net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "hci_request.h"
  36 #include "smp.h"
  37
  38 #define MGMT_VERSION    1
  39 #define MGMT_REVISION   8
  40
  41 static const u16 mgmt_commands[] = {
  42         MGMT_OP_READ_INDEX_LIST,
  43         MGMT_OP_READ_INFO,
  44         MGMT_OP_SET_POWERED,
  45         MGMT_OP_SET_DISCOVERABLE,
  46         MGMT_OP_SET_CONNECTABLE,
  47         MGMT_OP_SET_FAST_CONNECTABLE,
  48         MGMT_OP_SET_BONDABLE,
  49         MGMT_OP_SET_LINK_SECURITY,
  50         MGMT_OP_SET_SSP,
  51         MGMT_OP_SET_HS,
  52         MGMT_OP_SET_LE,
  53         MGMT_OP_SET_DEV_CLASS,
  54         MGMT_OP_SET_LOCAL_NAME,
  55         MGMT_OP_ADD_UUID,
  56         MGMT_OP_REMOVE_UUID,
  57         MGMT_OP_LOAD_LINK_KEYS,
  58         MGMT_OP_LOAD_LONG_TERM_KEYS,
  59         MGMT_OP_DISCONNECT,
  60         MGMT_OP_GET_CONNECTIONS,
  61         MGMT_OP_PIN_CODE_REPLY,
  62         MGMT_OP_PIN_CODE_NEG_REPLY,
  63         MGMT_OP_SET_IO_CAPABILITY,
  64         MGMT_OP_PAIR_DEVICE,
  65         MGMT_OP_CANCEL_PAIR_DEVICE,
  66         MGMT_OP_UNPAIR_DEVICE,
  67         MGMT_OP_USER_CONFIRM_REPLY,
  68         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  69         MGMT_OP_USER_PASSKEY_REPLY,
  70         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  71         MGMT_OP_READ_LOCAL_OOB_DATA,
  72         MGMT_OP_ADD_REMOTE_OOB_DATA,
  73         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  74         MGMT_OP_START_DISCOVERY,
  75         MGMT_OP_STOP_DISCOVERY,
  76         MGMT_OP_CONFIRM_NAME,
  77         MGMT_OP_BLOCK_DEVICE,
  78         MGMT_OP_UNBLOCK_DEVICE,
  79         MGMT_OP_SET_DEVICE_ID,
  80         MGMT_OP_SET_ADVERTISING,
  81         MGMT_OP_SET_BREDR,
  82         MGMT_OP_SET_STATIC_ADDRESS,
  83         MGMT_OP_SET_SCAN_PARAMS,
  84         MGMT_OP_SET_SECURE_CONN,
  85         MGMT_OP_SET_DEBUG_KEYS,
  86         MGMT_OP_SET_PRIVACY,
  87         MGMT_OP_LOAD_IRKS,
  88         MGMT_OP_GET_CONN_INFO,
  89         MGMT_OP_GET_CLOCK_INFO,
  90         MGMT_OP_ADD_DEVICE,
  91         MGMT_OP_REMOVE_DEVICE,
  92         MGMT_OP_LOAD_CONN_PARAM,
  93         MGMT_OP_READ_UNCONF_INDEX_LIST,
  94         MGMT_OP_READ_CONFIG_INFO,
  95         MGMT_OP_SET_EXTERNAL_CONFIG,
  96         MGMT_OP_SET_PUBLIC_ADDRESS,
  97         MGMT_OP_START_SERVICE_DISCOVERY,
  98 };
  99
 100 static const u16 mgmt_events[] = {
 101         MGMT_EV_CONTROLLER_ERROR,
 102         MGMT_EV_INDEX_ADDED,
 103         MGMT_EV_INDEX_REMOVED,
 104         MGMT_EV_NEW_SETTINGS,
 105         MGMT_EV_CLASS_OF_DEV_CHANGED,
 106         MGMT_EV_LOCAL_NAME_CHANGED,
 107         MGMT_EV_NEW_LINK_KEY,
 108         MGMT_EV_NEW_LONG_TERM_KEY,
 109         MGMT_EV_DEVICE_CONNECTED,
 110         MGMT_EV_DEVICE_DISCONNECTED,
 111         MGMT_EV_CONNECT_FAILED,
 112         MGMT_EV_PIN_CODE_REQUEST,
 113         MGMT_EV_USER_CONFIRM_REQUEST,
 114         MGMT_EV_USER_PASSKEY_REQUEST,
 115         MGMT_EV_AUTH_FAILED,
 116         MGMT_EV_DEVICE_FOUND,
 117         MGMT_EV_DISCOVERING,
 118         MGMT_EV_DEVICE_BLOCKED,
 119         MGMT_EV_DEVICE_UNBLOCKED,
 120         MGMT_EV_DEVICE_UNPAIRED,
 121         MGMT_EV_PASSKEY_NOTIFY,
 122         MGMT_EV_NEW_IRK,
 123         MGMT_EV_NEW_CSRK,
 124         MGMT_EV_DEVICE_ADDED,
 125         MGMT_EV_DEVICE_REMOVED,
 126         MGMT_EV_NEW_CONN_PARAM,
 127         MGMT_EV_UNCONF_INDEX_ADDED,
 128         MGMT_EV_UNCONF_INDEX_REMOVED,
 129         MGMT_EV_NEW_CONFIG_OPTIONS,
 130 };
 131
 132 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 133
 134 struct pending_cmd {
 135         struct list_head list;
 136         u16 opcode;
 137         int index;
 138         void *param;
 139         size_t param_len;
 140         struct sock *sk;
 141         void *user_data;
 142         int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 143 };
 144
 145 /* HCI to MGMT error code conversion table */
 146 static u8 mgmt_status_table[] = {
 147         MGMT_STATUS_SUCCESS,
 148         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 149         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 150         MGMT_STATUS_FAILED,             /* Hardware Failure */
 151         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 152         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 153         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 154         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 155         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 157         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 158         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 159         MGMT_STATUS_BUSY,               /* Command Disallowed */
 160         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 161         MGMT_STATUS_REJECTED,           /* Rejected Security */
 162         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 163         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 166         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 167         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 168         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 169         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 170         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 171         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 172         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 174         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 175         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 176         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 178         MGMT_STATUS_FAILED,             /* Unspecified Error */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 180         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 181         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 182         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 183         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 184         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 185         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 187         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 189         MGMT_STATUS_FAILED,             /* Transaction Collision */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 191         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 193         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 194         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 195         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 196         MGMT_STATUS_FAILED,             /* Slot Violation */
 197         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 198         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 200         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 201         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 202         MGMT_STATUS_BUSY,               /* Controller Busy */
 203         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 204         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 205         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 206         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 207         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 208 };
 209
 210 static u8 mgmt_status(u8 hci_status)
 211 {
 212         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 213                 return mgmt_status_table[hci_status];
 214
 215         return MGMT_STATUS_FAILED;
 216 }
 217
 218 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 219                       struct sock *skip_sk)
 220 {
 221         struct sk_buff *skb;
 222         struct mgmt_hdr *hdr;
 223
 224         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 225         if (!skb)
 226                 return -ENOMEM;
 227
 228         hdr = (void *) skb_put(skb, sizeof(*hdr));
 229         hdr->opcode = cpu_to_le16(event);
 230         if (hdev)
 231                 hdr->index = cpu_to_le16(hdev->id);
 232         else
 233                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 234         hdr->len = cpu_to_le16(data_len);
 235
 236         if (data)
 237                 memcpy(skb_put(skb, data_len), data, data_len);
 238
 239         /* Time stamp */
 240         __net_timestamp(skb);
 241
 242         hci_send_to_control(skb, skip_sk);
 243         kfree_skb(skb);
 244
 245         return 0;
 246 }
 247
 248 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 249 {
 250         struct sk_buff *skb;
 251         struct mgmt_hdr *hdr;
 252         struct mgmt_ev_cmd_status *ev;
 253         int err;
 254
 255         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 256
 257         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 258         if (!skb)
 259                 return -ENOMEM;
 260
 261         hdr = (void *) skb_put(skb, sizeof(*hdr));
 262
 263         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 264         hdr->index = cpu_to_le16(index);
 265         hdr->len = cpu_to_le16(sizeof(*ev));
 266
 267         ev = (void *) skb_put(skb, sizeof(*ev));
 268         ev->status = status;
 269         ev->opcode = cpu_to_le16(cmd);
 270
 271         err = sock_queue_rcv_skb(sk, skb);
 272         if (err < 0)
 273                 kfree_skb(skb);
 274
 275         return err;
 276 }
 277
 278 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 279                         void *rp, size_t rp_len)
 280 {
 281         struct sk_buff *skb;
 282         struct mgmt_hdr *hdr;
 283         struct mgmt_ev_cmd_complete *ev;
 284         int err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 289         if (!skb)
 290                 return -ENOMEM;
 291
 292         hdr = (void *) skb_put(skb, sizeof(*hdr));
 293
 294         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 295         hdr->index = cpu_to_le16(index);
 296         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 297
 298         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 299         ev->opcode = cpu_to_le16(cmd);
 300         ev->status = status;
 301
 302         if (rp)
 303                 memcpy(ev->data, rp, rp_len);
 304
 305         err = sock_queue_rcv_skb(sk, skb);
 306         if (err < 0)
 307                 kfree_skb(skb);
 308
 309         return err;
 310 }
 311
 312 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 313                         u16 data_len)
 314 {
 315         struct mgmt_rp_read_version rp;
 316
 317         BT_DBG("sock %p", sk);
 318
 319         rp.version = MGMT_VERSION;
 320         rp.revision = cpu_to_le16(MGMT_REVISION);
 321
 322         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 323                             sizeof(rp));
 324 }
 325
 326 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 327                          u16 data_len)
 328 {
 329         struct mgmt_rp_read_commands *rp;
 330         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 331         const u16 num_events = ARRAY_SIZE(mgmt_events);
 332         __le16 *opcode;
 333         size_t rp_size;
 334         int i, err;
 335
 336         BT_DBG("sock %p", sk);
 337
 338         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 339
 340         rp = kmalloc(rp_size, GFP_KERNEL);
 341         if (!rp)
 342                 return -ENOMEM;
 343
 344         rp->num_commands = cpu_to_le16(num_commands);
 345         rp->num_events = cpu_to_le16(num_events);
 346
 347         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 348                 put_unaligned_le16(mgmt_commands[i], opcode);
 349
 350         for (i = 0; i < num_events; i++, opcode++)
 351                 put_unaligned_le16(mgmt_events[i], opcode);
 352
 353         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 354                            rp_size);
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 361                            u16 data_len)
 362 {
 363         struct mgmt_rp_read_index_list *rp;
 364         struct hci_dev *d;
 365         size_t rp_len;
 366         u16 count;
 367         int err;
 368
 369         BT_DBG("sock %p", sk);
 370
 371         read_lock(&hci_dev_list_lock);
 372
 373         count = 0;
 374         list_for_each_entry(d, &hci_dev_list, list) {
 375                 if (d->dev_type == HCI_BREDR &&
 376                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 377                         count++;
 378         }
 379
 380         rp_len = sizeof(*rp) + (2 * count);
 381         rp = kmalloc(rp_len, GFP_ATOMIC);
 382         if (!rp) {
 383                 read_unlock(&hci_dev_list_lock);
 384                 return -ENOMEM;
 385         }
 386
 387         count = 0;
 388         list_for_each_entry(d, &hci_dev_list, list) {
 389                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 390                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 391                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 392                         continue;
 393
 394                 /* Devices marked as raw-only are neither configured
 395                  * nor unconfigured controllers.
 396                  */
 397                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 398                         continue;
 399
 400                 if (d->dev_type == HCI_BREDR &&
 401                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 402                         rp->index[count++] = cpu_to_le16(d->id);
 403                         BT_DBG("Added hci%u", d->id);
 404                 }
 405         }
 406
 407         rp->num_controllers = cpu_to_le16(count);
 408         rp_len = sizeof(*rp) + (2 * count);
 409
 410         read_unlock(&hci_dev_list_lock);
 411
 412         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 413                            rp_len);
 414
 415         kfree(rp);
 416
 417         return err;
 418 }
 419
 420 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 421                                   void *data, u16 data_len)
 422 {
 423         struct mgmt_rp_read_unconf_index_list *rp;
 424         struct hci_dev *d;
 425         size_t rp_len;
 426         u16 count;
 427         int err;
 428
 429         BT_DBG("sock %p", sk);
 430
 431         read_lock(&hci_dev_list_lock);
 432
 433         count = 0;
 434         list_for_each_entry(d, &hci_dev_list, list) {
 435                 if (d->dev_type == HCI_BREDR &&
 436                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 437                         count++;
 438         }
 439
 440         rp_len = sizeof(*rp) + (2 * count);
 441         rp = kmalloc(rp_len, GFP_ATOMIC);
 442         if (!rp) {
 443                 read_unlock(&hci_dev_list_lock);
 444                 return -ENOMEM;
 445         }
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 450                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 451                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 452                         continue;
 453
 454                 /* Devices marked as raw-only are neither configured
 455                  * nor unconfigured controllers.
 456                  */
 457                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 458                         continue;
 459
 460                 if (d->dev_type == HCI_BREDR &&
 461                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 462                         rp->index[count++] = cpu_to_le16(d->id);
 463                         BT_DBG("Added hci%u", d->id);
 464                 }
 465         }
 466
 467         rp->num_controllers = cpu_to_le16(count);
 468         rp_len = sizeof(*rp) + (2 * count);
 469
 470         read_unlock(&hci_dev_list_lock);
 471
 472         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 473                            0, rp, rp_len);
 474
 475         kfree(rp);
 476
 477         return err;
 478 }
 479
 480 static bool is_configured(struct hci_dev *hdev)
 481 {
 482         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 483             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 484                 return false;
 485
 486         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 487             !bacmp(&hdev->public_addr, BDADDR_ANY))
 488                 return false;
 489
 490         return true;
 491 }
 492
 493 static __le32 get_missing_options(struct hci_dev *hdev)
 494 {
 495         u32 options = 0;
 496
 497         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 498             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 499                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 500
 501         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 502             !bacmp(&hdev->public_addr, BDADDR_ANY))
 503                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 504
 505         return cpu_to_le32(options);
 506 }
 507
 508 static int new_options(struct hci_dev *hdev, struct sock *skip)
 509 {
 510         __le32 options = get_missing_options(hdev);
 511
 512         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 513                           sizeof(options), skip);
 514 }
 515
 516 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 517 {
 518         __le32 options = get_missing_options(hdev);
 519
 520         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 521                             sizeof(options));
 522 }
 523
 524 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 525                             void *data, u16 data_len)
 526 {
 527         struct mgmt_rp_read_config_info rp;
 528         u32 options = 0;
 529
 530         BT_DBG("sock %p %s", sk, hdev->name);
 531
 532         hci_dev_lock(hdev);
 533
 534         memset(&rp, 0, sizeof(rp));
 535         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 536
 537         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 538                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 539
 540         if (hdev->set_bdaddr)
 541                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 542
 543         rp.supported_options = cpu_to_le32(options);
 544         rp.missing_options = get_missing_options(hdev);
 545
 546         hci_dev_unlock(hdev);
 547
 548         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 549                             sizeof(rp));
 550 }
 551
 552 static u32 get_supported_settings(struct hci_dev *hdev)
 553 {
 554         u32 settings = 0;
 555
 556         settings |= MGMT_SETTING_POWERED;
 557         settings |= MGMT_SETTING_BONDABLE;
 558         settings |= MGMT_SETTING_DEBUG_KEYS;
 559         settings |= MGMT_SETTING_CONNECTABLE;
 560         settings |= MGMT_SETTING_DISCOVERABLE;
 561
 562         if (lmp_bredr_capable(hdev)) {
 563                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 564                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 565                 settings |= MGMT_SETTING_BREDR;
 566                 settings |= MGMT_SETTING_LINK_SECURITY;
 567
 568                 if (lmp_ssp_capable(hdev)) {
 569                         settings |= MGMT_SETTING_SSP;
 570                         settings |= MGMT_SETTING_HS;
 571                 }
 572
 573                 if (lmp_sc_capable(hdev))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_SECURE_CONN;
 581                 settings |= MGMT_SETTING_PRIVACY;
 582         }
 583
 584         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 585             hdev->set_bdaddr)
 586                 settings |= MGMT_SETTING_CONFIGURATION;
 587
 588         return settings;
 589 }
 590
 591 static u32 get_current_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         if (hdev_is_powered(hdev))
 596                 settings |= MGMT_SETTING_POWERED;
 597
 598         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 599                 settings |= MGMT_SETTING_CONNECTABLE;
 600
 601         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 602                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 603
 604         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 605                 settings |= MGMT_SETTING_DISCOVERABLE;
 606
 607         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 608                 settings |= MGMT_SETTING_BONDABLE;
 609
 610         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 611                 settings |= MGMT_SETTING_BREDR;
 612
 613         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 614                 settings |= MGMT_SETTING_LE;
 615
 616         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 617                 settings |= MGMT_SETTING_LINK_SECURITY;
 618
 619         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 620                 settings |= MGMT_SETTING_SSP;
 621
 622         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 623                 settings |= MGMT_SETTING_HS;
 624
 625         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 626                 settings |= MGMT_SETTING_ADVERTISING;
 627
 628         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 629                 settings |= MGMT_SETTING_SECURE_CONN;
 630
 631         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 632                 settings |= MGMT_SETTING_DEBUG_KEYS;
 633
 634         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 635                 settings |= MGMT_SETTING_PRIVACY;
 636
 637         return settings;
 638 }
 639
 640 #define PNP_INFO_SVCLASS_ID             0x1200
 641
 642 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 643 {
 644         u8 *ptr = data, *uuids_start = NULL;
 645         struct bt_uuid *uuid;
 646
 647         if (len < 4)
 648                 return ptr;
 649
 650         list_for_each_entry(uuid, &hdev->uuids, list) {
 651                 u16 uuid16;
 652
 653                 if (uuid->size != 16)
 654                         continue;
 655
 656                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 657                 if (uuid16 < 0x1100)
 658                         continue;
 659
 660                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 661                         continue;
 662
 663                 if (!uuids_start) {
 664                         uuids_start = ptr;
 665                         uuids_start[0] = 1;
 666                         uuids_start[1] = EIR_UUID16_ALL;
 667                         ptr += 2;
 668                 }
 669
 670                 /* Stop if not enough space to put next UUID */
 671                 if ((ptr - data) + sizeof(u16) > len) {
 672                         uuids_start[1] = EIR_UUID16_SOME;
 673                         break;
 674                 }
 675
 676                 *ptr++ = (uuid16 & 0x00ff);
 677                 *ptr++ = (uuid16 & 0xff00) >> 8;
 678                 uuids_start[0] += sizeof(uuid16);
 679         }
 680
 681         return ptr;
 682 }
 683
 684 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 685 {
 686         u8 *ptr = data, *uuids_start = NULL;
 687         struct bt_uuid *uuid;
 688
 689         if (len < 6)
 690                 return ptr;
 691
 692         list_for_each_entry(uuid, &hdev->uuids, list) {
 693                 if (uuid->size != 32)
 694                         continue;
 695
 696                 if (!uuids_start) {
 697                         uuids_start = ptr;
 698                         uuids_start[0] = 1;
 699                         uuids_start[1] = EIR_UUID32_ALL;
 700                         ptr += 2;
 701                 }
 702
 703                 /* Stop if not enough space to put next UUID */
 704                 if ((ptr - data) + sizeof(u32) > len) {
 705                         uuids_start[1] = EIR_UUID32_SOME;
 706                         break;
 707                 }
 708
 709                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 710                 ptr += sizeof(u32);
 711                 uuids_start[0] += sizeof(u32);
 712         }
 713
 714         return ptr;
 715 }
 716
 717 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 718 {
 719         u8 *ptr = data, *uuids_start = NULL;
 720         struct bt_uuid *uuid;
 721
 722         if (len < 18)
 723                 return ptr;
 724
 725         list_for_each_entry(uuid, &hdev->uuids, list) {
 726                 if (uuid->size != 128)
 727                         continue;
 728
 729                 if (!uuids_start) {
 730                         uuids_start = ptr;
 731                         uuids_start[0] = 1;
 732                         uuids_start[1] = EIR_UUID128_ALL;
 733                         ptr += 2;
 734                 }
 735
 736                 /* Stop if not enough space to put next UUID */
 737                 if ((ptr - data) + 16 > len) {
 738                         uuids_start[1] = EIR_UUID128_SOME;
 739                         break;
 740                 }
 741
 742                 memcpy(ptr, uuid->uuid, 16);
 743                 ptr += 16;
 744                 uuids_start[0] += 16;
 745         }
 746
 747         return ptr;
 748 }
 749
 750 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 751 {
 752         struct pending_cmd *cmd;
 753
 754         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 755                 if (cmd->opcode == opcode)
 756                         return cmd;
 757         }
 758
 759         return NULL;
 760 }
 761
 762 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 763                                                   struct hci_dev *hdev,
 764                                                   const void *data)
 765 {
 766         struct pending_cmd *cmd;
 767
 768         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 769                 if (cmd->user_data != data)
 770                         continue;
 771                 if (cmd->opcode == opcode)
 772                         return cmd;
 773         }
 774
 775         return NULL;
 776 }
 777
 778 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 779 {
 780         u8 ad_len = 0;
 781         size_t name_len;
 782
 783         name_len = strlen(hdev->dev_name);
 784         if (name_len > 0) {
 785                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 786
 787                 if (name_len > max_len) {
 788                         name_len = max_len;
 789                         ptr[1] = EIR_NAME_SHORT;
 790                 } else
 791                         ptr[1] = EIR_NAME_COMPLETE;
 792
 793                 ptr[0] = name_len + 1;
 794
 795                 memcpy(ptr + 2, hdev->dev_name, name_len);
 796
 797                 ad_len += (name_len + 2);
 798                 ptr += (name_len + 2);
 799         }
 800
 801         return ad_len;
 802 }
 803
 804 static void update_scan_rsp_data(struct hci_request *req)
 805 {
 806         struct hci_dev *hdev = req->hdev;
 807         struct hci_cp_le_set_scan_rsp_data cp;
 808         u8 len;
 809
 810         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 811                 return;
 812
 813         memset(&cp, 0, sizeof(cp));
 814
 815         len = create_scan_rsp_data(hdev, cp.data);
 816
 817         if (hdev->scan_rsp_data_len == len &&
 818             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 819                 return;
 820
 821         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 822         hdev->scan_rsp_data_len = len;
 823
 824         cp.length = len;
 825
 826         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 827 }
 828
 829 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 830 {
 831         struct pending_cmd *cmd;
 832
 833         /* If there's a pending mgmt command the flags will not yet have
 834          * their final values, so check for this first.
