool changed = false;
6772
6773         if (status) {
6774                 u8 mgmt_err = mgmt_status(status);
6775
6776                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6777                                                  &hdev->dev_flags)) {
6778                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6779                         new_settings(hdev, NULL);
6780                 }
6781
6782                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6783                                      &mgmt_err);
6784                 return;
6785         }
6786
6787         if (enable) {
6788                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6789         } else {
6790                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6791                 if (!changed)
6792                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6793                                                      &hdev->dev_flags);
6794                 else
6795                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6796         }
6797
6798         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6799
6800         if (changed)
6801                 new_settings(hdev, match.sk);
6802
6803         if (match.sk)
6804                 sock_put(match.sk);
6805
6806         hci_req_init(&req, hdev);
6807
6808         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6809                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6810                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6811                                     sizeof(enable), &enable);
6812                 update_eir(&req);
6813         } else {
6814                 clear_eir(&req);
6815         }
6816
6817         hci_req_run(&req, NULL);
6818 }
6819
6820 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6821 {
6822         struct cmd_lookup match = { NULL, hdev };
6823         bool changed = false;
6824
6825         if (status) {
6826                 u8 mgmt_err = mgmt_status(status);
6827
6828                 if (enable) {
6829                         if (test_and_clear_bit(HCI_SC_ENABLED,
6830                                                &hdev->dev_flags))
6831                                 new_settings(hdev, NULL);
6832                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6833                 }
6834
6835                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6836                                      cmd_status_rsp, &mgmt_err);
6837                 return;
6838         }
6839
6840         if (enable) {
6841                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6842         } else {
6843                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6844                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6845         }
6846
6847         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6848                              settings_rsp, &match);
6849
6850         if (changed)
6851                 new_settings(hdev, match.sk);
6852
6853         if (match.sk)
6854                 sock_put(match.sk);
6855 }
6856
6857 static void sk_lookup(struct pending_cmd *cmd, void *data)
6858 {
6859         struct cmd_lookup *match = data;
6860
6861         if (match->sk == NULL) {
6862                 match->sk = cmd->sk;
6863                 sock_hold(match->sk);
6864         }
6865 }
6866
6867 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6868                                     u8 status)
6869 {
6870         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6871
6872         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6873         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6874         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6875
6876         if (!status)
6877                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6878                            NULL);
6879
6880         if (match.sk)
6881                 sock_put(match.sk);
6882 }
6883
6884 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6885 {
6886         struct mgmt_cp_set_local_name ev;
6887         struct pending_cmd *cmd;
6888
6889         if (status)
6890                 return;
6891
6892         memset(&ev, 0, sizeof(ev));
6893         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6894         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6895
6896         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6897         if (!cmd) {
6898                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6899
6900                 /* If this is a HCI command related to powering on the
6901                  * HCI dev don't send any mgmt signals.
6902                  */
6903                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6904                         return;
6905         }
6906
6907         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6908                    cmd ? cmd->sk : NULL);
6909 }
6910
6911 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6912                                        u8 *rand192, u8 *hash256, u8 *rand256,
6913                                        u8 status)
6914 {
6915         struct pending_cmd *cmd;
6916
6917         BT_DBG("%s status %u", hdev->name, status);
6918
6919         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6920         if (!cmd)
6921                 return;
6922
6923         if (status) {
6924                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6925                            mgmt_status(status));
6926         } else {
6927                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
6928                         struct mgmt_rp_read_local_oob_ext_data rp;
6929
6930                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6931                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
6932
6933                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6934                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
6935
6936                         cmd_complete(cmd->sk, hdev->id,
6937                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6938                                      &rp, sizeof(rp));
6939                 } else {
6940                         struct mgmt_rp_read_local_oob_data rp;
6941
6942                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6943                         memcpy(rp.rand, rand192, sizeof(rp.rand));
6944
6945                         cmd_complete(cmd->sk, hdev->id,
6946                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6947                                      &rp, sizeof(rp));
6948                 }
6949         }
6950
6951         mgmt_pending_remove(cmd);
6952 }
6953
6954 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
6955 {
6956         int i;
6957
6958         for (i = 0; i < uuid_count; i++) {
6959                 if (!memcmp(uuid, uuids[i], 16))
6960                         return true;
6961         }
6962
6963         return false;
6964 }
6965
6966 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
6967 {
6968         u16 parsed = 0;
6969
6970         while (parsed < eir_len) {
6971                 u8 field_len = eir[0];
6972                 u8 uuid[16];
6973                 int i;
6974
6975                 if (field_len == 0)
6976                         break;
6977
6978                 if (eir_len - parsed < field_len + 1)
6979                         break;
6980
6981                 switch (eir[1]) {
6982                 case EIR_UUID16_ALL:
6983                 case EIR_UUID16_SOME:
6984                         for (i = 0; i + 3 <= field_len; i += 2) {
6985                                 memcpy(uuid, bluetooth_base_uuid, 16);
6986                                 uuid[13] = eir[i + 3];
6987                                 uuid[12] = eir[i + 2];
6988                                 if (has_uuid(uuid, uuid_count, uuids))
6989                                         return true;
6990                         }
6991                         break;
6992                 case EIR_UUID32_ALL:
6993                 case EIR_UUID32_SOME:
6994                         for (i = 0; i + 5 <= field_len; i += 4) {
6995                                 memcpy(uuid, bluetooth_base_uuid, 16);
6996                                 uuid[15] = eir[i + 5];
6997                                 uuid[14] = eir[i + 4];
6998                                 uuid[13] = eir[i + 3];
6999                                 uuid[12] = eir[i + 2];
7000                                 if (has_uuid(uuid, uuid_count, uuids))
7001                                         return true;
7002                         }
7003                         break;
7004                 case EIR_UUID128_ALL:
7005                 case EIR_UUID128_SOME:
7006                         for (i = 0; i + 17 <= field_len; i += 16) {
7007                                 memcpy(uuid, eir + i + 2, 16);
7008                                 if (has_uuid(uuid, uuid_count, uuids))
7009                                         return true;
7010                         }
7011                         break;
7012                 }
7013
7014                 parsed += field_len + 1;
7015                 eir += field_len + 1;
7016         }
7017
7018         return false;
7019 }
7020
7021 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7022                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7023                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7024 {
7025         char buf[512];
7026         struct mgmt_ev_device_found *ev = (void *) buf;
7027         size_t ev_size;
7028         bool match;
7029
7030         /* Don't send events for a non-kernel initiated discovery. With
7031          * LE one exception is if we have pend_le_reports > 0 in which
7032          * case we're doing passive scanning and want these events.