 835          */
 836         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 837         if (cmd) {
 838                 struct mgmt_mode *cp = cmd->param;
 839                 if (cp->val == 0x01)
 840                         return LE_AD_GENERAL;
 841                 else if (cp->val == 0x02)
 842                         return LE_AD_LIMITED;
 843         } else {
 844                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 845                         return LE_AD_LIMITED;
 846                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 847                         return LE_AD_GENERAL;
 848         }
 849
 850         return 0;
 851 }
 852
 853 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 854 {
 855         u8 ad_len = 0, flags = 0;
 856
 857         flags |= get_adv_discov_flags(hdev);
 858
 859         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 860                 flags |= LE_AD_NO_BREDR;
 861
 862         if (flags) {
 863                 BT_DBG("adv flags 0x%02x", flags);
 864
 865                 ptr[0] = 2;
 866                 ptr[1] = EIR_FLAGS;
 867                 ptr[2] = flags;
 868
 869                 ad_len += 3;
 870                 ptr += 3;
 871         }
 872
 873         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 874                 ptr[0] = 2;
 875                 ptr[1] = EIR_TX_POWER;
 876                 ptr[2] = (u8) hdev->adv_tx_power;
 877
 878                 ad_len += 3;
 879                 ptr += 3;
 880         }
 881
 882         return ad_len;
 883 }
 884
 885 static void update_adv_data(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         struct hci_cp_le_set_adv_data cp;
 889         u8 len;
 890
 891         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 892                 return;
 893
 894         memset(&cp, 0, sizeof(cp));
 895
 896         len = create_adv_data(hdev, cp.data);
 897
 898         if (hdev->adv_data_len == len &&
 899             memcmp(cp.data, hdev->adv_data, len) == 0)
 900                 return;
 901
 902         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 903         hdev->adv_data_len = len;
 904
 905         cp.length = len;
 906
 907         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 908 }
 909
 910 int mgmt_update_adv_data(struct hci_dev *hdev)
 911 {
 912         struct hci_request req;
 913
 914         hci_req_init(&req, hdev);
 915         update_adv_data(&req);
 916
 917         return hci_req_run(&req, NULL);
 918 }
 919
 920 static void create_eir(struct hci_dev *hdev, u8 *data)
 921 {
 922         u8 *ptr = data;
 923         size_t name_len;
 924
 925         name_len = strlen(hdev->dev_name);
 926
 927         if (name_len > 0) {
 928                 /* EIR Data type */
 929                 if (name_len > 48) {
 930                         name_len = 48;
 931                         ptr[1] = EIR_NAME_SHORT;
 932                 } else
 933                         ptr[1] = EIR_NAME_COMPLETE;
 934
 935                 /* EIR Data length */
 936                 ptr[0] = name_len + 1;
 937
 938                 memcpy(ptr + 2, hdev->dev_name, name_len);
 939
 940                 ptr += (name_len + 2);
 941         }
 942
 943         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 944                 ptr[0] = 2;
 945                 ptr[1] = EIR_TX_POWER;
 946                 ptr[2] = (u8) hdev->inq_tx_power;
 947
 948                 ptr += 3;
 949         }
 950
 951         if (hdev->devid_source > 0) {
 952                 ptr[0] = 9;
 953                 ptr[1] = EIR_DEVICE_ID;
 954
 955                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 956                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 957                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 958                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 959
 960                 ptr += 10;
 961         }
 962
 963         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 964         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 965         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 966 }
 967
 968 static void update_eir(struct hci_request *req)
 969 {
 970         struct hci_dev *hdev = req->hdev;
 971         struct hci_cp_write_eir cp;
 972
 973         if (!hdev_is_powered(hdev))
 974                 return;
 975
 976         if (!lmp_ext_inq_capable(hdev))
 977                 return;
 978
 979         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 980                 return;
 981
 982         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 983                 return;
 984
 985         memset(&cp, 0, sizeof(cp));
 986
 987         create_eir(hdev, cp.data);
 988
 989         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 990                 return;
 991
 992         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 993
 994         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 995 }
 996
 997 static u8 get_service_classes(struct hci_dev *hdev)
 998 {
 999         struct bt_uuid *uuid;
1000         u8 val = 0;
1001
1002         list_for_each_entry(uuid, &hdev->uuids, list)
1003                 val |= uuid->svc_hint;
1004
1005         return val;
1006 }
1007
1008 static void update_class(struct hci_request *req)
1009 {
1010         struct hci_dev *hdev = req->hdev;
1011         u8 cod[3];
1012
1013         BT_DBG("%s", hdev->name);
1014
1015         if (!hdev_is_powered(hdev))
1016                 return;
1017
1018         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1019                 return;
1020
1021         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1022                 return;
1023
1024         cod[0] = hdev->minor_class;
1025         cod[1] = hdev->major_class;
1026         cod[2] = get_service_classes(hdev);
1027
1028         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1029                 cod[1] |= 0x20;
1030
1031         if (memcmp(cod, hdev->dev_class, 3) == 0)
1032                 return;
1033
1034         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1035 }
1036
1037 static bool get_connectable(struct hci_dev *hdev)
1038 {
1039         struct pending_cmd *cmd;
1040
1041         /* If there's a pending mgmt command the flag will not yet have
1042          * it's final value, so check for this first.
1043          */
1044         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1045         if (cmd) {
1046                 struct mgmt_mode *cp = cmd->param;
1047                 return cp->val;
1048         }
1049
1050         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1051 }
1052
1053 static void disable_advertising(struct hci_request *req)
1054 {
1055         u8 enable = 0x00;
1056
1057         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1058 }
1059
1060 static void enable_advertising(struct hci_request *req)
1061 {
1062         struct hci_dev *hdev = req->hdev;
1063         struct hci_cp_le_set_adv_param cp;
1064         u8 own_addr_type, enable = 0x01;
1065         bool connectable;
1066
1067         if (hci_conn_num(hdev, LE_LINK) > 0)
1068                 return;
1069
1070         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1071                 disable_advertising(req);
1072
1073         /* Clear the HCI_LE_ADV bit temporarily so that the
1074          * hci_update_random_address knows that it's safe to go ahead
1075          * and write a new random address. The flag will be set back on
1076          * as soon as the SET_ADV_ENABLE HCI command completes.
1077          */
1078         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1079
1080         connectable = get_connectable(hdev);
1081
1082         /* Set require_privacy to true only when non-connectable
1083          * advertising is used. In that case it is fine to use a
1084          * non-resolvable private address.
1085          */
1086         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1087                 return;
1088
1089         memset(&cp, 0, sizeof(cp));
1090         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1091         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1092         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1093         cp.own_address_type = own_addr_type;
1094         cp.channel_map = hdev->le_adv_channel_map;
1095
1096         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1097
1098         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1099 }
1100
1101 static void service_cache_off(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             service_cache.work);
1105         struct hci_request req;
1106
1107         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1108                 return;
1109
1110         hci_req_init(&req, hdev);
1111
1112         hci_dev_lock(hdev);
1113
1114         update_eir(&req);
1115         update_class(&req);
1116
1117         hci_dev_unlock(hdev);
1118
1119         hci_req_run(&req, NULL);
1120 }
1121
1122 static void rpa_expired(struct work_struct *work)
1123 {
1124         struct hci_dev *hdev = container_of(work, struct hci_dev,
1125                                             rpa_expired.work);
1126         struct hci_request req;
1127
1128         BT_DBG("");
1129
1130         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1131
1132         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1133                 return;
1134
1135         /* The generation of a new RPA and programming it into the
1136          * controller happens in the enable_advertising() function.
1137          */
1138         hci_req_init(&req, hdev);
1139         enable_advertising(&req);
1140         hci_req_run(&req, NULL);
1141 }
1142
1143 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1144 {
1145         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1146                 return;
1147
1148         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1149         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1150
1151         /* Non-mgmt controlled devices get this bit set
1152          * implicitly so that pairing works for them, however
1153          * for mgmt we require user-space to explicitly enable
1154          * it
1155          */
1156         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1157 }
1158
1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160                                 void *data, u16 data_len)
1161 {
1162         struct mgmt_rp_read_info rp;
1163
1164         BT_DBG("sock %p %s", sk, hdev->name);
1165
1166         hci_dev_lock(hdev);
1167
1168         memset(&rp, 0, sizeof(rp));
1169
1170         bacpy(&rp.bdaddr, &hdev->bdaddr);
1171
1172         rp.version = hdev->hci_ver;
1173         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1174
1175         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1177
1178         memcpy(rp.dev_class, hdev->dev_class, 3);
1179
1180         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1182
1183         hci_dev_unlock(hdev);
1184
1185         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1186                             sizeof(rp));
1187 }
1188
1189 static void mgmt_pending_free(struct pending_cmd *cmd)
1190 {
1191         sock_put(cmd->sk);
1192         kfree(cmd->param);
1193         kfree(cmd);
1194 }
1195
1196 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1197                                             struct hci_dev *hdev, void *data,
1198                                             u16 len)
1199 {
1200         struct pending_cmd *cmd;
1201
1202         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1203         if (!cmd)
1204                 return NULL;
1205
1206         cmd->opcode = opcode;
1207         cmd->index = hdev->id;
1208
1209         cmd->param = kmemdup(data, len, GFP_KERNEL);
1210         if (!cmd->param) {
1211                 kfree(cmd);
1212                 return NULL;
1213         }
1214
1215         cmd->param_len = len;
1216
1217         cmd->sk = sk;
1218         sock_hold(sk);
1219
1220         list_add(&cmd->list, &hdev->mgmt_pending);
1221
1222         return cmd;
1223 }
1224
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226                                  void (*cb)(struct pending_cmd *cmd,
1227                                             void *data),
1228                                  void *data)
1229 {
1230         struct pending_cmd *cmd, *tmp;
1231
1232         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233                 if (opcode > 0 && cmd->opcode != opcode)
1234                         continue;
1235
1236                 cb(cmd, data);
1237         }
1238 }
1239
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1241 {
1242         list_del(&cmd->list);
1243         mgmt_pending_free(cmd);
1244 }
1245
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1247 {
1248         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1249
1250         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1251                             sizeof(settings));
1252 }
1253
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1255 {
1256         BT_DBG("%s status 0x%02x", hdev->name, status);
1257
1258         if (hci_conn_count(hdev) == 0) {
1259                 cancel_delayed_work(&hdev->power_off);
1260                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1261         }
1262 }
1263
1264 static bool hci_stop_discovery(struct hci_request *req)
1265 {
1266         struct hci_dev *hdev = req->hdev;
1267         struct hci_cp_remote_name_req_cancel cp;
1268         struct inquiry_entry *e;
1269
1270         switch (hdev->discovery.state) {
1271         case DISCOVERY_FINDING:
1272                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1274                 } else {
1275                         cancel_delayed_work(&hdev->le_scan_disable);
1276                         hci_req_add_le_scan_disable(req);
1277                 }
1278
1279                 return true;
1280
1281         case DISCOVERY_RESOLVING:
1282                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1283                                                      NAME_PENDING);
1284                 if (!e)
1285                         break;
1286
1287                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1289                             &cp);
1290
1291                 return true;
1292
1293         default:
1294                 /* Passive scanning */
1295                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296                         hci_req_add_le_scan_disable(req);
1297                         return true;
1298                 }
1299
1300                 break;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1307 {
1308         struct hci_request req;
1309         struct hci_conn *conn;
1310         bool discov_stopped;
1311         int err;
1312
1313         hci_req_init(&req, hdev);
1314
1315         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316             test_bit(HCI_PSCAN, &hdev->flags)) {
1317                 u8 scan = 0x00;
1318                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1319         }
1320
1321         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322                 disable_advertising(&req);
1323
1324         discov_stopped = hci_stop_discovery(&req);
1325
1326         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327                 struct hci_cp_disconnect dc;
1328                 struct hci_cp_reject_conn_req rej;
1329
1330                 switch (conn->state) {
1331                 case BT_CONNECTED:
1332                 case BT_CONFIG:
1333                         dc.handle = cpu_to_le16(conn->handle);
1334                         dc.reason = 0x15; /* Terminated due to Power Off */
1335                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1336                         break;
1337                 case BT_CONNECT:
1338                         if (conn->type == LE_LINK)
1339                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1340                                             0, NULL);
1341                         else if (conn->type == ACL_LINK)
1342                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1343                                             6, &conn->dst);
1344                         break;
1345                 case BT_CONNECT2:
1346                         bacpy(&rej.bdaddr, &conn->dst);
1347                         rej.reason = 0x15; /* Terminated due to Power Off */
1348                         if (conn->type == ACL_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         else if (conn->type == SCO_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         break;
1355                 }
1356         }
1357
1358         err = hci_req_run(&req, clean_up_hci_complete);
1359         if (!err && discov_stopped)
1360                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1361
1362         return err;
1363 }
1364
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1366                        u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         struct pending_cmd *cmd;
1370         int err;
1371
1372         BT_DBG("request for %s", hdev->name);
1373
1374         if (cp->val != 0x00 && cp->val != 0x01)
1375                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376                                   MGMT_STATUS_INVALID_PARAMS);
1377
1378         hci_dev_lock(hdev);
1379
1380         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1382                                  MGMT_STATUS_BUSY);
1383                 goto failed;
1384         }
1385
1386         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387                 cancel_delayed_work(&hdev->power_off);
1388
1389                 if (cp->val) {
1390                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1391                                          data, len);
1392                         err = mgmt_powered(hdev, 1);
1393                         goto failed;
1394                 }
1395         }
1396
1397         if (!!cp->val == hdev_is_powered(hdev)) {
1398                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1399                 goto failed;
1400         }
1401
1402         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1403         if (!cmd) {
1404                 err = -ENOMEM;
1405                 goto failed;
1406         }
1407
1408         if (cp->val) {
1409                 queue_work(hdev->req_workqueue, &hdev->power_on);
1410                 err = 0;
1411         } else {
1412                 /* Disconnect connections, stop scans, etc */
1413                 err = clean_up_hci_state(hdev);
1414                 if (!err)
1415                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416                                            HCI_POWER_OFF_TIMEOUT);
1417
1418                 /* ENODATA means there were no HCI commands queued */
1419                 if (err == -ENODATA) {
1420                         cancel_delayed_work(&hdev->power_off);
1421                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1422                         err = 0;
1423                 }
1424         }
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1432 {
1433         __le32 ev;
1434
1435         ev = cpu_to_le32(get_current_settings(hdev));
1436
1437         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1438 }
1439
1440 int mgmt_new_settings(struct hci_dev *hdev)
1441 {
1442         return new_settings(hdev, NULL);
1443 }
1444
1445 struct cmd_lookup {
1446         struct sock *sk;
1447         struct hci_dev *hdev;
1448         u8 mgmt_status;
1449 };
1450
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1452 {
1453         struct cmd_lookup *match = data;
1454
1455         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1456
1457         list_del(&cmd->list);
1458
1459         if (match->sk == NULL) {
1460                 match->sk = cmd->sk;
1461                 sock_hold(match->sk);
1462         }
1463
1464         mgmt_pending_free(cmd);
1465 }
1466
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1468 {
1469         u8 *status = data;
1470
1471         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472         mgmt_pending_remove(cmd);
1473 }
1474
1475 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1476 {
1477         if (cmd->cmd_complete) {
1478                 u8 *status = data;
1479
1480                 cmd->cmd_complete(cmd, *status);
1481                 mgmt_pending_remove(cmd);
1482
1483                 return;
1484         }
1485
1486         cmd_status_rsp(cmd, data);
1487 }
1488
1489 static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1490 {
1491         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1492                             cmd->param, cmd->param_len);
1493 }
1494
1495 static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1496 {
1497         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1498                             sizeof(struct mgmt_addr_info));
1499 }
1500
1501 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1502 {
1503         if (!lmp_bredr_capable(hdev))
1504                 return MGMT_STATUS_NOT_SUPPORTED;
1505         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1506                 return MGMT_STATUS_REJECTED;
1507         else
1508                 return MGMT_STATUS_SUCCESS;
1509 }
1510
1511 static u8 mgmt_le_support(struct hci_dev *hdev)
1512 {
1513         if (!lmp_le_capable(hdev))
1514                 return MGMT_STATUS_NOT_SUPPORTED;
1515         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1516                 return MGMT_STATUS_REJECTED;
1517         else
1518                 return MGMT_STATUS_SUCCESS;
1519 }
1520
1521 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1522                                       u16 opcode)
1523 {
1524         struct pending_cmd *cmd;
1525         struct mgmt_mode *cp;
1526         struct hci_request req;
1527         bool changed;
1528
1529         BT_DBG("status 0x%02x", status);
1530
1531         hci_dev_lock(hdev);
1532
1533         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1534         if (!cmd)
1535                 goto unlock;
1536
1537         if (status) {
1538                 u8 mgmt_err = mgmt_status(status);
1539                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1540                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1541                 goto remove_cmd;
1542         }
1543
1544         cp = cmd->param;
1545         if (cp->val) {
1546                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1547                                             &hdev->dev_flags);
1548
1549                 if (hdev->discov_timeout > 0) {
1550                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1551                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1552                                            to);
1553                 }
1554         } else {
1555                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1556                                              &hdev->dev_flags);
1557         }
1558
1559         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1560
1561         if (changed)
1562                 new_settings(hdev, cmd->sk);
1563
1564         /* When the discoverable mode gets changed, make sure
1565          * that class of device has the limited discoverable
1566          * bit correctly set. Also update page scan based on whitelist
1567          * entries.
1568          */
1569         hci_req_init(&req, hdev);
1570         __hci_update_page_scan(&req);
1571         update_class(&req);
1572         hci_req_run(&req, NULL);
1573
1574 remove_cmd:
1575         mgmt_pending_remove(cmd);
1576
1577 unlock:
1578         hci_dev_unlock(hdev);
1579 }
1580
1581 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1582                             u16 len)
1583 {
1584         struct mgmt_cp_set_discoverable *cp = data;
1585         struct pending_cmd *cmd;
1586         struct hci_request req;
1587         u16 timeout;
1588         u8 scan;
1589         int err;
1590
1591         BT_DBG("request for %s", hdev->name);
1592
1593         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1594             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1595                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1596                                   MGMT_STATUS_REJECTED);
1597
1598         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1599                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1600                                   MGMT_STATUS_INVALID_PARAMS);
1601
1602         timeout = __le16_to_cpu(cp->timeout);
1603
1604         /* Disabling discoverable requires that no timeout is set,
1605          * and enabling limited discoverable requires a timeout.
1606          */
1607         if ((cp->val == 0x00 && timeout > 0) ||
1608             (cp->val == 0x02 && timeout == 0))
1609                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1610                                   MGMT_STATUS_INVALID_PARAMS);
1611
1612         hci_dev_lock(hdev);
1613
1614         if (!hdev_is_powered(hdev) && timeout > 0) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1616                                  MGMT_STATUS_NOT_POWERED);
1617                 goto failed;
1618         }
1619
1620         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1621             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1622                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1623                                  MGMT_STATUS_BUSY);
1624                 goto failed;
1625         }
1626
1627         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1628                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1629                                  MGMT_STATUS_REJECTED);
1630                 goto failed;
1631         }
1632
1633         if (!hdev_is_powered(hdev)) {
1634                 bool changed = false;
1635
1636                 /* Setting limited discoverable when powered off is
1637                  * not a valid operation since it requires a timeout
1638                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1639                  */
1640                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1641                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1642                         changed = true;
1643                 }
1644
1645                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1646                 if (err < 0)
1647                         goto failed;
1648
1649                 if (changed)
1650                         err = new_settings(hdev, sk);
1651
1652                 goto failed;
1653         }
1654
1655         /* If the current mode is the same, then just update the timeout
1656          * value with the new value. And if only the timeout gets updated,
1657          * then no need for any HCI transactions.
1658          */
1659         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1660             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1661                                           &hdev->dev_flags)) {
1662                 cancel_delayed_work(&hdev->discov_off);
1663                 hdev->discov_timeout = timeout;
1664
1665                 if (cp->val && hdev->discov_timeout > 0) {
1666                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1667                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1668                                            to);
1669                 }
1670
1671                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1672                 goto failed;
1673         }
1674
1675         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1676         if (!cmd) {
1677                 err = -ENOMEM;
1678                 goto failed;
1679         }
1680
1681         /* Cancel any potential discoverable timeout that might be
1682          * still active and store new timeout value. The arming of
1683          * the timeout happens in the complete handler.
1684          */
1685         cancel_delayed_work(&hdev->discov_off);
1686         hdev->discov_timeout = timeout;
1687
1688         /* Limited discoverable mode */
1689         if (cp->val == 0x02)
1690                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1691         else
1692                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1693
1694         hci_req_init(&req, hdev);
1695
1696         /* The procedure for LE-only controllers is much simpler - just
1697          * update the advertising data.
1698          */
1699         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1700                 goto update_ad;
1701
1702         scan = SCAN_PAGE;
1703
1704         if (cp->val) {
1705                 struct hci_cp_write_current_iac_lap hci_cp;
1706
1707                 if (cp->val == 0x02) {
1708                         /* Limited discoverable mode */
1709                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1710                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1711                         hci_cp.iac_lap[1] = 0x8b;
1712                         hci_cp.iac_lap[2] = 0x9e;
1713                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1714                         hci_cp.iac_lap[4] = 0x8b;
1715                         hci_cp.iac_lap[5] = 0x9e;
1716                 } else {
1717                         /* General discoverable mode */
1718                         hci_cp.num_iac = 1;
1719                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1720                         hci_cp.iac_lap[1] = 0x8b;
1721                         hci_cp.iac_lap[2] = 0x9e;
1722                 }
1723
1724                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1725                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1726
1727                 scan |= SCAN_INQUIRY;
1728         } else {
1729                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1730         }
1731
1732         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1733
1734 update_ad:
1735         update_adv_data(&req);
1736
1737         err = hci_req_run(&req, set_discoverable_complete);
1738         if (err < 0)
1739                 mgmt_pending_remove(cmd);
1740
1741 failed:
1742         hci_dev_unlock(hdev);
1743         return err;
1744 }
1745
1746 static void write_fast_connectable(struct hci_request *req, bool enable)
1747 {
1748         struct hci_dev *hdev = req->hdev;
1749         struct hci_cp_write_page_scan_activity acp;
1750         u8 type;
1751
1752         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1753                 return;
1754
1755         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1756                 return;
1757
1758         if (enable) {
1759                 type = PAGE_SCAN_TYPE_INTERLACED;
1760
1761                 /* 160 msec page scan interval */
1762                 acp.interval = cpu_to_le16(0x0100);
1763         } else {
1764                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1765
1766                 /* default 1.28 sec page scan */
1767                 acp.interval = cpu_to_le16(0x0800);
1768         }
1769
1770         acp.window = cpu_to_le16(0x0012);
1771
1772         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1773             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1774                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1775                             sizeof(acp), &acp);
1776
1777         if (hdev->page_scan_type != type)
1778                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1779 }
1780
1781 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1782                                      u16 opcode)
1783 {
1784         struct pending_cmd *cmd;
1785         struct mgmt_mode *cp;
1786         bool conn_changed, discov_changed;
1787
1788         BT_DBG("status 0x%02x", status);
1789
1790         hci_dev_lock(hdev);
1791
1792         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1793         if (!cmd)
1794                 goto unlock;
1795
1796         if (status) {
1797                 u8 mgmt_err = mgmt_status(status);
1798                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1799                 goto remove_cmd;
1800         }
1801
1802         cp = cmd->param;
1803         if (cp->val) {
1804                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1805                                                  &hdev->dev_flags);
1806                 discov_changed = false;
1807         } else {
1808                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1809                                                   &hdev->dev_flags);
1810                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1811                                                     &hdev->dev_flags);
1812         }
1813
1814         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1815
1816         if (conn_changed || discov_changed) {
1817                 new_settings(hdev, cmd->sk);
1818                 hci_update_page_scan(hdev);
1819                 if (discov_changed)
1820                         mgmt_update_adv_data(hdev);
1821                 hci_update_background_scan(hdev);
1822         }
1823
1824 remove_cmd:
1825         mgmt_pending_remove(cmd);
1826
1827 unlock:
1828         hci_dev_unlock(hdev);
1829 }
1830
1831 static int set_connectable_update_settings(struct hci_dev *hdev,
1832                                            struct sock *sk, u8 val)
1833 {
1834         bool changed = false;
1835         int err;
1836
1837         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1838                 changed = true;
1839
1840         if (val) {
1841                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1842         } else {
1843                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1844                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1845         }
1846
1847         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1848         if (err < 0)
1849                 return err;
1850
1851         if (changed) {
1852                 hci_update_page_scan(hdev);
1853                 hci_update_background_scan(hdev);
1854                 return new_settings(hdev, sk);
1855         }
1856
1857         return 0;
1858 }
1859
1860 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1861                            u16 len)
1862 {
1863         struct mgmt_mode *cp = data;
1864         struct pending_cmd *cmd;
1865         struct hci_request req;
1866         u8 scan;
1867         int err;
1868
1869         BT_DBG("request for %s", hdev->name);
1870
1871         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1872             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1873                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1874                                   MGMT_STATUS_REJECTED);
1875
1876         if (cp->val != 0x00 && cp->val != 0x01)
1877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1878                                   MGMT_STATUS_INVALID_PARAMS);
1879
1880         hci_dev_lock(hdev);
1881
1882         if (!hdev_is_powered(hdev)) {
1883                 err = set_connectable_update_settings(hdev, sk, cp->val);
1884                 goto failed;
1885         }
1886
1887         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1888             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1889                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1890                                  MGMT_STATUS_BUSY);
1891                 goto failed;
1892         }
1893
1894         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1895         if (!cmd) {
1896                 err = -ENOMEM;
1897                 goto failed;
1898         }
1899
1900         hci_req_init(&req, hdev);
1901
1902         /* If BR/EDR is not enabled and we disable advertising as a
1903          * by-product of disabling connectable, we need to update the
1904          * advertising flags.
1905          */
1906         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1907                 if (!cp->val) {
1908                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1909                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1910                 }
1911                 update_adv_data(&req);
1912         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1913                 if (cp->val) {
1914                         scan = SCAN_PAGE;
1915                 } else {
1916                         /* If we don't have any whitelist entries just
1917                          * disable all scanning. If there are entries
1918                          * and we had both page and inquiry scanning
1919                          * enabled then fall back to only page scanning.
1920                          * Otherwise no changes are needed.
1921                          */
1922                         if (list_empty(&hdev->whitelist))
1923                                 scan = SCAN_DISABLED;
1924                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1925                                 scan = SCAN_PAGE;
1926                         else
1927                                 goto no_scan_update;
1928
1929                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1930                             hdev->discov_timeout > 0)
1931                                 cancel_delayed_work(&hdev->discov_off);
1932                 }
1933
1934                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1935         }
1936
1937 no_scan_update:
1938         /* If we're going from non-connectable to connectable or
1939          * vice-versa when fast connectable is enabled ensure that fast
1940          * connectable gets disabled. write_fast_connectable won't do
1941          * anything if the page scan parameters are already what they
1942          * should be.
1943          */
1944         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1945                 write_fast_connectable(&req, false);
1946
1947         /* Update the advertising parameters if necessary */
1948         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1949                 enable_advertising(&req);
1950
1951         err = hci_req_run(&req, set_connectable_complete);
1952         if (err < 0) {
1953                 mgmt_pending_remove(cmd);
1954                 if (err == -ENODATA)
1955                         err = set_connectable_update_settings(hdev, sk,
1956                                                               cp->val);
1957                 goto failed;
1958         }
1959
1960 failed:
1961         hci_dev_unlock(hdev);
1962         return err;
1963 }
1964
1965 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1966                         u16 len)
1967 {
1968         struct mgmt_mode *cp = data;
1969         bool changed;
1970         int err;
1971
1972         BT_DBG("request for %s", hdev->name);
1973
1974         if (cp->val != 0x00 && cp->val != 0x01)
1975                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1976                                   MGMT_STATUS_INVALID_PARAMS);
1977
1978         hci_dev_lock(hdev);
1979
1980         if (cp->val)
1981                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1982         else
1983                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1984
1985         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1986         if (err < 0)
1987                 goto unlock;
1988
1989         if (changed)
1990                 err = new_settings(hdev, sk);
1991
1992 unlock:
1993         hci_dev_unlock(hdev);
1994         return err;
1995 }
1996
1997 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1998                              u16 len)
1999 {
2000         struct mgmt_mode *cp = data;
2001         struct pending_cmd *cmd;
2002         u8 val, status;
2003         int err;
2004
2005         BT_DBG("request for %s", hdev->name);
2006
2007         status = mgmt_bredr_support(hdev);
2008         if (status)
2009                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2010                                   status);
2011
2012         if (cp->val != 0x00 && cp->val != 0x01)
2013                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2014                                   MGMT_STATUS_INVALID_PARAMS);
2015
2016         hci_dev_lock(hdev);
2017
2018         if (!hdev_is_powered(hdev)) {
2019                 bool changed = false;
2020
2021                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2022                                           &hdev->dev_flags)) {
2023                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2024                         changed = true;
2025                 }
2026
2027                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2028                 if (err < 0)
2029                         goto failed;
2030
2031                 if (changed)
2032                         err = new_settings(hdev, sk);
2033
2034                 goto failed;
2035         }
2036
2037         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2038                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2039                                  MGMT_STATUS_BUSY);
2040                 goto failed;
2041         }
2042
2043         val = !!cp->val;
2044
2045         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2046                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2047                 goto failed;
2048         }
2049
2050         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2051         if (!cmd) {
2052                 err = -ENOMEM;
2053                 goto failed;
2054         }
2055
2056         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2057         if (err < 0) {
2058                 mgmt_pending_remove(cmd);
2059                 goto failed;
2060         }
2061
2062 failed:
2063         hci_dev_unlock(hdev);
2064         return err;
2065 }
2066
2067 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2068 {
2069         struct mgmt_mode *cp = data;
2070         struct pending_cmd *cmd;
2071         u8 status;
2072         int err;
2073
2074         BT_DBG("request for %s", hdev->name);
2075
2076         status = mgmt_bredr_support(hdev);
2077         if (status)
2078                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2079
2080         if (!lmp_ssp_capable(hdev))
2081                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2082                                   MGMT_STATUS_NOT_SUPPORTED);
2083
2084         if (cp->val != 0x00 && cp->val != 0x01)
2085                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2086                                   MGMT_STATUS_INVALID_PARAMS);
2087
2088         hci_dev_lock(hdev);
2089
2090         if (!hdev_is_powered(hdev)) {
2091                 bool changed;
2092
2093                 if (cp->val) {
2094                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2095                                                     &hdev->dev_flags);
2096                 } else {
2097                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2098                                                      &hdev->dev_flags);
2099                         if (!changed)
2100                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2101                                                              &hdev->dev_flags);
2102                         else
2103                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2104                 }
2105
2106                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2107                 if (err < 0)
2108                         goto failed;
2109
2110                 if (changed)
2111                         err = new_settings(hdev, sk);
2112
2113                 goto failed;
2114         }
2115
2116         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2117             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2118                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2119                                  MGMT_STATUS_BUSY);
2120                 goto failed;
2121         }
2122
2123         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2124                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2125                 goto failed;
2126         }
2127
2128         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2129         if (!cmd) {
2130                 err = -ENOMEM;
2131                 goto failed;
2132         }
2133
2134         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2135                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2136                              sizeof(cp->val), &cp->val);
2137
2138         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2139         if (err < 0) {
2140                 mgmt_pending_remove(cmd);
2141                 goto failed;
2142         }
2143
2144 failed:
2145         hci_dev_unlock(hdev);
2146         return err;
2147 }
2148
2149 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2150 {
2151         struct mgmt_mode *cp = data;
2152         bool changed;
2153         u8 status;
2154         int err;
2155
2156         BT_DBG("request for %s", hdev->name);
2157
2158         status = mgmt_bredr_support(hdev);
2159         if (status)
2160                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2161
2162         if (!lmp_ssp_capable(hdev))
2163                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2164                                   MGMT_STATUS_NOT_SUPPORTED);
2165
2166         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2167                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2168                                   MGMT_STATUS_REJECTED);
2169
2170         if (cp->val != 0x00 && cp->val != 0x01)
2171                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2172                                   MGMT_STATUS_INVALID_PARAMS);
2173
2174         hci_dev_lock(hdev);
2175
2176         if (cp->val) {
2177                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2178         } else {
2179                 if (hdev_is_powered(hdev)) {
2180                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2181                                          MGMT_STATUS_REJECTED);
2182                         goto unlock;
2183                 }
2184
2185                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2186         }
2187
2188         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2189         if (err < 0)
2190                 goto unlock;
2191
2192         if (changed)
2193                 err = new_settings(hdev, sk);
2194
2195 unlock:
2196         hci_dev_unlock(hdev);
2197         return err;
2198 }
2199
2200 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2201 {
2202         struct cmd_lookup match = { NULL, hdev };
2203
2204         hci_dev_lock(hdev);
2205
2206         if (status) {
2207                 u8 mgmt_err = mgmt_status(status);
2208
2209                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2210                                      &mgmt_err);
2211                 goto unlock;
2212         }
2213
2214         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2215
2216         new_settings(hdev, match.sk);
2217
2218         if (match.sk)
2219                 sock_put(match.sk);
2220
2221         /* Make sure the controller has a good default for
2222          * advertising data. Restrict the update to when LE
2223          * has actually been enabled. During power on, the
2224          * update in powered_update_hci will take care of it.
2225          */
2226         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2227                 struct hci_request req;
2228
2229                 hci_req_init(&req, hdev);
2230                 update_adv_data(&req);
2231                 update_scan_rsp_data(&req);
2232                 __hci_update_background_scan(&req);
2233                 hci_req_run(&req, NULL);
2234         }
2235
2236 unlock:
2237         hci_dev_unlock(hdev);
2238 }
2239
2240 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2241 {
2242         struct mgmt_mode *cp = data;
2243         struct hci_cp_write_le_host_supported hci_cp;
2244         struct pending_cmd *cmd;
2245         struct hci_request req;
2246         int err;
2247         u8 val, enabled;
2248
2249         BT_DBG("request for %s", hdev->name);
2250
2251         if (!lmp_le_capable(hdev))
2252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2253                                   MGMT_STATUS_NOT_SUPPORTED);
2254
2255         if (cp->val != 0x00 && cp->val != 0x01)
2256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2257                                   MGMT_STATUS_INVALID_PARAMS);
2258
2259         /* LE-only devices do not allow toggling LE on/off */
2260         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2261                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2262                                   MGMT_STATUS_REJECTED);
2263
2264         hci_dev_lock(hdev);
2265
2266         val = !!cp->val;
2267         enabled = lmp_host_le_capable(hdev);
2268
2269         if (!hdev_is_powered(hdev) || val == enabled) {
2270                 bool changed = false;
2271
2272                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2273                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2274                         changed = true;
2275                 }
2276
2277                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2278                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2279                         changed = true;
2280                 }
2281
2282                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2283                 if (err < 0)
2284                         goto unlock;
2285
2286                 if (changed)
2287                         err = new_settings(hdev, sk);
2288
2289                 goto unlock;
2290         }
2291
2292         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2293             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2294                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2295                                  MGMT_STATUS_BUSY);
2296                 goto unlock;
2297         }
2298
2299         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2300         if (!cmd) {
2301                 err = -ENOMEM;
2302                 goto unlock;
2303         }
2304
2305         hci_req_init(&req, hdev);
2306
2307         memset(&hci_cp, 0, sizeof(hci_cp));
2308
2309         if (val) {
2310                 hci_cp.le = val;
2311                 hci_cp.simul = 0x00;
2312         } else {
2313                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2314                         disable_advertising(&req);
2315         }
2316
2317         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2318                     &hci_cp);
2319
2320         err = hci_req_run(&req, le_enable_complete);
2321         if (err < 0)
2322                 mgmt_pending_remove(cmd);
2323
2324 unlock:
2325         hci_dev_unlock(hdev);
2326         return err;
2327 }
2328
2329 /* This is a helper function to test for pending mgmt commands that can
2330  * cause CoD or EIR HCI commands. We can only allow one such pending
2331  * mgmt command at a time since otherwise we cannot easily track what
2332  * the current values are, will be, and based on that calculate if a new
2333  * HCI command needs to be sent and if yes with what value.
2334  */
2335 static bool pending_eir_or_class(struct hci_dev *hdev)
2336 {
2337         struct pending_cmd *cmd;
2338
2339         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2340                 switch (cmd->opcode) {
2341                 case MGMT_OP_ADD_UUID:
2342                 case MGMT_OP_REMOVE_UUID:
2343                 case MGMT_OP_SET_DEV_CLASS:
2344                 case MGMT_OP_SET_POWERED:
2345                         return true;
2346                 }
2347         }
2348
2349         return false;
2350 }
2351
2352 static const u8 bluetooth_base_uuid[] = {
2353                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2354                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2355 };
2356
2357 static u8 get_uuid_size(const u8 *uuid)
2358 {
2359         u32 val;
2360
2361         if (memcmp(uuid, bluetooth_base_uuid, 12))
2362                 return 128;
2363
2364         val = get_unaligned_le32(&uuid[12]);
2365         if (val > 0xffff)
2366                 return 32;
2367
2368         return 16;
2369 }
2370
2371 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2372 {
2373         struct pending_cmd *cmd;
2374
2375         hci_dev_lock(hdev);
2376
2377         cmd = mgmt_pending_find(mgmt_op, hdev);
2378         if (!cmd)
2379                 goto unlock;
2380
2381         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2382                      hdev->dev_class, 3);
2383
2384         mgmt_pending_remove(cmd);
2385
2386 unlock:
2387         hci_dev_unlock(hdev);
2388 }
2389
2390 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2391 {
2392         BT_DBG("status 0x%02x", status);
2393
2394         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2395 }
2396
2397 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2398 {
2399         struct mgmt_cp_add_uuid *cp = data;
2400         struct pending_cmd *cmd;
2401         struct hci_request req;
2402         struct bt_uuid *uuid;
2403         int err;
2404
2405         BT_DBG("request for %s", hdev->name);
2406
2407         hci_dev_lock(hdev);
2408
2409         if (pending_eir_or_class(hdev)) {
2410                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2411                                  MGMT_STATUS_BUSY);
2412                 goto failed;
2413         }
2414
2415         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2416         if (!uuid) {
2417                 err = -ENOMEM;
2418                 goto failed;
2419         }
2420
2421         memcpy(uuid->uuid, cp->uuid, 16);
2422         uuid->svc_hint = cp->svc_hint;
2423         uuid->size = get_uuid_size(cp->uuid);
2424
2425         list_add_tail(&uuid->list, &hdev->uuids);
2426
2427         hci_req_init(&req, hdev);
2428
2429         update_class(&req);
2430         update_eir(&req);
2431
2432         err = hci_req_run(&req, add_uuid_complete);
2433         if (err < 0) {
2434                 if (err != -ENODATA)
2435                         goto failed;
2436
2437                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2438                                    hdev->dev_class, 3);
2439                 goto failed;
2440         }
2441
2442         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2443         if (!cmd) {
2444                 err = -ENOMEM;
2445                 goto failed;
2446         }
2447
2448         err = 0;
2449
2450 failed:
2451         hci_dev_unlock(hdev);
2452         return err;
2453 }
2454
2455 static bool enable_service_cache(struct hci_dev *hdev)
2456 {
2457         if (!hdev_is_powered(hdev))
2458                 return false;
2459
2460         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2461                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2462                                    CACHE_TIMEOUT);
2463                 return true;
2464         }
2465
2466         return false;
2467 }
2468
2469 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2470 {
2471         BT_DBG("status 0x%02x", status);
2472
2473         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2474 }
2475
2476 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2477                        u16 len)
2478 {
2479         struct mgmt_cp_remove_uuid *cp = data;
2480         struct pending_cmd *cmd;
2481         struct bt_uuid *match, *tmp;
2482         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2483         struct hci_request req;
2484         int err, found;
2485
2486         BT_DBG("request for %s", hdev->name);
2487
2488         hci_dev_lock(hdev);
2489
2490         if (pending_eir_or_class(hdev)) {
2491                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2492                                  MGMT_STATUS_BUSY);
2493                 goto unlock;
2494         }
2495
2496         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2497                 hci_uuids_clear(hdev);
2498
2499                 if (enable_service_cache(hdev)) {
2500                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2501                                            0, hdev->dev_class, 3);
2502                         goto unlock;
2503                 }
2504
2505                 goto update_class;
2506         }
2507
2508         found = 0;
2509
2510         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2511                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2512                         continue;
2513
2514                 list_del(&match->list);
2515                 kfree(match);
2516                 found++;
2517         }
2518
2519         if (found == 0) {
2520                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2521                                  MGMT_STATUS_INVALID_PARAMS);
2522                 goto unlock;
2523         }
2524
2525 update_class:
2526         hci_req_init(&req, hdev);
2527
2528         update_class(&req);
2529         update_eir(&req);
2530
2531         err = hci_req_run(&req, remove_uuid_complete);
2532         if (err < 0) {
2533                 if (err != -ENODATA)
2534                         goto unlock;
2535
2536                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2537                                    hdev->dev_class, 3);
2538                 goto unlock;
2539         }
2540
2541         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2542         if (!cmd) {
2543                 err = -ENOMEM;
2544                 goto unlock;
2545         }
2546
2547         err = 0;
2548
2549 unlock:
2550         hci_dev_unlock(hdev);
2551         return err;
2552 }
2553
2554 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2555 {
2556         BT_DBG("status 0x%02x", status);
2557
2558         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2559 }
2560
2561 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2562                          u16 len)
2563 {
2564         struct mgmt_cp_set_dev_class *cp = data;
2565         struct pending_cmd *cmd;
2566         struct hci_request req;
2567         int err;
2568
2569         BT_DBG("request for %s", hdev->name);
2570
2571         if (!lmp_bredr_capable(hdev))
2572                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2573                                   MGMT_STATUS_NOT_SUPPORTED);
2574
2575         hci_dev_lock(hdev);
2576
2577         if (pending_eir_or_class(hdev)) {
2578                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2579                                  MGMT_STATUS_BUSY);
2580                 goto unlock;
2581         }
2582
2583         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2584                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2585                                  MGMT_STATUS_INVALID_PARAMS);
2586                 goto unlock;
2587         }
2588
2589         hdev->major_class = cp->major;
2590         hdev->minor_class = cp->minor;
2591
2592         if (!hdev_is_powered(hdev)) {
2593                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2594                                    hdev->dev_class, 3);
2595                 goto unlock;
2596         }
2597
2598         hci_req_init(&req, hdev);
2599
2600         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2601                 hci_dev_unlock(hdev);
2602                 cancel_delayed_work_sync(&hdev->service_cache);
2603                 hci_dev_lock(hdev);
2604                 update_eir(&req);
2605         }
2606
2607         update_class(&req);
2608
2609         err = hci_req_run(&req, set_class_complete);
2610         if (err < 0) {
2611                 if (err != -ENODATA)
2612                         goto unlock;
2613
2614                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2615                                    hdev->dev_class, 3);
2616                 goto unlock;
2617         }
2618
2619         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2620         if (!cmd) {
2621                 err = -ENOMEM;
2622                 goto unlock;
2623         }
2624
2625         err = 0;
2626
2627 unlock:
2628         hci_dev_unlock(hdev);
2629         return err;
2630 }
2631
2632 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2633                           u16 len)
2634 {
2635         struct mgmt_cp_load_link_keys *cp = data;
2636         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2637                                    sizeof(struct mgmt_link_key_info));
2638         u16 key_count, expected_len;
2639         bool changed;
2640         int i;
2641
2642         BT_DBG("request for %s", hdev->name);
2643
2644         if (!lmp_bredr_capable(hdev))
2645                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2646                                   MGMT_STATUS_NOT_SUPPORTED);
2647
2648         key_count = __le16_to_cpu(cp->key_count);
2649         if (key_count > max_key_count) {
2650                 BT_ERR("load_link_keys: too big key_count value %u",
2651                        key_count);
2652                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2653                                   MGMT_STATUS_INVALID_PARAMS);
2654         }
2655
2656         expected_len = sizeof(*cp) + key_count *
2657                                         sizeof(struct mgmt_link_key_info);
2658         if (expected_len != len) {
2659                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2660                        expected_len, len);
2661                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2662                                   MGMT_STATUS_INVALID_PARAMS);
2663         }
2664
2665         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2666                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2667                                   MGMT_STATUS_INVALID_PARAMS);
2668
2669         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2670                key_count);
2671
2672         for (i = 0; i < key_count; i++) {
2673                 struct mgmt_link_key_info *key = &cp->keys[i];
2674
2675                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2676                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2677                                           MGMT_STATUS_INVALID_PARAMS);
2678         }
2679
2680         hci_dev_lock(hdev);
2681
2682         hci_link_keys_clear(hdev);
2683
2684         if (cp->debug_keys)
2685                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2686                                             &hdev->dev_flags);
2687         else
2688                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2689                                              &hdev->dev_flags);
2690
2691         if (changed)
2692                 new_settings(hdev, NULL);
2693
2694         for (i = 0; i < key_count; i++) {
2695                 struct mgmt_link_key_info *key = &cp->keys[i];
2696
2697                 /* Always ignore debug keys and require a new pairing if
2698                  * the user wants to use them.
2699                  */
2700                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2701                         continue;
2702
2703                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2704                                  key->type, key->pin_len, NULL);
2705         }
2706
2707         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2708
2709         hci_dev_unlock(hdev);
2710
2711         return 0;
2712 }
2713
2714 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2715                            u8 addr_type, struct sock *skip_sk)
2716 {
2717         struct mgmt_ev_device_unpaired ev;
2718
2719         bacpy(&ev.addr.bdaddr, bdaddr);
2720         ev.addr.type = addr_type;
2721
2722         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2723                           skip_sk);
2724 }
2725
2726 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2727                          u16 len)
2728 {
2729         struct mgmt_cp_unpair_device *cp = data;
2730         struct mgmt_rp_unpair_device rp;
2731         struct hci_cp_disconnect dc;
2732         struct pending_cmd *cmd;
2733         struct hci_conn *conn;
2734         int err;
2735
2736         memset(&rp, 0, sizeof(rp));
2737         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2738         rp.addr.type = cp->addr.type;
2739
2740         if (!bdaddr_type_is_valid(cp->addr.type))
2741                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2742                                     MGMT_STATUS_INVALID_PARAMS,
2743                                     &rp, sizeof(rp));
2744
2745         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2746                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2747                                     MGMT_STATUS_INVALID_PARAMS,
2748                                     &rp, sizeof(rp));
2749
2750         hci_dev_lock(hdev);
2751
2752         if (!hdev_is_powered(hdev)) {
2753                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2754                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2755                 goto unlock;
2756         }
2757
2758         if (cp->addr.type == BDADDR_BREDR) {
2759                 /* If disconnection is requested, then look up the
2760                  * connection. If the remote device is connected, it
2761                  * will be later used to terminate the link.
2762                  *
2763                  * Setting it to NULL explicitly will cause no
2764                  * termination of the link.
2765                  */
2766                 if (cp->disconnect)
2767                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2768                                                        &cp->addr.bdaddr);
2769                 else
2770                         conn = NULL;
2771
2772                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2773         } else {
2774                 u8 addr_type;
2775
2776                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2777                                                &cp->addr.bdaddr);
2778                 if (conn) {
2779                         /* Defer clearing up the connection parameters
2780                          * until closing to give a chance of keeping
2781                          * them if a repairing happens.
2782                          */
2783                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2784
2785                         /* If disconnection is not requested, then
2786                          * clear the connection variable so that the
2787                          * link is not terminated.
2788                          */
2789                         if (!cp->disconnect)
2790                                 conn = NULL;
2791                 }
2792
2793                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2794                         addr_type = ADDR_LE_DEV_PUBLIC;
2795                 else
2796                         addr_type = ADDR_LE_DEV_RANDOM;
2797
2798                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2799
2800                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2801         }
2802
2803         if (err < 0) {
2804                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2805                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2806                 goto unlock;
2807         }
2808
2809         /* If the connection variable is set, then termination of the
2810          * link is requested.