7033          */
7034         if (!hci_discovery_active(hdev)) {
7035                 if (link_type == ACL_LINK)
7036                         return;
7037                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7038                         return;
7039         }
7040
7041         /* When using service discovery with a RSSI threshold, then check
7042          * if such a RSSI threshold is specified. If a RSSI threshold has
7043          * been specified, then all results with a RSSI smaller than the
7044          * RSSI threshold will be dropped.
7045          *
7046          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7047          * the results are also dropped.
7048          */
7049         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7050             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
7051                 return;
7052
7053         /* Make sure that the buffer is big enough. The 5 extra bytes
7054          * are for the potential CoD field.
7055          */
7056         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7057                 return;
7058
7059         memset(buf, 0, sizeof(buf));
7060
7061         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7062          * RSSI value was reported as 0 when not available. This behavior
7063          * is kept when using device discovery. This is required for full
7064          * backwards compatibility with the API.
7065          *
7066          * However when using service discovery, the value 127 will be
7067          * returned when the RSSI is not available.
7068          */
7069         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi)
7070                 rssi = 0;
7071
7072         bacpy(&ev->addr.bdaddr, bdaddr);
7073         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7074         ev->rssi = rssi;
7075         ev->flags = cpu_to_le32(flags);
7076
7077         if (eir_len > 0) {
7078                 /* When using service discovery and a list of UUID is
7079                  * provided, results with no matching UUID should be
7080                  * dropped. In case there is a match the result is
7081                  * kept and checking possible scan response data
7082                  * will be skipped.
7083                  */
7084                 if (hdev->discovery.uuid_count > 0) {
7085                         match = eir_has_uuids(eir, eir_len,
7086                                               hdev->discovery.uuid_count,
7087                                               hdev->discovery.uuids);
7088                         if (!match)
7089                                 return;
7090                 }
7091
7092                 /* Copy EIR or advertising data into event */
7093                 memcpy(ev->eir, eir, eir_len);
7094         } else {
7095                 /* When using service discovery and a list of UUID is
7096                  * provided, results with empty EIR or advertising data
7097                  * should be dropped since they do not match any UUID.
7098                  */
7099                 if (hdev->discovery.uuid_count > 0)
7100                         return;
7101         }
7102
7103         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7104                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7105                                           dev_class, 3);
7106
7107         if (scan_rsp_len > 0) {
7108                 /* When using service discovery and a list of UUID is
7109                  * provided, results with no matching UUID should be
7110                  * dropped if there is no previous match from the
7111                  * advertising data.
7112                  */
7113                 if (hdev->discovery.uuid_count > 0) {
7114                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7115                                                      hdev->discovery.uuid_count,
7116                                                      hdev->discovery.uuids))
7117                                 return;
7118                 }
7119
7120                 /* Append scan response data to event */
7121                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7122         } else {
7123                 /* When using service discovery and a list of UUID is
7124                  * provided, results with empty scan response and no
7125                  * previous matched advertising data should be dropped.
7126                  */
7127                 if (hdev->discovery.uuid_count > 0 && !match)
7128                         return;
7129         }
7130
7131         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7132         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7133
7134         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7135 }
7136
7137 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7138                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7139 {
7140         struct mgmt_ev_device_found *ev;
7141         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7142         u16 eir_len;
7143
7144         ev = (struct mgmt_ev_device_found *) buf;
7145
7146         memset(buf, 0, sizeof(buf));
7147
7148         bacpy(&ev->addr.bdaddr, bdaddr);
7149         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7150         ev->rssi = rssi;
7151
7152         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7153                                   name_len);
7154
7155         ev->eir_len = cpu_to_le16(eir_len);
7156
7157         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7158 }
7159
7160 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7161 {
7162         struct mgmt_ev_discovering ev;
7163
7164         BT_DBG("%s discovering %u", hdev->name, discovering);
7165
7166         memset(&ev, 0, sizeof(ev));
7167         ev.type = hdev->discovery.type;
7168         ev.discovering = discovering;
7169
7170         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7171 }
7172
7173 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
7174 {
7175         BT_DBG("%s status %u", hdev->name, status);
7176 }
7177
7178 void mgmt_reenable_advertising(struct hci_dev *hdev)
7179 {
7180         struct hci_request req;
7181
7182         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7183                 return;
7184
7185         hci_req_init(&req, hdev);
7186         enable_advertising(&req);
7187         hci_req_run(&req, adv_enable_complete);
7188 }