2811          */
2812         if (!conn) {
2813                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2814                                    &rp, sizeof(rp));
2815                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2816                 goto unlock;
2817         }
2818
2819         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2820                                sizeof(*cp));
2821         if (!cmd) {
2822                 err = -ENOMEM;
2823                 goto unlock;
2824         }
2825
2826         cmd->cmd_complete = addr_cmd_complete;
2827
2828         dc.handle = cpu_to_le16(conn->handle);
2829         dc.reason = 0x13; /* Remote User Terminated Connection */
2830         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2831         if (err < 0)
2832                 mgmt_pending_remove(cmd);
2833
2834 unlock:
2835         hci_dev_unlock(hdev);
2836         return err;
2837 }
2838
2839 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2840                       u16 len)
2841 {
2842         struct mgmt_cp_disconnect *cp = data;
2843         struct mgmt_rp_disconnect rp;
2844         struct pending_cmd *cmd;
2845         struct hci_conn *conn;
2846         int err;
2847
2848         BT_DBG("");
2849
2850         memset(&rp, 0, sizeof(rp));
2851         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2852         rp.addr.type = cp->addr.type;
2853
2854         if (!bdaddr_type_is_valid(cp->addr.type))
2855                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2856                                     MGMT_STATUS_INVALID_PARAMS,
2857                                     &rp, sizeof(rp));
2858
2859         hci_dev_lock(hdev);
2860
2861         if (!test_bit(HCI_UP, &hdev->flags)) {
2862                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2863                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2864                 goto failed;
2865         }
2866
2867         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2868                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2869                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2870                 goto failed;
2871         }
2872
2873         if (cp->addr.type == BDADDR_BREDR)
2874                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2875                                                &cp->addr.bdaddr);
2876         else
2877                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2878
2879         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2880                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2881                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2882                 goto failed;
2883         }
2884
2885         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2886         if (!cmd) {
2887                 err = -ENOMEM;
2888                 goto failed;
2889         }
2890
2891         cmd->cmd_complete = generic_cmd_complete;
2892
2893         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2894         if (err < 0)
2895                 mgmt_pending_remove(cmd);
2896
2897 failed:
2898         hci_dev_unlock(hdev);
2899         return err;
2900 }
2901
2902 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2903 {
2904         switch (link_type) {
2905         case LE_LINK:
2906                 switch (addr_type) {
2907                 case ADDR_LE_DEV_PUBLIC:
2908                         return BDADDR_LE_PUBLIC;
2909
2910                 default:
2911                         /* Fallback to LE Random address type */
2912                         return BDADDR_LE_RANDOM;
2913                 }
2914
2915         default:
2916                 /* Fallback to BR/EDR type */
2917                 return BDADDR_BREDR;
2918         }
2919 }
2920
2921 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2922                            u16 data_len)
2923 {
2924         struct mgmt_rp_get_connections *rp;
2925         struct hci_conn *c;
2926         size_t rp_len;
2927         int err;
2928         u16 i;
2929
2930         BT_DBG("");
2931
2932         hci_dev_lock(hdev);
2933
2934         if (!hdev_is_powered(hdev)) {
2935                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2936                                  MGMT_STATUS_NOT_POWERED);
2937                 goto unlock;
2938         }
2939
2940         i = 0;
2941         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2942                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2943                         i++;
2944         }
2945
2946         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2947         rp = kmalloc(rp_len, GFP_KERNEL);
2948         if (!rp) {
2949                 err = -ENOMEM;
2950                 goto unlock;
2951         }
2952
2953         i = 0;
2954         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2955                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2956                         continue;
2957                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2958                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2959                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2960                         continue;
2961                 i++;
2962         }
2963
2964         rp->conn_count = cpu_to_le16(i);
2965
2966         /* Recalculate length in case of filtered SCO connections, etc */
2967         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2968
2969         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2970                            rp_len);
2971
2972         kfree(rp);
2973
2974 unlock:
2975         hci_dev_unlock(hdev);
2976         return err;
2977 }
2978
2979 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2980                                    struct mgmt_cp_pin_code_neg_reply *cp)
2981 {
2982         struct pending_cmd *cmd;
2983         int err;
2984
2985         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2986                                sizeof(*cp));
2987         if (!cmd)
2988                 return -ENOMEM;
2989
2990         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2991                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2992         if (err < 0)
2993                 mgmt_pending_remove(cmd);
2994
2995         return err;
2996 }
2997
2998 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2999                           u16 len)
3000 {
3001         struct hci_conn *conn;
3002         struct mgmt_cp_pin_code_reply *cp = data;
3003         struct hci_cp_pin_code_reply reply;
3004         struct pending_cmd *cmd;
3005         int err;
3006
3007         BT_DBG("");
3008
3009         hci_dev_lock(hdev);
3010
3011         if (!hdev_is_powered(hdev)) {
3012                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3013                                  MGMT_STATUS_NOT_POWERED);
3014                 goto failed;
3015         }
3016
3017         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3018         if (!conn) {
3019                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3020                                  MGMT_STATUS_NOT_CONNECTED);
3021                 goto failed;
3022         }
3023
3024         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3025                 struct mgmt_cp_pin_code_neg_reply ncp;
3026
3027                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3028
3029                 BT_ERR("PIN code is not 16 bytes long");
3030
3031                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3032                 if (err >= 0)
3033                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3034                                          MGMT_STATUS_INVALID_PARAMS);
3035
3036                 goto failed;
3037         }
3038
3039         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3040         if (!cmd) {
3041                 err = -ENOMEM;
3042                 goto failed;
3043         }
3044
3045         cmd->cmd_complete = addr_cmd_complete;
3046
3047         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3048         reply.pin_len = cp->pin_len;
3049         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3050
3051         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3052         if (err < 0)
3053                 mgmt_pending_remove(cmd);
3054
3055 failed:
3056         hci_dev_unlock(hdev);
3057         return err;
3058 }
3059
3060 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3061                              u16 len)
3062 {
3063         struct mgmt_cp_set_io_capability *cp = data;
3064
3065         BT_DBG("");
3066
3067         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3068                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3069                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3070
3071         hci_dev_lock(hdev);
3072
3073         hdev->io_capability = cp->io_capability;
3074
3075         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3076                hdev->io_capability);
3077
3078         hci_dev_unlock(hdev);
3079
3080         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3081                             0);
3082 }
3083
3084 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3085 {
3086         struct hci_dev *hdev = conn->hdev;
3087         struct pending_cmd *cmd;
3088
3089         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3090                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3091                         continue;
3092
3093                 if (cmd->user_data != conn)
3094                         continue;
3095
3096                 return cmd;
3097         }
3098
3099         return NULL;
3100 }
3101
3102 static int pairing_complete(struct pending_cmd *cmd, u8 status)
3103 {
3104         struct mgmt_rp_pair_device rp;
3105         struct hci_conn *conn = cmd->user_data;
3106         int err;
3107
3108         bacpy(&rp.addr.bdaddr, &conn->dst);
3109         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3110
3111         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3112                            &rp, sizeof(rp));
3113
3114         /* So we don't get further callbacks for this connection */
3115         conn->connect_cfm_cb = NULL;
3116         conn->security_cfm_cb = NULL;
3117         conn->disconn_cfm_cb = NULL;
3118
3119         hci_conn_drop(conn);
3120
3121         /* The device is paired so there is no need to remove
3122          * its connection parameters anymore.
3123          */
3124         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3125
3126         hci_conn_put(conn);
3127
3128         return err;
3129 }
3130
3131 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3132 {
3133         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3134         struct pending_cmd *cmd;
3135
3136         cmd = find_pairing(conn);
3137         if (cmd) {
3138                 cmd->cmd_complete(cmd, status);
3139                 mgmt_pending_remove(cmd);
3140         }
3141 }
3142
3143 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3144 {
3145         struct pending_cmd *cmd;
3146
3147         BT_DBG("status %u", status);
3148
3149         cmd = find_pairing(conn);
3150         if (!cmd) {
3151                 BT_DBG("Unable to find a pending command");
3152                 return;
3153         }
3154
3155         cmd->cmd_complete(cmd, mgmt_status(status));
3156         mgmt_pending_remove(cmd);
3157 }
3158
3159 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3160 {
3161         struct pending_cmd *cmd;
3162
3163         BT_DBG("status %u", status);
3164
3165         if (!status)
3166                 return;
3167
3168         cmd = find_pairing(conn);
3169         if (!cmd) {
3170                 BT_DBG("Unable to find a pending command");
3171                 return;
3172         }
3173
3174         cmd->cmd_complete(cmd, mgmt_status(status));
3175         mgmt_pending_remove(cmd);
3176 }
3177
3178 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3179                        u16 len)
3180 {
3181         struct mgmt_cp_pair_device *cp = data;
3182         struct mgmt_rp_pair_device rp;
3183         struct pending_cmd *cmd;
3184         u8 sec_level, auth_type;
3185         struct hci_conn *conn;
3186         int err;
3187
3188         BT_DBG("");
3189
3190         memset(&rp, 0, sizeof(rp));
3191         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3192         rp.addr.type = cp->addr.type;
3193
3194         if (!bdaddr_type_is_valid(cp->addr.type))
3195                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3196                                     MGMT_STATUS_INVALID_PARAMS,
3197                                     &rp, sizeof(rp));
3198
3199         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3200                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3201                                     MGMT_STATUS_INVALID_PARAMS,
3202                                     &rp, sizeof(rp));
3203
3204         hci_dev_lock(hdev);
3205
3206         if (!hdev_is_powered(hdev)) {
3207                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3208                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3209                 goto unlock;
3210         }
3211
3212         sec_level = BT_SECURITY_MEDIUM;
3213         auth_type = HCI_AT_DEDICATED_BONDING;
3214
3215         if (cp->addr.type == BDADDR_BREDR) {
3216                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3217                                        auth_type);
3218         } else {
3219                 u8 addr_type;
3220
3221                 /* Convert from L2CAP channel address type to HCI address type
3222                  */
3223                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3224                         addr_type = ADDR_LE_DEV_PUBLIC;
3225                 else
3226                         addr_type = ADDR_LE_DEV_RANDOM;
3227
3228                 /* When pairing a new device, it is expected to remember
3229                  * this device for future connections. Adding the connection
3230                  * parameter information ahead of time allows tracking
3231                  * of the slave preferred values and will speed up any
3232                  * further connection establishment.
3233                  *
3234                  * If connection parameters already exist, then they
3235                  * will be kept and this function does nothing.
3236                  */
3237                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3238
3239                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3240                                       sec_level, HCI_LE_CONN_TIMEOUT,
3241                                       HCI_ROLE_MASTER);
3242         }
3243
3244         if (IS_ERR(conn)) {
3245                 int status;
3246
3247                 if (PTR_ERR(conn) == -EBUSY)
3248                         status = MGMT_STATUS_BUSY;
3249                 else
3250                         status = MGMT_STATUS_CONNECT_FAILED;
3251
3252                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3253                                    status, &rp,
3254                                    sizeof(rp));
3255                 goto unlock;
3256         }
3257
3258         if (conn->connect_cfm_cb) {
3259                 hci_conn_drop(conn);
3260                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3261                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3262                 goto unlock;
3263         }
3264
3265         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3266         if (!cmd) {
3267                 err = -ENOMEM;
3268                 hci_conn_drop(conn);
3269                 goto unlock;
3270         }
3271
3272         cmd->cmd_complete = pairing_complete;
3273
3274         /* For LE, just connecting isn't a proof that the pairing finished */
3275         if (cp->addr.type == BDADDR_BREDR) {
3276                 conn->connect_cfm_cb = pairing_complete_cb;
3277                 conn->security_cfm_cb = pairing_complete_cb;
3278                 conn->disconn_cfm_cb = pairing_complete_cb;
3279         } else {
3280                 conn->connect_cfm_cb = le_pairing_complete_cb;
3281                 conn->security_cfm_cb = le_pairing_complete_cb;
3282                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3283         }
3284
3285         conn->io_capability = cp->io_cap;
3286         cmd->user_data = hci_conn_get(conn);
3287
3288         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3289             hci_conn_security(conn, sec_level, auth_type, true)) {
3290                 cmd->cmd_complete(cmd, 0);
3291                 mgmt_pending_remove(cmd);
3292         }
3293
3294         err = 0;
3295
3296 unlock:
3297         hci_dev_unlock(hdev);
3298         return err;
3299 }
3300
3301 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3302                               u16 len)
3303 {
3304         struct mgmt_addr_info *addr = data;
3305         struct pending_cmd *cmd;
3306         struct hci_conn *conn;
3307         int err;
3308
3309         BT_DBG("");
3310
3311         hci_dev_lock(hdev);
3312
3313         if (!hdev_is_powered(hdev)) {
3314                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3315                                  MGMT_STATUS_NOT_POWERED);
3316                 goto unlock;
3317         }
3318
3319         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3320         if (!cmd) {
3321                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3322                                  MGMT_STATUS_INVALID_PARAMS);
3323                 goto unlock;
3324         }
3325
3326         conn = cmd->user_data;
3327
3328         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3329                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3330                                  MGMT_STATUS_INVALID_PARAMS);
3331                 goto unlock;
3332         }
3333
3334         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3335         mgmt_pending_remove(cmd);
3336
3337         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3338                            addr, sizeof(*addr));
3339 unlock:
3340         hci_dev_unlock(hdev);
3341         return err;
3342 }
3343
3344 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3345                              struct mgmt_addr_info *addr, u16 mgmt_op,
3346                              u16 hci_op, __le32 passkey)
3347 {
3348         struct pending_cmd *cmd;
3349         struct hci_conn *conn;
3350         int err;
3351
3352         hci_dev_lock(hdev);
3353
3354         if (!hdev_is_powered(hdev)) {
3355                 err = cmd_complete(sk, hdev->id, mgmt_op,
3356                                    MGMT_STATUS_NOT_POWERED, addr,
3357                                    sizeof(*addr));
3358                 goto done;
3359         }
3360
3361         if (addr->type == BDADDR_BREDR)
3362                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3363         else
3364                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3365
3366         if (!conn) {
3367                 err = cmd_complete(sk, hdev->id, mgmt_op,
3368                                    MGMT_STATUS_NOT_CONNECTED, addr,
3369                                    sizeof(*addr));
3370                 goto done;
3371         }
3372
3373         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3374                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3375                 if (!err)
3376                         err = cmd_complete(sk, hdev->id, mgmt_op,
3377                                            MGMT_STATUS_SUCCESS, addr,
3378                                            sizeof(*addr));
3379                 else
3380                         err = cmd_complete(sk, hdev->id, mgmt_op,
3381                                            MGMT_STATUS_FAILED, addr,
3382                                            sizeof(*addr));
3383
3384                 goto done;
3385         }
3386
3387         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3388         if (!cmd) {
3389                 err = -ENOMEM;
3390                 goto done;
3391         }
3392
3393         cmd->cmd_complete = addr_cmd_complete;
3394
3395         /* Continue with pairing via HCI */
3396         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3397                 struct hci_cp_user_passkey_reply cp;
3398
3399                 bacpy(&cp.bdaddr, &addr->bdaddr);
3400                 cp.passkey = passkey;
3401                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3402         } else
3403                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3404                                    &addr->bdaddr);
3405
3406         if (err < 0)
3407                 mgmt_pending_remove(cmd);
3408
3409 done:
3410         hci_dev_unlock(hdev);
3411         return err;
3412 }
3413
3414 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3415                               void *data, u16 len)
3416 {
3417         struct mgmt_cp_pin_code_neg_reply *cp = data;
3418
3419         BT_DBG("");
3420
3421         return user_pairing_resp(sk, hdev, &cp->addr,
3422                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3423                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3424 }
3425
3426 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3427                               u16 len)
3428 {
3429         struct mgmt_cp_user_confirm_reply *cp = data;
3430
3431         BT_DBG("");
3432
3433         if (len != sizeof(*cp))
3434                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3435                                   MGMT_STATUS_INVALID_PARAMS);
3436
3437         return user_pairing_resp(sk, hdev, &cp->addr,
3438                                  MGMT_OP_USER_CONFIRM_REPLY,
3439                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3440 }
3441
3442 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3443                                   void *data, u16 len)
3444 {
3445         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3446
3447         BT_DBG("");
3448
3449         return user_pairing_resp(sk, hdev, &cp->addr,
3450                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3451                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3452 }
3453
3454 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3455                               u16 len)
3456 {
3457         struct mgmt_cp_user_passkey_reply *cp = data;
3458
3459         BT_DBG("");
3460
3461         return user_pairing_resp(sk, hdev, &cp->addr,
3462                                  MGMT_OP_USER_PASSKEY_REPLY,
3463                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3464 }
3465
3466 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3467                                   void *data, u16 len)
3468 {
3469         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3470
3471         BT_DBG("");
3472
3473         return user_pairing_resp(sk, hdev, &cp->addr,
3474                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3475                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3476 }
3477
3478 static void update_name(struct hci_request *req)
3479 {
3480         struct hci_dev *hdev = req->hdev;
3481         struct hci_cp_write_local_name cp;
3482
3483         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3484
3485         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3486 }
3487
3488 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3489 {
3490         struct mgmt_cp_set_local_name *cp;
3491         struct pending_cmd *cmd;
3492
3493         BT_DBG("status 0x%02x", status);
3494
3495         hci_dev_lock(hdev);
3496
3497         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3498         if (!cmd)
3499                 goto unlock;
3500
3501         cp = cmd->param;
3502
3503         if (status)
3504                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3505                            mgmt_status(status));
3506         else
3507                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3508                              cp, sizeof(*cp));
3509
3510         mgmt_pending_remove(cmd);
3511
3512 unlock:
3513         hci_dev_unlock(hdev);
3514 }
3515
3516 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3517                           u16 len)
3518 {
3519         struct mgmt_cp_set_local_name *cp = data;
3520         struct pending_cmd *cmd;
3521         struct hci_request req;
3522         int err;
3523
3524         BT_DBG("");
3525
3526         hci_dev_lock(hdev);
3527
3528         /* If the old values are the same as the new ones just return a
3529          * direct command complete event.
3530          */
3531         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3532             !memcmp(hdev->short_name, cp->short_name,
3533                     sizeof(hdev->short_name))) {
3534                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3535                                    data, len);
3536                 goto failed;
3537         }
3538
3539         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3540
3541         if (!hdev_is_powered(hdev)) {
3542                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3543
3544                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3545                                    data, len);
3546                 if (err < 0)
3547                         goto failed;
3548
3549                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3550                                  sk);
3551
3552                 goto failed;
3553         }
3554
3555         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3556         if (!cmd) {
3557                 err = -ENOMEM;
3558                 goto failed;
3559         }
3560
3561         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3562
3563         hci_req_init(&req, hdev);
3564
3565         if (lmp_bredr_capable(hdev)) {
3566                 update_name(&req);
3567                 update_eir(&req);
3568         }
3569
3570         /* The name is stored in the scan response data and so
3571          * no need to udpate the advertising data here.
3572          */
3573         if (lmp_le_capable(hdev))
3574                 update_scan_rsp_data(&req);
3575
3576         err = hci_req_run(&req, set_name_complete);
3577         if (err < 0)
3578                 mgmt_pending_remove(cmd);
3579
3580 failed:
3581         hci_dev_unlock(hdev);
3582         return err;
3583 }
3584
3585 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3586                                void *data, u16 data_len)
3587 {
3588         struct pending_cmd *cmd;
3589         int err;
3590
3591         BT_DBG("%s", hdev->name);
3592
3593         hci_dev_lock(hdev);
3594
3595         if (!hdev_is_powered(hdev)) {
3596                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3597                                  MGMT_STATUS_NOT_POWERED);
3598                 goto unlock;
3599         }
3600
3601         if (!lmp_ssp_capable(hdev)) {
3602                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3603                                  MGMT_STATUS_NOT_SUPPORTED);
3604                 goto unlock;
3605         }
3606
3607         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3608                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3609                                  MGMT_STATUS_BUSY);
3610                 goto unlock;
3611         }
3612
3613         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3614         if (!cmd) {
3615                 err = -ENOMEM;
3616                 goto unlock;
3617         }
3618
3619         if (bredr_sc_enabled(hdev))
3620                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3621                                    0, NULL);
3622         else
3623                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3624
3625         if (err < 0)
3626                 mgmt_pending_remove(cmd);
3627
3628 unlock:
3629         hci_dev_unlock(hdev);
3630         return err;
3631 }
3632
3633 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3634                                void *data, u16 len)
3635 {
3636         struct mgmt_addr_info *addr = data;
3637         int err;
3638
3639         BT_DBG("%s ", hdev->name);
3640
3641         if (!bdaddr_type_is_valid(addr->type))
3642                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3643                                     MGMT_STATUS_INVALID_PARAMS, addr,
3644                                     sizeof(*addr));
3645
3646         hci_dev_lock(hdev);
3647
3648         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3649                 struct mgmt_cp_add_remote_oob_data *cp = data;
3650                 u8 status;
3651
3652                 if (cp->addr.type != BDADDR_BREDR) {
3653                         err = cmd_complete(sk, hdev->id,
3654                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3655                                            MGMT_STATUS_INVALID_PARAMS,
3656                                            &cp->addr, sizeof(cp->addr));
3657                         goto unlock;
3658                 }
3659
3660                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3661                                               cp->addr.type, cp->hash,
3662                                               cp->rand, NULL, NULL);
3663                 if (err < 0)
3664                         status = MGMT_STATUS_FAILED;
3665                 else
3666                         status = MGMT_STATUS_SUCCESS;
3667
3668                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3669                                    status, &cp->addr, sizeof(cp->addr));
3670         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3671                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3672                 u8 *rand192, *hash192;
3673                 u8 status;
3674
3675                 if (bdaddr_type_is_le(cp->addr.type)) {
3676                         rand192 = NULL;
3677                         hash192 = NULL;
3678                 } else {
3679                         rand192 = cp->rand192;
3680                         hash192 = cp->hash192;
3681                 }
3682
3683                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3684                                               cp->addr.type, hash192, rand192,
3685                                               cp->hash256, cp->rand256);
3686                 if (err < 0)
3687                         status = MGMT_STATUS_FAILED;
3688                 else
3689                         status = MGMT_STATUS_SUCCESS;
3690
3691                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3692                                    status, &cp->addr, sizeof(cp->addr));
3693         } else {
3694                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3695                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3696                                  MGMT_STATUS_INVALID_PARAMS);
3697         }
3698
3699 unlock:
3700         hci_dev_unlock(hdev);
3701         return err;
3702 }
3703
3704 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3705                                   void *data, u16 len)
3706 {
3707         struct mgmt_cp_remove_remote_oob_data *cp = data;
3708         u8 status;
3709         int err;
3710
3711         BT_DBG("%s", hdev->name);
3712
3713         if (cp->addr.type != BDADDR_BREDR)
3714                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3715                                     MGMT_STATUS_INVALID_PARAMS,
3716                                     &cp->addr, sizeof(cp->addr));
3717
3718         hci_dev_lock(hdev);
3719
3720         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3721                 hci_remote_oob_data_clear(hdev);
3722                 status = MGMT_STATUS_SUCCESS;
3723                 goto done;
3724         }
3725
3726         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3727         if (err < 0)
3728                 status = MGMT_STATUS_INVALID_PARAMS;
3729         else
3730                 status = MGMT_STATUS_SUCCESS;
3731
3732 done:
3733         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3734                            status, &cp->addr, sizeof(cp->addr));
3735
3736         hci_dev_unlock(hdev);
3737         return err;
3738 }
3739
3740 static bool trigger_discovery(struct hci_request *req, u8 *status)
3741 {
3742         struct hci_dev *hdev = req->hdev;
3743         struct hci_cp_le_set_scan_param param_cp;
3744         struct hci_cp_le_set_scan_enable enable_cp;
3745         struct hci_cp_inquiry inq_cp;
3746         /* General inquiry access code (GIAC) */
3747         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3748         u8 own_addr_type;
3749         int err;
3750
3751         switch (hdev->discovery.type) {
3752         case DISCOV_TYPE_BREDR:
3753                 *status = mgmt_bredr_support(hdev);
3754                 if (*status)
3755                         return false;
3756
3757                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3758                         *status = MGMT_STATUS_BUSY;
3759                         return false;
3760                 }
3761
3762                 hci_inquiry_cache_flush(hdev);
3763
3764                 memset(&inq_cp, 0, sizeof(inq_cp));
3765                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3766                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3767                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3768                 break;
3769
3770         case DISCOV_TYPE_LE:
3771         case DISCOV_TYPE_INTERLEAVED:
3772                 *status = mgmt_le_support(hdev);
3773                 if (*status)
3774                         return false;
3775
3776                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3777                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3778                         *status = MGMT_STATUS_NOT_SUPPORTED;
3779                         return false;
3780                 }
3781
3782                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3783                         /* Don't let discovery abort an outgoing
3784                          * connection attempt that's using directed
3785                          * advertising.
3786                          */
3787                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3788                                                        BT_CONNECT)) {
3789                                 *status = MGMT_STATUS_REJECTED;
3790                                 return false;
3791                         }
3792
3793                         disable_advertising(req);
3794                 }
3795
3796                 /* If controller is scanning, it means the background scanning
3797                  * is running. Thus, we should temporarily stop it in order to
3798                  * set the discovery scanning parameters.
3799                  */
3800                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3801                         hci_req_add_le_scan_disable(req);
3802
3803                 memset(&param_cp, 0, sizeof(param_cp));
3804
3805                 /* All active scans will be done with either a resolvable
3806                  * private address (when privacy feature has been enabled)
3807                  * or non-resolvable private address.
3808                  */
3809                 err = hci_update_random_address(req, true, &own_addr_type);
3810                 if (err < 0) {
3811                         *status = MGMT_STATUS_FAILED;
3812                         return false;
3813                 }
3814
3815                 param_cp.type = LE_SCAN_ACTIVE;
3816                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3817                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3818                 param_cp.own_address_type = own_addr_type;
3819                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3820                             &param_cp);
3821
3822                 memset(&enable_cp, 0, sizeof(enable_cp));
3823                 enable_cp.enable = LE_SCAN_ENABLE;
3824                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3825                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3826                             &enable_cp);
3827                 break;
3828
3829         default:
3830                 *status = MGMT_STATUS_INVALID_PARAMS;
3831                 return false;
3832         }
3833
3834         return true;
3835 }
3836
3837 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3838                                      u16 opcode)
3839 {
3840         struct pending_cmd *cmd;
3841         unsigned long timeout;
3842
3843         BT_DBG("status %d", status);
3844
3845         hci_dev_lock(hdev);
3846
3847         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3848         if (!cmd)
3849                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3850
3851         if (cmd) {
3852                 cmd->cmd_complete(cmd, mgmt_status(status));
3853                 mgmt_pending_remove(cmd);
3854         }
3855
3856         if (status) {
3857                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3858                 goto unlock;
3859         }
3860
3861         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3862
3863         switch (hdev->discovery.type) {
3864         case DISCOV_TYPE_LE:
3865                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3866                 break;
3867         case DISCOV_TYPE_INTERLEAVED:
3868                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3869                 break;
3870         case DISCOV_TYPE_BREDR:
3871                 timeout = 0;
3872                 break;
3873         default:
3874                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3875                 timeout = 0;
3876                 break;
3877         }
3878
3879         if (timeout)
3880                 queue_delayed_work(hdev->workqueue,
3881                                    &hdev->le_scan_disable, timeout);
3882
3883 unlock:
3884         hci_dev_unlock(hdev);
3885 }
3886
3887 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3888                            void *data, u16 len)
3889 {
3890         struct mgmt_cp_start_discovery *cp = data;
3891         struct pending_cmd *cmd;
3892         struct hci_request req;
3893         u8 status;
3894         int err;
3895
3896         BT_DBG("%s", hdev->name);
3897
3898         hci_dev_lock(hdev);
3899
3900         if (!hdev_is_powered(hdev)) {
3901                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3902                                    MGMT_STATUS_NOT_POWERED,
3903                                    &cp->type, sizeof(cp->type));
3904                 goto failed;
3905         }
3906
3907         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3908             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3909                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3910                                    MGMT_STATUS_BUSY, &cp->type,
3911                                    sizeof(cp->type));
3912                 goto failed;
3913         }
3914
3915         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3916         if (!cmd) {
3917                 err = -ENOMEM;
3918                 goto failed;
3919         }
3920
3921         cmd->cmd_complete = generic_cmd_complete;
3922
3923         /* Clear the discovery filter first to free any previously
3924          * allocated memory for the UUID list.
3925          */
3926         hci_discovery_filter_clear(hdev);
3927
3928         hdev->discovery.type = cp->type;
3929         hdev->discovery.report_invalid_rssi = false;
3930
3931         hci_req_init(&req, hdev);
3932
3933         if (!trigger_discovery(&req, &status)) {
3934                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3935                                    status, &cp->type, sizeof(cp->type));
3936                 mgmt_pending_remove(cmd);
3937                 goto failed;
3938         }
3939
3940         err = hci_req_run(&req, start_discovery_complete);
3941         if (err < 0) {
3942                 mgmt_pending_remove(cmd);
3943                 goto failed;
3944         }
3945
3946         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3947
3948 failed:
3949         hci_dev_unlock(hdev);
3950         return err;
3951 }
3952
3953 static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
3954 {
3955         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3956                             cmd->param, 1);
3957 }
3958
3959 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3960                                    void *data, u16 len)
3961 {
3962         struct mgmt_cp_start_service_discovery *cp = data;
3963         struct pending_cmd *cmd;
3964         struct hci_request req;
3965         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3966         u16 uuid_count, expected_len;
3967         u8 status;
3968         int err;
3969
3970         BT_DBG("%s", hdev->name);
3971
3972         hci_dev_lock(hdev);
3973
3974         if (!hdev_is_powered(hdev)) {
3975                 err = cmd_complete(sk, hdev->id,
3976                                    MGMT_OP_START_SERVICE_DISCOVERY,
3977                                    MGMT_STATUS_NOT_POWERED,
3978                                    &cp->type, sizeof(cp->type));
3979                 goto failed;
3980         }
3981
3982         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3983             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3984                 err = cmd_complete(sk, hdev->id,
3985                                    MGMT_OP_START_SERVICE_DISCOVERY,
3986                                    MGMT_STATUS_BUSY, &cp->type,
3987                                    sizeof(cp->type));
3988                 goto failed;
3989         }
3990
3991         uuid_count = __le16_to_cpu(cp->uuid_count);
3992         if (uuid_count > max_uuid_count) {
3993                 BT_ERR("service_discovery: too big uuid_count value %u",
3994                        uuid_count);
3995                 err = cmd_complete(sk, hdev->id,
3996                                    MGMT_OP_START_SERVICE_DISCOVERY,
3997                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
3998                                    sizeof(cp->type));
3999                 goto failed;
4000         }
4001
4002         expected_len = sizeof(*cp) + uuid_count * 16;
4003         if (expected_len != len) {
4004                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4005                        expected_len, len);
4006                 err = cmd_complete(sk, hdev->id,
4007                                    MGMT_OP_START_SERVICE_DISCOVERY,
4008                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4009                                    sizeof(cp->type));
4010                 goto failed;
4011         }
4012
4013         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4014                                hdev, data, len);
4015         if (!cmd) {
4016                 err = -ENOMEM;
4017                 goto failed;
4018         }
4019
4020         cmd->cmd_complete = service_discovery_cmd_complete;
4021
4022         /* Clear the discovery filter first to free any previously
4023          * allocated memory for the UUID list.
4024          */
4025         hci_discovery_filter_clear(hdev);
4026
4027         hdev->discovery.type = cp->type;
4028         hdev->discovery.rssi = cp->rssi;
4029         hdev->discovery.uuid_count = uuid_count;
4030
4031         if (uuid_count > 0) {
4032                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4033                                                 GFP_KERNEL);
4034                 if (!hdev->discovery.uuids) {
4035                         err = cmd_complete(sk, hdev->id,
4036                                            MGMT_OP_START_SERVICE_DISCOVERY,
4037                                            MGMT_STATUS_FAILED,
4038                                            &cp->type, sizeof(cp->type));
4039                         mgmt_pending_remove(cmd);
4040                         goto failed;
4041                 }
4042         }
4043
4044         hci_req_init(&req, hdev);
4045
4046         if (!trigger_discovery(&req, &status)) {
4047                 err = cmd_complete(sk, hdev->id,
4048                                    MGMT_OP_START_SERVICE_DISCOVERY,
4049                                    status, &cp->type, sizeof(cp->type));
4050                 mgmt_pending_remove(cmd);
4051                 goto failed;
4052         }
4053
4054         err = hci_req_run(&req, start_discovery_complete);
4055         if (err < 0) {
4056                 mgmt_pending_remove(cmd);
4057                 goto failed;
4058         }
4059
4060         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4061
4062 failed:
4063         hci_dev_unlock(hdev);
4064         return err;
4065 }
4066
4067 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4068 {
4069         struct pending_cmd *cmd;
4070
4071         BT_DBG("status %d", status);
4072
4073         hci_dev_lock(hdev);
4074
4075         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4076         if (cmd) {
4077                 cmd->cmd_complete(cmd, mgmt_status(status));
4078                 mgmt_pending_remove(cmd);
4079         }
4080
4081         if (!status)
4082                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4083
4084         hci_dev_unlock(hdev);
4085 }
4086
4087 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4088                           u16 len)
4089 {
4090         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4091         struct pending_cmd *cmd;
4092         struct hci_request req;
4093         int err;
4094
4095         BT_DBG("%s", hdev->name);
4096
4097         hci_dev_lock(hdev);
4098
4099         if (!hci_discovery_active(hdev)) {
4100                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4101                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4102                                    sizeof(mgmt_cp->type));
4103                 goto unlock;
4104         }
4105
4106         if (hdev->discovery.type != mgmt_cp->type) {
4107                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4108                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4109                                    sizeof(mgmt_cp->type));
4110                 goto unlock;
4111         }
4112
4113         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4114         if (!cmd) {
4115                 err = -ENOMEM;
4116                 goto unlock;
4117         }
4118
4119         cmd->cmd_complete = generic_cmd_complete;
4120
4121         hci_req_init(&req, hdev);
4122
4123         hci_stop_discovery(&req);
4124
4125         err = hci_req_run(&req, stop_discovery_complete);
4126         if (!err) {
4127                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4128                 goto unlock;
4129         }
4130
4131         mgmt_pending_remove(cmd);
4132
4133         /* If no HCI commands were sent we're done */
4134         if (err == -ENODATA) {
4135                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4136                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4137                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4138         }
4139
4140 unlock:
4141         hci_dev_unlock(hdev);
4142         return err;
4143 }
4144
4145 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4146                         u16 len)
4147 {
4148         struct mgmt_cp_confirm_name *cp = data;
4149         struct inquiry_entry *e;
4150         int err;
4151
4152         BT_DBG("%s", hdev->name);
4153
4154         hci_dev_lock(hdev);
4155
4156         if (!hci_discovery_active(hdev)) {
4157                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4158                                    MGMT_STATUS_FAILED, &cp->addr,
4159                                    sizeof(cp->addr));
4160                 goto failed;
4161         }
4162
4163         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4164         if (!e) {
4165                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4166                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4167                                    sizeof(cp->addr));
4168                 goto failed;
4169         }
4170
4171         if (cp->name_known) {
4172                 e->name_state = NAME_KNOWN;
4173                 list_del(&e->list);
4174         } else {
4175                 e->name_state = NAME_NEEDED;
4176                 hci_inquiry_cache_update_resolve(hdev, e);
4177         }
4178
4179         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4180                            sizeof(cp->addr));
4181
4182 failed:
4183         hci_dev_unlock(hdev);
4184         return err;
4185 }
4186
4187 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4188                         u16 len)
4189 {
4190         struct mgmt_cp_block_device *cp = data;
4191         u8 status;
4192         int err;
4193
4194         BT_DBG("%s", hdev->name);
4195
4196         if (!bdaddr_type_is_valid(cp->addr.type))
4197                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4198                                     MGMT_STATUS_INVALID_PARAMS,
4199                                     &cp->addr, sizeof(cp->addr));
4200
4201         hci_dev_lock(hdev);
4202
4203         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4204                                   cp->addr.type);
4205         if (err < 0) {
4206                 status = MGMT_STATUS_FAILED;
4207                 goto done;
4208         }
4209
4210         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4211                    sk);
4212         status = MGMT_STATUS_SUCCESS;
4213
4214 done:
4215         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4216                            &cp->addr, sizeof(cp->addr));
4217
4218         hci_dev_unlock(hdev);
4219
4220         return err;
4221 }
4222
4223 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4224                           u16 len)
4225 {
4226         struct mgmt_cp_unblock_device *cp = data;
4227         u8 status;
4228         int err;
4229
4230         BT_DBG("%s", hdev->name);
4231
4232         if (!bdaddr_type_is_valid(cp->addr.type))
4233                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4234                                     MGMT_STATUS_INVALID_PARAMS,
4235                                     &cp->addr, sizeof(cp->addr));
4236
4237         hci_dev_lock(hdev);
4238
4239         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4240                                   cp->addr.type);
4241         if (err < 0) {
4242                 status = MGMT_STATUS_INVALID_PARAMS;
4243                 goto done;
4244         }
4245
4246         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4247                    sk);
4248         status = MGMT_STATUS_SUCCESS;
4249
4250 done:
4251         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4252                            &cp->addr, sizeof(cp->addr));
4253
4254         hci_dev_unlock(hdev);
4255
4256         return err;
4257 }
4258
4259 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4260                          u16 len)
4261 {
4262         struct mgmt_cp_set_device_id *cp = data;
4263         struct hci_request req;
4264         int err;
4265         __u16 source;
4266
4267         BT_DBG("%s", hdev->name);
4268
4269         source = __le16_to_cpu(cp->source);
4270
4271         if (source > 0x0002)
4272                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4273                                   MGMT_STATUS_INVALID_PARAMS);
4274
4275         hci_dev_lock(hdev);
4276
4277         hdev->devid_source = source;
4278         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4279         hdev->devid_product = __le16_to_cpu(cp->product);
4280         hdev->devid_version = __le16_to_cpu(cp->version);
4281
4282         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4283
4284         hci_req_init(&req, hdev);
4285         update_eir(&req);
4286         hci_req_run(&req, NULL);
4287
4288         hci_dev_unlock(hdev);
4289
4290         return err;
4291 }
4292
4293 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4294                                      u16 opcode)
4295 {
4296         struct cmd_lookup match = { NULL, hdev };
4297
4298         hci_dev_lock(hdev);
4299
4300         if (status) {
4301                 u8 mgmt_err = mgmt_status(status);
4302
4303                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4304                                      cmd_status_rsp, &mgmt_err);
4305                 goto unlock;
4306         }
4307
4308         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4309                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4310         else
4311                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4312
4313         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4314                              &match);
4315
4316         new_settings(hdev, match.sk);
4317
4318         if (match.sk)
4319                 sock_put(match.sk);
4320
4321 unlock:
4322         hci_dev_unlock(hdev);
4323 }
4324
4325 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4326                            u16 len)
4327 {
4328         struct mgmt_mode *cp = data;
4329         struct pending_cmd *cmd;
4330         struct hci_request req;
4331         u8 val, enabled, status;
4332         int err;
4333
4334         BT_DBG("request for %s", hdev->name);
4335
4336         status = mgmt_le_support(hdev);
4337         if (status)
4338                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4339                                   status);
4340
4341         if (cp->val != 0x00 && cp->val != 0x01)
4342                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4343                                   MGMT_STATUS_INVALID_PARAMS);
4344
4345         hci_dev_lock(hdev);
4346
4347         val = !!cp->val;
4348         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4349
4350         /* The following conditions are ones which mean that we should
4351          * not do any HCI communication but directly send a mgmt
4352          * response to user space (after toggling the flag if
4353          * necessary).
4354          */
4355         if (!hdev_is_powered(hdev) || val == enabled ||
4356             hci_conn_num(hdev, LE_LINK) > 0 ||
4357             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4358              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4359                 bool changed = false;
4360
4361                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4362                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4363                         changed = true;
4364                 }
4365
4366                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4367                 if (err < 0)
4368                         goto unlock;
4369
4370                 if (changed)
4371                         err = new_settings(hdev, sk);
4372
4373                 goto unlock;
4374         }
4375
4376         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4377             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4378                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4379                                  MGMT_STATUS_BUSY);
4380                 goto unlock;
4381         }
4382
4383         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4384         if (!cmd) {
4385                 err = -ENOMEM;
4386                 goto unlock;
4387         }
4388
4389         hci_req_init(&req, hdev);
4390
4391         if (val)
4392                 enable_advertising(&req);
4393         else
4394                 disable_advertising(&req);
4395
4396         err = hci_req_run(&req, set_advertising_complete);
4397         if (err < 0)
4398                 mgmt_pending_remove(cmd);
4399
4400 unlock:
4401         hci_dev_unlock(hdev);
4402         return err;
4403 }
4404
4405 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4406                               void *data, u16 len)
4407 {
4408         struct mgmt_cp_set_static_address *cp = data;
4409         int err;
4410
4411         BT_DBG("%s", hdev->name);
4412
4413         if (!lmp_le_capable(hdev))
4414                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4415                                   MGMT_STATUS_NOT_SUPPORTED);
4416
4417         if (hdev_is_powered(hdev))
4418                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4419                                   MGMT_STATUS_REJECTED);
4420
4421         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4422                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4423                         return cmd_status(sk, hdev->id,
4424                                           MGMT_OP_SET_STATIC_ADDRESS,
4425                                           MGMT_STATUS_INVALID_PARAMS);
4426
4427                 /* Two most significant bits shall be set */
4428                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4429                         return cmd_status(sk, hdev->id,
4430                                           MGMT_OP_SET_STATIC_ADDRESS,
4431                                           MGMT_STATUS_INVALID_PARAMS);
4432         }
4433
4434         hci_dev_lock(hdev);
4435
4436         bacpy(&hdev->static_addr, &cp->bdaddr);
4437
4438         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4439
4440         hci_dev_unlock(hdev);
4441
4442         return err;
4443 }
4444
4445 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4446                            void *data, u16 len)
4447 {
4448         struct mgmt_cp_set_scan_params *cp = data;
4449         __u16 interval, window;
4450         int err;
4451
4452         BT_DBG("%s", hdev->name);
4453
4454         if (!lmp_le_capable(hdev))
4455                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4456                                   MGMT_STATUS_NOT_SUPPORTED);
4457
4458         interval = __le16_to_cpu(cp->interval);
4459
4460         if (interval < 0x0004 || interval > 0x4000)
4461                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4462                                   MGMT_STATUS_INVALID_PARAMS);
4463
4464         window = __le16_to_cpu(cp->window);
4465
4466         if (window < 0x0004 || window > 0x4000)
4467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4468                                   MGMT_STATUS_INVALID_PARAMS);
4469
4470         if (window > interval)
4471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4472                                   MGMT_STATUS_INVALID_PARAMS);
4473
4474         hci_dev_lock(hdev);
4475
4476         hdev->le_scan_interval = interval;
4477         hdev->le_scan_window = window;
4478
4479         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4480
4481         /* If background scan is running, restart it so new parameters are
4482          * loaded.
4483          */
4484         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4485             hdev->discovery.state == DISCOVERY_STOPPED) {
4486                 struct hci_request req;
4487
4488                 hci_req_init(&req, hdev);
4489
4490                 hci_req_add_le_scan_disable(&req);
4491                 hci_req_add_le_passive_scan(&req);
4492
4493                 hci_req_run(&req, NULL);
4494         }
4495
4496         hci_dev_unlock(hdev);
4497
4498         return err;
4499 }
4500
4501 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4502                                       u16 opcode)
4503 {
4504         struct pending_cmd *cmd;
4505
4506         BT_DBG("status 0x%02x", status);
4507
4508         hci_dev_lock(hdev);
4509
4510         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4511         if (!cmd)
4512                 goto unlock;
4513
4514         if (status) {
4515                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4516                            mgmt_status(status));
4517         } else {
4518                 struct mgmt_mode *cp = cmd->param;
4519
4520                 if (cp->val)
4521                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4522                 else
4523                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4524
4525                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4526                 new_settings(hdev, cmd->sk);
4527         }
4528
4529         mgmt_pending_remove(cmd);
4530
4531 unlock:
4532         hci_dev_unlock(hdev);
4533 }
4534
4535 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4536                                 void *data, u16 len)
4537 {
4538         struct mgmt_mode *cp = data;
4539         struct pending_cmd *cmd;
4540         struct hci_request req;
4541         int err;
4542
4543         BT_DBG("%s", hdev->name);
4544
4545         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4546             hdev->hci_ver < BLUETOOTH_VER_1_2)
4547                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4548                                   MGMT_STATUS_NOT_SUPPORTED);
4549
4550         if (cp->val != 0x00 && cp->val != 0x01)
4551                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4552                                   MGMT_STATUS_INVALID_PARAMS);
4553
4554         if (!hdev_is_powered(hdev))
4555                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4556                                   MGMT_STATUS_NOT_POWERED);
4557
4558         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4559                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560                                   MGMT_STATUS_REJECTED);
4561
4562         hci_dev_lock(hdev);
4563
4564         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4565                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4566                                  MGMT_STATUS_BUSY);
4567                 goto unlock;
4568         }
4569
4570         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4571                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4572                                         hdev);
4573                 goto unlock;
4574         }
4575
4576         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4577                                data, len);
4578         if (!cmd) {
4579                 err = -ENOMEM;
4580                 goto unlock;
4581         }
4582
4583         hci_req_init(&req, hdev);
4584
4585         write_fast_connectable(&req, cp->val);
4586
4587         err = hci_req_run(&req, fast_connectable_complete);
4588         if (err < 0) {
4589                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4590                                  MGMT_STATUS_FAILED);
4591                 mgmt_pending_remove(cmd);
4592         }
4593
4594 unlock:
4595         hci_dev_unlock(hdev);
4596
4597         return err;
4598 }
4599
4600 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4601 {
4602         struct pending_cmd *cmd;
4603
4604         BT_DBG("status 0x%02x", status);
4605
4606         hci_dev_lock(hdev);
4607
4608         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4609         if (!cmd)
4610                 goto unlock;
4611
4612         if (status) {
4613                 u8 mgmt_err = mgmt_status(status);
4614
4615                 /* We need to restore the flag if related HCI commands
4616                  * failed.
4617                  */
4618                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4619
4620                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4621         } else {
4622                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4623                 new_settings(hdev, cmd->sk);
4624         }
4625
4626         mgmt_pending_remove(cmd);
4627
4628 unlock:
4629         hci_dev_unlock(hdev);
4630 }
4631
4632 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4633 {
4634         struct mgmt_mode *cp = data;
4635         struct pending_cmd *cmd;
4636         struct hci_request req;
4637         int err;
4638
4639         BT_DBG("request for %s", hdev->name);
4640
4641         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4642                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4643                                   MGMT_STATUS_NOT_SUPPORTED);
4644
4645         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4646                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4647                                   MGMT_STATUS_REJECTED);
4648
4649         if (cp->val != 0x00 && cp->val != 0x01)
4650                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4651                                   MGMT_STATUS_INVALID_PARAMS);
4652
4653         hci_dev_lock(hdev);
4654
4655         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4656                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4657                 goto unlock;
4658         }
4659
4660         if (!hdev_is_powered(hdev)) {
4661                 if (!cp->val) {
4662                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4663                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4664                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4665                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4666                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4667                 }
4668
4669                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4670
4671                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4672                 if (err < 0)
4673                         goto unlock;
4674
4675                 err = new_settings(hdev, sk);
4676                 goto unlock;
4677         }
4678
4679         /* Reject disabling when powered on */
4680         if (!cp->val) {
4681                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4682                                  MGMT_STATUS_REJECTED);
4683                 goto unlock;
4684         } else {
4685                 /* When configuring a dual-mode controller to operate
4686                  * with LE only and using a static address, then switching
4687                  * BR/EDR back on is not allowed.
4688                  *
4689                  * Dual-mode controllers shall operate with the public
4690                  * address as its identity address for BR/EDR and LE. So
4691                  * reject the attempt to create an invalid configuration.
4692                  *
4693                  * The same restrictions applies when secure connections
4694                  * has been enabled. For BR/EDR this is a controller feature
4695                  * while for LE it is a host stack feature. This means that
4696                  * switching BR/EDR back on when secure connections has been
4697                  * enabled is not a supported transaction.
4698                  */
4699                 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
4700                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4701                      test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
4702                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4703                                          MGMT_STATUS_REJECTED);
4704                         goto unlock;
4705                 }
4706         }
4707
4708         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4709                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4710                                  MGMT_STATUS_BUSY);
4711                 goto unlock;
4712         }
4713
4714         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4715         if (!cmd) {
4716                 err = -ENOMEM;
4717                 goto unlock;
4718         }
4719
4720         /* We need to flip the bit already here so that update_adv_data
4721          * generates the correct flags.
4722          */
4723         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4724
4725         hci_req_init(&req, hdev);
4726
4727         write_fast_connectable(&req, false);
4728         __hci_update_page_scan(&req);
4729
4730         /* Since only the advertising data flags will change, there
4731          * is no need to update the scan response data.
4732          */
4733         update_adv_data(&req);
4734
4735         err = hci_req_run(&req, set_bredr_complete);
4736         if (err < 0)
4737                 mgmt_pending_remove(cmd);
4738
4739 unlock:
4740         hci_dev_unlock(hdev);
4741         return err;
4742 }
4743
4744 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4745                            void *data, u16 len)
4746 {
4747         struct mgmt_mode *cp = data;
4748         struct pending_cmd *cmd;
4749         u8 val;
4750         int err;
4751
4752         BT_DBG("request for %s", hdev->name);
4753
4754         if (!lmp_sc_capable(hdev) &&
4755             !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4756                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4757                                   MGMT_STATUS_NOT_SUPPORTED);
4758
4759         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
4760             !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4762                                   MGMT_STATUS_REJECTED);
4763
4764         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4765                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4766                                   MGMT_STATUS_INVALID_PARAMS);
4767
4768         hci_dev_lock(hdev);
4769
4770         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4771             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4772                 bool changed;
4773
4774                 if (cp->val) {
4775                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4776                                                     &hdev->dev_flags);
4777                         if (cp->val == 0x02)
4778                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4779                         else
4780                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4781                 } else {
4782                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4783                                                      &hdev->dev_flags);
4784                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4785                 }
4786
4787                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4788                 if (err < 0)
4789                         goto failed;
4790
4791                 if (changed)
4792                         err = new_settings(hdev, sk);
4793
4794                 goto failed;
4795         }
4796
4797         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4799                                  MGMT_STATUS_BUSY);
4800                 goto failed;
4801         }
4802
4803         val = !!cp->val;
4804
4805         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4806             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4807                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4808                 goto failed;
4809         }
4810
4811         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4812         if (!cmd) {
4813                 err = -ENOMEM;
4814                 goto failed;
4815         }
4816
4817         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4818         if (err < 0) {
4819                 mgmt_pending_remove(cmd);
4820                 goto failed;
4821         }
4822
4823         if (cp->val == 0x02)
4824                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4825         else
4826                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4827
4828 failed:
4829         hci_dev_unlock(hdev);
4830         return err;
4831 }
4832
4833 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4834                           void *data, u16 len)
4835 {
4836         struct mgmt_mode *cp = data;
4837         bool changed, use_changed;
4838         int err;
4839
4840         BT_DBG("request for %s", hdev->name);
4841
4842         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4843                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4844                                   MGMT_STATUS_INVALID_PARAMS);
4845
4846         hci_dev_lock(hdev);
4847
4848         if (cp->val)
4849                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4850                                             &hdev->dev_flags);
4851         else
4852                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4853                                              &hdev->dev_flags);
4854
4855         if (cp->val == 0x02)
4856                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4857                                                 &hdev->dev_flags);
4858         else
4859                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4860                                                  &hdev->dev_flags);
4861
4862         if (hdev_is_powered(hdev) && use_changed &&
4863             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4864                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4865                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4866                              sizeof(mode), &mode);
4867         }
4868
4869         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4870         if (err < 0)
4871                 goto unlock;
4872
4873         if (changed)
4874                 err = new_settings(hdev, sk);
4875
4876 unlock:
4877         hci_dev_unlock(hdev);
4878         return err;
4879 }
4880
4881 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4882                        u16 len)
4883 {
4884         struct mgmt_cp_set_privacy *cp = cp_data;
4885         bool changed;
4886         int err;
4887
4888         BT_DBG("request for %s", hdev->name);
4889
4890         if (!lmp_le_capable(hdev))
4891                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4892                                   MGMT_STATUS_NOT_SUPPORTED);
4893
4894         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4895                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4896                                   MGMT_STATUS_INVALID_PARAMS);
4897
4898         if (hdev_is_powered(hdev))
4899                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4900                                   MGMT_STATUS_REJECTED);
4901
4902         hci_dev_lock(hdev);
4903
4904         /* If user space supports this command it is also expected to
4905          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4906          */
4907         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4908
4909         if (cp->privacy) {
4910                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4911                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4912                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4913         } else {
4914                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4915                 memset(hdev->irk, 0, sizeof(hdev->irk));
4916                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4917         }
4918
4919         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4920         if (err < 0)
4921                 goto unlock;
4922
4923         if (changed)
4924                 err = new_settings(hdev, sk);
4925
4926 unlock:
4927         hci_dev_unlock(hdev);
4928         return err;
4929 }
4930
4931 static bool irk_is_valid(struct mgmt_irk_info *irk)
4932 {
4933         switch (irk->addr.type) {
4934         case BDADDR_LE_PUBLIC:
4935                 return true;
4936
4937         case BDADDR_LE_RANDOM:
4938                 /* Two most significant bits shall be set */
4939                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4940                         return false;
4941                 return true;
4942         }
4943
4944         return false;
4945 }
4946
4947 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4948                      u16 len)
4949 {
4950         struct mgmt_cp_load_irks *cp = cp_data;
4951         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4952                                    sizeof(struct mgmt_irk_info));
4953         u16 irk_count, expected_len;
4954         int i, err;
4955
4956         BT_DBG("request for %s", hdev->name);
4957
4958         if (!lmp_le_capable(hdev))
4959                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4960                                   MGMT_STATUS_NOT_SUPPORTED);
4961
4962         irk_count = __le16_to_cpu(cp->irk_count);
4963         if (irk_count > max_irk_count) {
4964                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4965                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4966                                   MGMT_STATUS_INVALID_PARAMS);
4967         }
4968
4969         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4970         if (expected_len != len) {
4971                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4972                        expected_len, len);
4973                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4974                                   MGMT_STATUS_INVALID_PARAMS);
4975         }
4976
4977         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4978
4979         for (i = 0; i < irk_count; i++) {
4980                 struct mgmt_irk_info *key = &cp->irks[i];
4981
4982                 if (!irk_is_valid(key))
4983                         return cmd_status(sk, hdev->id,
4984                                           MGMT_OP_LOAD_IRKS,
4985                                           MGMT_STATUS_INVALID_PARAMS);
4986         }
4987
4988         hci_dev_lock(hdev);
4989
4990         hci_smp_irks_clear(hdev);
4991
4992         for (i = 0; i < irk_count; i++) {
4993                 struct mgmt_irk_info *irk = &cp->irks[i];
4994                 u8 addr_type;
4995
4996                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4997                         addr_type = ADDR_LE_DEV_PUBLIC;
4998                 else
4999                         addr_type = ADDR_LE_DEV_RANDOM;
5000
5001                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5002                             BDADDR_ANY);
5003         }
5004
5005         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5006
5007         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5008
5009         hci_dev_unlock(hdev);
5010
5011         return err;
5012 }
5013
5014 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5015 {
5016         if (key->master != 0x00 && key->master != 0x01)
5017                 return false;
5018
5019         switch (key->addr.type) {
5020         case BDADDR_LE_PUBLIC:
5021                 return true;
5022
5023         case BDADDR_LE_RANDOM:
5024                 /* Two most significant bits shall be set */
5025                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5026                         return false;
5027                 return true;
5028         }
5029
5030         return false;
5031 }
5032
5033 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5034                                void *cp_data, u16 len)
5035 {
5036         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5037         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5038                                    sizeof(struct mgmt_ltk_info));
5039         u16 key_count, expected_len;
5040         int i, err;
5041
5042         BT_DBG("request for %s", hdev->name);
5043
5044         if (!lmp_le_capable(hdev))
5045                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5046                                   MGMT_STATUS_NOT_SUPPORTED);
5047
5048         key_count = __le16_to_cpu(cp->key_count);
5049         if (key_count > max_key_count) {
5050                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5051                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5052                                   MGMT_STATUS_INVALID_PARAMS);
5053         }
5054
5055         expected_len = sizeof(*cp) + key_count *
5056                                         sizeof(struct mgmt_ltk_info);
5057         if (expected_len != len) {
5058                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5059                        expected_len, len);
5060                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5061                                   MGMT_STATUS_INVALID_PARAMS);
5062         }
5063
5064         BT_DBG("%s key_count %u", hdev->name, key_count);
5065
5066         for (i = 0; i < key_count; i++) {
5067                 struct mgmt_ltk_info *key = &cp->keys[i];
5068
5069                 if (!ltk_is_valid(key))
5070                         return cmd_status(sk, hdev->id,
5071                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
5072                                           MGMT_STATUS_INVALID_PARAMS);
5073         }
5074
5075         hci_dev_lock(hdev);
5076
5077         hci_smp_ltks_clear(hdev);
5078
5079         for (i = 0; i < key_count; i++) {
5080                 struct mgmt_ltk_info *key = &cp->keys[i];
5081                 u8 type, addr_type, authenticated;
5082
5083                 if (key->addr.type == BDADDR_LE_PUBLIC)
5084                         addr_type = ADDR_LE_DEV_PUBLIC;
5085                 else
5086                         addr_type = ADDR_LE_DEV_RANDOM;
5087
5088                 switch (key->type) {
5089                 case MGMT_LTK_UNAUTHENTICATED:
5090                         authenticated = 0x00;
5091                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5092                         break;
5093                 case MGMT_LTK_AUTHENTICATED:
5094                         authenticated = 0x01;
5095                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5096                         break;
5097                 case MGMT_LTK_P256_UNAUTH:
5098                         authenticated = 0x00;
5099                         type = SMP_LTK_P256;
5100                         break;
5101                 case MGMT_LTK_P256_AUTH:
5102                         authenticated = 0x01;
5103                         type = SMP_LTK_P256;
5104                         break;
5105                 case MGMT_LTK_P256_DEBUG:
5106                         authenticated = 0x00;
5107                         type = SMP_LTK_P256_DEBUG;
5108                 default:
5109                         continue;
5110                 }
5111
5112                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5113                             authenticated, key->val, key->enc_size, key->ediv,
5114                             key->rand);
5115         }
5116
5117         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5118                            NULL, 0);
5119
5120         hci_dev_unlock(hdev);
5121
5122         return err;
5123 }
5124
5125 static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5126 {
5127         struct hci_conn *conn = cmd->user_data;
5128         struct mgmt_rp_get_conn_info rp;
5129         int err;
5130
5131         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5132
5133         if (status == MGMT_STATUS_SUCCESS) {
5134                 rp.rssi = conn->rssi;
5135                 rp.tx_power = conn->tx_power;
5136                 rp.max_tx_power = conn->max_tx_power;
5137         } else {
5138                 rp.rssi = HCI_RSSI_INVALID;
5139                 rp.tx_power = HCI_TX_POWER_INVALID;
5140                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5141         }
5142
5143         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5144                            &rp, sizeof(rp));
5145
5146         hci_conn_drop(conn);
5147         hci_conn_put(conn);
5148
5149         return err;
5150 }
5151
5152 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5153                                        u16 opcode)
5154 {
5155         struct hci_cp_read_rssi *cp;
5156         struct pending_cmd *cmd;
5157         struct hci_conn *conn;
5158         u16 handle;
5159         u8 status;
5160
5161         BT_DBG("status 0x%02x", hci_status);
5162
5163         hci_dev_lock(hdev);
5164
5165         /* Commands sent in request are either Read RSSI or Read Transmit Power
5166          * Level so we check which one was last sent to retrieve connection
5167          * handle.  Both commands have handle as first parameter so it's safe to
5168          * cast data on the same command struct.
5169          *
5170          * First command sent is always Read RSSI and we fail only if it fails.
5171          * In other case we simply override error to indicate success as we
5172          * already remembered if TX power value is actually valid.
5173          */
5174         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5175         if (!cp) {
5176                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5177                 status = MGMT_STATUS_SUCCESS;
5178         } else {
5179                 status = mgmt_status(hci_status);
5180         }
5181
5182         if (!cp) {
5183                 BT_ERR("invalid sent_cmd in conn_info response");
5184                 goto unlock;
5185         }
5186
5187         handle = __le16_to_cpu(cp->handle);
5188         conn = hci_conn_hash_lookup_handle(hdev, handle);
5189         if (!conn) {
5190                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5191                 goto unlock;
5192         }
5193
5194         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5195         if (!cmd)
5196                 goto unlock;
5197
5198         cmd->cmd_complete(cmd, status);
5199         mgmt_pending_remove(cmd);
5200
5201 unlock:
5202         hci_dev_unlock(hdev);
5203 }
5204
5205 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5206                          u16 len)
5207 {
5208         struct mgmt_cp_get_conn_info *cp = data;
5209         struct mgmt_rp_get_conn_info rp;
5210         struct hci_conn *conn;
5211         unsigned long conn_info_age;
5212         int err = 0;
5213
5214         BT_DBG("%s", hdev->name);
5215
5216         memset(&rp, 0, sizeof(rp));
5217         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5218         rp.addr.type = cp->addr.type;
5219
5220         if (!bdaddr_type_is_valid(cp->addr.type))
5221                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5222                                     MGMT_STATUS_INVALID_PARAMS,
5223                                     &rp, sizeof(rp));
5224
5225         hci_dev_lock(hdev);
5226
5227         if (!hdev_is_powered(hdev)) {
5228                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5229                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5230                 goto unlock;
5231         }
5232
5233         if (cp->addr.type == BDADDR_BREDR)
5234                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5235                                                &cp->addr.bdaddr);
5236         else
5237                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5238
5239         if (!conn || conn->state != BT_CONNECTED) {
5240                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5241                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5242                 goto unlock;
5243         }
5244
5245         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5246                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5247                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
5248                 goto unlock;
5249         }
5250
5251         /* To avoid client trying to guess when to poll again for information we
5252          * calculate conn info age as random value between min/max set in hdev.
5253          */
5254         conn_info_age = hdev->conn_info_min_age +
5255                         prandom_u32_max(hdev->conn_info_max_age -
5256                                         hdev->conn_info_min_age);
5257
5258         /* Query controller to refresh cached values if they are too old or were
5259          * never read.
5260          */
5261         if (time_after(jiffies, conn->conn_info_timestamp +
5262                        msecs_to_jiffies(conn_info_age)) ||
5263             !conn->conn_info_timestamp) {
5264                 struct hci_request req;
5265                 struct hci_cp_read_tx_power req_txp_cp;
5266                 struct hci_cp_read_rssi req_rssi_cp;
5267                 struct pending_cmd *cmd;
5268
5269                 hci_req_init(&req, hdev);
5270                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5271                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5272                             &req_rssi_cp);
5273
5274                 /* For LE links TX power does not change thus we don't need to
5275                  * query for it once value is known.
5276                  */
5277                 if (!bdaddr_type_is_le(cp->addr.type) ||
5278                     conn->tx_power == HCI_TX_POWER_INVALID) {
5279                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5280                         req_txp_cp.type = 0x00;
5281                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5282                                     sizeof(req_txp_cp), &req_txp_cp);
5283                 }
5284
5285                 /* Max TX power needs to be read only once per connection */
5286                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5287                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5288                         req_txp_cp.type = 0x01;
5289                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5290                                     sizeof(req_txp_cp), &req_txp_cp);
5291                 }
5292
5293                 err = hci_req_run(&req, conn_info_refresh_complete);
5294                 if (err < 0)
5295                         goto unlock;
5296
5297                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5298                                        data, len);
5299                 if (!cmd) {
5300                         err = -ENOMEM;
5301                         goto unlock;
5302                 }
5303
5304                 hci_conn_hold(conn);
5305                 cmd->user_data = hci_conn_get(conn);
5306                 cmd->cmd_complete = conn_info_cmd_complete;
5307
5308                 conn->conn_info_timestamp = jiffies;
5309         } else {
5310                 /* Cache is valid, just reply with values cached in hci_conn */
5311                 rp.rssi = conn->rssi;
5312                 rp.tx_power = conn->tx_power;
5313                 rp.max_tx_power = conn->max_tx_power;
5314
5315                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5316                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5317         }
5318
5319 unlock:
5320         hci_dev_unlock(hdev);
5321         return err;
5322 }
5323
5324 static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5325 {
5326         struct hci_conn *conn = cmd->user_data;
5327         struct mgmt_rp_get_clock_info rp;
5328         struct hci_dev *hdev;
5329         int err;
5330
5331         memset(&rp, 0, sizeof(rp));
5332         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5333
5334         if (status)
5335                 goto complete;
5336
5337         hdev = hci_dev_get(cmd->index);
5338         if (hdev) {
5339                 rp.local_clock = cpu_to_le32(hdev->clock);
5340                 hci_dev_put(hdev);
5341         }
5342
5343         if (conn) {
5344                 rp.piconet_clock = cpu_to_le32(conn->clock);
5345                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5346         }
5347
5348 complete:
5349         err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5350                            sizeof(rp));
5351
5352         if (conn) {
5353                 hci_conn_drop(conn);
5354                 hci_conn_put(conn);
5355         }
5356
5357         return err;
5358 }
5359
5360 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5361 {
5362         struct hci_cp_read_clock *hci_cp;
5363         struct pending_cmd *cmd;
5364         struct hci_conn *conn;
5365
5366         BT_DBG("%s status %u", hdev->name, status);
5367
5368         hci_dev_lock(hdev);
5369
5370         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5371         if (!hci_cp)
5372                 goto unlock;
5373
5374         if (hci_cp->which) {
5375                 u16 handle = __le16_to_cpu(hci_cp->handle);
5376                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5377         } else {
5378                 conn = NULL;
5379         }
5380
5381         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5382         if (!cmd)
5383                 goto unlock;
5384
5385         cmd->cmd_complete(cmd, mgmt_status(status));
5386         mgmt_pending_remove(cmd);
5387
5388 unlock:
5389         hci_dev_unlock(hdev);
5390 }
5391
5392 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5393                          u16 len)
5394 {
5395         struct mgmt_cp_get_clock_info *cp = data;
5396         struct mgmt_rp_get_clock_info rp;
5397         struct hci_cp_read_clock hci_cp;
5398         struct pending_cmd *cmd;
5399         struct hci_request req;
5400         struct hci_conn *conn;
5401         int err;
5402
5403         BT_DBG("%s", hdev->name);
5404
5405         memset(&rp, 0, sizeof(rp));
5406         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5407         rp.addr.type = cp->addr.type;
5408
5409         if (cp->addr.type != BDADDR_BREDR)
5410                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5411                                     MGMT_STATUS_INVALID_PARAMS,
5412                                     &rp, sizeof(rp));
5413
5414         hci_dev_lock(hdev);
5415
5416         if (!hdev_is_powered(hdev)) {
5417                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5418                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5419                 goto unlock;
5420         }
5421
5422         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5423                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5424                                                &cp->addr.bdaddr);
5425                 if (!conn || conn->state != BT_CONNECTED) {
5426                         err = cmd_complete(sk, hdev->id,
5427                                            MGMT_OP_GET_CLOCK_INFO,
5428                                            MGMT_STATUS_NOT_CONNECTED,
5429                                            &rp, sizeof(rp));
5430                         goto unlock;
5431                 }
5432         } else {
5433                 conn = NULL;
5434         }
5435
5436         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5437         if (!cmd) {
5438                 err = -ENOMEM;
5439                 goto unlock;
5440         }
5441
5442         cmd->cmd_complete = clock_info_cmd_complete;
5443
5444         hci_req_init(&req, hdev);
5445
5446         memset(&hci_cp, 0, sizeof(hci_cp));
5447         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5448
5449         if (conn) {
5450                 hci_conn_hold(conn);
5451                 cmd->user_data = hci_conn_get(conn);
5452
5453                 hci_cp.handle = cpu_to_le16(conn->handle);
5454                 hci_cp.which = 0x01; /* Piconet clock */
5455                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5456         }
5457
5458         err = hci_req_run(&req, get_clock_info_complete);
5459         if (err < 0)
5460                 mgmt_pending_remove(cmd);
5461
5462 unlock:
5463         hci_dev_unlock(hdev);
5464         return err;
5465 }
5466
5467 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5468 {
5469         struct hci_conn *conn;
5470
5471         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5472         if (!conn)
5473                 return false;
5474
5475         if (conn->dst_type != type)
5476                 return false;
5477
5478         if (conn->state != BT_CONNECTED)
5479                 return false;
5480
5481         return true;
5482 }
5483
5484 /* This function requires the caller holds hdev->lock */
5485 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5486                                u8 addr_type, u8 auto_connect)
5487 {
5488         struct hci_dev *hdev = req->hdev;
5489         struct hci_conn_params *params;
5490
5491         params = hci_conn_params_add(hdev, addr, addr_type);
5492         if (!params)
5493                 return -EIO;
5494
5495         if (params->auto_connect == auto_connect)
5496                 return 0;
5497
5498         list_del_init(&params->action);
5499
5500         switch (auto_connect) {
5501         case HCI_AUTO_CONN_DISABLED:
5502         case HCI_AUTO_CONN_LINK_LOSS:
5503                 __hci_update_background_scan(req);
5504                 break;
5505         case HCI_AUTO_CONN_REPORT:
5506                 list_add(&params->action, &hdev->pend_le_reports);
5507                 __hci_update_background_scan(req);
5508                 break;
5509         case HCI_AUTO_CONN_DIRECT:
5510         case HCI_AUTO_CONN_ALWAYS:
5511                 if (!is_connected(hdev, addr, addr_type)) {
5512                         list_add(&params->action, &hdev->pend_le_conns);
5513                         __hci_update_background_scan(req);
5514                 }
5515                 break;
5516         }
5517
5518         params->auto_connect = auto_connect;
5519
5520         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5521                auto_connect);
5522
5523         return 0;
5524 }
5525
5526 static void device_added(struct sock *sk, struct hci_dev *hdev,
5527                          bdaddr_t *bdaddr, u8 type, u8 action)
5528 {
5529         struct mgmt_ev_device_added ev;
5530
5531         bacpy(&ev.addr.bdaddr, bdaddr);
5532         ev.addr.type = type;
5533         ev.action = action;
5534
5535         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5536 }
5537
5538 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5539 {
5540         struct pending_cmd *cmd;
5541
5542         BT_DBG("status 0x%02x", status);
5543
5544         hci_dev_lock(hdev);
5545
5546         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5547         if (!cmd)
5548                 goto unlock;
5549
5550         cmd->cmd_complete(cmd, mgmt_status(status));
5551         mgmt_pending_remove(cmd);
5552
5553 unlock:
5554         hci_dev_unlock(hdev);
5555 }
5556
5557 static int add_device(struct sock *sk, struct hci_dev *hdev,
5558                       void *data, u16 len)
5559 {
5560         struct mgmt_cp_add_device *cp = data;
5561         struct pending_cmd *cmd;
5562         struct hci_request req;
5563         u8 auto_conn, addr_type;
5564         int err;
5565
5566         BT_DBG("%s", hdev->name);
5567
5568         if (!bdaddr_type_is_valid(cp->addr.type) ||
5569             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5570                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5571                                     MGMT_STATUS_INVALID_PARAMS,
5572                                     &cp->addr, sizeof(cp->addr));
5573
5574         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5575                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5576                                     MGMT_STATUS_INVALID_PARAMS,
5577                                     &cp->addr, sizeof(cp->addr));
5578
5579         hci_req_init(&req, hdev);
5580
5581         hci_dev_lock(hdev);
5582
5583         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5584         if (!cmd) {
5585                 err = -ENOMEM;
5586                 goto unlock;
5587         }
5588
5589         cmd->cmd_complete = addr_cmd_complete;
5590
5591         if (cp->addr.type == BDADDR_BREDR) {
5592                 /* Only incoming connections action is supported for now */
5593                 if (cp->action != 0x01) {
5594                         err = cmd->cmd_complete(cmd,
5595                                                 MGMT_STATUS_INVALID_PARAMS);
5596                         mgmt_pending_remove(cmd);
5597                         goto unlock;
5598                 }
5599
5600                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5601                                           cp->addr.type);
5602                 if (err)
5603                         goto unlock;
5604
5605                 __hci_update_page_scan(&req);
5606
5607                 goto added;
5608         }
5609
5610         if (cp->addr.type == BDADDR_LE_PUBLIC)
5611                 addr_type = ADDR_LE_DEV_PUBLIC;
5612         else
5613                 addr_type = ADDR_LE_DEV_RANDOM;
5614
5615         if (cp->action == 0x02)
5616                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5617         else if (cp->action == 0x01)
5618                 auto_conn = HCI_AUTO_CONN_DIRECT;
5619         else
5620                 auto_conn = HCI_AUTO_CONN_REPORT;
5621
5622         /* If the connection parameters don't exist for this device,
5623          * they will be created and configured with defaults.
5624          */
5625         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5626                                 auto_conn) < 0) {
5627                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5628                 mgmt_pending_remove(cmd);
5629                 goto unlock;
5630         }
5631
5632 added:
5633         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5634
5635         err = hci_req_run(&req, add_device_complete);
5636         if (err < 0) {
5637                 /* ENODATA means no HCI commands were needed (e.g. if
5638                  * the adapter is powered off).
5639                  */
5640                 if (err == -ENODATA)
5641                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5642                 mgmt_pending_remove(cmd);
5643         }
5644
5645 unlock:
5646         hci_dev_unlock(hdev);
5647         return err;
5648 }
5649
5650 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5651                            bdaddr_t *bdaddr, u8 type)
5652 {
5653         struct mgmt_ev_device_removed ev;
5654
5655         bacpy(&ev.addr.bdaddr, bdaddr);
5656         ev.addr.type = type;
5657
5658         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5659 }
5660
5661 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5662 {
5663         struct pending_cmd *cmd;
5664
5665         BT_DBG("status 0x%02x", status);
5666
5667         hci_dev_lock(hdev);
5668
5669         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5670         if (!cmd)
5671                 goto unlock;
5672
5673         cmd->cmd_complete(cmd, mgmt_status(status));
5674         mgmt_pending_remove(cmd);
5675
5676 unlock:
5677         hci_dev_unlock(hdev);
5678 }
5679
5680 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5681                          void *data, u16 len)
5682 {
5683         struct mgmt_cp_remove_device *cp = data;
5684         struct pending_cmd *cmd;
5685         struct hci_request req;
5686         int err;
5687
5688         BT_DBG("%s", hdev->name);
5689
5690         hci_req_init(&req, hdev);
5691
5692         hci_dev_lock(hdev);
5693
5694         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5695         if (!cmd) {
5696                 err = -ENOMEM;
5697                 goto unlock;
5698         }
5699
5700         cmd->cmd_complete = addr_cmd_complete;
5701
5702         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5703                 struct hci_conn_params *params;
5704                 u8 addr_type;
5705
5706                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5707                         err = cmd->cmd_complete(cmd,
5708                                                 MGMT_STATUS_INVALID_PARAMS);
5709                         mgmt_pending_remove(cmd);
5710                         goto unlock;
5711                 }
5712
5713                 if (cp->addr.type == BDADDR_BREDR) {
5714                         err = hci_bdaddr_list_del(&hdev->whitelist,
5715                                                   &cp->addr.bdaddr,
5716                                                   cp->addr.type);
5717                         if (err) {
5718                                 err = cmd->cmd_complete(cmd,
5719                                                         MGMT_STATUS_INVALID_PARAMS);
5720                                 mgmt_pending_remove(cmd);
5721                                 goto unlock;
5722                         }
5723
5724                         __hci_update_page_scan(&req);
5725
5726                         device_removed(sk, hdev, &cp->addr.bdaddr,
5727                                        cp->addr.type);
5728                         goto complete;
5729                 }
5730
5731                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5732                         addr_type = ADDR_LE_DEV_PUBLIC;
5733                 else
5734                         addr_type = ADDR_LE_DEV_RANDOM;
5735
5736                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5737                                                 addr_type);
5738                 if (!params) {
5739                         err = cmd->cmd_complete(cmd,
5740                                                 MGMT_STATUS_INVALID_PARAMS);
5741                         mgmt_pending_remove(cmd);
5742                         goto unlock;
5743                 }
5744
5745                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5746                         err = cmd->cmd_complete(cmd,
5747                                                 MGMT_STATUS_INVALID_PARAMS);
5748                         mgmt_pending_remove(cmd);
5749                         goto unlock;
5750                 }
5751
5752                 list_del(&params->action);
5753                 list_del(&params->list);
5754                 kfree(params);
5755                 __hci_update_background_scan(&req);
5756
5757                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5758         } else {
5759                 struct hci_conn_params *p, *tmp;
5760                 struct bdaddr_list *b, *btmp;
5761
5762                 if (cp->addr.type) {
5763                         err = cmd->cmd_complete(cmd,
5764                                                 MGMT_STATUS_INVALID_PARAMS);
5765                         mgmt_pending_remove(cmd);
5766                         goto unlock;
5767                 }
5768
5769                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5770                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5771                         list_del(&b->list);
5772                         kfree(b);
5773                 }
5774
5775                 __hci_update_page_scan(&req);
5776
5777                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5778                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5779                                 continue;
5780                         device_removed(sk, hdev, &p->addr, p->addr_type);
5781                         list_del(&p->action);
5782                         list_del(&p->list);
5783                         kfree(p);
5784                 }
5785
5786                 BT_DBG("All LE connection parameters were removed");
5787
5788                 __hci_update_background_scan(&req);
5789         }
5790
5791 complete:
5792         err = hci_req_run(&req, remove_device_complete);
5793         if (err < 0) {
5794                 /* ENODATA means no HCI commands were needed (e.g. if
5795                  * the adapter is powered off).
5796                  */
5797                 if (err == -ENODATA)
5798                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5799                 mgmt_pending_remove(cmd);
5800         }
5801
5802 unlock:
5803         hci_dev_unlock(hdev);
5804         return err;
5805 }
5806
5807 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5808                            u16 len)
5809 {
5810         struct mgmt_cp_load_conn_param *cp = data;
5811         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5812                                      sizeof(struct mgmt_conn_param));
5813         u16 param_count, expected_len;
5814         int i;
5815
5816         if (!lmp_le_capable(hdev))
5817                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5818                                   MGMT_STATUS_NOT_SUPPORTED);
5819
5820         param_count = __le16_to_cpu(cp->param_count);
5821         if (param_count > max_param_count) {
5822                 BT_ERR("load_conn_param: too big param_count value %u",
5823                        param_count);
5824                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5825                                   MGMT_STATUS_INVALID_PARAMS);
5826         }
5827
5828         expected_len = sizeof(*cp) + param_count *
5829                                         sizeof(struct mgmt_conn_param);
5830         if (expected_len != len) {
5831                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5832                        expected_len, len);
5833                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5834                                   MGMT_STATUS_INVALID_PARAMS);
5835         }
5836
5837         BT_DBG("%s param_count %u", hdev->name, param_count);
5838
5839         hci_dev_lock(hdev);
5840
5841         hci_conn_params_clear_disabled(hdev);
5842
5843         for (i = 0; i < param_count; i++) {
5844                 struct mgmt_conn_param *param = &cp->params[i];
5845                 struct hci_conn_params *hci_param;
5846                 u16 min, max, latency, timeout;
5847                 u8 addr_type;
5848
5849                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5850                        param->addr.type);
5851
5852                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5853                         addr_type = ADDR_LE_DEV_PUBLIC;
5854                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5855                         addr_type = ADDR_LE_DEV_RANDOM;
5856                 } else {
5857                         BT_ERR("Ignoring invalid connection parameters");
5858                         continue;
5859                 }
5860
5861                 min = le16_to_cpu(param->min_interval);
5862                 max = le16_to_cpu(param->max_interval);
5863                 latency = le16_to_cpu(param->latency);
5864                 timeout = le16_to_cpu(param->timeout);
5865
5866                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5867                        min, max, latency, timeout);
5868
5869                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5870                         BT_ERR("Ignoring invalid connection parameters");
5871                         continue;
5872                 }
5873
5874                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5875                                                 addr_type);
5876                 if (!hci_param) {
5877                         BT_ERR("Failed to add connection parameters");
5878                         continue;
5879                 }
5880
5881                 hci_param->conn_min_interval = min;
5882                 hci_param->conn_max_interval = max;
5883                 hci_param->conn_latency = latency;
5884                 hci_param->supervision_timeout = timeout;
5885         }
5886
5887         hci_dev_unlock(hdev);
5888
5889         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5890 }
5891
5892 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5893                                void *data, u16 len)
5894 {
5895         struct mgmt_cp_set_external_config *cp = data;
5896         bool changed;
5897         int err;
5898
5899         BT_DBG("%s", hdev->name);
5900
5901         if (hdev_is_powered(hdev))
5902                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5903                                   MGMT_STATUS_REJECTED);
5904
5905         if (cp->config != 0x00 && cp->config != 0x01)
5906                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5907                                     MGMT_STATUS_INVALID_PARAMS);
5908
5909         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5910                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5911                                   MGMT_STATUS_NOT_SUPPORTED);
5912
5913         hci_dev_lock(hdev);
5914
5915         if (cp->config)
5916                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5917                                             &hdev->dev_flags);
5918         else
5919                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5920                                              &hdev->dev_flags);
5921
5922         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5923         if (err < 0)
5924                 goto unlock;
5925
5926         if (!changed)
5927                 goto unlock;
5928
5929         err = new_options(hdev, sk);
5930
5931         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5932                 mgmt_index_removed(hdev);
5933
5934                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5935                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5936                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5937
5938                         queue_work(hdev->req_workqueue, &hdev->power_on);
5939                 } else {
5940                         set_bit(HCI_RAW, &hdev->flags);
5941                         mgmt_index_added(hdev);
5942                 }
5943         }
5944
5945 unlock:
5946         hci_dev_unlock(hdev);
5947         return err;
5948 }
5949
5950 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5951                               void *data, u16 len)
5952 {
5953         struct mgmt_cp_set_public_address *cp = data;
5954         bool changed;
5955         int err;
5956
5957         BT_DBG("%s", hdev->name);
5958
5959         if (hdev_is_powered(hdev))
5960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5961                                   MGMT_STATUS_REJECTED);
5962
5963         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5964                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5965                                   MGMT_STATUS_INVALID_PARAMS);
5966
5967         if (!hdev->set_bdaddr)
5968                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5969                                   MGMT_STATUS_NOT_SUPPORTED);
5970
5971         hci_dev_lock(hdev);
5972
5973         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5974         bacpy(&hdev->public_addr, &cp->bdaddr);
5975
5976         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5977         if (err < 0)
5978                 goto unlock;
5979
5980         if (!changed)
5981                 goto unlock;
5982
5983         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5984                 err = new_options(hdev, sk);
5985
5986         if (is_configured(hdev)) {
5987                 mgmt_index_removed(hdev);
5988
5989                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5990
5991                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5992                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5993
5994                 queue_work(hdev->req_workqueue, &hdev->power_on);
5995         }
5996
5997 unlock:
5998         hci_dev_unlock(hdev);
5999         return err;
6000 }
6001
6002 static const struct mgmt_handler {
6003         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
6004                      u16 data_len);
6005         bool var_len;
6006         size_t data_len;
6007 } mgmt_handlers[] = {
6008         { NULL }, /* 0x0000 (no command) */
6009         { read_version,           false, MGMT_READ_VERSION_SIZE },
6010         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
6011         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
6012         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
6013         { set_powered,            false, MGMT_SETTING_SIZE },
6014         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
6015         { set_connectable,        false, MGMT_SETTING_SIZE },
6016         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
6017         { set_bondable,           false, MGMT_SETTING_SIZE },
6018         { set_link_security,      false, MGMT_SETTING_SIZE },
6019         { set_ssp,                false, MGMT_SETTING_SIZE },
6020         { set_hs,                 false, MGMT_SETTING_SIZE },
6021         { set_le,                 false, MGMT_SETTING_SIZE },
6022         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
6023         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
6024         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
6025         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
6026         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
6027         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
6028         { disconnect,             false, MGMT_DISCONNECT_SIZE },
6029         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
6030         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
6031         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6032         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
6033         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
6034         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6035         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
6036         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
6037         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6038         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
6039         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6040         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6041         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
6042         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6043         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
6044         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
6045         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
6046         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
6047         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
6048         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
6049         { set_advertising,        false, MGMT_SETTING_SIZE },
6050         { set_bredr,              false, MGMT_SETTING_SIZE },
6051         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
6052         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
6053         { set_secure_conn,        false, MGMT_SETTING_SIZE },
6054         { set_debug_keys,         false, MGMT_SETTING_SIZE },
6055         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
6056         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
6057         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
6058         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
6059         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
6060         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
6061         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
6062         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
6063         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
6064         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
6065         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
6066         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
6067 };
6068
6069 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
6070 {
6071         void *buf;
6072         u8 *cp;
6073         struct mgmt_hdr *hdr;
6074         u16 opcode, index, len;
6075         struct hci_dev *hdev = NULL;
6076         const struct mgmt_handler *handler;
6077         int err;
6078
6079         BT_DBG("got %zu bytes", msglen);
6080
6081         if (msglen < sizeof(*hdr))
6082                 return -EINVAL;
6083
6084         buf = kmalloc(msglen, GFP_KERNEL);
6085         if (!buf)
6086                 return -ENOMEM;
6087
6088         if (memcpy_from_msg(buf, msg, msglen)) {
6089                 err = -EFAULT;
6090                 goto done;
6091         }
6092
6093         hdr = buf;
6094         opcode = __le16_to_cpu(hdr->opcode);
6095         index = __le16_to_cpu(hdr->index);
6096         len = __le16_to_cpu(hdr->len);
6097
6098         if (len != msglen - sizeof(*hdr)) {
6099                 err = -EINVAL;
6100                 goto done;
6101         }
6102
6103         if (index != MGMT_INDEX_NONE) {
6104                 hdev = hci_dev_get(index);
6105                 if (!hdev) {
6106                         err = cmd_status(sk, index, opcode,
6107                                          MGMT_STATUS_INVALID_INDEX);
6108                         goto done;
6109                 }
6110
6111                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
6112                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
6113                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
6114                         err = cmd_status(sk, index, opcode,
6115                                          MGMT_STATUS_INVALID_INDEX);
6116                         goto done;
6117                 }
6118
6119                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
6120                     opcode != MGMT_OP_READ_CONFIG_INFO &&
6121                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
6122                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
6123                         err = cmd_status(sk, index, opcode,
6124                                          MGMT_STATUS_INVALID_INDEX);
6125                         goto done;
6126                 }
6127         }
6128
6129         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
6130             mgmt_handlers[opcode].func == NULL) {
6131                 BT_DBG("Unknown op %u", opcode);
6132                 err = cmd_status(sk, index, opcode,
6133                                  MGMT_STATUS_UNKNOWN_COMMAND);
6134                 goto done;
6135         }
6136
6137         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
6138                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6139                 err = cmd_status(sk, index, opcode,
6140                                  MGMT_STATUS_INVALID_INDEX);
6141                 goto done;
6142         }
6143
6144         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
6145                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6146                 err = cmd_status(sk, index, opcode,
6147                                  MGMT_STATUS_INVALID_INDEX);
6148                 goto done;
6149         }
6150
6151         handler = &mgmt_handlers[opcode];
6152
6153         if ((handler->var_len && len < handler->data_len) ||
6154             (!handler->var_len && len != handler->data_len)) {
6155                 err = cmd_status(sk, index, opcode,
6156                                  MGMT_STATUS_INVALID_PARAMS);
6157                 goto done;
6158         }
6159
6160         if (hdev)
6161                 mgmt_init_hdev(sk, hdev);
6162
6163         cp = buf + sizeof(*hdr);
6164
6165         err = handler->func(sk, hdev, cp, len);
6166         if (err < 0)
6167                 goto done;
6168
6169         err = msglen;
6170
6171 done:
6172         if (hdev)
6173                 hci_dev_put(hdev);
6174
6175         kfree(buf);
6176         return err;
6177 }
6178
6179 void mgmt_index_added(struct hci_dev *hdev)
6180 {
6181         if (hdev->dev_type != HCI_BREDR)
6182                 return;
6183
6184         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6185                 return;
6186
6187         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6188                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6189         else
6190                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6191 }
6192
6193 void mgmt_index_removed(struct hci_dev *hdev)
6194 {
6195         u8 status = MGMT_STATUS_INVALID_INDEX;
6196
6197         if (hdev->dev_type != HCI_BREDR)
6198                 return;
6199
6200         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6201                 return;
6202
6203         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6204
6205         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6206                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6207         else
6208                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6209 }
6210
6211 /* This function requires the caller holds hdev->lock */
6212 static void restart_le_actions(struct hci_request *req)
6213 {
6214         struct hci_dev *hdev = req->hdev;
6215         struct hci_conn_params *p;
6216
6217         list_for_each_entry(p, &hdev->le_conn_params, list) {
6218                 /* Needed for AUTO_OFF case where might not "really"
6219                  * have been powered off.
6220                  */
6221                 list_del_init(&p->action);
6222
6223                 switch (p->auto_connect) {
6224                 case HCI_AUTO_CONN_DIRECT:
6225                 case HCI_AUTO_CONN_ALWAYS:
6226                         list_add(&p->action, &hdev->pend_le_conns);
6227                         break;
6228                 case HCI_AUTO_CONN_REPORT:
6229                         list_add(&p->action, &hdev->pend_le_reports);
6230                         break;
6231                 default:
6232                         break;
6233                 }
6234         }
6235
6236         __hci_update_background_scan(req);
6237 }
6238
6239 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6240 {
6241         struct cmd_lookup match = { NULL, hdev };
6242
6243         BT_DBG("status 0x%02x", status);
6244
6245         if (!status) {
6246                 /* Register the available SMP channels (BR/EDR and LE) only
6247                  * when successfully powering on the controller. This late
6248                  * registration is required so that LE SMP can clearly
6249                  * decide if the public address or static address is used.
6250                  */
6251                 smp_register(hdev);
6252         }
6253
6254         hci_dev_lock(hdev);
6255
6256         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6257
6258         new_settings(hdev, match.sk);
6259
6260         hci_dev_unlock(hdev);
6261
6262         if (match.sk)
6263                 sock_put(match.sk);
6264 }
6265
6266 static int powered_update_hci(struct hci_dev *hdev)
6267 {
6268         struct hci_request req;
6269         u8 link_sec;
6270
6271         hci_req_init(&req, hdev);
6272
6273         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6274             !lmp_host_ssp_capable(hdev)) {
6275                 u8 mode = 0x01;
6276
6277                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6278
6279                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6280                         u8 support = 0x01;
6281
6282                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6283                                     sizeof(support), &support);
6284                 }
6285         }
6286
6287         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6288             lmp_bredr_capable(hdev)) {
6289                 struct hci_cp_write_le_host_supported cp;
6290
6291                 cp.le = 0x01;
6292                 cp.simul = 0x00;
6293
6294                 /* Check first if we already have the right
6295                  * host state (host features set)
6296                  */
6297                 if (cp.le != lmp_host_le_capable(hdev) ||
6298                     cp.simul != lmp_host_le_br_capable(hdev))
6299                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6300                                     sizeof(cp), &cp);
6301         }
6302
6303         if (lmp_le_capable(hdev)) {
6304                 /* Make sure the controller has a good default for
6305                  * advertising data. This also applies to the case
6306                  * where BR/EDR was toggled during the AUTO_OFF phase.
6307                  */
6308                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6309                         update_adv_data(&req);
6310                         update_scan_rsp_data(&req);
6311                 }
6312
6313                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6314                         enable_advertising(&req);
6315
6316                 restart_le_actions(&req);
6317         }
6318
6319         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6320         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6321                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6322                             sizeof(link_sec), &link_sec);
6323
6324         if (lmp_bredr_capable(hdev)) {
6325                 write_fast_connectable(&req, false);
6326                 __hci_update_page_scan(&req);
6327                 update_class(&req);
6328                 update_name(&req);
6329                 update_eir(&req);
6330         }
6331
6332         return hci_req_run(&req, powered_complete);
6333 }
6334
6335 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6336 {
6337         struct cmd_lookup match = { NULL, hdev };
6338         u8 status, zero_cod[] = { 0, 0, 0 };
6339         int err;
6340
6341         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6342                 return 0;
6343
6344         if (powered) {
6345                 if (powered_update_hci(hdev) == 0)
6346                         return 0;
6347
6348                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6349                                      &match);
6350                 goto new_settings;
6351         }
6352
6353         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6354
6355         /* If the power off is because of hdev unregistration let
6356          * use the appropriate INVALID_INDEX status. Otherwise use
6357          * NOT_POWERED. We cover both scenarios here since later in
6358          * mgmt_index_removed() any hci_conn callbacks will have already
6359          * been triggered, potentially causing misleading DISCONNECTED
6360          * status responses.
6361          */
6362         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6363                 status = MGMT_STATUS_INVALID_INDEX;
6364         else
6365                 status = MGMT_STATUS_NOT_POWERED;
6366
6367         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6368
6369         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6370                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6371                            zero_cod, sizeof(zero_cod), NULL);
6372
6373 new_settings:
6374         err = new_settings(hdev, match.sk);
6375
6376         if (match.sk)
6377                 sock_put(match.sk);
6378
6379         return err;
6380 }
6381
6382 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6383 {
6384         struct pending_cmd *cmd;
6385         u8 status;
6386
6387         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6388         if (!cmd)
6389                 return;
6390
6391         if (err == -ERFKILL)
6392                 status = MGMT_STATUS_RFKILLED;
6393         else
6394                 status = MGMT_STATUS_FAILED;
6395
6396         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6397
6398         mgmt_pending_remove(cmd);
6399 }
6400
6401 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6402 {
6403         struct hci_request req;
6404
6405         hci_dev_lock(hdev);
6406
6407         /* When discoverable timeout triggers, then just make sure
6408          * the limited discoverable flag is cleared. Even in the case
6409          * of a timeout triggered from general discoverable, it is
6410          * safe to unconditionally clear the flag.
6411          */
6412         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6413         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6414
6415         hci_req_init(&req, hdev);
6416         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6417                 u8 scan = SCAN_PAGE;
6418                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6419                             sizeof(scan), &scan);
6420         }
6421         update_class(&req);
6422         update_adv_data(&req);
6423         hci_req_run(&req, NULL);
6424
6425         hdev->discov_timeout = 0;
6426
6427         new_settings(hdev, NULL);
6428
6429         hci_dev_unlock(hdev);
6430 }
6431
6432 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6433                        bool persistent)
6434 {
6435         struct mgmt_ev_new_link_key ev;
6436
6437         memset(&ev, 0, sizeof(ev));
6438
6439         ev.store_hint = persistent;
6440         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6441         ev.key.addr.type = BDADDR_BREDR;
6442         ev.key.type = key->type;
6443         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6444         ev.key.pin_len = key->pin_len;
6445
6446         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6447 }
6448
6449 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6450 {
6451         switch (ltk->type) {
6452         case SMP_LTK:
6453         case SMP_LTK_SLAVE:
6454                 if (ltk->authenticated)
6455                         return MGMT_LTK_AUTHENTICATED;
6456                 return MGMT_LTK_UNAUTHENTICATED;
6457         case SMP_LTK_P256:
6458                 if (ltk->authenticated)
6459                         return MGMT_LTK_P256_AUTH;
6460                 return MGMT_LTK_P256_UNAUTH;
6461         case SMP_LTK_P256_DEBUG:
6462                 return MGMT_LTK_P256_DEBUG;
6463         }
6464
6465         return MGMT_LTK_UNAUTHENTICATED;
6466 }
6467
6468 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6469 {
6470         struct mgmt_ev_new_long_term_key ev;
6471
6472         memset(&ev, 0, sizeof(ev));
6473
6474         /* Devices using resolvable or non-resolvable random addresses
6475          * without providing an indentity resolving key don't require
6476          * to store long term keys. Their addresses will change the
6477          * next time around.
6478          *
6479          * Only when a remote device provides an identity address
6480          * make sure the long term key is stored. If the remote
6481          * identity is known, the long term keys are internally
6482          * mapped to the identity address. So allow static random
6483          * and public addresses here.
6484          */
6485         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6486             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6487                 ev.store_hint = 0x00;
6488         else
6489                 ev.store_hint = persistent;
6490
6491         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6492         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6493         ev.key.type = mgmt_ltk_type(key);
6494         ev.key.enc_size = key->enc_size;
6495         ev.key.ediv = key->ediv;
6496         ev.key.rand = key->rand;
6497
6498         if (key->type == SMP_LTK)
6499                 ev.key.master = 1;
6500
6501         memcpy(ev.key.val, key->val, sizeof(key->val));
6502
6503         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6504 }
6505
6506 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6507 {
6508         struct mgmt_ev_new_irk ev;
6509
6510         memset(&ev, 0, sizeof(ev));
6511
6512         /* For identity resolving keys from devices that are already
6513          * using a public address or static random address, do not
6514          * ask for storing this key. The identity resolving key really
6515          * is only mandatory for devices using resovlable random
6516          * addresses.
6517          *
6518          * Storing all identity resolving keys has the downside that
6519          * they will be also loaded on next boot of they system. More
6520          * identity resolving keys, means more time during scanning is
6521          * needed to actually resolve these addresses.
6522          */
6523         if (bacmp(&irk->rpa, BDADDR_ANY))
6524                 ev.store_hint = 0x01;
6525         else
6526                 ev.store_hint = 0x00;
6527
6528         bacpy(&ev.rpa, &irk->rpa);
6529         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6530         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6531         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6532
6533         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6534 }
6535
6536 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6537                    bool persistent)
6538 {
6539         struct mgmt_ev_new_csrk ev;
6540
6541         memset(&ev, 0, sizeof(ev));
6542
6543         /* Devices using resolvable or non-resolvable random addresses
6544          * without providing an indentity resolving key don't require
6545          * to store signature resolving keys. Their addresses will change
6546          * the next time around.
6547          *
6548          * Only when a remote device provides an identity address
6549          * make sure the signature resolving key is stored. So allow
6550          * static random and public addresses here.
6551          */
6552         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6553             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6554                 ev.store_hint = 0x00;
6555         else
6556                 ev.store_hint = persistent;
6557
6558         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6559         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6560         ev.key.master = csrk->master;
6561         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6562
6563         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6564 }
6565
6566 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6567                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6568                          u16 max_interval, u16 latency, u16 timeout)
6569 {
6570         struct mgmt_ev_new_conn_param ev;
6571
6572         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6573                 return;
6574
6575         memset(&ev, 0, sizeof(ev));
6576         bacpy(&ev.addr.bdaddr, bdaddr);
6577         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6578         ev.store_hint = store_hint;
6579         ev.min_interval = cpu_to_le16(min_interval);
6580         ev.max_interval = cpu_to_le16(max_interval);
6581         ev.latency = cpu_to_le16(latency);
6582         ev.timeout = cpu_to_le16(timeout);
6583
6584         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6585 }
6586
6587 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6588                                   u8 data_len)
6589 {
6590         eir[eir_len++] = sizeof(type) + data_len;
6591         eir[eir_len++] = type;
6592         memcpy(&eir[eir_len], data, data_len);
6593         eir_len += data_len;
6594
6595         return eir_len;
6596 }
6597
6598 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6599                            u32 flags, u8 *name, u8 name_len)
6600 {
6601         char buf[512];
6602         struct mgmt_ev_device_connected *ev = (void *) buf;
6603         u16 eir_len = 0;
6604
6605         bacpy(&ev->addr.bdaddr, &conn->dst);
6606         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6607
6608         ev->flags = __cpu_to_le32(flags);
6609
6610         /* We must ensure that the EIR Data fields are ordered and
6611          * unique. Keep it simple for now and avoid the problem by not
6612          * adding any BR/EDR data to the LE adv.
6613          */
6614         if (conn->le_adv_data_len > 0) {
6615                 memcpy(&ev->eir[eir_len],
6616                        conn->le_adv_data, conn->le_adv_data_len);
6617                 eir_len = conn->le_adv_data_len;
6618         } else {
6619                 if (name_len > 0)
6620                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6621                                                   name, name_len);
6622
6623                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6624                         eir_len = eir_append_data(ev->eir, eir_len,
6625                                                   EIR_CLASS_OF_DEV,
6626                                                   conn->dev_class, 3);
6627         }
6628
6629         ev->eir_len = cpu_to_le16(eir_len);
6630
6631         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6632                     sizeof(*ev) + eir_len, NULL);
6633 }
6634
6635 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6636 {
6637         struct sock **sk = data;
6638
6639         cmd->cmd_complete(cmd, 0);
6640
6641         *sk = cmd->sk;
6642         sock_hold(*sk);
6643
6644         mgmt_pending_remove(cmd);
6645 }
6646
6647 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6648 {
6649         struct hci_dev *hdev = data;
6650         struct mgmt_cp_unpair_device *cp = cmd->param;
6651
6652         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6653
6654         cmd->cmd_complete(cmd, 0);
6655         mgmt_pending_remove(cmd);
6656 }
6657
6658 bool mgmt_powering_down(struct hci_dev *hdev)
6659 {
6660         struct pending_cmd *cmd;
6661         struct mgmt_mode *cp;
6662
6663         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6664         if (!cmd)
6665                 return false;
6666
6667         cp = cmd->param;
6668         if (!cp->val)
6669                 return true;
6670
6671         return false;
6672 }
6673
6674 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6675                               u8 link_type, u8 addr_type, u8 reason,
6676                               bool mgmt_connected)
6677 {
6678         struct mgmt_ev_device_disconnected ev;
6679         struct sock *sk = NULL;
6680
6681         /* The connection is still in hci_conn_hash so test for 1
6682          * instead of 0 to know if this is the last one.
6683          */
6684         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6685                 cancel_delayed_work(&hdev->power_off);
6686                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6687         }
6688
6689         if (!mgmt_connected)
6690                 return;
6691
6692         if (link_type != ACL_LINK && link_type != LE_LINK)
6693                 return;
6694
6695         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6696
6697         bacpy(&ev.addr.bdaddr, bdaddr);
6698         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6699         ev.reason = reason;
6700
6701         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6702
6703         if (sk)
6704                 sock_put(sk);
6705
6706         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6707                              hdev);
6708 }
6709
6710 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6711                             u8 link_type, u8 addr_type, u8 status)
6712 {
6713         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6714         struct mgmt_cp_disconnect *cp;
6715         struct pending_cmd *cmd;
6716
6717         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6718                              hdev);
6719
6720         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6721         if (!cmd)
6722                 return;
6723
6724         cp = cmd->param;
6725
6726         if (bacmp(bdaddr, &cp->addr.bdaddr))
6727                 return;
6728
6729         if (cp->addr.type != bdaddr_type)
6730                 return;
6731
6732         cmd->cmd_complete(cmd, mgmt_status(status));
6733         mgmt_pending_remove(cmd);
6734 }
6735
6736 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6737                          u8 addr_type, u8 status)
6738 {
6739         struct mgmt_ev_connect_failed ev;
6740
6741         /* The connection is still in hci_conn_hash so test for 1
6742          * instead of 0 to know if this is the last one.
6743          */
6744         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6745                 cancel_delayed_work(&hdev->power_off);
6746                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6747         }
6748
6749         bacpy(&ev.addr.bdaddr, bdaddr);
6750         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6751         ev.status = mgmt_status(status);
6752
6753         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6754 }
6755
6756 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6757 {
6758         struct mgmt_ev_pin_code_request ev;
6759
6760         bacpy(&ev.addr.bdaddr, bdaddr);
6761         ev.addr.type = BDADDR_BREDR;
6762         ev.secure = secure;
6763
6764         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6765 }
6766
6767 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6768                                   u8 status)
6769 {
6770         struct pending_cmd *cmd;
6771
6772         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6773         if (!cmd)
6774                 return;
6775
6776         cmd->cmd_complete(cmd, mgmt_status(status));
6777         mgmt_pending_remove(cmd);
6778 }
6779
6780 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6781                                       u8 status)
6782 {
6783         struct pending_cmd *cmd;
6784
6785         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6786         if (!cmd)
6787                 return;
6788
6789         cmd->cmd_complete(cmd, mgmt_status(status));
6790         mgmt_pending_remove(cmd);
6791 }
6792
6793 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6794                               u8 link_type, u8 addr_type, u32 value,
6795                               u8 confirm_hint)
6796 {
6797         struct mgmt_ev_user_confirm_request ev;
6798
6799         BT_DBG("%s", hdev->name);
6800
6801         bacpy(&ev.addr.bdaddr, bdaddr);
6802         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6803         ev.confirm_hint = confirm_hint;
6804         ev.value = cpu_to_le32(value);
6805
6806         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6807                           NULL);
6808 }
6809
6810 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6811                               u8 link_type, u8 addr_type)
6812 {
6813         struct mgmt_ev_user_passkey_request ev;
6814
6815         BT_DBG("%s", hdev->name);
6816
6817         bacpy(&ev.addr.bdaddr, bdaddr);
6818         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6819
6820         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6821                           NULL);
6822 }
6823
6824 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6825                                       u8 link_type, u8 addr_type, u8 status,
6826                                       u8 opcode)
6827 {
6828         struct pending_cmd *cmd;
6829
6830         cmd = mgmt_pending_find(opcode, hdev);
6831         if (!cmd)
6832                 return -ENOENT;
6833
6834         cmd->cmd_complete(cmd, mgmt_status(status));
6835         mgmt_pending_remove(cmd);
6836
6837         return 0;
6838 }
6839
6840 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6841                                      u8 link_type, u8 addr_type, u8 status)
6842 {
6843         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6844                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6845 }
6846
6847 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6848                                          u8 link_type, u8 addr_type, u8 status)
6849 {
6850         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6851                                           status,
6852                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6853 }
6854
6855 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6856                                      u8 link_type, u8 addr_type, u8 status)
6857 {
6858         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6859                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6860 }
6861
6862 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6863                                          u8 link_type, u8 addr_type, u8 status)
6864 {
6865         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6866                                           status,
6867                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6868 }
6869
6870 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6871                              u8 link_type, u8 addr_type, u32 passkey,
6872                              u8 entered)
6873 {
6874         struct mgmt_ev_passkey_notify ev;
6875
6876         BT_DBG("%s", hdev->name);
6877
6878         bacpy(&ev.addr.bdaddr, bdaddr);
6879         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6880         ev.passkey = __cpu_to_le32(passkey);
6881         ev.entered = entered;
6882
6883         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6884 }
6885
6886 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6887 {
6888         struct mgmt_ev_auth_failed ev;
6889         struct pending_cmd *cmd;
6890         u8 status = mgmt_status(hci_status);
6891
6892         bacpy(&ev.addr.bdaddr, &conn->dst);
6893         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6894         ev.status = status;
6895
6896         cmd = find_pairing(conn);
6897
6898         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6899                     cmd ? cmd->sk : NULL);
6900
6901         if (cmd) {
6902                 cmd->cmd_complete(cmd, status);
6903                 mgmt_pending_remove(cmd);
6904         }
6905 }
6906
6907 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6908 {
6909         struct cmd_lookup match = { NULL, hdev };
6910         bool changed;
6911
6912         if (status) {
6913                 u8 mgmt_err = mgmt_status(status);
6914                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6915                                      cmd_status_rsp, &mgmt_err);
6916                 return;
6917         }
6918
6919         if (test_bit(HCI_AUTH, &hdev->flags))
6920                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6921                                             &hdev->dev_flags);
6922         else
6923                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6924                                              &hdev->dev_flags);
6925
6926         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6927                              &match);
6928
6929         if (changed)
6930                 new_settings(hdev, match.sk);
6931
6932         if (match.sk)
6933                 sock_put(match.sk);
6934 }
6935
6936 static void clear_eir(struct hci_request *req)
6937 {
6938         struct hci_dev *hdev = req->hdev;
6939         struct hci_cp_write_eir cp;
6940
6941         if (!lmp_ext_inq_capable(hdev))
6942                 return;
6943
6944         memset(hdev->eir, 0, sizeof(hdev->eir));
6945
6946         memset(&cp, 0, sizeof(cp));
6947
6948         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6949 }
6950
6951 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6952 {
6953         struct cmd_lookup match = { NULL, hdev };
6954         struct hci_request req;
6955         bool changed = false;
6956
6957         if (status) {
6958                 u8 mgmt_err = mgmt_status(status);
6959
6960                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6961                                                  &hdev->dev_flags)) {
6962                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6963                         new_settings(hdev, NULL);
6964                 }
6965
6966                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6967                                      &mgmt_err);
6968                 return;
6969         }
6970
6971         if (enable) {
6972                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6973         } else {
6974                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6975                 if (!changed)
6976                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6977                                                      &hdev->dev_flags);
6978                 else
6979                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6980         }
6981
6982         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6983
6984         if (changed)
6985                 new_settings(hdev, match.sk);
6986
6987         if (match.sk)
6988                 sock_put(match.sk);
6989
6990         hci_req_init(&req, hdev);
6991
6992         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6993                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6994                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6995                                     sizeof(enable), &enable);
6996                 update_eir(&req);
6997         } else {
6998                 clear_eir(&req);
6999         }
7000
7001         hci_req_run(&req, NULL);
7002 }
7003
7004 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7005 {
7006         struct cmd_lookup match = { NULL, hdev };
7007         bool changed = false;
7008
7009         if (status) {
7010                 u8 mgmt_err = mgmt_status(status);
7011
7012                 if (enable) {
7013                         if (test_and_clear_bit(HCI_SC_ENABLED,
7014                                                &hdev->dev_flags))
7015                                 new_settings(hdev, NULL);
7016                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
7017                 }
7018
7019                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
7020                                      cmd_status_rsp, &mgmt_err);
7021                 return;
7022         }
7023
7024         if (enable) {
7025                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
7026         } else {
7027                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
7028                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
7029         }
7030
7031         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
7032                              settings_rsp, &match);
7033
7034         if (changed)
7035                 new_settings(hdev, match.sk);
7036
7037         if (match.sk)
7038                 sock_put(match.sk);
7039 }
7040
7041 static void sk_lookup(struct pending_cmd *cmd, void *data)
7042 {
7043         struct cmd_lookup *match = data;
7044
7045         if (match->sk == NULL) {
7046                 match->sk = cmd->sk;
7047                 sock_hold(match->sk);
7048         }
7049 }
7050
7051 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7052                                     u8 status)
7053 {
7054         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7055
7056         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7057         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7058         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7059
7060         if (!status)
7061                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7062                            NULL);
7063
7064         if (match.sk)
7065                 sock_put(match.sk);
7066 }
7067
7068 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7069 {
7070         struct mgmt_cp_set_local_name ev;
7071         struct pending_cmd *cmd;
7072
7073         if (status)
7074                 return;
7075
7076         memset(&ev, 0, sizeof(ev));
7077         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7078         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7079
7080         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7081         if (!cmd) {
7082                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7083
7084                 /* If this is a HCI command related to powering on the
7085                  * HCI dev don't send any mgmt signals.
7086                  */
7087                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7088                         return;
7089         }
7090
7091         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7092                    cmd ? cmd->sk : NULL);
7093 }
7094
7095 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7096                                        u8 *rand192, u8 *hash256, u8 *rand256,
7097                                        u8 status)
7098 {
7099         struct pending_cmd *cmd;
7100
7101         BT_DBG("%s status %u", hdev->name, status);
7102
7103         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7104         if (!cmd)
7105                 return;
7106
7107         if (status) {
7108                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7109                            mgmt_status(status));
7110         } else {
7111                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7112                         struct mgmt_rp_read_local_oob_ext_data rp;
7113
7114                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7115                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7116
7117                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7118                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7119
7120                         cmd_complete(cmd->sk, hdev->id,
7121                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7122                                      &rp, sizeof(rp));
7123                 } else {
7124                         struct mgmt_rp_read_local_oob_data rp;
7125
7126                         memcpy(rp.hash, hash192, sizeof(rp.hash));
7127                         memcpy(rp.rand, rand192, sizeof(rp.rand));
7128
7129                         cmd_complete(cmd->sk, hdev->id,
7130                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7131                                      &rp, sizeof(rp));
7132                 }
7133         }
7134
7135         mgmt_pending_remove(cmd);
7136 }
7137
7138 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7139 {
7140         int i;
7141
7142         for (i = 0; i < uuid_count; i++) {
7143                 if (!memcmp(uuid, uuids[i], 16))
7144                         return true;
7145         }
7146
7147         return false;
7148 }
7149
7150 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7151 {
7152         u16 parsed = 0;
7153
7154         while (parsed < eir_len) {
7155                 u8 field_len = eir[0];
7156                 u8 uuid[16];
7157                 int i;
7158
7159                 if (field_len == 0)
7160                         break;
7161
7162                 if (eir_len - parsed < field_len + 1)
7163                         break;
7164
7165                 switch (eir[1]) {
7166                 case EIR_UUID16_ALL:
7167                 case EIR_UUID16_SOME:
7168                         for (i = 0; i + 3 <= field_len; i += 2) {
7169                                 memcpy(uuid, bluetooth_base_uuid, 16);
7170                                 uuid[13] = eir[i + 3];
7171                                 uuid[12] = eir[i + 2];
7172                                 if (has_uuid(uuid, uuid_count, uuids))
7173                                         return true;
7174                         }
7175                         break;
7176                 case EIR_UUID32_ALL:
7177                 case EIR_UUID32_SOME:
7178                         for (i = 0; i + 5 <= field_len; i += 4) {
7179                                 memcpy(uuid, bluetooth_base_uuid, 16);
7180                                 uuid[15] = eir[i + 5];
7181                                 uuid[14] = eir[i + 4];
7182                                 uuid[13] = eir[i + 3];
7183                                 uuid[12] = eir[i + 2];
7184                                 if (has_uuid(uuid, uuid_count, uuids))
7185                                         return true;
7186                         }
7187                         break;
7188                 case EIR_UUID128_ALL:
7189                 case EIR_UUID128_SOME:
7190                         for (i = 0; i + 17 <= field_len; i += 16) {
7191                                 memcpy(uuid, eir + i + 2, 16);
7192                                 if (has_uuid(uuid, uuid_count, uuids))
7193                                         return true;
7194                         }
7195                         break;
7196                 }
7197
7198                 parsed += field_len + 1;
7199                 eir += field_len + 1;
7200         }
7201
7202         return false;
7203 }
7204
7205 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7206                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7207                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7208 {
7209         char buf[512];
7210         struct mgmt_ev_device_found *ev = (void *) buf;
7211         size_t ev_size;
7212         bool match;
7213
7214         /* Don't send events for a non-kernel initiated discovery. With
7215          * LE one exception is if we have pend_le_reports > 0 in which
7216          * case we're doing passive scanning and want these events.
7217          */
7218         if (!hci_discovery_active(hdev)) {
7219                 if (link_type == ACL_LINK)
7220                         return;
7221                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7222                         return;
7223         }
7224
7225         /* When using service discovery with a RSSI threshold, then check
7226          * if such a RSSI threshold is specified. If a RSSI threshold has
7227          * been specified, then all results with a RSSI smaller than the
7228          * RSSI threshold will be dropped.
7229          *
7230          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7231          * the results are also dropped.
7232          */
7233         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7234             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
7235                 return;
7236
7237         /* Make sure that the buffer is big enough. The 5 extra bytes
7238          * are for the potential CoD field.
7239          */
7240         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7241                 return;
7242
7243         memset(buf, 0, sizeof(buf));
7244
7245         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7246          * RSSI value was reported as 0 when not available. This behavior
7247          * is kept when using device discovery. This is required for full
7248          * backwards compatibility with the API.
7249          *
7250          * However when using service discovery, the value 127 will be
7251          * returned when the RSSI is not available.
7252          */
7253         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7254             link_type == ACL_LINK)
7255                 rssi = 0;
7256
7257         bacpy(&ev->addr.bdaddr, bdaddr);
7258         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7259         ev->rssi = rssi;
7260         ev->flags = cpu_to_le32(flags);
7261
7262         if (eir_len > 0) {
7263                 /* When using service discovery and a list of UUID is
7264                  * provided, results with no matching UUID should be
7265                  * dropped. In case there is a match the result is
7266                  * kept and checking possible scan response data
7267                  * will be skipped.
7268                  */
7269                 if (hdev->discovery.uuid_count > 0)
7270                         match = eir_has_uuids(eir, eir_len,
7271                                               hdev->discovery.uuid_count,
7272                                               hdev->discovery.uuids);
7273                 else
7274                         match = true;
7275
7276                 if (!match && !scan_rsp_len)
7277                         return;
7278
7279                 /* Copy EIR or advertising data into event */
7280                 memcpy(ev->eir, eir, eir_len);
7281         } else {
7282                 /* When using service discovery and a list of UUID is
7283                  * provided, results with empty EIR or advertising data
7284                  * should be dropped since they do not match any UUID.
7285                  */
7286                 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
7287                         return;
7288
7289                 match = false;
7290         }
7291
7292         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7293                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7294                                           dev_class, 3);
7295
7296         if (scan_rsp_len > 0) {
7297                 /* When using service discovery and a list of UUID is
7298                  * provided, results with no matching UUID should be
7299                  * dropped if there is no previous match from the
7300                  * advertising data.
7301                  */
7302                 if (hdev->discovery.uuid_count > 0) {
7303                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7304                                                      hdev->discovery.uuid_count,
7305                                                      hdev->discovery.uuids))
7306                                 return;
7307                 }
7308
7309                 /* Append scan response data to event */
7310                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7311         } else {
7312                 /* When using service discovery and a list of UUID is
7313                  * provided, results with empty scan response and no
7314                  * previous matched advertising data should be dropped.
7315                  */
7316                 if (hdev->discovery.uuid_count > 0 && !match)
7317                         return;
7318         }
7319
7320         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7321         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7322
7323         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7324 }
7325
7326 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7327                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7328 {
7329         struct mgmt_ev_device_found *ev;
7330         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7331         u16 eir_len;
7332
7333         ev = (struct mgmt_ev_device_found *) buf;
7334
7335         memset(buf, 0, sizeof(buf));
7336
7337         bacpy(&ev->addr.bdaddr, bdaddr);
7338         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7339         ev->rssi = rssi;
7340
7341         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7342                                   name_len);
7343
7344         ev->eir_len = cpu_to_le16(eir_len);
7345
7346         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7347 }
7348
7349 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7350 {
7351         struct mgmt_ev_discovering ev;
7352
7353         BT_DBG("%s discovering %u", hdev->name, discovering);
7354
7355         memset(&ev, 0, sizeof(ev));
7356         ev.type = hdev->discovery.type;
7357         ev.discovering = discovering;
7358
7359         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7360 }
7361
7362 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7363 {
7364         BT_DBG("%s status %u", hdev->name, status);
7365 }
7366
7367 void mgmt_reenable_advertising(struct hci_dev *hdev)
7368 {
7369         struct hci_request req;
7370
7371         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7372                 return;
7373
7374         hci_req_init(&req, hdev);
7375         enable_advertising(&req);
7376         hci_req_run(&req, adv_enable_complete);
7377 }